What are the US state AI laws for businesses?
There is no single federal AI law, so states and cities set the rules. The main ones are Colorado's automated decision and chatbot laws (January 1, 2027), Texas's AI act (January 1, 2026), California's privacy and hiring rules, and New York City's hiring audit law.
When each state and city AI rule starts
Most of these laws care about two things: whether AI helps decide something important about a person (a job, a loan, housing, insurance, health care), and whether people know they are dealing with an AI. A website chat agent that books appointments sits in a very different place from a tool that scores job applicants. When we plan systems as part of our AI consulting and implementation work, we sort every planned AI use into one of those two groups first, because that decides which of the rules below can apply.
We read the official text of each law below on October 30, 2026. This page explains what the text says; it is not legal advice, and a lawyer should check any system that touches hiring, lending, housing, insurance or health decisions.
| Law | Who it covers | What it requires | From | Who enforces |
|---|---|---|---|---|
| Colorado SB 26-189, Automated Decision-Making Technology | Developers and deployers of technology that processes personal data and helps make "consequential decisions" (education, employment, housing, financial or lending services, insurance, health care, essential government services) | Clear notice at the point of interaction; a plain-language explanation within 30 days after an adverse decision; human review on request; records kept at least 3 years | January 1, 2027 | Colorado Attorney General, as a deceptive trade practice |
| Colorado HB 26-1263, Chatbot Safety Act | Operators of conversational AI services | Tell users they are talking to an AI, estimate user age, protect minors, keep a self-harm response protocol, report yearly to the Attorney General | January 1, 2027 | Colorado Attorney General |
| Texas HB 149, Responsible AI Governance Act | Any "person" who develops or deploys an AI system in Texas, with extra duties for government agencies and health care providers | No AI built with intent to discriminate, manipulate toward harm or infringe constitutional rights; health care providers must disclose AI use to patients | January 1, 2026 | Texas Attorney General only |
| California CCPA regulations on automated decisionmaking | Businesses covered by the CCPA that use ADMT to make a "significant decision" | A pre-use notice, opt-out and access rights, risk assessments | Regulations effective January 1, 2026; ADMT compliance by January 1, 2027 | California Privacy Protection Agency |
| California Civil Rights Council employment regulations | Employers using automated-decision systems on applicants or employees | No discrimination through the system; keep employment records, including automated-decision data, for at least four years | October 1, 2025 | California Civil Rights Department |
| New York City Local Law 144 | Employers and employment agencies using automated employment decision tools | A bias audit within one year before use, a public summary of results, notice 10 business days before use | Enforced since July 5, 2023 | NYC Department of Consumer and Worker Protection |
Law firm trackers list AI bills and laws in more states, including Utah and Illinois. We have left them out of this table because we could not read their official legislature pages when we checked. Read the official text before relying on any summary, ours included.
Which state AI laws apply to a chatbot, AI receptionist or lead agent?
For a chat or voice agent that answers questions and books appointments, the main duty is telling people they are talking to an AI. The heavier rules start when the AI scores, ranks or screens people for jobs, loans, housing, insurance or care.
The first question that sorts your AI uses
We built this matrix from the official texts in the table above. The "likely" readings are ours, from the wording of each law and Colorado's interim draft rules; they are not legal opinions. Colorado's rules are still drafts as of October 30, 2026.
| What the AI does | Colorado ADMT Act | Colorado Chatbot Safety Act | Texas HB 149 | California ADMT rules |
|---|---|---|---|---|
| Website chat agent answers FAQs and books appointments | Unlikely: no consequential decision | Possibly exempt: the interim draft treats "scheduling an appointment" or "answering a billing question" as a narrow and discrete topic | Only the general bans; a health care provider must disclose AI use | Unlikely: no significant decision |
| AI receptionist answers calls and routes them | Unlikely | Depends on scope; for minors, the draft rules require repeated audio disclaimers on products without a screen | Same as above | Unlikely |
| Open-ended customer chat assistant | Unlikely | Likely in scope: disclose AI, age estimation, self-harm protocol | General bans | Unlikely |
| AI qualifies leads for a loan, lease or insurance quote | Likely in scope if its output materially influences the decision | Only if it is a conversational service in scope | No intent to discriminate | Likely in scope if it replaces human decisionmaking |
| AI screens or ranks job applicants | Likely in scope (employment) | Not the main issue | No intent to discriminate | Likely in scope; the Civil Rights Council rules also apply; NYC LL144 if hiring in New York City |
| Staff use ChatGPT to draft emails | No | Business-use services can be exempt | General bans only | No |
This split is why we design most AI chat agents and AI receptionists to answer, book and hand over to a person, and keep any decision about a person's eligibility with your staff. If you do want AI to score leads, our lead qualification agents rank by fit and urgency for your sales team, and we flag in writing when a use moves into a regulated decision.
What does Colorado's AI law require now?
Colorado replaced its 2024 AI Act with SB 26-189, signed May 14, 2026. From January 1, 2027, businesses using automated decision technology in consequential decisions must give notice, explain adverse outcomes within 30 days, offer human review and keep records three years.
The Colorado General Assembly's page for SB 26-189 sets out the duties:
- Deployers (businesses using the technology) give consumers "clear and conspicuous notice at the point of interaction", give a plain-language description of the technology's role within 30 days after an adverse consequential decision, and keep compliance records for at least 3 years.
- Developers give deployers technical documentation (intended uses, training data categories, known limits, instructions for human review) and tell them about material updates.
- Consumers can ask for the personal data used, ask for corrections, and ask for "meaningful human review and reconsideration" after an adverse outcome.
- Enforcement is by the Attorney General under the Colorado Consumer Protection Act. Before January 1, 2030, the Attorney General must give 60 days' notice and a chance to cure, where a cure is possible. The act creates no new private right of action.
The old law, SB 24-205, was challenged in federal court before it ever applied. xAI sued on April 9, 2026, and on April 24, 2026 the US Justice Department moved to intervene, arguing the law violated the Equal Protection Clause. The replacement law came three weeks later. The Attorney General's rules for both new Colorado laws are still in draft; we cover the October 2026 interim draft in our news piece on Colorado's AI and chatbot rules.
What does the Texas AI law require of private businesses?
Texas HB 149 took effect January 1, 2026. For most private businesses it bans building or using AI with intent to discriminate, push people toward harm, or infringe constitutional rights. Health care providers must also tell patients when AI is used.
From the enrolled text of HB 149, read October 30, 2026:
- Bans that apply to any person (sections 552.052 to 552.057): AI that "intentionally aims to incite or encourage" self-harm, harm to others or crime; AI developed "with the intent to unlawfully discriminate against a protected class" (disparate impact alone does not prove intent); certain sexual content and deepfakes.
- Disclosure (section 552.051): government agencies must tell consumers they are interacting with AI. If AI is used in health care services or treatment, "the provider of the service or treatment shall provide the disclosure", no later than the date the service is first provided. The disclosure must be clear, conspicuous and in plain language, and a hyperlink is allowed.
- Enforcement: the Attorney General has exclusive authority and there is no private right of action. The Attorney General must give written notice and 60 days to cure before suing. Penalties run from $10,000 to $12,000 per curable violation, $80,000 to $200,000 per uncurable violation, and $2,000 to $40,000 per day for continuing violations.
- A defense worth knowing: section 552.105(e) protects a business that finds a violation through testing or by substantially complying with NIST's AI Risk Management Framework.
That last point is one reason we test agents before launch and keep the test log. Our guide on how to test an AI agent before it goes live shows the method.
What do California's AI rules require?
Two sets of California rules matter most. Privacy regulations require covered businesses that use automated decisionmaking for significant decisions to comply by January 1, 2027. Civil rights regulations, in force since October 1, 2025, cover AI used on job applicants and employees.
The California Privacy Protection Agency lists its regulations as approved on September 22, 2025 and effective January 1, 2026. In the approved text, ADMT means technology that processes personal information and uses computation "to replace human decisionmaking or substantially replace human decisionmaking". A significant decision is one that results in the provision or denial of financial or lending services, housing, education, employment or compensation, or health care. Section 7200 says a business using ADMT for such a decision before January 1, 2027 must comply "no later than January 1, 2027". Section 7220 requires a pre-use notice, shown at or before the point where the business collects the personal information it will process with ADMT.
For hiring, the Civil Rights Council's regulations took effect October 1, 2025. They make clear that an automated-decision system can break California law if it harms applicants or employees based on protected traits, and they require employers to keep employment records, including automated-decision data, for "a minimum of four years".
Does the federal executive order cancel state AI laws?
No. Executive Order 14365, signed December 11, 2025, tells federal agencies to challenge state AI laws they see as onerous, but it does not preempt any state law by itself. Until a court or Congress acts, the state laws above still apply.
The order directs the Attorney General to set up an AI Litigation Task Force "within 30 days", the Commerce Secretary to publish an evaluation of onerous state AI laws within 90 days, the FTC to issue a policy statement within 90 days, and Commerce to tie some broadband grant money to state AI laws. It asks for a legislative recommendation for a federal framework that would preempt conflicting state laws, which Congress would have to pass. It also says it "shall be implemented consistent with applicable law". For planning, we treat the state dates in this page as real deadlines and watch for court rulings.
What should a business do about state AI laws now?
List every place you use AI, mark the ones that touch jobs, credit, housing, insurance, education or health decisions, add AI disclosure to chat and voice agents, give people a route to a human, and keep records for at least four years to cover California.
- Inventory. Every AI tool and agent, what it does, whose data it reads, and which states your customers and staff are in. Our AI readiness assessment checklist has the inventory questions.
- Mark consequential decisions. Anything that ranks, scores or screens people for the categories in the Colorado and California definitions goes on a separate list with a named owner.
- Disclose. Chat and voice agents say they are an AI at the start, and again when asked. That one setting covers Colorado's chatbot rule, Texas's health care rule and the EU AI Act's Article 50 if you have EU users; our page on whether the EU AI Act applies to US companies covers that side.
- Keep a human in the loop. Every agent has a handover path, and anyone refused something can ask a person to review it.
- Keep records. Four years covers both California's employment rule and Colorado's three-year rule.
- Write it down. Our page on whether your company needs an AI policy turns these steps into ten policy sections.
- Ask vendors for documentation. Colorado's law makes developers give deployers technical documentation; ask for it before you buy.
We add these controls inside the systems we build, on your own accounts, and say plainly when a question needs a lawyer. A free strategy call is the place to start if you are not sure which group your AI uses fall into.
More questions about US state AI laws
Is there a federal AI law in the United States?
Not a general one. Federal regulators apply existing law to AI: when the FTC announced Operation AI Comply on September 25, 2024, its Chair said "there is no AI exemption from the laws on the books". The NIST AI Risk Management Framework is voluntary guidance. The December 2025 executive order asks Congress for a federal framework, which has not been enacted as of October 30, 2026.
Do state AI laws apply to small businesses?
Often, yes. Texas HB 149 applies to any "person" who develops or deploys AI in Texas, with no size threshold in its prohibitions. Colorado's SB 26-189 page lists no small-business threshold either. California's ADMT rules apply only to businesses covered by the CCPA, which has its own thresholds. The deciding question is what your AI does; headcount rarely changes the answer.
Do we have to tell customers they are talking to an AI?
In more and more cases, yes. Colorado's Chatbot Safety Act requires operators of conversational AI services in scope to disclose that users are talking to AI from January 1, 2027. Texas requires it for government agencies and health care providers. The EU AI Act requires it for chat and voice agents serving EU users. We switch disclosure on by default in every agent we build.
Can a customer sue us under Colorado's AI law?
Not under the act itself. SB 26-189 creates no new private right of action; the Attorney General enforces it as a deceptive trade practice under the Colorado Consumer Protection Act. The act does set how fault is shared between developers and deployers in discrimination lawsuits brought under existing law, so a bad decision can still end up in court that way.
What are the penalties under the Texas AI law?
Under section 552.105 of HB 149: $10,000 to $12,000 per curable violation, $80,000 to $200,000 per uncurable violation, and $2,000 to $40,000 for each day a violation continues. The Attorney General must give written notice and 60 days to cure first, and there is a rebuttable presumption that the business used reasonable care.
Does staff using ChatGPT at work fall under these laws?
Usually not, as long as staff use it for drafting, research or summaries. The rules bite when AI output materially shapes a decision about a person, such as hiring or credit. Colorado's interim draft rules also treat services built for business operations and productivity as possibly exempt from the chatbot law. A short internal AI policy is still worth having for data and disclosure rules.
Will the Colorado law change again before 2027?
It could. The legislature already replaced the 2024 law once, the Attorney General's rules are still in draft, and the federal executive order targets laws like it. We plan builds on the current text and dates, and check the Attorney General's rulemaking page before each launch that touches a consequential decision.
Where can we check the official text ourselves?
Each state publishes its own: leg.colorado.gov for Colorado bills, coag.gov/ai for Colorado's rulemaking, capitol.texas.gov for Texas bills, cppa.ca.gov for California's privacy regulations, and nyc.gov for Local Law 144. The links in the sources list below go straight to the pages we read.
Sources and further reading
- Colorado General Assembly, SB 26-189 Automated Decision-Making Technology (read October 30, 2026)
- Colorado General Assembly, HB 26-1263 Conversational Artificial Intelligence Service Operator Requirements (read October 30, 2026)
- Colorado Attorney General, ADMT and Chatbot Safety rulemaking page (read October 30, 2026)
- Texas Legislature, HB 149 enrolled text and bill history (read October 30, 2026)
- California Privacy Protection Agency, CCPA updates, cybersecurity audits, risk assessments and ADMT regulations and approved text (read October 30, 2026)
- California Civil Rights Department, June 30, 2025 release on automated-decision system regulations
- NYC Department of Consumer and Worker Protection, Automated Employment Decision Tools
- The White House, Executive Order 14365, December 11, 2025
- US Department of Justice, April 24, 2026 release on the Colorado lawsuit
- FTC, Operation AI Comply, September 25, 2024
