top of page

State AI Laws That Just Took Effect: California, Colorado, Texas

S. West
Jul 8
7 min read

Updated: 4 days ago

Correction, 3 October 2026. This post went up in May. Three of its central claims have since turned out wrong or been overtaken. Colorado's AI Act never took effect. On 14 May 2026, Colorado enacted SB 26-189, which repeals it and replaces it with a narrower law from 1 January 2027. The 2024 Act also never had the private right of action we described. California's AI Transparency Act took effect on 2 August 2026, not January. Texas's law, as enacted, does not impose the private-sector notice and human-review duties we attributed to it. The body below is rewritten. The title is kept so existing links still work.

The US does not have a comprehensive federal AI law. Federal agencies have issued guidance, and sector rules (FDA, FTC, CFPB) apply to AI in specific contexts, but there is no federal counterpart to the EU AI Act. States have filled the gap, and 2026 is the year we learned how unstable that gap is.


When this post first ran, the state picture looked like a race to copy the EU: risk management, impact assessments, a duty of care. By October, the most ambitious of those laws had been repealed before it took effect. What's left is a set of narrower laws built around transparency and notice. For anyone building a compliance programme, the lesson goes beyond any single statute: a state AI requirement isn't settled until its effective date has passed. Plan around capabilities you'll need under any version of the law, not around one bill's text.


California's AI Transparency Act (SB 942, as amended by AB 853)


California's law is about generative AI and the public's ability to tell when content was machine-made. It applies to classification and decision systems only if they're also generative.


Scope. It covers "covered providers": people who create or produce a generative AI system with more than one million monthly visitors or users that is publicly accessible in California. AB 853 (2025) added duties for large online platforms, hosting platforms and some capture-device manufacturers, phased in on later dates.


Effective date. SB 942 was originally set for 1 January 2026. AB 853 moved it to 2 August 2026, the same day the EU's Article 50 transparency duties began. Teams with EU exposure can build one provenance pipeline for both.


Core obligations.


  1. A free AI-detection tool. Covered providers must give the public a free way to check whether content was generated by their system.

  2. Latent disclosures. Provenance data embedded in generated image, video and audio content, identifying it as AI-generated and its provider. In practice teams are converging on C2PA-style content credentials. That's a practice, not a mandate.

  3. An option for visible (manifest) disclosures. Users must be offered the choice to include a visible label.


Enforcement. Civil penalties, brought by the Attorney General or local prosecutors. There's no private right of action under the Act itself.


What's hard. Latent disclosure means changing the inference pipeline and every storage and distribution path the output takes. The test: pick one generated asset, follow it through your CDN, image-resizing and social-sharing paths, and check whether the provenance survives. Most pipelines strip metadata somewhere along the way.


Colorado: SB 24-205 repealed, SB 26-189 in its place


(Rewritten 3 October 2026.)


Colorado passed the first comprehensive US state AI law in 2024. It never took effect. In 2025 its start date was pushed from 1 February to 30 June 2026. Then, on 14 May 2026, Governor Polis signed SB 26-189, which repeals the 2024 Act's substantive provisions and replaces them.


Scope. SB 26-189 covers automated decision-making technology (ADMT) that materially influences a consequential decision in education, employment, housing, financial services, insurance, healthcare or essential government services. "Materially influences" means the ADMT's output is a non-trivial factor in the outcome. Routine technology, low-stakes decisions and advertising are carved out.


What was removed. The algorithmic-discrimination duty of care, the mandatory annual impact assessments, and the requirement for a risk-management programme (the 2024 Act pointed to the NIST AI RMF).


Developer obligations. Give deployers documentation: intended and known-harmful uses, the categories of training data, limitations, and instructions for deployment and human review. Notify deployers of material updates. Keep compliance records for three years.


Deployer obligations.


  • Notice before use. Tell consumers clearly before covered ADMT materially influences a consequential decision.

  • Adverse-decision explanation. After an adverse outcome, give a plain-language description of the decision and the ADMT's role, and explain how to ask for more information.

  • Correction. Consumers can correct factually incorrect personal data.

  • Human review. Consumers can ask for meaningful human review and reconsideration, to the extent commercially reasonable, by a reviewer who can change the outcome.

  • Records kept for three years.


Enforcement. The Colorado Attorney General has exclusive enforcement. There is no private right of action, and the 2024 Act never had one either. Violations are deceptive trade practices. The AG must give 60 days' notice to cure before acting, unless the violation is knowing or repeated. That cure right sunsets on 1 January 2030.


Effective date. 1 January 2027, for decisions made on or after that date.


What to test. The adverse-decision explanation is the obligation most likely to fail in practice, because it needs data most systems don't keep. Run this: take one real adverse decision from last month and try to produce, from your logs alone, which ADMT output was used, what weight it carried, and who could have overridden it. If you can't do that today, you have until January.


Texas's Responsible AI Governance Act (HB 149)


(Corrected 3 October 2026.) Texas's law was signed on 22 June 2025 and has been in force since 1 January 2026. It's much narrower than the early TRAIGA drafts, which is where the private-sector notice duties described in our original version came from.


For private companies, it's mostly a list of prohibited practices. You may not develop or deploy an AI system with the intent to unlawfully discriminate against a protected class, to manipulate people toward self-harm, violence or crime, to infringe constitutional rights, or to produce certain sexual content, including content depicting minors. Note the intent standard. Disparate impact alone is not enough under TRAIGA.


Disclosure duties fall on government agencies and healthcare providers, who must tell people when they're interacting with AI.


Government use. State agencies face further restrictions, including on social scoring and on biometric identification without consent.


Sandbox. It creates an AI regulatory sandbox for testing systems under relaxed enforcement.


Enforcement. The Attorney General has exclusive enforcement, after a 60-day notice-and-cure period. There is no private right of action. Civil penalties scale by violation and by whether a violation continues.


How the Three Laws Line Up Now



California SB 942

Colorado SB 26-189

Texas HB 149

In effect

2 Aug 2026

1 Jan 2027

1 Jan 2026

What it covers

Large generative AI providers (+ platforms via AB 853)

ADMT materially influencing consequential decisions

Prohibited AI practices (all); disclosure (government and healthcare)

Core duty

Detection tool + latent provenance

Notice, adverse-decision explanation, correction, human review

Don't build or deploy for prohibited intents

Impact assessment

No

No (removed)

No (private sector)

Enforcement

AG / local prosecutors

AG only, 60-day cure

AG only, 60-day cure

Private right of action

No

No

No


Two things stand out. First, none of the three now requires a private-sector impact assessment or gives individuals a right to sue. Second, the duties overlap less than in 2025, but where they do overlap, it's on the same capabilities: knowing which AI systems you run, telling people when AI is involved, and being able to explain and reverse a decision.


A Compliance Approach That Survives the Next Repeal


The 2026 lesson is that statutes are volatile and capabilities are not. Build the capabilities every version of these laws has asked for.


  1. An AI system register. Every system you build, deploy or substantially modify that touches US consumers, with owner, purpose, the decisions it influences, the data it uses and the states it reaches. All three laws assume you can produce this, and so does the EU AI Act. Done when: someone outside the team can answer "which systems influence hiring decisions in Colorado?" from the register in under ten minutes.

  2. Decision traceability. For any system that influences a consequential decision, log the model or version, the input references, the output, its role in the decision, and who could override it. That log is Colorado's adverse-decision explanation, and it's most of what an EU high-risk system will need in December 2027. Done when: you can reconstruct one real decision end to end from logs.

  3. Notice and human-review paths. Reusable notice templates and a working route to a human reviewer who has the authority to change the outcome. Done when: a test request reaches a reviewer and gets a logged response within your target time.

  4. Provenance for generative output. One marking pipeline that meets both California and EU Article 50. Done when: the marker survives your real distribution path.

  5. A watch list with effective dates. Track pending bills by effective date, not passage date, and review each item a quarter before it lands. Colorado's two delays and a repeal are the reason.


If the adverse-decision explanation is the obligation that worries you, start with the governance questions in the AI Readiness Assessment: whether you can explain a decision to the person it affected, and whether someone has confirmed which regulations apply.


The Takeaway


(Rewritten 3 October 2026.) In May we described three laws in force and a patchwork that would only get heavier. By October, one of the three had been repealed before it started, one had moved its date, and the third was narrower than we had described. What lasted were the capabilities underneath: a register, traceable decisions, notice, human review, provenance. Build those, and the next statute is a mapping exercise rather than a new project.


Sources




Related reading


bottom of page