Across the United States, states are moving from AI “principles” to enforceable rules. A wave of new statutes is taking effect in 2026, reflecting a practical shift: lawmakers want guardrails for fast-moving systems while still signaling that innovation is welcome.
A recent roundup of “new tech laws of 2026” highlighted how quickly state AI policy is expanding, from California’s frontier-model transparency requirements to Colorado’s comprehensive consumer protections and Texas’ new governance framework. The result is a patchwork that companies, public agencies, and consumers will feel in day-to-day operations.
1) Why states are legislating AI now
State lawmakers are reacting to specific, visible harms: deepfakes in politics and entertainment, algorithmic discrimination in high-stakes decisions, and safety risks from powerful “frontier” models. With Congress moving slowly, states are filling the gap with targeted laws that can be implemented and enforced locally.
Another driver is accountability. Many of the new statutes focus on disclosure, telling people when AI is used, what risks exist, and how to report problems. These approaches aim to create paper trails that regulators and courts can use when systems fail.
Finally, the pace of deployment is forcing timelines. As The Verge’s 2026 laws roundup notes, multiple AI-related rules are scheduled to take effect in 2026, meaning organizations must prepare now for compliance, documentation, and public-facing notices.
2) California SB 53: transparency rules for frontier AI
California’s SB 53, signed on September 29, 2025, is titled the “Transparency in Frontier Artificial Intelligence Act (TFAIA).” According to the Governor’s office, it creates frontier-model transparency requirements, incident reporting, and whistleblower protections, tools meant to surface safety issues early rather than after a major failure.
Reuters’ coverage emphasizes that SB 53 applies to major AI companies and requires safety disclosures addressing catastrophic risks. The same reporting described financial penalties that can reach up to $1 million per violation and referenced a revenue threshold for certain reporting (for example, companies with more than $500 million in revenue).
Politically, SB 53 is framed as a balance. Governor Gavin Newsom described the goal as establishing regulations “to protect our communities” while ensuring “the AI industry continues to thrive.” Senator Scott Wiener called the approach “commonsense guardrails” designed to help companies “understand and reduce risk.”
3) California SB 243: rules for companion chatbots and minors
California also enacted SB 243 (chaptered October 13, 2025, listed as Chapter 677, Statutes of 2025 in legislative tracking). Secondary compliance summaries describe it as taking effect January 1, 2026, and focusing on “companion chatbots,” especially where minors may be users.
As summarized by the California Lawyers Association, the law includes minor-facing notices, break reminders, and suicide/self-harm mitigation protocols. This reflects a broader state trend: regulating not “AI” in the abstract, but particular product categories that can shape emotions, relationships, and mental health.
Enforcement and oversight are central. A Skadden client alert notes annual reporting obligations to California’s Office of Suicide Prevention, and also highlights the law’s penalties and a private right of action (as summarized in that alert). For companies, this turns safety features into compliance deliverables, policies, logs, and reports that must stand up to scrutiny.
4) California SB 524: AI disclosure in police reports
California’s SB 524, signed October 13, 2025, targets government use of AI, specifically law enforcement documentation. The law requires police to disclose AI use in police reports, responding to concerns that AI-generated content can be mistaken for verified fact once it enters an official record.
In a press release, Senator Jesse Arreguín framed the bill around reliability and transparency, pointing to the risks of “AI hallucinations” showing up in official paperwork. The logic is straightforward: if a report used AI assistance, downstream readers (prosecutors, defense counsel, judges, journalists) should know.
This kind of rule is likely to influence procurement and training. Agencies may have to standardize when AI can be used, how outputs are verified, and what exact language officers must include to disclose AI involvement.
5) Colorado’s comprehensive framework, and its delayed compliance date
Colorado’s SB 24-205, “Consumer Protections for Artificial Intelligence,” was approved May 17, 2024. The bill summary describes a system focused on “high-risk AI systems,” requiring deployers and developers to use “reasonable care” to prevent algorithmic discrimination, with disclosure duties and enforcement by the Attorney General.
But the compliance timeline has shifted. Colorado’s SB25B-004, signed August 28, 2025, moved the compliance date to June 30, 2026 (while SB25B-004 itself became effective November 25, 2025). Legal analysis, including Greenberg Traurig’s, notes the shift from an earlier February 1, 2026 compliance date and anticipates further 2026 amendments.
For businesses, Colorado is a reminder that AI compliance is not a one-and-done project. A delayed date can help with planning, but ongoing legislative tweaks mean teams must monitor requirements, update risk assessments, and prepare for evolving definitions of “high-risk” and “reasonable care.”
6) Texas HB 149: a governance act with civil penalties
Texas’ HB 149, the “Texas Responsible Artificial Intelligence Governance Act,” is shown in legislative tracking as effective January 1, 2026. As summarized in Texas media roundups, the law introduces new rules and bans related to certain AI uses, including issues tied to explicit AI-generated deepfakes.
Implementation details matter as much as the statutory text. Chron.com reported on a Texas governance rollout that includes an AI council, a reporting portal, and civil fines, suggesting Texas is building not only rules, but also the administrative machinery to receive complaints and guide enforcement.
The practical impact is that organizations operating in Texas may face a compliance environment centered on reporting, governance, and penalties rather than purely consumer notices. That can shift internal priorities toward formal review processes, documentation, and escalation pathways.
7) Mental health and “AI therapy”: Utah, Nevada, and Illinois tighten oversight
Several states are converging on one theme: AI systems that appear to provide mental or behavioral health services. Nevada’s AB 406 (effective July 1, 2025) restricts AI systems “specifically programmed” to provide services that constitute professional mental/behavioral healthcare, and limits certain representations about what an AI tool can do. Nevada’s session law text highlights provisions (including “Section 7” and “Section 8”) that address both system capabilities and provider use.
Utah is refining its approach too. Davis Polk summarized 2025 amendments that narrowed generative-AI disclosure obligations so that disclosure is triggered by a “clear and unambiguous request,” while extending the repeal date to July 2027. Utah also added protections aimed at “mental health chatbots,” including requirements described in commentary on HB 452 and related bills (as summarized by outlets like Mondaq and Alston & Bird via JDSupra).
Illinois has also been cited as taking a harder line on “AI therapy.” The Washington Post reported on Illinois restrictions tied to chatbot scrutiny, including complaint-driven enforcement and fines noted in the report. Separately, an Illinois January 1, 2026 law was described in a local roundup as limiting discriminatory AI use in employment decisions and requiring applicant disclosure, showing the state’s AI focus spans both consumer well-being and workplace fairness.
8) Deepfakes and identity: Tennessee’s ELVIS Act as an early model
Tennessee’s ELVIS Act, signed March 21, 2024 and effective July 1, 2024, expanded right-of-publicity style protections to include “voice.” The Governor’s office presented it as a response to the evolving AI landscape, with Governor Bill Lee emphasizing the need for legal protection as technology changes.
What makes the ELVIS Act notable is its reach. Skadden’s analysis described it as targeting not only creators of deepfakes and voice clones, but also providers of tools and systems used to make them. That structure, looking beyond the end user to the enabling ecosystem, may influence other states crafting anti-deepfake statutes.
As 2026 approaches, deepfakes remain a motivating example for lawmakers, especially in election contexts. The Verge’s roundup also referenced AI election disclosure mentions, reinforcing that synthetic media regulation is becoming a standard part of state AI agendas.
9) The compliance reality: tracking a fast-changing patchwork
With so many timelines and categories, frontier model transparency, high-risk discrimination controls, chatbot safeguards, police-report disclosures, compliance is becoming multi-disciplinary. Legal, security, product, trust & safety, HR, and procurement teams all have roles, and deadlines vary by state and by use case.
Organizations are increasingly relying on structured tracking tools. The National Conference of State Legislatures (NCSL) maintains an Artificial Intelligence Legislation Database updated monthly (as of an update noted December 4, 2025), offering a centralized way to monitor bills and enacted laws across states.
The most resilient strategy is to build internal AI governance that can adapt: model and vendor inventories, documentation standards, incident reporting pathways, user disclosure templates, and audit-ready records. Even when laws differ, these core controls help reduce scramble when a new state requirement takes effect.
States rolling out new AI laws are not just “doing something about AI”, they are setting concrete expectations about transparency, safety, discrimination prevention, and truthful communication in sensitive contexts like mental health, employment, and policing.
As more statutes take effect in 2026, the main story is acceleration. California, Colorado, Texas, Utah, Nevada, Illinois, and Tennessee show how quickly the center of gravity is shifting toward enforceable oversight. For companies and public agencies, the next competitive advantage may be simple: the ability to prove, with documentation and governance, that AI is being used responsibly.
