State-by-State AI Compliance Wizard (2026)

In force now: New York City LL-144 (since July 2023), Texas HB 149 / TRAIGA (since 1 January 2026), Illinois HB 3773 (since 1 January 2026, amending the Illinois Human Rights Act), California AB 2013 (since 1 January 2026), California SB 942 (since 2 August 2026, after AB 853 delayed it) and California SB 1001. Coming next: Colorado SB 26-189 takes effect 1 January 2027, replacing the repealed SB 24-205. This wizard cross-cites all five jurisdictions.

Each statute has its own nexus test. Colorado SB 26-189 (from 1 January 2027) reaches deployers that use automated decision-making technology in consequential decisions about Colorado consumers, and the developers that supply it. Texas TRAIGA reaches anyone developing, deploying, or promoting an AI system for Texas consumers or residents. NYC LL-144 applies whenever a NYC employer uses an AEDT or NYC candidates are screened. California AB 2013 / SB 942 apply when the generative AI is made available in California. Illinois HB 3773 covers Illinois employers. In short: user footprint matters more than office footprint.

Adopting the NIST AI Risk Management Framework (or ISO/IEC 42001) as your governance backbone. NIST AI RMF is an affirmative defense under Texas TRAIGA § 552.202, and a widely accepted governance baseline that produces the documentation Colorado, California, Illinois, and NYC rules ask for. It does not by itself satisfy every state duty — notices, audits and disclosures still have to be delivered.

It depends on your state. NYC LL-144 requires an annual independent bias audit and public posting for any AEDT that "substantially assists" hiring or promotion decisions. Illinois HB 3773 requires notice and non-discriminatory use but does not mandate a specific audit format. Colorado’s repealed SB 24-205 would have required impact assessments; its replacement, SB 26-189 (from 1 January 2027), instead requires notices and adverse-decision explanations, not a bias audit. Previously, many providers planned to satisfy SB 24-205 with a NIST AI RMF-aligned audit. Texas TRAIGA requires disclosure and NIST-aligned risk management but no dedicated bias audit.

Penalties vary. NYC LL-144: $500 first violation, $1,500 per day for continued violations. Texas TRAIGA: up to $10,000 per curable violation and up to $200,000 per uncurable violation. Colorado SB 26-189 (from 1 January 2027): Attorney General enforcement under the Colorado Consumer Protection Act, with a 60-day cure period until 2030. California SB 942: $5,000 per violation, with each day a separate violation. Illinois BIPA (biometric): $1,000 negligent and $5,000 intentional per violation with a private right of action — the highest per-violation exposure of any U.S. AI-adjacent statute.

Colorado’s rules on open-source models under SB 26-189 should be checked against the enacted text. Texas TRAIGA does not exempt open source per se but focuses on consumer-facing deployment. California AB 2013 applies to any generative AI made available in California, including open weights. Best practice: assume duties attach as soon as an open-source model is offered to consumers commercially in the state.

The EU AI Act applies extraterritorially whenever the output of the AI system is used in the EU. U.S. state laws apply based on the state footprint of your consumers or employees. A U.S. SaaS with EU customers must satisfy both: state duties for U.S. operations and EU AI Act duties for EU output. The good news — Article 9 risk management, Article 10 data governance, Article 11 technical documentation, and Article 15 accuracy and robustness controls all overlap heavily with NIST AI RMF.

The federal AI executive order was revoked in January 2025, but OMB memoranda M-24-10 and M-24-18 remain guidance for federal agency AI use. Federal preemption of state AI laws is limited and untested in court. Multi-state operators should assume no federal preemption today and plan for state compliance until Congress acts.

Frequently. Colorado repealed and replaced its AI Act in May 2026 (SB 26-189, effective 1 January 2027). California SB 942 was delayed to 2 August 2026 by AB 853. California’s CPPA regulations on automated decisionmaking technology took effect 1 January 2026, with ADMT duties applying from 1 January 2027. We update this wizard within one week of any material state statutory or regulatory change and post release notes on aicompliancevendors.com and on our sister site ailawsbystate.com.

Colorado SB 26-189: https://leg.colorado.gov/bills/sb26-189. NYC LL-144: https://www.nyc.gov/site/dca/about/automated-employment-decision-tools.page. Texas HB 149: https://capitol.texas.gov/BillLookup/History.aspx?LegSess=89R&Bill=HB149. Illinois HB 3773: https://www.ilga.gov/legislation/BillStatus.asp?DocNum=3773. California AB 2013: https://leginfo.legislature.ca.gov/faces/billNavClient.xhtml?bill_id=202320240AB2013. California SB 942: https://leginfo.legislature.ca.gov/faces/billNavClient.xhtml?bill_id=202320240SB942.

No. This wizard is a preliminary self-service compliance check citing public statutes and regulations. It is not legal advice and does not create an attorney-client relationship. State and local rulemaking is ongoing. For binding advice, engage counsel licensed in each state.

No. Classification runs entirely in your browser. Nothing is transmitted to our servers. You can download the Markdown report locally and share it with counsel or your GRC team.