State AI Laws Creating Compliance Obligations for Enterprises
Multiple state AI laws already impose binding obligations that businesses cannot ignore.
State AI laws already impose enforceable obligations on enterprises, even without a comprehensive federal AI statute. A defensible compliance program must therefore do more than await federal clarity. It must identify where AI is used, determine which jurisdictions govern that use, and build controls that can adapt as state requirements change.
Why enterprises face real legal obligations today, not hypothetical future risk
There is no comprehensive federal AI statute, and Congress has not enacted legislation preempting state AI regulation. The Senate voted 99–1 to strip a proposed ten-year moratorium on state AI laws from the 2025 budget bill. A second attempt was dropped from the 2026 defense bill. Federal preemption has failed twice, while state obligations have become enforceable.
Executive Order 14365 tells a DOJ task force to challenge state AI laws on grounds that include unconstitutional regulation of interstate commerce and federal preemption. The effects of executive policy on state requirements depend on litigation. Businesses can fall within those requirements because their customers, employees, or affected consumers are in a covered state, regardless of where headquarters happens to be.
What the patchwork actually looks like — the laws in force and their effective dates
Texas TRAIGA took effect January 1, 2026, and only the state attorney general can enforce it. Its target is specific harmful practices, including behavioral manipulation, deceptive deepfakes, and unlawful biometric capture. It references NIST AI RMF adherence as a compliance factor. Illinois HB 3773 took effect the same day, but governs employment uses through the Illinois Department of Human Rights. It requires employer notice and prohibits discriminatory effects, including using ZIP codes as a proxy for a protected class.
California SB 53, the Transparency in Frontier Artificial Intelligence Act, took effect January 1, 2026, and applies only to frontier developers training models above a specified compute threshold. Its most extensive obligations apply to large frontier developers generating over $500 million in annual gross revenue. Downstream deployers are not its primary target. California AB 2013, enacted September 28, 2024, and effective January 1, 2026, separately requires developers to disclose information about training datasets.
California’s CPPA Automated Decision-Making Technology regulations have a phased schedule. The duty to carry out prospective risk-assessment began January 1, 2026, while the first assessments of activities already underway are due by December 31, 2027. Enforcement of the full provisions, including mandatory pre-use notices, consumer opt-out mechanisms, and detailed disclosures, is scheduled to begin January 1, 2027. The effective date is not every compliance deadline.
Connecticut’s CART Act took effect October 1, 2026. It covers specified high-risk uses, including automated employment decision technology, AI companion chatbots, frontier-model developers, generative-AI content provenance, and online platforms used by minors. Its obligations stagger through January 1, 2028, with social media reporting beginning March 1, 2028. Only the Connecticut attorney general has the power to enforce it. Most provisions have no private right of action, but the AI companion provisions provide one for users and parents.
Other enacted requirements have not yet taken effect. Colorado SB 26-189, the ADMT Act, was signed May 14, 2026, replaces SB 24-205, and has a January 1, 2027 effective date, with enforcement assigned exclusively to the State Attorney General. Its enforcement status is subject to a court stay, discussed below. Illinois SB 315, the AI Safety Measures Act, takes effect January 1, 2027, with the first state-mandated annual third-party audit requirement for frontier AI model developers effective January 1, 2028. New York’s amended RAISE Act takes effect January 1, 2027, and sets frontier-developer safety duties and a 72-hour window in which to report critical safety incidents.
How the same AI system can trigger different obligations depending on the state
NYC Local Law 144, enforced since 2023, requires an independent third-party bias audit and publication of results before deployment. Coverage turns on the job’s location, including positions based at an NYC office at least part time and fully remote roles associated with one. Illinois instead uses employee location as a trigger. Under HB 3773, the employer must give notice and avoid discriminatory effects, including those caused by inputs that seem neutral, such as ZIP codes.
Colorado adds duties that take effect January 1, 2027, depending on how the stay is resolved. Its trigger is whether AI “materially influences” a consequential decision affecting a Colorado resident. A covered deployer must provide a point-of-interaction disclosure, explain adverse outcomes and available recourse, and maintain a process for human review or correction. These duties are not interchangeable. A published audit does not receive a reconsideration request, and a notice does not establish that screening outcomes are nondiscriminatory.
Employers may still be liable for discrimination caused by third-party systems, and fault is divided between deployers and developers based on how the system was meant to be used. Colorado’s replacement law voids terms that shield developers from liability for discriminatory outcomes attributable to their products. Coverage therefore requires examining the role of embedded AI in a decision. Title VII’s disparate-impact prohibition also continues to apply to AI-driven hiring, despite the EEOC’s withdrawal of its AI technical-assistance guidance in 2025.
Why the landscape keeps shifting and how to read the signals
Colorado’s original AI Act was replaced before taking effect, forcing businesses preparing for SB 24-205 to redirect their work toward the replacement. Litigation adds a separate complication. DOJ intervention occurred April 24, 2026, and the court stay is dated April 27, 2026, before the replacement’s May 14, 2026 signing. Those dates distinguish the litigation timeline from the legislative one rather than establish a simple sequence in which the replacement was signed and then stayed.
The federal challenge operates case by case. A stay in Colorado does not suspend obligations in Illinois or Connecticut, and the task force’s activity cannot substitute for congressional preemption. Meanwhile, state proposals cluster around training-data transparency, chatbot safety, content provenance, and frontier-model oversight. Repeated enactment in those areas can push businesses toward common operating standards even without a federal law.
The useful signals extend beyond whether a bill passed. They include congressional action on preemption, state attorney general enforcement priorities, court decisions on DOJ challenges, and further expansion of California’s framework. Each can change what a compliance team must do or when it must do it. A static checklist ages badly in this setting. It records a legal position but cannot, by itself, manage the next amendment or court order.
The five categories of obligation that recur across jurisdictions
AI inventory and scope determination form the first workstream. Coverage depends on specific triggers, such as materially influencing a consequential decision, qualifying as a frontier developer, or using an automated employment decision tool. Those are factual questions about systems and their uses. The inventory must therefore cover models developed in-house as well as AI embedded in licensed software and employees’ use of public generative-AI tools.
Disclosure and transparency form the second workstream. The employment notices required in Illinois, point-of-interaction disclosures in Colorado, published audit results in NYC, and use-specific requirements in Connecticut each serve a different purpose. Their delivery cannot be treated as one generic notice. Training-data transparency is related but distinct, with California’s AB 2013 attaching disclosure duties to developers. For covered organizations, the practical requirement is knowing what information must be disclosed, to whom, and at what stage.
Bias audits and impact assessments form the third workstream. NYC requires an independent bias audit each year before a tool is deployed, while California’s prospective risk-assessment rules are already in effect. Illinois’s frontier-developer audit requirement begins January 1, 2028. Independence is not an internal review with better stationery. Where the law requires an outside audit, publication, or annual recurrence, a one-time legal assessment cannot satisfy that obligation.
Human review and adverse-outcome recourse form the fourth workstream. Colorado requires post-adverse disclosures explaining ADMT’s role and available recourse, together with a process for review or reconsideration. Connecticut imposes obligations in the same category for covered high-risk uses. Someone must receive, route, and respond to requests, or the stated right to reconsideration has no practical route through the organization.
Documentation and audit-ready recordkeeping form the fifth workstream. Colorado requires developers and deployers to maintain records regarding covered ADMT. Model prompts, safety filters, and vendor certifications do not, by themselves, show what data a system accessed or what it did. That requires evidence at the data layer. Authenticated access logs, attribute-based access controls, and tamper-evident audit records make it possible to trace what a system did, while model safety controls describe how it is meant to behave.
Why shadow AI and third-party agent use are the hardest part of the inventory problem
A formal register can describe sanctioned tools accurately while omitting employee use of public generative-AI systems. That leaves the coverage assessment incomplete from the start. Employees pasting legal work product, source code, or M&A data into unapproved tools create data-leakage pathways regardless of their intent. HIPAA, GDPR, and CCPA do not distinguish between a human analyst and an AI agent accessing protected data.
Agents intensify the problem because authorization and use occur at different scales. An agent inherits access rights from the human or service account authorizing it, then can exercise those rights at machine speed. Access that a senior analyst rarely exercises may remain available to an agent operating under the same authority. An inventory that records the agent’s existence but not its access therefore leaves a central operational question unanswered.
Embedded third-party AI presents a less visible version of the same problem. Licensed HR systems, underwriting platforms, compliance tools, and patient intake applications require coverage assessments even when the enterprise did not develop their AI functions. Vendor certification does not answer whether a particular deployment materially influences a consequential decision. The enterprise must assess its own use. Inventory is consequently a prerequisite for determining obligations.
Building a compliance posture that survives jurisdictional change
For a general counsel or head of compliance, the practical response is an architecture built around recurring obligations. Begin with a continuous inventory of internal systems, embedded third-party AI, and unapproved employee tools. Then flag consequential-decision uses, including hiring, lending, healthcare, housing, and insurance. Scope follows use as well as product category. This gives the legal assessment a factual foundation that can be updated without rebuilding the program.
Map jurisdictions by customer and employee location. A business headquartered in Maryland, Virginia, or Delaware and serving a national market can fall within several state regimes. Texas, Illinois, and Colorado all use location-of-affected-person triggers. The mapping must also preserve local distinctions. NYC’s job-location test, for example, cannot be replaced by a headquarters address or a single nationwide employee-location field.
Use California’s framework as an operational floor, with targeted additions for other jurisdictions. That means preparing for the CPPA requirements on pre-use notices, opt-out mechanisms, and risk assessments, while addressing training-data documentation under the applicable developer rules. Keep the phased deadlines visible. Even as businesses prepare for the full framework, some provisions are not yet enforceable, and NYC audits and other states’ recourse requirements still apply alongside California compliance.
Build evidence at the data layer through authenticated access logs, attribute-based access controls, and tamper-evident records of system activity. Kiteworks’ 2026 Data Security and Compliance Risk Forecast found that 33 percent of organizations have no audit logs at all. For autonomous agents, runtime monitoring and complete action logs are needed to document access and behavior. Policy enforcement must also operate in real time to prevent violations, rather than rely solely on retrospective review after a decision is challenged.
Review and renegotiate agreements so that responsibilities and risk allocation reflect the applicable law, including Colorado’s restrictions on shielding developers from discriminatory outcomes attributable to their products. Indemnification is not an operational control. The enterprise still needs its own coverage determination and evidence that its deployment meets the relevant duties.
Finally, organize the program so that changes are confined to the relevant workstream. Notices, audits, recourse, and recordkeeping need structures that can absorb revised requirements. Teams must keep watching attorney general announcements, court decisions on DOJ challenges, and California CPPA guidance as part of their ongoing work.
