California’s automated decision-making rules, Colorado’s rewritten AI law (SB26-189) and New York’s RAISE Act all take effect on 1 January 2027. Washington’s content-disclosure law follows on 1 February 2027, and Connecticut’s candidate notices on 1 October 2027. No federal law overrides them: Congress has not passed a preemption statute, and Executive Order 14365 cannot strike down a state law by itself.
In July 2025 the US Senate voted 99 to 1 to remove a moratorium on state AI laws from the reconciliation bill. Only Senator Tillis voted to keep it. Five months later the White House signed an executive order setting up a Justice Department task force to challenge state AI laws in court, and in June 2026 a House discussion draft proposed freezing state rules on AI development for three years. The draft never reached a vote.
On 3 November 2026 Democrats won both chambers of Congress. A federal law overriding state AI rules, which could not get through a Republican Congress, now has to get through a Democratic one, and nobody I know of expects it to. The same night Democrats gained attorney-general seats, and by Brownstein’s count will lead 29 to 22 in 2027 if close races hold. Attorneys general are the people who enforce these laws.
So if you deploy AI that makes or shapes decisions about people, plan for the states. The volume is not slowing. MultiState counted 1,208 AI bills introduced in 2025, 145 of them enacted, and 1,561 introduced in 45 states by March 2026. NYU’s Center on Technology Policy counted 109 AI laws enacted in 29 states by 1 July 2026. Trackers define an AI law differently, so their totals differ. Every one of them is going up.
What follows is engineering guidance, not legal advice. Your counsel decides which laws apply to you. The job here is making whatever they decide cheap to implement, and cheap to change when the next legislature meets.
Why federal preemption stalled
Executive Order 14365, “Ensuring a National Policy Framework for Artificial Intelligence”, was signed on 11 December 2025. It gave five parts of the government jobs to do, and almost a year later most are unfinished.
| Section | What it directed | Where it stands |
|---|---|---|
| 3 | A Justice Department AI Litigation Task Force within 30 days | Set up by memo on 9 January; one intervention so far, in Colorado |
| 4 | A Commerce evaluation naming “onerous” state AI laws within 90 days | Due 11 March and not published, per Holland & Knight and later trackers |
| 5 | Conditions on federal broadband funding | A policy notice still reported pending in July |
| 6 | An FCC proceeding on AI disclosure standards | Not opened; 23 state attorneys general had already opposed FCC preemption |
| 7 | An FTC policy statement on deceptive AI | Proposed on 1 July; comments closed on 31 July |
The FTC proposal is the one to watch. It argues that the FTC Act’s ban on deception applies “even when a company engages in a deceptive act or practice in order to comply with a State law”, which is a preemption argument by another route. It is still a proposal.
None of these can strike down a state law by themselves. Only Congress, by passing a preemption statute, or a court that rules against a specific law, can do that. The White House’s national AI policy framework of 20 March asked Congress to preempt state AI laws that “impose undue burdens”, and the House draft that followed stalled without a floor vote. With both chambers changing hands in January, a preemption statute is off the table for at least two years, and companies that waited for one to simplify their compliance are now waiting for something that is not coming.
Colorado’s AI Act: what litigation can and cannot do
Colorado’s AI Act, SB 24-205, was the first broad state law on high-risk AI. It was due to take effect on 1 February 2026, then 30 June. On 9 April 2026 xAI sued to block it, and on 24 April 2026 the Justice Department joined the case, the Task Force’s first public move. Three days later a magistrate judge entered a stipulated order: the Attorney General agreed not to enforce or investigate the law until 14 days after the court rules on xAI’s request for an injunction, a request deferred until Colorado’s implementing rules are final. Nothing was decided on the merits.
The legislature then replaced the law. SB26-189, signed on 14 May 2026 under the title “Automated Decision-Making Technology”, repealed SB 24-205 and re-enacted a narrower version from 1 January 2027. According to Holland & Knight, the duty of reasonable care, the mandatory risk-management programme and the annual impact assessment are gone. What remains is aimed at the person on the other end of the decision. Per the bill page and Buchalter’s summary, a deployer must give:
- clear and conspicuous notice before the technology materially influences a decision about housing, education, employment, credit, insurance, health care or government services;
- within 30 days of an adverse outcome, a plain-language description of the technology’s role and a way to ask for more;
- a way to correct inaccurate personal data;
- human review by a trained reviewer able to override the outcome, where technically feasible;
- and records kept for at least three years, with enforcement by the Attorney General, a 60-day cure period before 2030, and no private right of action.
The Attorney General’s draft rules followed in August and were revised in October, which added a rebuttable presumption that the technology materially influenced a decision and a 15-day deadline for answering requests, per Orrick.
The lesson is not that litigation works. A lawsuit bought time, the legislature used the time to cut the law’s paperwork, and every duty that touches a real person survived.
Which state AI laws apply in 2027?
The rules below are the ones that matter to most companies building AI for US users. Dates are as published by the states, the regulators or the law firms tracking them.
| Rule | Applies from | What it asks of a system |
|---|---|---|
| NYC Local Law 144 | 5 July 2023 | An independent bias audit of automated hiring tools within the past year, a published summary, and notice to candidates 10 business days before use |
| California employment rules on automated-decision systems | 1 October 2025 | Bring automated hiring and employment decisions under state anti-discrimination law; keep records for at least four years |
| Texas TRAIGA (HB 149) | 1 January 2026 | No prohibited uses; Attorney General enforcement with a 60-day cure period and penalties of $80,000 to $200,000 for violations that cannot be cured; a 36-month sandbox |
| Illinois HB 3773 | 1 January 2026 | AI used in employment decisions comes under the state Human Rights Act; implementing rules were proposed and withdrawn in 2026 |
| California SB 53 | 1 January 2026 | Frontier developers above $500 million in revenue publish a safety framework and transparency reports; critical incidents reported within 15 days, or 24 hours if life is at risk; up to $1 million per violation |
| Connecticut SB 5 | Phased from 1 October 2026 | Using an automated tool is no defence to an employment discrimination claim from October 2026; notices to candidates from 1 October 2027; Attorney General enforcement, no private right of action |
| California’s automated decision-making rules (CCPA regulations, sections 7220 to 7222) | 1 January 2027 | Notice before use; an opt-out, or an appeal to a human who can overturn; access to how the decision was made, for credit, education, employment, healthcare and housing |
| Colorado SB26-189 | 1 January 2027 | Notice before material influence; an explanation within 30 days of an adverse outcome; correction; human review with override; records for three years |
| New York RAISE Act | 1 January 2027 | Frontier developers above $500 million in revenue register with a new state office, file disclosures, and report critical safety incidents within 72 hours; penalties of $1 million, then $3 million |
| Washington HB 1170 and ESHB 2225 | 1 February 2027 and 1 January 2027 | Disclosure of AI-generated or AI-modified content, and rules for companion chatbots |
| EU AI Act, as amended by the digital omnibus | 2 December 2027 and 2 August 2028 | High-risk obligations for anyone selling AI into the EU, the later date for AI built into regulated products |
Two things stand out. The frontier-model laws, SB 53 and RAISE, reach a handful of model developers, not the companies building on their models. The rules that reach ordinary businesses are the ones about decisions: hiring, credit, insurance, education, healthcare and housing, where a model’s output changes someone’s life and a regulator expects to see notice, records and a way to appeal.
California’s own definition is a useful test of scope. Its regulations treat a decision as significant when it concerns financial or lending services, education, employment or contracting, healthcare, or housing, and the compliance line is blunt: “A business that uses ADMT for a significant decision prior to January 1, 2027, must be in compliance with the requirements of this Article no later than January 1, 2027.”
Enforcement has started, mostly under old laws
Most AI enforcement so far has used laws that predate AI. The FTC’s 2024 sweep, Operation AI Comply, brought five actions on the principle that AI gets no exemption from existing consumer-protection law, and DoNotPay agreed to pay $193,000. In 2025 the FTC finalised an order against Workado, which had marketed an AI-content detector as 98% accurate when independent testing found 53% on general content. In Texas, the Attorney General settled with Pieces Technologies in 2024 over the hallucination rate it advertised for clinical summaries used in at least four hospitals.
State attorneys general have since gone further. Kentucky’s sued Character Technologies in January 2026 under its consumer-protection and data-protection laws, Route Fifty reported, and Florida’s attorney general sued OpenAI in June.
Federal guidance, meanwhile, has thinned. The EEOC removed its AI hiring guidance in January 2025, and the CFPB withdrew 67 guidance documents in May 2025, among them its circular on adverse-action notices from complex algorithms. As the National Law Review put it, “removing guidance does not repeal law.” Title VII still applies, fair-lending law still applies, and so does the HHS rule requiring health programmes to identify and reduce discrimination risk in patient-care decision tools.
The pattern across all of it is that claims about an AI system’s accuracy and fairness need evidence behind them. That evidence is a decision log and an evaluation set, which is where the engineering starts.
What these laws ask of a system, rather than of a lawyer
Read across the map and the obligations repeat. Strip the legal vocabulary away and seven engineering requirements are left.
| Requirement | What you build | Where it comes from |
|---|---|---|
| Know which systems decide things about people | A register of models and the decisions each one makes or shapes | Colorado’s decision categories; California’s significant decisions |
| Tell people before it happens | A notice service that renders jurisdiction-specific text at the point of use | California section 7220; Colorado’s notice; NYC’s 10 business days |
| Explain an adverse outcome | Explanations assembled from logged inputs and rules, not regenerated by the model | Colorado’s 30 days |
| Keep the record | An append-only decision log: inputs, output, model and version, policy applied, time | Colorado’s three years; California’s four years for employment |
| Let a person appeal to a person | A review queue where a human can overturn the outcome, with every override logged | Colorado’s human review; California’s appeal route |
| Test for unequal outcomes | An evaluation set sliced by protected group, run on every model change | NYC’s annual audit; California’s employment rules |
| Report incidents fast | A runbook with named owners and a clock | SB 53’s 15 days; RAISE’s 72 hours |
None of the seven depends on which model you use, and that is deliberate. A system that has them absorbs a new state law by changing data. A system without them needs rebuilding every time a legislature meets.
Build compliance as configuration
The design that holds up keeps the legal differences in a table and the machinery in code. One row per jurisdiction and decision type holds what varies: which notice to show, how fast an explanation is due, how long to keep the record, whether an appeal must exist, how often to audit. The application resolves the row at decision time from where the person is, not where the server runs, and writes the row’s version into the decision log alongside everything else.
yaml
# One row per jurisdiction and decision type. A new law is a new row, not a release.
- jurisdiction: US-CO
decision: consequential # housing, education, employment, credit, insurance, health, government
notice_before_material_influence: true
adverse_outcome_explanation_days: 30
correction_right: true
human_review: where_feasible
record_retention_days: 1095 # three years
policy_version: co-sb26-189-2027-01
- jurisdiction: US-CA
decision: employment
pre_use_notice: true # CCPA regulations, section 7220
opt_out_or_human_appeal: true
record_retention_days: 1460 # Civil Rights Council employment rules: four years
policy_version: ca-2027-01
- jurisdiction: US-NY-NYC
decision: hiring
notice_business_days: 10
bias_audit: annual
policy_version: nyc-ll144-2023Two properties fall out of that shape. A decision made in March 2027 stays explainable under the rules that applied in March, even after a state amends them in June. And the question a regulator asks first, show me every decision this model made about people in this state last quarter, becomes a query instead of a project.
Map your controls to a recognised framework once, because two states now reward it in law. Texas gives a defence to a defendant who “substantially complies with the most recent version of the Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile”. Connecticut gives a presumption of reasonable care for following the NIST framework or ISO/IEC 42001, per Faegre Drinker. NIST’s Generative AI Profile lists 12 risks and just over 200 actions; ISO/IEC 42001 is a certifiable management system. Neither replaces a single notice or appeal, but both turn an audit into a mapping exercise.
The evaluation set behind your bias testing is the piece most teams build last and need first; we have written about building the evaluation set before the model for that reason. Deterministic paths are also far easier to explain than open-ended ones, which is one more argument for workflows over agents wherever a decision touches a person.
What not to build
Do not fork the product per state. Forks multiply with every legislative session, and the cost of keeping a dozen versions in step lands on your slowest team.
Do not let the model provider’s dashboard be your record. Provider logs have their own retention, their own access rules and their own deletion schedule, and none of those was chosen with your obligations in mind. The decision log has to be yours, in your store, under your retention policy.
Do not generate explanations after the fact by asking the model why it decided. A model asked to explain itself produces plausible text about the decision, not the reason for it. Colorado’s 30-day explanation has to describe what the technology actually did, so log the real inputs, the rule version and the threshold that fired, and build the explanation from those.
And do not wait for federal law to settle it. The argument for waiting was that preemption might wipe the state rules away. After 3 November that argument is gone, and the first of the 2027 obligations arrive on 1 January 2027.
We build AI systems with the register, the decision log, the notice service and the review queue designed in from the first sprint, because adding them later costs more than the model did. If you are putting AI into decisions about people in 2027, our AI and automation work starts here, and the retention, lineage and deletion side is data engineering. I have covered what else the election changes for tech buyers separately. Tell us what your system decides, and we will tell you which of the seven you already have.
Questions teams ask
Do these laws apply if we only use a third-party model?
Mostly, yes. The decision laws regulate deployers, the companies using AI to decide things about people, regardless of who trained the model. The frontier-model laws, SB 53 and New York’s RAISE Act, apply only to the few developers above their revenue and compute thresholds.
Is following the NIST AI RMF enough?
Following it helps, and in two states it now counts in law: Texas gives a defence for substantial compliance with NIST’s generative AI profile, and Connecticut a presumption of reasonable care for following NIST or ISO/IEC 42001. Neither replaces the notices, explanations and appeals each state requires.
Does the EU AI Act apply to a US company?
Yes, if you place AI on the EU market or its output is used in the EU. General-purpose model duties have applied since August 2025, most high-risk obligations now start on 2 December 2027, and fines reach €35 million or 7% of worldwide turnover for the most serious breaches.
When do the 2027 state AI laws take effect?
On 1 January 2027 for the three largest: California’s automated-decision rules, Colorado’s rewritten act and New York’s RAISE Act. Washington’s content-disclosure law follows on 1 February 2027, and Connecticut’s candidate notices on 1 October 2027.
Saurav Raj Joshi is the founder and CEO of Crimson Umbrella Technologies and a principal data and BI engineer. You can find Saurav on LinkedIn.