US State AI Laws in 2026: Colorado Repeal-and-Replace, Texas TRAIGA, California SB 53 and Illinois — What Actually Applies

TL;DR: As of September 21, 2026, no federal statute preempts state AI law. Colorado repealed its 2024 AI Act and replaced it with SB 26-189 (signed May 14, 2026), effective January 1, 2027. Texas TRAIGA has been in force since January 1, 2026 and turns on intent, not disparate impact. California SB 53 has applied to frontier model developers since January 1, 2026; the CCPA automated-decisionmaking rules bite on January 1, 2027. Illinois HB 3773 has bound employers since January 1, 2026. Executive Order 14365 and a DOJ AI Litigation Task Force push against all of it. Treat every date below as "as of September 21, 2026" and re-check the primary source before relying on it.

Why Do State AI Laws in 2026 Still Have No Simple Answer?

If you run an HR screening tool, an underwriting model, a tenant-scoring product or a customer-facing assistant, you have heard three contradictory things this year: state AI regulation is exploding, the federal government is about to wipe it out, and nothing has actually changed. All three are partly true. Several states have enacted binding AI statutes with real effective dates, but the most cited of them — Colorado's — was challenged in federal court, suspended by agreement, then rewritten by the legislature before it ever applied.

The White House has directed the Justice Department to sue states over AI laws. An executive order cannot repeal a state statute, though, and no court has struck one down on preemption grounds. So the practical question is not whether Washington will save you; it is which effective date lands on your product first. If you also sell into Europe or the UK, read this with our EU AI Act August 2026 enforcement guide and UK AI regulation update — the definitions do not line up, and mapping one onto the other is where global programs lose time.

What Is the State AI Law Snapshot as of September 21, 2026?

A status snapshot, not legal advice — and the part of this article that will age fastest.

State / statute	Status as of Sept 21, 2026	Who is covered	Core obligations	Enforcement
Colorado SB 26-189 (repealed and reenacted SB 24-205)	Signed May 14, 2026; effective Jan 1, 2027. SB 24-205 never took effect	Developers and deployers of ADMT that materially influences a consequential decision	Pre-use notice; explain an adverse decision within 30 days; human review and data correction; developer documentation	Colorado AG only; 60-day cure; no new private right of action
Texas TRAIGA (HB 149)	In force since Jan 1, 2026	Anyone developing or deploying AI in Texas or serving Texas residents; extra duties for government entities	Intent-based prohibitions; government and healthcare AI disclosure; biometric limits	Texas AG exclusively; 60-day cure; tiered penalties; NIST AI RMF safe harbor
California SB 53 (Transparency in Frontier AI Act)	Operative since Jan 1, 2026	Frontier model developers; heavier duties above USD 500m revenue with affiliates	Publish a frontier AI framework and transparency reports; report safety incidents to Cal OES; whistleblower protections	California AG; up to USD 1m per violation
California CCPA ADMT rules	Finalized 2025; compliance by Jan 1, 2027	CCPA-covered businesses using ADMT for significant decisions; employees and applicants count	Pre-use notice, opt-out and access rights, vendor terms; phased risk assessments and cyber audits	California Privacy Protection Agency and AG
Illinois HB 3773 (amends the Human Rights Act)	In force since Jan 1, 2026; IDHR proposed rules (May 2026) reported withdrawn and postponed in June 2026; no final rules reported	Employers using AI across hiring, promotion, discipline, discharge and other employment terms	No AI use with a discriminatory effect; no zip code as proxy; notice to applicants and employees	IDHR and Human Rights Commission; IHRA remedies
New York RAISE Act	Chapter amendment signed Mar 27, 2026; effective Jan 1, 2027; DFS rules pending	Developers of large frontier models	Safety protocol, transparency and incident reporting, per forthcoming DFS rules	New York AG / DFS

Two things stand out. 2026 was not the year the patchwork hit — January 1, 2027 is, and Colorado, New York and California's ADMT rules all converge there. And these statutes share no vocabulary: Colorado regulates automated decision-making technology, Texas regulates intent, SB 53 regulates developers by revenue, Illinois regulates employers under civil rights law. One control set will not satisfy all four.

What Happened to the Colorado AI Act, and What Does SB 26-189 Require?

SB 24-205 was the first US state law imposing a duty of reasonable care against algorithmic discrimination, with impact assessments and risk management programs loosely modeled on the EU approach. It never took effect; its start date had been pushed to June 30, 2026 before the repeal. xAI sued Colorado Attorney General Philip Weiser in the U.S. District Court for the District of Colorado on April 9, 2026, raising First Amendment, Commerce Clause, vagueness and equal protection claims. DOJ moved to intervene on April 24, 2026 — the first federal intervention against a state AI law — and on April 27, 2026 the court granted a joint motion temporarily suspending enforcement. On May 14, 2026 Governor Polis signed SB 26-189, repealing and reenacting the Act. Whether the original case has since been dismissed as moot is status unclear as of September 21, 2026; check the docket, not a secondary summary.

From January 1, 2027 the replacement requires:

• A narrower trigger. "High-risk AI system" is gone; what matters is ADMT that materially influences a consequential decision. Reported carve-outs include scheduling, customer-service triage, advertising, recommendations, search and content moderation.
• Notice before use, plus a plain-language explanation of an adverse decision within 30 days covering the role ADMT played and how to exercise rights.
• Meaningful human reconsideration and correction of inaccurate personal data, qualified by commercial reasonableness, and developer documentation to deployers on intended uses, known limitations and training-data categories.
• Dropped: the duty of reasonable care against algorithmic discrimination, mandatory impact assessments and risk management programs. Enforcement sits with the AG alone, with a 60-day cure right reported to sunset January 1, 2030 and no new private right of action.

If you built against the 2024 text: keep the inventory and vendor documentation, and re-scope everything else around notice, explanation and human review.

What Does Texas TRAIGA Prohibit, and Why Does Intent Matter?

TRAIGA, in force since January 1, 2026, is the alternative model: rather than asking whether a system produced a disparate outcome, it asks what the system was built or deployed to do. Reported prohibitions cover AI developed or deployed with intent to incite self-harm, harm to others or crime; with the sole intent to infringe constitutional rights; with intent to unlawfully discriminate; or to produce child sexual abuse material or explicit deepfakes involving minors. Disparate impact alone is reported not to establish a violation. Government entities must disclose AI interaction and may not use AI social scoring; healthcare providers must disclose AI use in treatment.

The Texas AG enforces exclusively after a mandatory 60-day cure, with no private right of action. Reported penalty tiers run roughly USD 10,000–12,000 per curable violation, USD 80,000–200,000 per uncurable violation and USD 2,000–40,000 per day for continuing violations — confirm current figures against the enrolled text before quoting them. Two features matter operationally: a safe harbor tied to substantial compliance with the NIST AI Risk Management Framework and to finding issues through internal or adversarial testing, and a 36-month regulatory sandbox run by the Department of Information Resources. The safe harbor is the actionable part, because a NIST-mapped governance record also helps in Colorado, in an EU conformity file and in customer security questionnaires — the leverage described in AI compliance monitoring: what it catches, what it misses.

Who Has to Comply with California SB 53 and the CCPA ADMT Rules?

SB 53 is a frontier-model law, chaptered September 29, 2025 and operative since January 1, 2026. Heavier obligations fall on "large frontier developers" — annual gross revenue above USD 500 million counted with affiliates — and include publishing and annually updating a catastrophic-risk framework, publishing transparency reports before deploying new or substantially modified frontier models, reporting critical safety incidents to Cal OES within 15 days (24 hours where risk is imminent), and whistleblower protections. Civil penalties run up to USD 1 million per violation. If you do not train frontier models, SB 53 almost certainly does not apply to you — but your vendors' published frameworks are now a legitimate diligence input.

The CCPA ADMT regulations are what reach ordinary businesses. They apply where a CCPA-covered business uses automated decisionmaking technology for a "significant decision" about a consumer, and in California employees and applicants are consumers. The reported list includes hiring, allocation of work, compensation, promotion, demotion, suspension and termination, alongside finance, housing, education and health care; advertising is excluded. Compliance is required by January 1, 2027, with separate phase-ins for risk assessments and cybersecurity audits — confirm those directly with the California Privacy Protection Agency, since the deadline to conduct an assessment differs from the deadline to submit it and I did not verify those specific dates to primary-source standard. If your privacy notice and vendor paper were last refreshed for GDPR, they will not carry this; see drafting privacy policies and DPAs with AI and the 2026 data processing agreement template.

What Do Illinois Employers Have to Do Under HB 3773?

Illinois amended its civil rights statute instead of writing an AI act. Since January 1, 2026 the Illinois Human Rights Act prohibits employers from using AI that has the effect of subjecting employees to discrimination based on a protected class, across recruitment, hiring, promotion, renewal, training selection, discharge, discipline and other terms of employment. Zip code as a proxy for a protected class is expressly prohibited, and employers must notify applicants and employees when AI is used for those purposes.

The standard is effects-based — the opposite of Texas — inside a statute with established remedies. The Department of Human Rights published proposed implementing rules on the form, timing and content of the notice in May 2026, reported to include annual notice to current employees, notice within 30 days of adopting a new or substantially updated system, and notice in job postings. Law-firm alerts report that the Department withdrew and postponed them in early June 2026, so no final rules were reported as of September 21, 2026. The statute's duties apply regardless; confirm on the IDHR site before writing policy around the proposed details. For HR the consequence is blunt: "we licensed the tool and the vendor validated it" is not a defense. You need the notice, the vendor's adverse-impact testing and a documented human decision point — the drafting side is covered in AI for employment contracts and HR policy drafting.

Is the Federal Government About to Preempt State AI Laws?

Executive Order 14365, "Ensuring a National Policy Framework for Artificial Intelligence," was signed December 11, 2025 and published in the Federal Register on December 16, 2025. It directed the Attorney General to establish, within 30 days, an AI Litigation Task Force whose sole responsibility is challenging state AI laws inconsistent with the order's policy, including on dormant Commerce Clause and preemption grounds; that task force was established January 9, 2026. Within 90 days the Secretary of Commerce was to publish an evaluation identifying "onerous" state AI laws, and a separate policy notice was to condition eligibility for certain BEAD broadband funds — a March 11, 2026 deadline. We could not confirm that the evaluation has been published. Whether a definitive list has since been published is status unclear as of September 21, 2026. The order also directs the FCC to consider a preemptive federal AI disclosure standard, the FTC to address deception and AI outputs, and advisers to recommend uniform federal legislation.

What the order does not do is repeal anything. Preemption comes from a federal statute or a court judgment. A ten-year state moratorium passed the House in 2025 and was stripped by the Senate 99–1, and the FY 2026 defense authorization excluded AI preemption language (reported by multiple firms tracking the bill). The only federal intervention so far was in the Colorado case, and that law was rewritten before any merits ruling. The defensible planning assumption: no federal statute had preempted state AI laws as of September 21, 2026, the pressure campaign may change specific state laws through legislatures rather than courts, and your January 1, 2027 deadlines are still live.

Working through this now? If you are mapping a system inventory against these statutes, you can use MeshLaw to draft a first pass of an internal AI use policy or a vendor-documentation request and to summarize where two statutes diverge — then have counsel verify the jurisdiction-specific conclusions before anything circulates.

"Does This Apply to Me?" A Decision Table

Run each system separately. Most organizations find one HR tool triggers three regimes while their customer chatbot triggers none.

If this describes your system…	Check first	Your likely role	First concrete step
Screens, ranks or scores job applicants or employees	Illinois HB 3773; California ADMT rules; Colorado SB 26-189 from Jan 1, 2027	Deployer / employer	Draft the applicant and employee notice; request vendor adverse-impact testing in writing
Materially influences credit, insurance, housing, education or health care access	Colorado SB 26-189; California ADMT rules; rules that already applied (ECOA, FCRA, FHA)	Deployer	Build the adverse-decision explanation template and the 30-day workflow
You build and license the model others use for those decisions	Colorado developer documentation duties; TRAIGA developer prohibitions; contract flow-downs	Developer	Produce a documentation pack: intended uses, limitations, training-data categories
You train frontier-scale models available in California or New York	California SB 53 now; NY RAISE Act from Jan 1, 2027	Frontier developer	Publish or update the safety framework; stand up incident reporting
Consumer-facing generative assistant, no consequential decision	TRAIGA intent-based prohibitions; state disclosure and deepfake laws; FTC deception principles	Deployer	Document intended use and red-team results; check disclosure rules per state served
Internal productivity use only (drafting, summarizing, search)	Usually none of the above — confidentiality, privilege and vendor terms still apply	Internal user	Write an acceptable-use policy; no client data without approval

What Is the Compliance Checklist Before January 1, 2027?

1. Inventory by decision, not by tool — tool lists miss model features embedded in HR and CRM platforms.
2. Map each system to a state footprint. Where the affected people live, not where you are headquartered, triggers these statutes.
3. Classify developer vs deployer per system. Many companies are both.
4. Fix notice first — pre-use notice and adverse-decision explanation are the common denominator across Colorado, Illinois and California, and the cheapest control to build.
5. Make human review real. A reviewer who cannot reverse the outcome is not meaningful human review, and that is the fact a regulator or plaintiff will develop first.
6. Get developer documentation in writing — intended uses, limitations, training-data categories, testing results, incident notice, and no indemnity clause Colorado would void.
7. Keep a dated regulatory log of what you checked, when and from which source. That log defends a decision made under a rule that later changed.

For teams scaling this across business units, the operating model — who owns the inventory, who signs off, how exceptions are logged — matters more than the legal analysis; legal AI for in-house teams covers that triage structure.

What Does This Mean for Law Firms and In-House Counsel?

Two layers, easily conflated. First, advising clients on the statutes above. Second, your own AI use, governed by professional conduct rules rather than AI statutes — competence, confidentiality, supervision, candor, reasonable fees. No state AI act lowers those duties or shields a fabricated citation; see legal AI and professional ethics. The advisory opportunity is concrete: most businesses have no system inventory, and the January 1, 2027 cluster is a natural reason to build one. Firms that keep jurisdiction matrices with a dated update process — the method in adopting legal AI in modern law firms — can make this repeatable work rather than one-off memos, and smaller practices choosing monitoring tooling may find our evaluation checklist for boutique firms faster than a vendor demo cycle.

What Can AI Help With, and What Must a Human Verify?

AI is genuinely useful for: drafting a first-pass system inventory from procurement and SSO records; turning a statute into an obligations checklist; drafting pre-use notices, adverse-decision templates and internal AI use policies; comparing two states' definitions side by side; checking a vendor's model card against your requirements; and flagging when a monitored page changes.

A human must verify: the current status of every statute, rule and case — exactly where models trained months ago confidently describe a law that has since been repealed, and Colorado is the textbook example; whether your specific system meets a statutory definition; penalty figures and effective dates against the enrolled text; and anything going to a client, regulator or court. See is AI legal advice reliable. The division is not "AI for easy things, humans for hard things": AI is good at breadth and unreliable at currency, which is the one thing this subject demands.

What Should You Watch Between Now and Early 2027?

• Colorado rulemaking — the AG's rules will define "materially influences" and "commercially reasonable," and those two phrases set the statute's real scope.
• The xAI litigation or a successor case. A merits ruling on First Amendment or dormant Commerce Clause grounds would travel far beyond Colorado.
• Commerce, NTIA, FTC and FCC output under EO 14365, which could create a federal disclosure baseline and trigger state reactions in the 2027 sessions.
• Congress — a uniform federal framework remains the most consequential and least predictable possibility.

On this article's shelf life: everything above is stated as of September 21, 2026. In the preceding twelve months one flagship state AI act was suspended by court order and then repealed and replaced, a second state re-signed its frontier law by chapter amendment, and a federal executive order created a litigation task force aimed at the category. Assume any date, penalty or status here needs re-verification against the legislature's bill page, the agency's rule text or the court docket.

Related Reading

• EU AI Act August 2026 — what becomes enforceable now
• AI compliance monitoring: what it catches, what it misses
• Drafting privacy policies and DPAs with AI
• AI for employment contracts and HR policy drafting
• Legal AI and professional ethics
• Legal AI for in-house teams
• Is AI legal advice reliable?
• Adopting legal AI in modern law firms

Frequently Asked Questions

Is there a single federal AI law in the United States in 2026?

No. As of September 21, 2026 there is no comprehensive federal AI statute and none preempting state AI regulation. Executive Order 14365 sets federal policy and directs litigation and agency action against state laws, but an executive order cannot repeal a state statute.

Does the Colorado AI Act apply to my business right now?

Not yet. SB 24-205 never took effect — enforcement was suspended by court order on April 27, 2026, and it was repealed and reenacted as SB 26-189, signed May 14, 2026. The replacement takes effect January 1, 2027.

What is the difference between a developer and a deployer?

Broadly, a developer builds or substantially modifies an AI system; a deployer puts it into use for decisions about people. Colorado and Texas assign different duties to each, and many companies are both, so the analysis runs system by system rather than entity-wide.

Does Texas TRAIGA prohibit AI that produces discriminatory outcomes?

Not on outcome alone. Its discrimination prohibition turns on intent to unlawfully discriminate, and disparate impact by itself is reported not to establish a violation — a deliberate contrast with Illinois, which is effects-based.

My company is outside the United States. Can these laws reach us?

Yes, in principle. TRAIGA reaches entities that conduct business in Texas or offer products used by Texas residents, and the CCPA applies to businesses meeting its thresholds that process California residents' personal information wherever they sit. Physical presence is not the test.

Does California SB 53 apply to companies that only use AI rather than build it?

Generally no. SB 53 targets frontier model developers, with heavier duties above a USD 500 million revenue threshold counted with affiliates. If you license models, the law affects you indirectly through your vendors' published frameworks and incident reporting.

What do I actually have to tell employees and applicants?

Under Illinois HB 3773 you must notify applicants and employees when AI is used for covered employment decisions, with proposed rules on timing, content and delivery reported withdrawn and postponed in June 2026. California's ADMT rules add pre-use notice and opt-out or access mechanics from January 1, 2027, so write one notice that satisfies the strictest applicable state.

Will the DOJ AI Litigation Task Force get these laws struck down?

Unknown. The task force was established January 9, 2026 and the federal government intervened in the Colorado case that April, but Colorado rewrote the statute before any merits decision, so there is no controlling ruling as of September 21, 2026. Planning on a court invalidating your obligations is not a compliance strategy.

If federal preemption arrives later, is my compliance work wasted?

Mostly not. Inventory, vendor documentation, notice templates, human-review workflows and a NIST-aligned governance record are the same artifacts any plausible federal framework, the EU AI Act and customer diligence all demand.

Do these laws create a private right of action?

Colorado SB 26-189 and Texas TRAIGA are reported to reserve enforcement to the state Attorney General without a new private right of action. Illinois is different: HB 3773 sits inside the Illinois Human Rights Act, so individuals can pursue charges through the IDHR and Human Rights Commission.

How often should a compliance team re-check this area?

Quarterly at minimum, and on a monitored-source basis for the statutes you are actually subject to: the legislature's bill page, the agency's rule page and the relevant docket. A flagship statute here went from enacted, to suspended, to repealed and replaced in roughly twenty-four months.

Can I rely on an AI tool to keep a table like this current?

Only as a first pass. AI is efficient at watching many sources and flagging changes, and unreliable at telling you whether a change is legally operative. Require a human to confirm status against the primary source before any date or obligation enters a client deliverable.

Disclaimer and Next Step

This article is general information about a fast-moving area, current as of September 21, 2026, and is not legal advice. Statutes, rules and litigation status here change on a scale of weeks; the facts stated were verified against legislature, White House, Federal Register and law-firm sources on that date and may already have moved. Confirm every effective date, definition and penalty against the primary source, and consult a licensed attorney in the relevant jurisdiction before acting.

If you are starting the inventory-and-notice work described above, MeshLaw can help you draft internal AI use policies, notice and adverse-decision templates and vendor documentation requests, and compare how two states' definitions differ — with the status of each law and the final wording confirmed by your own counsel.