AI Compliance · 2026-07-30 · 10 min read
US State AI Laws 2026: The Complete Map of What's In Force
More than a dozen US state AI laws are already in force, and a second wave lands between October 2026 and July 2027. Here is the complete, dated, section-by-section map: what each state requires, who enforces it, and what it costs to get wrong.
As of July 2026, at least a dozen US state AI laws are already in force — Texas TRAIGA, Illinois HB 3773, Utah's AIPA, NYC Local Law 144, five separate California laws, Maine's chatbot disclosure statute, and AI-therapy restrictions in seven states. Connecticut's first duties apply from October 1, 2026, Colorado's ADMT law from January 1, 2027, and no federal statute preempts any of them.
The full map is below: every duty with its statute section, effective date, and penalty, so you can date-order your obligations instead of guessing. Vetoed bills and laws that never took effect are called out separately — half the confusion in this space comes from maps that mix the two.
Which US state AI laws are in force in 2026?
These laws bind covered companies today.
| Law | In force since | What it requires | Enforcement and penalties |
|---|---|---|---|
| Texas TRAIGA (HB 149, Bus. & Com. Code chs. 551–552) | Jan 1, 2026 | Intent-based prohibitions on AI development and deployment | AG-exclusive, 60-day cure; $10,000–$12,000 per curable violation, $80,000–$200,000 uncurable, $2,000–$40,000/day continuing; licensing-agency sanctions up to $100,000 |
| Illinois HB 3773 (775 ILCS 5/2-102(L)) | Jan 1, 2026 | Discriminatory use of AI in employment decisions is a civil-rights violation; zip-code proxies are expressly prohibited; employees must be notified | IDHR charges under the Illinois Human Rights Act |
| Utah AIPA (Utah Code ch. 13-77, as narrowed by SB 226) | In force; sunsets Jul 1, 2027 unless extended | Disclose genAI use in consumer transactions on request; regulated professionals must disclose prominently in high-risk interactions (both conditions must be met) | Utah consumer-protection enforcement |
| NYC Local Law 144 | Jan 1, 2023 (enforced since Jul 5, 2023) | Annual independent bias audit (≤1 year old at use), public results summary, and 10-business-day candidate notice for automated employment decision tools | $500 first violation, $500–$1,500 subsequent; audit and posting failures accrue per day, notice failures per candidate |
| California AB 2013 (Civ. Code §§3110–3111) | Jan 1, 2026 | Developers — including fine-tuners, per §3110(d) — must publish a 12-element training-data summary before making genAI publicly available to Californians; no size threshold | UCL §17200, up to $2,500 per violation, no cure period |
| California FEHA ADS regulations (2 CCR §§11008.1, 11009(f)) | Oct 1, 2025 | Employers with 5+ employees and one California employee or applicant face discrimination liability for automated-decision systems; 4-year record retention (§11013(c)) | FEHA enforcement; anti-bias testing evidence is weighable |
| California SB 243 (BPC §§22601–22606) | Jan 1, 2026 | Companion-chatbot operator duties; customer-service and business-operations bots are excluded | Private right of action (§22605): greater of actual damages or $1,000 per violation, plus fees |
| California BOT Act (BPC §17940) | 2019 | Bots must not mislead people to incentivize purchases or influence votes without disclosure | California's original bot-disclosure law |
| Maine chatbot disclosure (10 M.R.S. §1500-DD) | Sep 16, 2025 | If a reasonable consumer could be misled into thinking they are chatting with a human, clear disclosure is required — the broadest pure chatbot-disclosure duty in the country | Maine UTPA; up to $10,000 per intentional violation |
| New York GBL Art. 47 | Nov 5, 2025 | AI-companion safeguards and crisis protocols | — |
Two patterns worth noticing. First, employment AI is the most regulated use case: Illinois, NYC, and California all reach it through different mechanisms. If you use an ATS with AI ranking, start with our NYC Local Law 144 bias audit guide — the employer owns that duty even when a vendor supplies the tool. Second, California alone accounts for five in-force laws with different triggers; the California AI laws 2026 guide covers each in depth, including why AB 2013's training-data summary applies with no size threshold now that the xAI v. Bonta preliminary injunction was denied on March 4, 2026.
Which states restrict AI therapy in 2026?
Seven states already restrict AI in therapy or mental-health contexts, with two more weeks away:
| State | Law | Status |
|---|---|---|
| Utah | HB 452 (ch. 13-72a) | In force since May 7, 2025 |
| Nevada | AB 406 | In force since Jul 1, 2025; $15,000 per violation |
| Illinois | WOPR Act | In force since Aug 1, 2025 |
| Vermont | Act 156 | In force since Jun 17, 2026 |
| Rhode Island | S 2197 | In force since Jun 22, 2026 |
| Tennessee | SB 1580 | In force since Jul 1, 2026; TCPA enforcement plus private right of action, $5,000 per violation |
| Maine | LD 2082 | In force since Jul 29, 2026 |
| Colorado | HB 26-1195 | Applies from Aug 12, 2026 |
| Missouri | SB 1019 | Applies from Aug 28, 2026; MMPA, $10,000 first / $20,000 subsequent |
Even general-purpose chatbots should watch this table — several of the 2027 laws below prohibit conversational AI from representing itself as a therapist at all.
Which state AI laws apply from late 2026 and 2027?
The second wave is dated and predictable. These are enacted laws with future effective dates — not proposals.
| Law | Applies from | Who is covered | Core duties |
|---|---|---|---|
| California SB 942/AB 853 (AI Transparency Act) | Aug 2, 2026 | GenAI systems with over 1,000,000 monthly users producing image, audio, or video | Covered-provider transparency duties; genAI weight-hosting gate and large-online-platform duties follow from Jan 1, 2027 |
| Connecticut PA 26-15 | Oct 1, 2026 (first phase) | Broad — consumer, employment, and provenance duties | AI-subscription key-terms notice, AEDT anti-bias evidentiary rule, WARN AI disclosure, provenance (§15); companion duties from Jan 1, 2027; AEDT deployer notices from Oct 1, 2027; AG-only CUTPA enforcement, though the CHRO discrimination path reaches damages |
| CCPA ADMT regulations (11 CCR) | Jan 1, 2027 | Only CCPA "businesses" (e.g., over $26.6M revenue or data thresholds) | ADMT compliance obligations; the regulations themselves took effect Jan 1, 2026 |
| Colorado SB 26-189 | Jan 1, 2027 | Automated decision-making | Pre-use disclosure, adverse-decision explanation, correction and human-review rights, 3-year records; AG-exclusive; 60-day cure available until the cure provision is repealed Jan 1, 2030 — the act itself does not sunset |
The 2027 chatbot wave
Seven more states have enacted conversational-AI laws with 2027 effective dates:
| Applies from | Laws |
|---|---|
| Jan 1, 2027 | Colorado HB 26-1263, Washington HB 2225, Oregon SB 1546, Rhode Island S 2195 |
| Jul 1, 2027 | Nebraska LB 525, Idaho S 1297, Georgia SB 540 |
The trap in this wave: the Idaho, Nebraska, and Colorado laws impose general conversational-AI duties — crisis protocols and a prohibition on representing the bot as a therapist — that reach all consumer conversational AI, not just "companion" apps. A support chatbot with a friendly persona is in scope.
Which state AI laws can most companies ignore?
Three categories generate noise without generating duties:
- Vetoed bills. Virginia HB 2094 was vetoed in March 2025 — there is no Virginia AI act, despite what many compliance maps still show.
- Frontier-only laws. California SB 53, New York's RAISE Act, and Illinois SB 315 bind developers training at roughly 10^26 FLOPs or exceeding $500M in revenue. Below those thresholds, they impose zero duties. If you build on a model API, these are your vendor's problem, not yours.
- Laws that never took effect. Colorado SB 24-205 — the famous "Colorado AI Act" of 2024 — was repealed and replaced by SB 26-189 before ever applying. Citing SB 24-205 obligations in 2026 is a tell that a vendor's content is stale.
Is there a federal law preempting state AI laws?
No. No federal preemption statute exists. Executive Order 14365 (December 2025) and the DOJ AI Litigation Task Force put pressure on state enforcement, but an executive order cannot repeal a state statute — and the one high-profile challenge, xAI v. Bonta, failed at the preliminary-injunction stage in March 2026. The operational conclusion: build your compliance program against state law as written, and treat preemption headlines as noise until Congress actually acts.
How to work out which state AI laws apply to your company
- Map people, not headquarters. These laws attach to where your users, employees, and applicants are — a Delaware C-corp with California applicants owes FEHA ADS duties, and one Maine user puts §1500-DD in play.
- Classify what your AI actually does. The duty triggers are use cases: employment decisions (IL, NYC, CA, CT), consumer chatbots (ME, CA, UT), companions (CA, NY, the 2027 wave), genAI content (CA AB 2013, SB 942), and automated decision-making (CO, CCPA ADMT).
- Check the thresholds. Some laws have none (AB 2013), some are small (FEHA's 5 employees), some are large (CCPA's $26.6M revenue, SB 942's 1M monthly users). Never assume you are too small — California AB 2013 expressly has no size threshold at all.
- Date-order the duties. In force now beats "applies from 2027." Your next 12 months: Aug 2026 (CA SB 942, CO and MO therapy laws), Oct 2026 (CT), Jan 2027 (CO ADMT, CCPA ADMT, four chatbot states).
- Write the policy and keep the records. California FEHA requires 4-year records, Colorado 3-year. An AI acceptable use policy is the cheapest artifact that shows up in nearly every enforcement scenario.
Shieldra automates steps 1–4 with a deterministic rules engine — every classification traces to a statutory citation, across Texas, Illinois, Utah, Colorado, California, Connecticut, NYC LL144, multi-state conversational-AI, and the EU AI Act on one platform. See what's covered. And if you sell into Europe at all, note that EU AI Act Article 50 transparency applies from August 2, 2026 — three days after this post's publication date. The free EU AI Act checker gives you a risk tier and role-scoped obligations in about three minutes, no signup.
FAQ
How many US states have AI laws in force in 2026?
Statewide AI statutes are in force in Texas, Illinois, Utah, California, Maine, and New York, plus NYC Local Law 144 at the city level, and AI-therapy restrictions are in force in seven states. Counting California's five laws individually, more than a dozen distinct state and local AI laws bind companies today, with Connecticut, Colorado, and seven chatbot-law states following between October 2026 and July 2027.
Is there a federal AI law that overrides state AI laws?
No. There is no federal preemption statute. Executive Order 14365 (December 2025) and the DOJ AI Litigation Task Force create litigation pressure on state enforcement, but they do not repeal or suspend any state law. Every law in this map remains enforceable as written.
Do chatbot disclosure laws apply to customer-service bots?
It depends on the state. California SB 243 (BPC §§22601–22606) expressly excludes customer-service and business-operations bots from its companion-chatbot duties. Maine's 10 M.R.S. §1500-DD takes the opposite approach: it applies whenever a reasonable consumer could be misled into thinking they are chatting with a human, regardless of the bot's purpose — which is why it is the broadest pure disclosure duty in force.
What happened to the Colorado AI Act?
The original Colorado AI Act, SB 24-205, was repealed and replaced before it ever took effect. Its successor, SB 26-189, applies from January 1, 2027 and requires pre-use disclosure, adverse-decision explanations, correction and human-review rights, and 3-year records, with AG-exclusive enforcement and a 60-day cure period that lasts until January 1, 2030.
Does Virginia have an AI law in 2026?
No. Virginia's HB 2094 was vetoed in March 2025, so no Virginia AI act exists. Any compliance checklist that lists Virginia obligations is out of date.