As of July 2026, the United States still lacks a comprehensive federal statute governing artificial intelligence in the private sector. While federal executive actions continue to…
As of July 2026, the United States still lacks a comprehensive federal statute governing artificial intelligence in the private sector. While federal executive actions continue to shape policy direction, the binding obligations that companies must meet today are concentrated at the state level. Businesses deploying or developing AI systems should therefore look first to state law to identify their enforceable duties, and second to federal signals to anticipate where the compliance landscape may shift.
Four states currently impose active private-sector AI obligations: California, Texas, Illinois, and Utah. California's regime tightens further on August 2, 2026, when the AI Transparency Act becomes operative. Covered organizations should confirm that disclosure workflows, consumer-facing notices, and internal documentation practices are ready to meet the Act's requirements before that date. Companies operating across multiple jurisdictions should also expect meaningful variation in scope, definitions, and enforcement posture among these states, and should map their AI use cases against each applicable regime rather than assuming uniform treatment.
Colorado has taken a different path. Under SB 26-189, signed on May 14, 2026, the core automated decision-making obligations that were previously scheduled to take effect have been postponed to January 1, 2027. This delay offers covered entities meaningful runway to build governance structures, complete impact assessments, refine disclosure practices, and align vendor contracts with the forthcoming requirements. Organizations should treat this window as a preparation period rather than a reprieve, since the underlying substantive duties remain on the horizon.
The broader picture is complicated by the March 2026 National AI Legislative Framework, which signals a federal effort to preempt conflicting state laws. Whether, when, and how far preemption ultimately extends remains uncertain, but the direction of travel matters. Clients should design compliance programs that are modular and adaptable, so that controls built to meet current state obligations can be extended, reduced, or reallocated as the federal-state boundary evolves.
This article provides general information only and does not constitute legal advice. Because AI compliance obligations depend heavily on the specific systems, jurisdictions, and use cases involved, clients should seek tailored counsel before acting on any of the developments discussed above.