US State AI Laws in 2026: Colorado, Texas, California, and the Preemption Fight

Is there a federal law that overrides state AI laws?

No federal statute overrides state AI laws. A December 2025 executive order targets them for legal challenge, but until a court rules against a specific law, that law is enforceable.

Executive Order 14365, signed December 11, 2025, states a policy of a national AI framework and directs the Attorney General to form an AI Litigation Task Force to challenge state AI laws that conflict with it. It directs the Commerce Department to identify state laws it views as onerous, and it asks agencies to consider conditioning certain grants on state AI policy.

An executive order binds federal agencies. It does not repeal a state statute.

Congress has twice considered pausing state AI laws and has not done so. The Senate stripped a ten-year moratorium from the 2025 reconciliation bill by a 99-1 vote, and the final text of the 2026 defense authorization bill omitted a similar provision that had been expected in it. On July 1, 2026 the FTC proposed a policy statement taking the position that a state law requiring an AI company to deceive consumers, for example by altering truthful outputs, is impliedly preempted to the extent it conflicts with the FTC Act. Comments closed July 31, 2026. A proposed statement is not a court ruling.

Until a court enjoins a specific state law, plan to comply with it.

What happened to the Colorado AI Act?

Colorado’s 2024 AI Act never took effect. It was delayed, challenged in court, and then repealed and replaced by SB 26-189, a narrower law.

• SB 24-205 was signed in 2024 with an effective date of February 1, 2026.
• In August 2025, SB 25B-004 moved that date to June 30, 2026.
• On April 9, 2026, xAI sued to block the law. On April 24, the Justice Department moved to intervene. On April 27, the court granted the parties’ joint motion: the Attorney General agreed not to enforce the law until 14 days after the court rules on xAI’s motion for a preliminary injunction (X.AI LLC v. Weiser, No. 1:26-cv-01515, D. Colo.).
• On May 14, 2026, the governor signed SB 26-189, which repeals and reenacts the framework around automated decision-making technology, or ADMT.

The new law is narrower. Commentators note that it drops the 2024 law’s impact assessment and risk management program duties. What remains is mostly documentation, notice, and consumer rights.

What does SB 26-189 require?

SB 26-189 requires technical documentation from developers, notice and adverse-decision explanations from deployers, and access, correction, and human review rights for consumers.

• Scope: ADMT that materially influences a consequential decision about access to, eligibility for, or compensation related to education, employment, housing, financial or lending services, insurance, health care, or essential government services.
• Developers, from January 1, 2027: give deployers technical documentation on intended uses, training data categories, known limits, and instructions for use and human review; notify deployers of material updates.
• Deployers: before using covered ADMT in a consequential decision, give clear and conspicuous notice, which a prominent public notice at points of interaction satisfies; within 30 days after an adverse decision, give a plain-language description of the ADMT’s role.
• Consumer rights: request the personal data used and correction of factually incorrect data; request meaningful human review and reconsideration after an adverse outcome, to the extent commercially reasonable. Correction rights do not extend to opinions, predictions, or scores.
• Records: at least 3 years.
• Enforcement: the Attorney General, under the Colorado Consumer Protection Act. Before January 1, 2030, the Attorney General must give notice and 60 days to cure where a cure is possible, unless the violation was knowing or repeated. No new private right of action.

Two exclusions decide whether many generative AI tools are covered. The definition of ADMT excludes “a tool used by an individual solely to summarize, organize, translate, draft, route, or present information for human review of administrative processing.” Separately, a consequential decision does not include actions in which ADMT is used to summarize, organize, or present information for human review if the system does not produce a score, ranking, recommendation, classification, prediction, or other inference that materially influences the outcome (C.R.S. 6-1-1701(2)(b)(II) and (3)(b)(IV)).

The xAI case, in which the Justice Department intervened, remained open on the court’s docket as of October 2026, and commentators expect a challenge to the new law as well.

What does Texas require?

The Texas Responsible Artificial Intelligence Governance Act, HB 149, took effect January 1, 2026. It is mostly a list of intent-based prohibitions, not a risk management statute.

• No developing or deploying AI intended to incite self-harm, harm to others, or criminal activity
• No AI developed or deployed with the sole intent of infringing constitutional rights
• No AI developed or deployed with intent to unlawfully discriminate against a protected class. The statute says disparate impact alone is not enough to show intent
• No AI developed or distributed with the sole intent of producing certain sexual content involving minors or unlawful deepfakes
• Health care providers must disclose AI use in a service or treatment to the patient or the patient’s personal representative no later than the date the service or treatment is first provided, or, in an emergency, as soon as reasonably possible (Sec. 552.051(f))

Social scoring and certain biometric limits apply only to government entities.

The Attorney General brings enforcement actions, after a written notice and 60-day cure period. A state licensing agency may add sanctions against a licensee found in violation, including a penalty of up to $100,000, if the Attorney General recommends it (Sec. 552.106). Civil penalties run $10,000 to $12,000 for curable violations, $80,000 to $200,000 for uncurable ones, and $2,000 to $40,000 per day for continuing violations. A defendant is not liable if another person used its AI system in a prohibited way, or if it discovered the violation through feedback from a developer, deployer, or other person; through testing, including adversarial or red-team testing; by following state agency guidelines; or through an internal review process while substantially complying with the most recent NIST AI RMF Generative AI Profile or another nationally or internationally recognized AI risk management framework (Sec. 552.105(e)). Framework compliance is part of one of those routes, not a defense by itself.

What does California require?

California has no single AI act. It has several laws that together reach most uses.

• CCPA automated decisionmaking rules: The California Privacy Protection Agency’s regulations took effect January 1, 2026. Businesses that use ADMT for significant decisions must comply from January 1, 2027, including pre-use notice, access, and opt-out rights, with exceptions such as a human appeal. Risk assessment compliance began January 1, 2026, with attestations due April 1, 2028.
• SB 53, frontier AI transparency: Signed September 29, 2025. Applies to developers of models trained above 10²⁶ operations, with the heaviest duties on those with more than $500 million in annual revenue. Requires a published frontier AI framework, transparency reports, reporting of critical safety incidents to the Office of Emergency Services within 15 days of discovery, or within 24 hours to an appropriate authority when an incident poses an imminent risk of death or serious physical injury, and whistleblower protections. Penalties up to $1 million per violation, enforced by the Attorney General.
• AB 2013, training data disclosure: Requires developers of public generative AI systems released on or after January 1, 2022 to post a high-level summary of training datasets. xAI challenged the law; the district court denied a preliminary injunction in March 2026, and the case is on appeal in the Ninth Circuit.
• Employment rules: The Civil Rights Council’s automated-decision system regulations took effect October 1, 2025. See the employment guide.
• Health care: AB 3030 (AI patient communications) and SB 1120 (physician review in utilization review). See the health care guide.
• Pricing: AB 325 on common pricing algorithms took effect January 1, 2026. See the pricing guide.

The governor vetoed SB 7, the “No Robo Bosses Act,” on October 13, 2025, citing overbreadth and overlap with the privacy agency’s rules.

What does Utah require?

Utah requires a business using generative AI with consumers to disclose it when the consumer clearly asks, and requires up-front disclosure from people in state-licensed or state-certified occupations in high-risk interactions. SB 226 (2025) narrowed these duties and placed them in Utah Code Title 13, Chapter 75, which is not on the Title 13 repeal list. SB 226 and SB 332 separately extended the Artificial Intelligence Policy Act (Chapter 72, which created the Office of Artificial Intelligence Policy and its learning laboratory) to July 1, 2027 (Utah Code 63I-2-213).

• A business using generative AI with consumers must disclose that the person is dealing with AI if the person clearly asks.
• People in state-licensed or state-certified occupations must disclose AI use up front in “high-risk” interactions, meaning those that collect sensitive personal information such as health, financial, or biometric data, or that give personalized advice someone could reasonably rely on for significant decisions, such as financial, legal, medical, or mental health advice.
• A business that discloses clearly at the start and throughout the interaction has a safe harbor.
• Fines of up to $2,500 per violation by the Division of Consumer Protection.

What do Illinois and New York City require?

Both regulate AI in employment decisions. Illinois bars AI use with a discriminatory effect and requires notice, and New York City requires a recent independent bias audit before an automated hiring tool is used.

Illinois HB 3773 (Public Act 103-0804) amended the Human Rights Act effective January 1, 2026. Employers may not use AI in employment decisions in a way that has the effect of discriminating on a protected basis, may not use zip codes as a proxy for protected classes, and must give notice when AI is used. The Department of Human Rights published proposed notice rules on May 15, 2026, then postponed the rulemaking and withdrew the proposal on June 2, 2026, according to law firm reports. No replacement had been adopted as of this writing. The statute’s notice requirement took effect January 1, 2026 regardless.

NYC Local Law 144 bars employers and employment agencies from using an automated employment decision tool unless it had an independent bias audit within the past year, a summary is posted, and candidates get notice. A December 2025 State Comptroller audit found the city’s enforcement weak, and the city agency generally agreed with the recommendations.

Details for both are in the employment guide.

How do the main state laws compare?

They differ most in reach. Colorado’s law and California’s privacy rules cover consequential or significant decisions across many sectors. Texas reaches anyone doing business in the state, but mainly through intent-based prohibitions. The rest target frontier developers, generative AI disclosures, or employers.

How should a multistate program be built?

Build one program to the strictest common elements of these laws, then add the few state-specific pieces on top, rather than a separate program for each state. Across the laws above, the common elements are:

• An inventory that flags every system used in a consequential decision
• Vendor documentation on intended use, data, limits, and human review
• A notice template that can be placed at the point of interaction
• An adverse decision explanation that names the AI’s role in plain language
• A route to human review and correction of inaccurate data
• Records kept for at least 4 years, which covers both Colorado and California employment rules
• A quarterly check of new laws, delays, and court orders

What does Colorado’s narrower law mean for a program?

Colorado’s replacement law is narrower than the law it replaced: its duties rest on notice, explanation, and human review rather than on risk programs and impact assessments. A program that does those three things well covers the core of Colorado’s new duties; other laws in this guide add more, such as California’s risk assessments.

This guide is general information as of October 2026, not legal advice. State laws, rules, and court orders in this area change often; confirm current text with the legislature, the regulator, or counsel.