This guide maps AI laws in the US, state by state. The United States does not have a comprehensive federal AI law. Instead, a patchwork of state laws, one targeted federal statute and a White House campaign against state rules decide what applies to you. Which rules matter depends on three things: where your users live, where your workers or candidates are, and what your AI does.
This guide sets out the federal picture, then each state that has passed significant AI law, then what it all means for creators, employers and people building AI. Every law links to its entry in our US AI law tracker, where we record its status, key dates and the official sources we checked. It reflects the position in November 2026.
The short answer: which AI laws apply to you
- Everyone: publishing, or threatening to publish, intimate images of a real person without consent, including AI-made ones, is a federal crime under the TAKE IT DOWN Act.
- Employers: using AI in hiring brings legal duties in Illinois and New York City today, and in Colorado from 1 January 2027.
- AI tool makers: California requires training-data summaries and hidden provenance data in AI-generated media.
- Frontier model developers: California’s SB 53 applies now, and New York’s RAISE Act follows on 1 January 2027.
- Chatbot operators: Utah and Texas have disclosure rules for some interactions.
Why there is no federal AI law
Congress has debated AI bills for years but has passed only narrow measures, and it has yet to enact anything like the EU AI Act. In the absence of federal rules, most US AI regulation comes from state legislatures, which have moved fast since 2023. Many states have introduced AI-related bills; far fewer have passed broad ones, so state-level AI regulation is uneven and creates compliance challenges for businesses that work across state lines.
In late 2025 the White House changed tack: instead of adding federal rules, it set out to limit state ones. Supporters say one national standard would help AI innovation; critics say states should be free to protect their residents. That conflict between federal and state rules is now the biggest open question in US AI law.
Federal AI regulation: the national picture
TAKE IT DOWN Act (Public Law 119-12)
Signed on 19 May 2025, this is the one federal statute aimed squarely at an AI harm. It made it a crime to knowingly publish intimate images of a person without consent, including AI-generated “digital forgeries”, or to threaten to. Penalties reach two years in prison where the victim is an adult and three years where the victim is a minor.
Its second half applies to platforms. Since 19 May 2026, websites and apps that mainly host user content must remove reported intimate images within 48 hours of a valid request and make reasonable efforts to remove copies. Failing to do so is treated as an unfair or deceptive practice, enforced by the Federal Trade Commission, which has opened a reporting site at TakeItDown.ftc.gov. Read the tracker entry.
Executive Order 14365 and the push against state AI rules
Executive Order 14365, “Ensuring a National Policy Framework for Artificial Intelligence”, was signed on 11 December 2025. The Trump administration’s order directs the Attorney General to run an AI Litigation Task Force that challenges state AI laws in court (set up by a memo on 9 January 2026), asks the Commerce Department to identify burdensome state laws, ties some broadband funding to states’ AI rules, and asks the FCC and FTC to work on federal standards.
An order of this kind cannot override state law on its own. That takes an act of Congress or a valid federal regulation, and courts decide each challenge. The first test came in Colorado, where the Justice Department joined a lawsuit against the state’s AI law in April 2026 (see below). Read the tracker entry.
What Congress is considering
At the federal level, the main proposal is a draft. In June 2026 two House members released a discussion draft called the Great American AI Act. Among much else, it would block state laws that specifically target AI model development for three years, while leaving laws on the use of AI untouched. It has not been formally introduced as a bill, although a House committee advanced several smaller bills drawn from it. No federal law pre-empting state AI rules has passed.
State AI laws, state by state
California
California has more AI law in force than any other state.
SB 53, the Transparency in Frontier Artificial Intelligence Act, took effect on 1 January 2026. It applies to developers that train frontier AI models, the largest general-purpose systems. The biggest, with more than $500 million in annual revenue, must publish a framework explaining how they manage catastrophic risks. All frontier developers must publish transparency reports before releasing new or substantially changed models and report critical safety incidents to the state’s emergency services office within 15 days; if there is an imminent risk of death or serious injury, they must tell an appropriate authority, such as law enforcement, within 24 hours. Whistleblowers are protected, and penalties reach $1 million per violation.
AB 2013 requires developers of generative artificial intelligence systems offered to Californians, and released or substantially changed since 1 January 2022, to post documentation about their AI training data, including a high-level dataset summary. xAI sued to block it; a federal court refused a preliminary injunction on 4 March 2026, and the Ninth Circuit is due to hear the appeal on 18 November 2026.
The California AI Transparency Act (SB 942) is about provenance: hidden data embedded in AI-generated images, video and audio that records where they came from. Its provider duties apply from 2 August 2026. A 2025 amendment (AB 853) added duties for large online platforms and AI hosting platforms from 1 January 2027, and for makers of cameras and recording devices from 1 January 2028. A further amendment, SB 1000, signed on 30 September 2026, extended the law to every publicly accessible generative AI provider in California and dropped an earlier duty to offer visible labels. Penalties are $5,000 per violation, with each day counted separately.
California passed several more AI laws in 2026, including rules on automated decisions in employment and AI in health care. We will add them to the tracker as we verify their details.
Colorado
Colorado became the first state to pass a broad AI law in 2024, aimed at high-risk AI systems, but it never took effect. On 14 May 2026 it was repealed and replaced by SB 26-189, on automated decision-making technology, which takes effect on 1 January 2027.
The new law is narrower. It covers technology that uses personal data to score, rank or predict in consequential decisions about education, jobs, housing, lending, insurance, health care and government services. Businesses deploying AI systems in these decisions (deployers) must give people advance notice, explain an adverse decision within 30 days, and let them correct their data and ask for meaningful human review. Developers must give deployers the documentation they need, and records must be kept for three years. The Attorney General enforces it, with penalties of up to $20,000 per violation and a right to fix problems first that lasts until 2030.
Separately, xAI sued Colorado in April 2026 and the Justice Department intervened, a rare federal intervention in a challenge to a state AI law. Under an agreed order, the state is not enforcing against xAI while the case continues.
Illinois
Since 1 January 2026, HB 3773 has amended the Illinois Human Rights Act. An employer commits a civil-rights violation if it uses AI that has a discriminatory effect on protected groups in recruiting, hiring, promotion, discipline, dismissal or other terms of employment, uses zip codes as a stand-in for protected traits, or fails to tell employees that AI is being used. Law firms tracking the rules report that proposed rules on how to give notice of AI use were withdrawn in June 2026 (the department’s own page has not been updated), so the duty applies without detailed rules for now.
New York and New York City
New York City’s Local Law 144 has been enforced since 5 July 2023. Employers using automated tools to make or substantially assist hiring and promotion decisions must have them independently bias-audited every year, publish a summary of the results, and tell candidates at least ten business days in advance. Penalties are $500 to $1,500 per violation. A December 2025 audit by the State Comptroller found enforcement had been weak, which may not last.
At state level, the RAISE Act was signed in December 2025 and rewritten in March 2026 to mirror California’s SB 53. Under the amended law (Chapter 96 of 2026), from 1 January 2027 frontier developers with more than $500 million in revenue must publish safety frameworks, and all frontier developers must report critical safety incidents within 72 hours. Law-firm summaries report that a new office at the Department of Financial Services oversees the law. Penalties reach $1 million for a first violation and $3 million for later ones.
Texas
The Texas Responsible Artificial Intelligence Governance Act (TRAIGA), often shortened to the Responsible AI Governance Act, has applied since 1 January 2026. Texas takes a narrower approach to AI than a full regulatory framework. Rather than regulating AI broadly, it bans a short list of harmful purposes: AI intended to encourage self-harm or crime, to discriminate unlawfully, to infringe constitutional rights, or to produce child sexual abuse material or sexual deepfakes. Government bodies may not use AI for social scoring, and government agencies and health-care providers must tell people when they are dealing with AI.
Enforcement of its compliance requirements is limited. Only the Attorney General can enforce it, after giving 60 days to fix the problem. Penalties range from $10,000 to $200,000 per violation, plus daily penalties for continuing ones. A business that finds a problem through its own testing or review and substantially follows the NIST AI Risk Management Framework (NIST being the National Institute of Standards and Technology, a federal agency), or a similar recognised framework, has a defence, and the law also creates a regulatory sandbox for testing AI products.
Utah
Utah’s approach is to regulate generative AI mainly through disclosure. Its Artificial Intelligence Policy Act requires businesses to disclose that people are dealing with generative AI when they ask, and up front in regulated professions and sensitive interactions. It also created a state Office of Artificial Intelligence Policy and a learning lab that can give AI pilots regulatory relief. The office and learning lab are set to expire on 1 July 2027 unless the legislature renews them (a legislative committee recommended extending them to 2037 in September 2026); the disclosure rules have no expiry date.
What AI laws in the US mean for you
Creators and everyday users
- Never make or share intimate or sexual images of a real person without consent. Under federal law, and in Texas specifically, AI-made images count.
- Expect more AI tools to tag their output with hidden provenance data because of California’s rules, and keep using platform AI labels.
- If a chatbot helps you with something important, remember that Utah and Texas require some services to say they are AI; elsewhere, ask.
Employers and small businesses
- Start your AI governance with an inventory: list every tool that uses AI to screen, rank or assess people, including features inside your hiring software, and note the AI use cases each one serves.
- If you hire in Illinois, tell employees and applicants that AI is used and test for algorithmic bias and discriminatory effects.
- If you hire in New York City, commission a yearly independent bias audit and give candidates notice.
- If you make consequential decisions about people in Colorado, prepare notices, explanations and a human-review route before 1 January 2027.
AI builders
- Map where your users are, because your AI regulatory duties follow them. California’s training-data and provenance rules are the most likely to apply to small AI companies today.
- If you train frontier-scale models, the AI safety rules in California’s SB 53 apply now and those in New York’s RAISE Act from 2027.
- Remember that existing laws still cover AI: state privacy laws, state consumer protection rules and anti-discrimination law apply alongside the AI-specific ones.
- Keep complying with state rules even while federal challenges are pending: they apply unless a court blocks them.
Key dates ahead
- 18 November 2026: the Ninth Circuit hears xAI’s challenge to California’s AB 2013.
- 1 January 2027: Colorado’s SB 26-189 and New York’s RAISE Act take effect; California’s platform duties under the AI Transparency Act begin; Cal OES starts annual reports on frontier AI incidents.
- 1 July 2027: the part of Utah’s AI Policy Act covering its AI office and learning lab is scheduled to expire unless renewed; the disclosure rules stay.
- 1 January 2028: California’s provenance duties reach new cameras and recording devices.
Frequently asked questions about US AI laws
Does the US have a federal AI law?
Not a comprehensive AI law. The TAKE IT DOWN Act is the only federal statute aimed squarely at an AI harm, and the December 2025 executive order sets policy rather than binding rules on businesses. Federal agencies such as the FTC can still apply general rules on unfair or deceptive practices to AI, as they can to any other technology.
Will federal AI legislation override state rules?
Not yet. Only an act of Congress or a valid federal regulation can pre-empt state AI legislation, and none has passed. The Great American AI Act draft would pause state rules that target AI model development, but it is not a bill. Until a court or Congress says otherwise, the state rules apply.
Which state law applies if my business is in one state but serves people in another?
Look at where the people affected are, not only where you are based. A hiring tool used on candidates in New York City, or a lending decision about someone in Colorado, can bring that place’s rules into play even if your company sits elsewhere. Our tracker entries set out who each law covers.
Do these laws apply to AI tools I buy from a vendor?
Usually, yes. In New York City and Illinois the duties fall on the employer using the tool, not just the company that built it. Colorado splits duties between developers and deployers, so the vendor must give you documentation and you must give people notice and a route to human review.
How we keep this guide current
We check each law against its official text or an official government source and record the date we last checked it on its tracker entry. When a law changes, we update the entry first and this guide straight after. If you spot something out of date, tell us through the Ask an Ethicist form.
Last checked: 7 November 2026. This guide explains the law in plain English; it is not legal advice. Laws change quickly, so check the tracker entries and their official sources before you rely on them. Spotted an error? Tell us, and see how we check facts.
