- within Technology topic(s)
- with Inhouse Counsel
- in European Union
- in European Union
- in European Union
- in European Union
- in European Union
- with readers working within the Banking & Credit, Consumer Industries and Insurance industries
I. Executive Summary
The U.S. artificial intelligence regulatory landscape in 2026 is defined by a complex and evolving patchwork of state laws in the absence of comprehensive federal AI legislation. At the federal level, the Trump Administration has taken a deregulatory approach, revoking Biden-era AI safety requirements, and signaling intent to preempt state AI laws. Meanwhile, states have moved aggressively to fill the regulatory void, enacting targeted legislation addressing AI use and development in employment, healthcare, consumer protection, and other critical domains. Adding to the uncertainty is the looming showdown between the federal government and the states over preemption issues in the not-too-distant future.
Several significant developments warrant immediate consideration from organizations deploying AI systems:
- Multiple State AI Laws Effective January 1, 2026: Many states, including California, Texas, and Illinois, have enacted significant AI legislation taking effect at the start of 2026, with Colorado's comprehensive AI Act following on June 30, 2026.
- Continued State Activity: Over 1,000 AI-related bills were introduced across states in 2025 alone, with over 700 introduced the year before, signaling continued legislative momentum at the state level.1
- Federal Deregulation and Preemption Efforts: On January 20, 2025, President Trump revoked Biden's Executive Order 14110 on AI safety.2 Subsequently, on December 11, 2025, President Trump signed a new executive order titled "Ensuring a National Policy Framework for Artificial Intelligence," which proposes to preempt state AI laws deemed inconsistent with the federal deregulatory policy.3 That order requires the Attorney General to establish an AI Litigation Task Force responsible for identifying and challenging state laws that are inconsistent with the federal policy of "a minimally burdensome national policy framework for AI."
- New Legal Challenges to State AI Laws: Additionally, several companies have begun filing a variety of legal challenges to state AI laws, and those cases are just beginning to make their way through the court system. However, until courts rule otherwise, state AI laws remain enforceable, and companies must take action to comply with those new requirements.
Key Takeaway: Until courts rule on federal preemption and other legal challenges to state AI laws, those state laws remain enforceable. Organizations should continue to comply with applicable state AI requirements while monitoring any legal challenges to those laws and related federal developments.
II. New and Upcoming State Laws: What's Effective Now vs.Coming Soon
AI companies should pay close attention to the patchwork of new state AI laws that have recently become effective this year, and those that will become effective on later dates in the future.
A. New State Laws Effective January 1, 2026
Several states have enacted new laws that went into effect on January 1, 2026, that regulate various aspects of AI use and development.
1. California Transparency in Frontier AI Act (SB 53): Signed by Governor Newsom on September 29, 2025.4 Requires "frontier developers" of large AI models (trained using >1026 FLOPS) to publish risk frameworks, report critical safety incidents, and implement whistleblower protections. Large frontier developers (>$500M annual revenue) face enhanced obligations. Penalties up to $1 million per violation.
AI Training Data Transparency Act (AB 2013): Signed September 28, 2024. Mandates that generative AI developers publish information about training datasets, including sources, data types, whether copyrighted material is included, and collection timeframes.5
Companion Chatbot Law (SB 243)6: Requires operators to disclose AI nature, maintain protocols to prevent suicidal ideation and self-harm content, and implement special protections for minors using AI companion chatbots, including break reminders every three hours.
Healthcare AI Disclosures (AB 489)7: Prohibits AI technology providers from falsely claiming healthcare licenses and requires disclosures when AI communicates with patients.
2. Illinois
Amendment to Human Rights Act (HB 3773): Signed by Governor Pritzker on August 9, 2024.8 Makes it a civil rights violation to use AI for employment decisions (recruitment, hiring, promotion, discharge, discipline, tenure) without notice to employees, in a manner that discriminates against protected classes, or using ZIP codes as proxies for protected characteristics. Private right of action available.
3. Texas
Texas Responsible AI Governance Act (TRAIGA, HB 149): Signed by Governor Abbott on June 22, 2025. Applies to developers and deployers conducting business in Texas. Prohibits AI systems designed for "restricted purposes" including encouragement of self-harm, unlawful discrimination, constitutional rights infringement, and CSAM generation. Provides affirmative defenses for compliance with NIST AI RMF. Penalties range from $10,000–$12,000 (curable, if not cured) to $80,000–$200,000 (uncurable violations), plus $2,000–$40,000 per day for continuing violations. No private right of action.9
4.Other States
Nevada: Political advertising disclosures for synthetic media (NRS 294A.347-95).10
Montana: Right of publicity protections for AI-generated likenesses (MCA Title 30, Chapter 14).11
Rhode Island, Nebraska, Indiana, Kentucky:Consumer privacy laws with automated decision-making opt-out rights.
B. Coming Later in 2026
Additionally, a number of states have other laws that will be going into effect on later dates throughout 2026.
Colorado AI Act (SB 24-205) – June 30, 2026: The first comprehensive U.S. statute targeting "high-risk" AI systems.12 Originally set for February 1, 2026, the effective date was delayed by SB 25B-004 (signed August 28, 2025). Requires developers and deployers to exercise reasonable care to prevent algorithmic discrimination, conduct impact assessments, and provide consumer disclosures. (Notably, this is the only state law specifically mentioned in President Trump's December 2025 Executive Order as an example of a state law perceived to entail "excessive State regulation".) Penalties up to $20,000 per violation. No private right of action.
California AI Transparency Act (SB 942) – August 2, 2026: Requires generative AI providers to offer watermarks, latent disclosures, and detection tools for AI-generated content.
C. Looking Ahead to 2027
Still more state AI laws will begin going into effect a year from now, in January 2027.
- California AI Transparency Act Platform Requirements – January 1, 2027: Large online platforms must detect and label machine-readable provenance data on AI-generated content.
- California CCPA Regulations on Automated Decision-Making – January 1, 2027: Businesses using automated decision-making technology for significant decisions must conduct risk assessments, provide pre-use notices, and allow consumer opt-outs. (Related risk assessment requirements take effect January 1, 2026.).
D. State AI Law Requirements Summary Table
The following table summarizes key compliance deadlines and requirements for recently enacted state AI laws (and the lone federal AI statute) that are set to become effective in 2026 and 2027.
|
Effective Date |
Jurisdiction / Law |
Key Requirement |
Penalties for Non-Compliance |
|
Jan.1, 2026 |
California – SB 53 (TFAIA) |
Frontier AI Framework, whistleblower protections, safety incident reporting |
Up to $1M/violation |
|
Jan.1, 2026 |
California – AB 2013 |
Training data transparency disclosures |
Enforcement by AG |
|
Jan.1, 2026 |
California – Companion Chatbot |
Minor protections, crisis protocols, AI disclosure |
$1,000/violation (private action) |
|
Jan.1, 2026 |
Texas – HB 149 (TRAIGA) |
Prohibited uses, disclosures, affirmative defenses |
$10K–$12K (curable); $80K–$200K (uncurable) |
|
Jan.1, 2026 |
Illinois – HB 3773 |
Employment AI notice; non-discrimination |
IHRA remedies (private action) |
|
Jan.1, 2026 |
Nevada – NRS 294A |
Political advertising synthetic media disclosure |
Injunctive relief |
|
Jan.1, 2026 |
Montana – MCA Title 30 |
AI likeness/publicity protections |
Actual damages + profits |
|
May 19, 2026 |
Federal – TAKE IT DOWN Act |
Platform notice-and-removal process for NCII/deepfakes |
FTC enforcement; criminal penalties |
|
June 30, 2026 |
Colorado – SB 24-205 |
High-risk AI impact assessments, consumer disclosures, appeal rights |
Up to $20,000/violation |
|
Aug.2, 2026 |
California – SB 942 |
AI content watermarking, detection tools |
$5,000/violation/day |
|
Jan.1, 2027 |
California – SB 942 (Platforms) |
Large platform provenance labeling |
$5,000/violation/day |
|
Jan.1, 2027 |
California – CCPA Regs |
ADMT risk assessments and opt-out |
Up to $7,500/violation |
III. Federal Framework
In stark contrast to the approach of many states, the federal government has eliminated prior requirements on the development and use of AI, and established a taskforce and protocols to bring challenges to state laws perceived to conflict with the national policy of promoting AI development. Against that backdrop, federal agencies continue to use their authority to regulate AI-concerns within their purview. Organizations also may choose to comply with the voluntary federal frameworks with respect to AI development and deployment.
A. Revocation of Biden-Era AI Requirements
On January 20, 2025, the first day of his second term, President Trump revoked President Biden's Executive Order 14110, titled "Safe, Secure, and Trustworthy Development and Use of Artificial Intelligence," which was signed on October 30, 2023. The key requirements that were revoked include the following:
- Requirement for developers of the most powerful AI systems to share safety testing and red-teaming results with the federal government;
- Directives for federal agencies to engage in over 100 specific actions across eight policy areas;
- Requirement for all federal agencies to appoint Chief AI Officers; and
- Department of Labor requirements regarding AI's impact on employment.
Three days later, on January 23, 2025, President Trump signed a new executive order titled "Removing Barriers to American Leadership in Artificial Intelligence," which declared it "the policy of the United States to sustain and enhance America's global AI dominance" and directed advisers to develop an "action plan" within 180 days.13
B. December 2025 Executive Order on State Preemption
On December 11, 2025, President Trump signed an executive order titled "Ensuring a National Policy Framework for Artificial Intelligence," proposing to establish a uniform federal AI policy that would preempt state laws deemed inconsistent with federal policy.14 This order builds on the January 2025 revocation and further advances the Administration's deregulatory approach.
Key Directives:
- AI Litigation Task Force: The Attorney General is directed to establish a task force to challenge state AI laws on grounds of unconstitutional regulation of interstate commerce or federal preemption.
- Commerce Department Evaluation (Due March 11, 2026): The Secretary of Commerce must publish an evaluation identifying burdensome state AI laws that conflict with federal policy, particularly those requiring AI to alter truthful outputs or compelling disclosures that may violate First Amendment protections. (The Colorado AI Act is specifically cited as an example.)
- Federal Funding Leverage: Certain Broadband Equity Access and Deployment (BEAD) program funds may be conditioned on states avoiding "onerous" AI laws, potentially placing significant state infrastructure grants at risk.
- FCC Proceeding: The FCC is directed to consider adopting a federal AI reporting and disclosure standard that would preempt conflicting state laws.
- FTC Policy Statement (Due March 11, 2026): The FTC must describe how the FTC Act applies to AI and when state laws requiring alteration of truthful outputs are preempted.
Categories NOT Proposed for Preemption:
- Child safety regulation
- AI compute and data center infrastructure (except generally applicable permitting reforms)
- State government procurement and use of AI
Practical Implication: The Executive Order itself cannot overturn existing state law—that can only be done by an act of Congress or the courts. Until the relevant legal challenges are resolved, state laws remain enforceable, and organizations must continue to comply.
C. Current Legislative Status
The federal regulatory landscape for AI remains limited in scope.
Notably, on May 22, 2025, the U.S. House of Representatives passed a provision within a broader budget reconciliation bill that would have barred states and localities from enforcing AI-specific regulations for ten years. However, the Senate ultimately voted to remove this provision, leaving state enforcement authority intact.
Although AI-related legislation has been introduced in Congress, only one standalone statute touching on AI has been enacted to date:
TAKE IT DOWN Act (Signed May 19, 2025): Requires online platforms to delete flagged non-consensual intimate imagery, including AI-generated deepfakes, within 48 hours of a report.15 Creates criminal penalties for distributing such content (up to three years imprisonment) and empowers the Federal Trade Commission (FTC) to enforce compliance. Covered platforms have until May 19, 2026 to establish the required notice-and-removal process.
D. Federal Agency Enforcement
Federal agencies continue to use existing statutory authorities to address AI-related concerns:
- Federal Trade Commission (FTC): Targets deceptive practices including "AI washing" (misleading or exaggerated claims about AI capability), privacy issues, fake reviews, and algorithmic pricing concerns.16
- Securities and Exchange Commission (SEC): Focuses on transparency, conflicts of interest, and "AI washing" in investment contexts. Following the landmark March 2024 settlements against Delphia (USA) and Global Predictions, the SEC has intensified its scrutiny of automated tools. The SEC's 2026 Examination Priorities specifically target AI-related disclosures, emphasizing that firms must provide material, company-specific detail rather than boilerplate language.17
- Equal Employment Opportunity Commission (EEOC): Monitors AI use in hiring, promotion, and workforce management for disparate impact and unlawful bias against protected classes. Note: Some EEOC AI guidance was removed in January 2025, but underlying statutory protections remain.18
- Department of Justice (DOJ): Updated its Evaluation of Corporate Compliance Programs (ECCP) in September 2024 to address AI-specific risks. The revised guidance directs federal prosecutors to evaluate whether companies have assessed the potential impact of AI on compliance with criminal laws, implemented controls to ensure AI-generated data accuracy, and protected against AI-generated false approvals or documentation.19 The December 2025 Executive Order also established a DOJ AI Litigation Task Force to challenge state AI laws deemed inconsistent with federal policy.
- Food and Drug Administration (FDA): Regulates AI in medical devices through its Software as a Medical Device (SaMD) framework, with draft guidance on AI in drug development. 20
E. Voluntary Federal Frameworks
Several voluntary frameworks continue to guide AI development and deployment:
- NIST AI Risk Management Framework (January 26, 2023): A voluntary, non-binding framework released by the U.S. Department of Commerce's National Institute of Standards and Technology.21 Widely adopted by private companies and government agencies as a best-practice guide, it encourages organizations to assess and mitigate AI risks through its core principles of "map, measure, manage, and govern." Notably, compliance with this framework provides an affirmative defense under Texas's TRAIGA.
- NIST Generative AI Profile (July 26, 2024): A supplement tailoring the RMF's principles to generative AI risks, including misinformation, deepfakes, and intellectual property concerns.22 Offers over 400 recommended actions across the generative AI lifecycle.
- House Bipartisan Task Force Report (December 2024): Provides guiding principles and policy proposals to promote U.S. leadership in responsible AI innovation. Notably cautions Congress against a one-size-fits-all regulatory framework, advocating for a sector-specific approach.
IV. Compliance Considerations
The uncertain and rapidly evolving legal and regulatory framework poses a number of challenges for organizations. However, there are steps that organizations can take, and practices that can be implemented, in order to ensure they are well-positioned to address the changing landscape and new issues presented by AI use.
A. Internal Preparation
1.Inventory AI Assets Across the Organization
Map all AI use across the enterprise. Investigate "shadow AI" deployments (unauthorized use of certain AI systems by employees to perform their work). Creating a comprehensive inventory is a foundational step in AI governance, as effective risk management requires visibility intoallAI systems in use. This inventory should identify AI systems used in high-risk contexts such as employment, healthcare, financial services, and consumer-facing applications.
2.Update Vendor Agreements
Review and revise AI vendor contracts to address liability allocation for:
- Intellectual property infringement (particularly given ongoing copyright fair use litigation);
- Autonomous errors and "hallucinations" resulting in financial loss; and
- Indemnification clauses addressing AI-specific risks.
3. Prepare for the Strictest State Regulations
Do not wait for any of the legal challenges to state laws (including federal preemption) to resolve. Identify the most stringent applicable state requirements and build compliance programs around those. Organizations should note that certain laws, such as the Colorado AI Act's impact assessments, "take months to prepare," making early preparation essential for the June 30, 2026, effective date.
4. Establish Incident-Response Protocols
Develop and document protocols for addressing:
- AI-related errors and hallucinations;
- Critical safety incidents (particularly for frontier AI developers subject to California SB 53);
- Regulatory inquiries and investigations; and
- Consumer complaints regarding automated decision-making
B. Navigating Federal-State Tension over AI Regulation
The December 2025 Executive Order creates uncertainty regarding the enforceability of state AI laws. However, until courts rule on preemption questions and other legal challenges, organizations should:
- Monitor the Commerce Department's March 11, 2026 evaluation of state AI laws;
- Track DOJ AI Litigation Task Force activities; and
- Develop flexible compliance programs capable of adjusting to the shifting regulatory environment.
The Executive Order does not propose preemption of child safety regulations, state government AI procurement and use, or AI infrastructure regulation (except permitting). Organizations operating in these areas should assume continued state enforcement authority unless other legal challenges are raised by private actors.
C. Sector-Specific Considerations
Certain sectors should be mindful of specific considerations that are applicable to those sectors, and ensure compliance with the relevant framework.
Employment:
- Require third-party bias audits for automated employment decision tools where required by law (NYC Local Law 144) or as a risk-management measure;
- Implement notice and disclosure procedures for Illinois HB 3773 compliance;
- Document AI use in hiring, promotion, and workforce management decisions;
- Maintain records for California's four-year retention requirement; and
- Note that while EEOC removed some AI guidance in January 2025, the underlying Title VII, ADA, and ADEA protections remain in effect.
Consumer-Facing AI:
- Implement AI disclosure requirements for chatbots and automated systems;
- Develop crisis-response protocols for companion AI applications; and
- Prepare for automated decision-making opt-out requirements under state privacy laws.
Healthcare
- Include disclaimers in AI-generated patient communications (California AB 3030);
- Ensure human oversight in utilization review decisions (Texas SB 815, California Physicians Make Decisions Act); and
- Comply with FDA SaMD requirements for medical device AI.
D. Looking Ahead
The AI regulatory landscape will continue to evolve rapidly. Key developments to monitor include:
- Court challenges to the December 2025 Executive Order and state AI laws;
- Additional state legislation (over 1,000 AI-related bills were introduced across states in 2025);
- Federal agency enforcement actions, particularly by the FTC, EEOC, and SEC;
- Copyright fair use litigation outcomes (NYT v. OpenAI, Getty v. Stability AI); and
- EU AI Act implementation and its influence on U.S. multinationals.
Footnotes
1 BSA, 2025 State AI Wave Building After 700 Bills in 2024 (2024), available at https://www.bsa.org/news-events/news/2025-state-ai-wave-building-after-700-bills-in-2024; MultiState, Artificial Intelligence (AI) Legislation Tracker (2025), available at https://www.multistate.ai/artificial-intelligence-ai-legislation(reporting 1,208 AI-related bills in 2025).
2 Exec. Order, Initial Rescissions of Harmful Executive Orders and Actions (Jan. 20, 2025), available at https://www.whitehouse.gov/presidential-actions/2025/01/initial-rescissions-of-harmful-executive-orders-and-actions/; Exec. Order, Removing Barriers to American Leadership in Artificial Intelligence (Jan. 23, 2025), available at https://www.whitehouse.gov/presidential-actions/2025/01/removing-barriers-to-american-leadership-in-artificial-intelligence/ (referencing "the revoked Executive Order 14110 of October 30, 2023").
3 Exec. Order, Ensuring a National Policy Framework for Artificial Intelligence (Dec. 11, 2025), available at https://www.whitehouse.gov/presidential-actions/2025/12/eliminating-state-law-obstruction-of-national-artificial-intelligence-policy/.
4 Cal. S.B. 53, 2025-2026 Reg. Sess. (Cal. 2025); Press Release, Office of Governor Gavin Newsom, Governor Newsom Signs SB 53 (Sept. 29, 2025), available at https://www.gov.ca.gov/2025/09/29/governor-newsom-signs-sb-53-advancing-californias-world-leading-artificial-intelligence-industry/.
5 Cal. A.B. 2013, 2023-2024 Reg. Sess. (Cal. 2024), available at https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=202320240AB2013.
6 Cal. S.B. 243, 2025-2026 Reg. Sess. (Cal. 2025) (signed by Governor Newsom on October 13, 2025; effective January 1, 2026), available at https://leginfo.legislature.ca.gov/faces/billNavClient.xhtml?bill_id=202520260SB243.
7 Cal. A.B. 489, 2025-2026 Reg. Sess. (Cal. 2025) (signed by Governor Newsom on October 11, 2025; effective January 1, 2026), available at https://leginfo.legislature.ca.gov/faces/billNavClient.xhtml?bill_id=202520260AB489.
8 775 ILCS 5/2-102 (amended by H.B. 3773, 103d Gen. Assemb. (Ill. 2024)), available at https://www.ilga.gov/legislation/BillStatus.asp?DocNum=3773&GAID=17&GA=103&DocTypeID=HB
9 Tex. H.B. 149, 89th Leg., R.S. (2025), available at https://capitol.texas.gov/BillLookup/History.aspx?LegSess=89R&Bill=HB149.
10 Nev. A.B. 73, 83d Leg., Reg. Sess. (Nev. 2025), available at https://www.leg.state.nv.us/App/NELIS/REL/83rd2025/Bill/12673/Overview (requiring disclosure of AI-manipulated election materials; effective January 1, 2026).
11 Mont. H.B. 513, 69th Leg., Reg. Sess. (Mont. 2025) (revising laws related to use of name, voice, and likeness of individuals and penalties for unauthorized use; signed May 2025), available at https://laws.leg.mt.gov/legprd/LAW0210W$BSIV.ActionQuery?P_BILL_NO1=513&P_BLTP_BILL_TYP_CD=HB&Z_ACTION=Find&P_SESS=20251.
12 Colo. S.B. 24-205, 74th Gen. Assemb., 2d Reg. Sess. (Colo. 2024), available at https://leg.colorado.gov/bills/sb24-205.
13 Exec. Order, Initial Rescissions of Harmful Executive Orders and Actions (Jan. 20, 2025), available at https://www.whitehouse.gov/presidential-actions/2025/01/initial-rescissions-of-harmful-executive-orders-and-actions/; Exec. Order, Removing Barriers to American Leadership in Artificial Intelligence (Jan. 23, 2025), available at https://www.whitehouse.gov/presidential-actions/2025/01/removing-barriers-to-american-leadership-in-artificial-intelligence/.
14 Exec. Order, Ensuring a National Policy Framework for Artificial Intelligence (Dec. 11, 2025), available at https://www.whitehouse.gov/presidential-actions/2025/12/eliminating-state-law-obstruction-of-national-artificial-intelligence-policy/.
15 TAKE IT DOWN Act, S. 146, 119th Cong. (2025), available at https://www.congress.gov/bill/119th-congress/senate-bill/146.
16 See FTC, Press Release, FTC Order Requires Workado to Back AI Detection Claims (Apr. 2025), available at https://www.ftc.gov/news-events/news/press-releases/2025/04/ftc-order-requires-workado-back-artificial-intelligence-detection-claims.
17 In the Matter of Delphia (USA) Inc., Investment Advisers Act Release No. 6573 (Mar. 18, 2024);In the Matter of Global Predictions Inc., Investment Advisers Act Release No. 6574 (Mar. 18, 2024). See also SEC Division of Examinations,2026 Examination Priorities4, 13-14 (Nov. 2025) (prioritizing the "accuracy of AI-related disclosures" and the "governance of emerging financial technologies"), available at https://www.sec.gov/files/2026-exam-priorities.pdf.
18 EEOC removed AI-related guidance from its website on January 27, 2025; see EEOC, What is the EEOC's Role in AI? (Apr. 2024), available at https://www.eeoc.gov/sites/default/files/2024-04/20240429_What%20is%20the%20EEOCs%20role%20in%20AI.pdf(archived guidance).
19 U.S. Dep't of Justice, Evaluation of Corporate Compliance Programs (updated Sept. 23, 2024), available at https://www.justice.gov/criminal/criminal-fraud/page/file/937501/d.
20 FDA, Artificial Intelligence-Enabled Medical Devices (Jan. 2025), available at https://www.fda.gov/medical-devices/software-medical-device-samd/artificial-intelligence-enabled-medical-devices (listing over 1,000 authorized AI-enabled devices); FDA, Press Release, FDA Issues Comprehensive Draft Guidance for Developers of Artificial Intelligence-Enabled Medical Devices (Jan. 6, 2025), available at https://www.fda.gov/news-events/press-announcements/fda-issues-comprehensive-draft-guidance-developers-artificial-intelligence-enabled-medical-devices.
21 NIST, AI Risk Management Framework (AI RMF 1.0) (Jan. 26, 2023), available at https://www.nist.gov/itl/ai-risk-management-framework.
22 NIST, Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile (NIST AI 600-1) (July 26, 2024), available at https://www.nist.gov/publications/artificial-intelligence-risk-management-framework-generative-artificial-intelligence.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
[View Source]
