- COColorado SB 26-189Jan 1, 2027
- CACalifornia SB 53Jan 1, 2026
- ILIllinois HB 3773Jan 1, 2026
- TXTexas TRAIGAJan 1, 2026
- UTUtah AI Policy ActMay 1, 2024
- NYNYC LL144Jul 5, 2023
- Colorado SB 26-189: effective Jan 1, 2027
- California SB 53: effective Jan 1, 2026
- Illinois HB 3773: effective Jan 1, 2026
- Texas TRAIGA: effective Jan 1, 2026
- Utah AI Policy Act: effective May 1, 2024
- NYC LL144: effective Jul 5, 2023
An automated tool used for a New York City job, or AI in Illinois employment decisions
Employers and employment agencies that use AI in hiring, promotion and other employment decisions
Decisions about Colorado consumers, or automated decisions by a business under the CCPA
Businesses that use AI in significant decisions about people, such as lending, housing or health care
Your AI informs Colorado decisions, or your model passes SB 53’s compute threshold
Developers of AI used in consequential decisions in Colorado, and of frontier models
Doing business in Texas at all, or a Utah consumer asking if they’re talking to AI
Any business in Texas, and anyone in Utah who uses generative AI to talk with consumers
Colo. SB 26-189
From January 1, 2027, deployers give notice at the point of interaction, explain an adverse decision within 30 days, and offer data correction and human review. Developers supply documentation.
Tex. HB 149
Since January 1, 2026, no AI intended to manipulate people into self-harm or crime, discriminate unlawfully or make child sexual abuse material. Agencies and health care providers disclose AI use.
Cal. SB 53
Since January 1, 2026, developers of models trained above 10²⁶ operations publish transparency reports and report safety incidents within 15 days. Those over $500M in revenue also publish a framework.
CCPA regs §7200
From January 1, 2027, CCPA businesses using automated decisionmaking technology (ADMT) for significant decisions give notice, an opt-out and access. Risk assessments are due December 31, 2027.
NYC LL144
Enforced since July 5, 2023. An automated hiring tool needs an independent bias audit within the past year and a published summary. Candidates get notice 10 business days before use.
Ill. HB 3773
Since January 1, 2026, employers can’t use AI with a discriminatory effect in employment decisions, or zip codes as a proxy for protected classes. They must tell employees when AI is used.
Colorado repealed and reenacted that law with SB 26-189, signed May 14, 2026, before it took effect. The new version starts January 1, 2027, with different duties, so recheck plans built on the 2024 text. [1]
EO 14365 set up a federal task force and a review of state AI laws, but it doesn’t preempt them itself. Congress hasn’t passed a law that does, so state AI laws remain enforceable. [9]
It doesn’t. For private businesses, TRAIGA bans AI built with certain intents, such as unlawful discrimination, and disparate impact alone doesn’t prove intent. Disclosure falls on agencies and health care providers. [2]
Is the Colorado AI Act still happening?
Yes, in a new form. SB 26-189, signed May 14, 2026, replaced the 2024 law before it took effect. From January 1, 2027, it covers developers and deployers of AI used in consequential decisions about education, jobs, housing, lending, insurance, health care and government services. Developers supply documentation and update notices, and records are kept for three years. The attorney general enforces it as a deceptive practice, with 60 days to fix a violation until 2030.
Should we wait for federal preemption?
No. Executive Order 14365, signed December 11, 2025, created a Justice Department AI Litigation Task Force, formed January 9, 2026, and ordered Commerce to list “onerous” state laws. It carves out child safety and state government procurement and use of AI. Until Congress or a court says otherwise, state laws apply as written, and the next dates arrive January 1, 2027, in Colorado and California.
Does California SB 53 apply to companies that use AI?
Usually not. SB 53 covers frontier developers, whose models are trained with more than 10²⁶ operations, and adds duties for large ones with more than $500 million in revenue. Since January 1, 2026, they publish transparency reports and report safety incidents within 15 days, or 24 hours if the danger is imminent. If you use automated decisionmaking technology for significant decisions about Californians, plan for the CCPA rules that apply from January 1, 2027.
Do AI hiring tools need a bias audit?
In New York City, yes. Local Law 144 requires an independent bias audit within a year before you use an automated employment decision tool for jobs in the city, a published summary of the results, and notice 10 business days before use. Illinois doesn’t require an audit, but since January 1, 2026, it bars AI with a discriminatory effect in employment decisions and requires notice. Colorado’s law covers decisions about jobs too, from January 1, 2027.
Does following the NIST AI RMF help in Texas?
It can, though it isn’t a blanket shield. Under TRAIGA, a defendant that substantially complies with the most recent version of NIST’s Generative AI Profile, a companion to the AI RMF, meets one of the conditions for avoiding liability. The attorney general enforces the law, gives 60 days to fix a violation, and can seek up to $200,000 for each violation that can’t be cured. A record of how you follow the profile makes your case easier to show.
Does Enzai have frameworks for US state laws?
Not ready-made ones. You build your own in Enzai: add a framework for each law, such as Colorado’s, with its own controls and classifications. Classify each AI system first, so only the controls that apply are created. Then assign owners and due dates, attach evidence such as bias audits and notices, and keep the system’s risks in one register. Your counsel decides what each law requires; Enzai holds the evidence.
Sources · Reviewed Oct 2026
