US state AI law varies by state, changes frequently, and must be checked state by state on official legislature and regulator sources. Colorado enacted the first comprehensive state AI law, SB 24-205, the Colorado AI Act, signed in May 2024, with duties for developers and deployers of high risk AI systems that make or are a substantial factor in consequential decisions, including risk management, impact assessments, disclosures and a rebuttable presumption of reasonable care for compliance with recognised frameworks. Secondary reporting checked for this guide conflicted on the later position of the Colorado law, including its effective date and whether it was amended or replaced, and that conflict is itself the reason to check the Colorado General Assembly official record before relying on any statement about Colorado. Other states have enacted narrower laws on employment, biometric data, deepfakes, consumer protection and sector uses, and no state law should be treated as a US equivalent of the AI Act.
Why must state law be checked state by state?
The United States has a federal system in which states can legislate on AI within their constitutional powers, and states have done so in different ways, at different speeds and with different scopes. Some states have enacted comprehensive laws for high risk systems and consequential decisions. Some have enacted narrow laws for a single use, such as automated employment decision tools, biometric identifiers, deepfakes in elections, or AI disclosures in consumer contexts. Some have amended existing consumer protection, employment, civil rights or sector laws to address AI, without enacting a standalone AI statute. Some have proposed bills that have not been enacted. The result is a patchwork in which a system that is lawful in one state may be subject to duties in another, and a duty that applies in one state may not apply in a neighbouring state. A company that operates in several states must therefore map each state where it has users, customers, employees or affected persons, and must check the law of each state separately. A national summary, including this guide, can orient the mapping, but it cannot replace the state by state check. The check should be done on the official legislature site for the state, the official regulator site, and the official text of the statute or regulation, with the effective date and any amendments recorded.
What did Colorado enact in 2024?
Colorado SB 24-205, the Colorado AI Act, was signed in May 2024 and was described at the time as the first comprehensive state AI law in the United States. In outline, as originally enacted, it applied to developers and deployers of high risk AI systems, defined as systems that make, or are a substantial factor in making, a consequential decision, in areas including employment, education, financial services, healthcare, housing, insurance and legal services. It imposed a duty of reasonable care to avoid algorithmic discrimination, risk management programme duties, impact assessment duties, disclosure duties to consumers and to the Attorney General in defined circumstances, and a rebuttable presumption of reasonable care for compliance with recognised frameworks, including the NIST AI Risk Management Framework or an equivalent framework. Enforcement was through the Attorney General as an unfair or deceptive trade practice, without a private right of action in the original text. Those provisions are described here in outline from the original enactment reporting. The later position, including the effective date, any delay, amendment, litigation or replacement, is the subject of conflicting secondary reporting checked for this guide, and must be checked on the Colorado General Assembly official record. This guide does not assert the current Colorado position beyond the checking instruction, and no Colorado duty should be relied on without that check.
For the broader regulatory framework, see non-EU and international overview.
What other state approaches exist?
Other states have taken narrower or sector approaches that must be checked individually. Illinois has biometric privacy law that has been applied to AI and biometric data, and has enacted employment and AI related provisions that must be checked on the Illinois legislature site. New York City has enacted a local law on automated employment decision tools, with bias audit and disclosure duties, which is a city law, not a state law, and which illustrates the further layer of local regulation. Texas, California, Utah and other states have enacted or proposed laws on AI disclosures, on generative AI, on deepfakes, on health and on employment uses, each with its own scope, definitions and effective dates. The details of those laws are not reproduced in this guide, because they change and because a summary would quickly become out of date and would risk misstating a definition or a date. A company should list the states and localities where it operates, check each official source, and record the statute, the scope, the duties, the effective date and the enforcement authority for each. A company should also check whether a state law has a small business, size or sector threshold, a cure period, or a safe harbour for recognised frameworks, because those provisions can change the practical duties for a small company.
How do state laws relate to federal law and to the AI Act?
State laws operate alongside federal sector law, and both operate alongside the AI Act for Union activities. There is no general federal preemption of state AI laws as checked on 29 October 2026, and executive action that proposes preemption or funding conditions must be checked on official sources and must not be assumed to have legal effect. A system can therefore be subject to a state duty, a federal sector duty and an AI Act duty at the same time, with different definitions of high risk, consequential decision, developer and deployer, and with different documentation, disclosure and enforcement arrangements. The definitions must not be conflated. A high risk system under Colorado law is not the same as a high risk system under the AI Act, even where the language is similar, and compliance with one definition does not prove compliance with the other. The record should keep the state, federal and EU analyses distinct, with the definitions and duties for each jurisdiction cited separately. Where a voluntary framework, such as NIST AI RMF, is referenced in more than one jurisdiction, the reference should be recorded for each jurisdiction separately, because the legal effect of the reference differs.
What should a company operating in several states do?
A company operating in several states should maintain a state map, updated at a planned interval and when a new state is entered or a law changes. The map should list each state, the statutes and regulations that apply, the scope, the definitions, the duties, the effective dates, the enforcement authority, the cure and safe harbour provisions, and the local advice obtained. It should be reviewed by US legal counsel, and it should be linked to the product inventory, so that a new system, a new use or a new customer location triggers a fresh state check. The map should be kept in a form that can be produced to a regulator, with the official sources cited. A company that relies on a vendor, a consultant or a blog summary for its state map, without checking the official sources, will miss amendments, effective date changes and litigation that affect its position. The map should also record the position as checked on a date, because state law changes frequently and a map without a date will be treated as out of date. The interval for review should be short, and the review should be owned by a named person.
Continue with US federal AI position.
What does this guide not decide?
This guide does not decide the current law of any US state, does not reproduce any state statute, and does not state whether the Colorado law is in force, amended or replaced. It gives the original Colorado enactment in outline and the checking route for the current position, and it gives the state by state method for other states. A company with a specific state activity should obtain US legal advice on the current law of that state, checked on the official legislature and regulator sources on the date of the decision. This guide is a method and an orientation, not a statement of current state law.
Frequently asked questions
Is there a single US AI law that covers all states?
No. There is no federal AI statute, and state laws vary by state in scope, definitions, duties and effective dates. Each state where a company operates must be checked on its official legislature and regulator sources, with the position dated. A national summary cannot replace the state by state check.
What was the Colorado AI Act?
Colorado SB 24-205, signed in May 2024, was the first comprehensive state AI law, with duties for developers and deployers of high risk systems in consequential decisions. Secondary reporting conflicted on its later position, including effective date and amendment or replacement, so the current position must be checked on the Colorado General Assembly official record before it is relied on.
Does NIST AI RMF compliance satisfy state law?
Not by itself. Some state laws gave a rebuttable presumption or an affirmative defence for compliance with recognised frameworks including NIST AI RMF, but the legal effect, the framework version and the conditions differ by state and by version of the law. The state statute must be checked, and the framework alignment must be evidenced for that state.
Can a state high risk definition be used for the AI Act?
No. State definitions of high risk and consequential decision differ from the AI Act definitions in Articles 3 and 6 and Annex III. The analyses must be kept distinct, with the definitions and duties for each jurisdiction cited separately. Compliance in one jurisdiction does not prove compliance in another.
Continue through this AI Act cluster
This article is an informational overview, not a legal determination. Check the current legal text and official implementation guidance for your system and role.
Consolidated Regulation (EU) 2024/1689 ↗NIST AI Risk Management Framework ↗AI Act Service Desk timeline ↗