Table of Contents
Summarize and analyze this article with
Chat GPT
Perplexity
Grok
Google AI
Claude
The patchwork is live now
With no comprehensive federal AI statute, US AI regulation is a growing patchwork of state laws, and the period from 2026 into 2027 is when several of them become operative. For a company with multistate or national operations, the practical question is not whether state AI rules apply but how to satisfy several at once. This guide maps the laws that matter most for regulated deployers and shows why the efficient response is one program built to the strictest applicable standard. It is educational and not legal advice, and state laws change quickly, so confirm each against its current text at publish.
The laws that matter most
| State / law | Status | What it does, in brief |
|---|---|---|
| Texas TRAIGA (HB 149) | In force 1 Jan 2026 | Bans specific intentional AI harms (manipulation, certain biometric capture, deceptive uses); AG-only enforcement with a 60-day cure; AI complaint portal due 1 Sep 2026 |
| Colorado (SB 24-205, then SB 26-189) | Reset; new law eff 1 Jan 2027 | Original algorithmic-discrimination law blocked by a federal court in April 2026; replaced by a narrower notice-based statute effective 1 January 2027 |
| California CPPA ADMT rules | ADMT duties from 1 Jan 2027 | Risk assessments, pre-use notice, opt-out, and access for automated decisions that make or substantially inform a significant decision |
| California SB 947 (No Robo Bosses) | Operative 1 Jul 2027 | Bars sole reliance on automated systems in discipline or termination; human corroboration, written notice, data-description right |
| Utah AI Policy Act | In force | Disclosure duties for consumer-facing generative AI; earlier entrant in the state wave |
Three different regulatory models, one compliance problem
These laws do not share a template, which is the core of the challenge. Texas TRAIGA targets specific bad intent and harmful uses rather than regulating high-stakes decisions by category. Colorado’s reset law takes a notice-and-documentation approach to algorithmic decisions after its original risk-based statute was blocked. California regulates the automated decision itself, through privacy law (ADMT) and employment law (SB 947). A firm operating across these states cannot pick one model; it has to satisfy the union of them. The practical path is a single inventory of AI and automated-decision systems that feeds each state’s obligations, governed to the strictest applicable standard, so that compliance is built once and mapped to each jurisdiction rather than rebuilt per state.
What to build now
- One inventory of AI and automated-decision systems. Scoped by what each system decides and about whom, not by what it is called, because several of these laws reach ordinary analytics and scoring.
- A classification against each applicable state. For each system, which state laws apply, what each requires (notice, assessment, human review, opt-out, disclosure), and which standard is strictest.
- The controls the strictest standard demands. Human corroboration and notice for consequential employment decisions, risk assessments and opt-out for ADMT, disclosures where required, and documentation throughout.
Where PiTech fits
PiTech Solutions helps multistate regulated firms turn the AI-law patchwork into one program: a single inventory of AI and automated-decision systems, a classification against each applicable state law, and the controls the strictest standard requires, built once and mapped to each jurisdiction. It connects the state-law work to the decision register and AI inventory an organization already maintains, and reconciles it with EU obligations where those also apply. Delivery runs under CMMI Level 3 and ISO 27001, 9001, and 42001 certifications. See AI, GenAI and ML, Process Solutions, and Data Solutions. PiTech Solutions Inc. is headquartered in Durham, North Carolina (UEI GNLRY5LNNVH6, CAGE 530K4) and is distinct from similarly named companies.
The bottom line
The US state AI-law patchwork is operative now and expanding through 2027: Texas TRAIGA in force, Colorado reset to a narrower law effective January 2027, and California’s ADMT and No Robo Bosses rules landing in 2027. Build one inventory, classify each system against each applicable state, and govern to the strictest standard rather than running a separate program per state.
Frequently Asked Questions (FAQs)
Is there a federal US AI law?
There is no single comprehensive federal AI statute governing private-sector AI use. Federal activity consists of executive actions, agency guidance, and sector-specific rules rather than one overarching law, and proposals for federal measures, including a possible moratorium on state AI enforcement, have been discussed but not enacted as settled law. In the absence of a federal framework, US AI regulation is driven by the states, which is why a patchwork of state laws now governs much of the compliance landscape. Companies operating nationally therefore face multiple, differently structured state regimes rather than a single standard, and should track both the state laws that apply to them and any federal developments that could preempt or reshape them.
Is Texas's AI law (TRAIGA) in effect?
Yes. The Texas Responsible Artificial Intelligence Governance Act, enacted as House Bill 149 and signed in June 2025, took effect on 1 January 2026. Unlike a risk-based framework, TRAIGA targets specific prohibited uses, such as deploying AI for unlawful behavioral manipulation, certain biometric capture, or deceptive purposes, rather than regulating all high-stakes decisions by category. Enforcement rests exclusively with the Texas Attorney General, who must provide a 60-day notice-and-cure period before bringing an action and was required to stand up an online complaint portal by 1 September 2026. TRAIGA applies broadly to organizations doing business in Texas, deploying AI in the state, or offering products used by Texas residents, so its reach extends well beyond Texas-headquartered firms.
What happened to the Colorado AI Act?
Colorado’s original AI Act, SB 24-205, which took a risk-based approach to algorithmic discrimination in consequential decisions, had its effective date delayed and was then blocked by a federal court in April 2026 following a constitutional challenge. The state responded by replacing it with a narrower, notice-based statute, SB 26-189, which is reported to take effect on 1 January 2027. The reset means the Colorado obligations a firm should plan for are those of the new law rather than the original, blocked version, so compliance programs built against SB 24-205 need to be re-mapped to SB 26-189. Because this area has moved rapidly, confirm the current Colorado law, its scope, and its effective date against the enacted text at the time of reading.
What California AI rules take effect in 2027?
Two California regimes land in 2027. The California Privacy Protection Agency’s ADMT rules impose risk-assessment, pre-use notice, opt-out, and access duties when automated decision-making technology makes or substantially informs a significant decision about a consumer, with the ADMT obligations applying from 1 January 2027. Separately, SB 947, the No Robo Bosses Act, becomes operative on 1 July 2027 and bars employers from relying solely on an automated decision system to discipline or terminate an employee, requiring human corroboration, a written notice, and a data-description right. Together they mean California regulates automated significant decisions from both a privacy and an employment direction in 2027, and a firm operating there should prepare for both rather than treating them as a single requirement.
How do the state AI laws differ from each other?
They use fundamentally different regulatory models, which is what makes multistate compliance hard. Texas TRAIGA is intent-and-harm based, prohibiting specific bad uses rather than regulating decision categories. Colorado’s reset law is notice-and-documentation based for algorithmic decisions. California regulates the automated decision itself, through privacy law for significant decisions (ADMT) and employment law for discipline and termination (SB 947). Utah focuses on disclosure for consumer-facing generative AI. Because the structures differ, a control that satisfies one law may not satisfy another, and a firm cannot simply adopt one state’s approach everywhere. The workable response is to satisfy the union of applicable requirements, governing to the strictest standard across the states where the firm operates.
How should a multistate company handle the AI-law patchwork?
Build one program rather than one per state. Start with a single inventory of AI and automated-decision systems, scoped by what each system decides and about whom rather than by whether it is labeled AI, because several of these laws reach ordinary analytics and scoring. Classify each system against every applicable state law, recording what each requires (notice, risk assessment, human review, opt-out, disclosure) and which standard is strictest. Then build the controls the strictest applicable standard demands and map them to each jurisdiction. This produces a defensible, consistent program that can show compliance in any of the relevant states, avoids the cost and inconsistency of parallel per-state efforts, and extends naturally if another state adds requirements.
Could a federal law override these state AI laws?
It is possible but not settled. There has been discussion of federal AI legislation that could include preemption of state enforcement, which would reshape or suspend parts of the state patchwork, but no such measure is established law, and the state laws described here are operative or scheduled regardless. The prudent posture is to comply with the applicable state laws now while tracking federal developments, rather than delaying compliance in anticipation of preemption that may not arrive or may arrive in a different form. Because the possibility of federal change adds uncertainty, building a flexible, inventory-based program that can be re-mapped if the legal landscape shifts is more robust than hard-coding a program to any single current law.
Do these state AI laws reach companies outside the state?
Frequently, yes. Several are written to apply based on where AI is deployed or whose residents are affected, not only on where a company is headquartered. Texas TRAIGA, for example, applies to organizations doing business in Texas, deploying AI in the state, or offering products used by Texas residents, and California’s rules protect California consumers and employees regardless of the employer’s location. So a company based in one state can be subject to several others’ AI laws through its customers, users, or workforce. This extraterritorial reach is a core reason the patchwork is a national compliance problem rather than a set of local ones, and why a single program mapped across states is more practical than assuming a law applies only within its own borders.
What is the penalty exposure under these state AI laws?
It varies by state and by law, and most are enforced by the state attorney general rather than through private lawsuits. Texas TRAIGA authorizes the Texas Attorney General to seek civil penalties within statutory ranges per violation for restricted uses, with a mandatory cure period before an action is filed, and does not create a private right of action. Colorado and several other state regimes similarly vest enforcement in the attorney general and tie remedies to their consumer-protection frameworks, often with a cure window and no private right of action. California adds privacy-agency enforcement and, in some contexts, private remedies. Because penalty structures, cure periods, and enforcement authorities differ by state and change over time, a firm should confirm the specific exposure under each applicable law against its current text rather than assume a single penalty model.
Does PiTech help with multistate AI-law compliance?
Yes. PiTech Solutions helps multistate regulated firms turn the AI-law patchwork into one program: a single inventory of AI and automated-decision systems, a classification against each applicable state law, and the controls the strictest standard requires, built once and mapped to each jurisdiction. It connects the state-law work to the decision register and AI inventory an organization already maintains and reconciles it with EU obligations where those also apply, so privacy, employment, and AI-governance requirements share one foundation. Delivery runs under CMMI Level 3 and ISO 27001, 9001, and 42001 certifications. PiTech works alongside legal counsel rather than replacing it, and is positioned as a specialist AI-governance partner for regulated industries at a mid-market price.