The comparison: ten threads and one matrix
Lesson 6 of 6 in State AI Laws in Depth: Colorado, California, Texas, Illinois, NYC, and Beyond.
Line the laws up and the patchwork resolves into patterns. Ten threads recur: (1) duties assigned by role — developer versus deployer; (2) a consequential-decision domain list (employment, housing, credit, education, healthcare, insurance, government services) descended from the EU’s Annex III; (3) an algorithmic-discrimination standard — with Texas as the intent-based outlier; (4) notice duties at the point of interaction, before use, or after adverse decisions; (5) impact or risk assessments; (6) human review and appeal rights; (7) the NIST AI RMF or ISO/IEC 42001 as safe harbor or defense; (8) AG-exclusive enforcement with cure periods and no private right of action — Illinois excepted; (9) trade-secret carve-outs limiting what explanations must reveal; and (10) the 2026 drift from duty-of-care frameworks toward transparency-first frameworks under federal pressure, with Colorado’s repeal as the case study.
The matrix below is the module’s takeaway artifact. Read it column by column when you need one law; read it row by row when you are designing one control to satisfy them all — which is precisely what the capstone module does.
| Law | Who it binds | Core duties | Discrimination standard | Enforcement | Key dates |
|---|---|---|---|---|---|
Colorado SB 26-189 | Developers and deployers of ADMT in 7 consequential domains | Developer technical docs; point-of-interaction notice; 30-day adverse-decision explanation; data correction; human review; 3-yr records | None of its own — allocates developer/deployer fault under other laws | AG only, deceptive trade practice; 60-day cure until 2030; no PRA | Live May 14, 2026; developer docs and AG rules Jan 1, 2027 |
California AB 2013 | GenAI developers serving Californians | Public training-data documentation (sources, personal info, copyright, synthetic data) | — | Civil penalties | Eff. Jan 1, 2026; look-back to Jan 1, 2022 |
California SB 942 / AB 853 | Large GenAI providers; large platforms; capture devices | Free detection tool; manifest and latent disclosures; platform provenance surfacing | — | Civil penalties | In force Aug 2026 |
California SB 53 (TFAIA) | Frontier developers (compute threshold); heavier tier by revenue | Published frontier AI framework; transparency reports; Cal OES incident reporting; whistleblower protection | — | AG civil penalties | Eff. Jan 1, 2026 |
CCPA ADMT regs | CCPA businesses using ADMT for significant decisions | Pre-use notice; opt-out; access/explanation; risk assessments; cyber audits | Indirect (risk-assessment content) | CPPA + AG | Eff. Jan 1, 2026; ADMT compliance Jan 1, 2027; assessments due Apr 1, 2028; audits 2028–2030 |
Illinois HB 3773 | Employers using AI in employment decisions | Non-discrimination; no zip-code proxies; notice of AI use | Civil-rights standard incl. disparate-impact logic | IDHR — individual charges available | Eff. Jan 1, 2026 |
NYC Local Law 144 | Employers/agencies using AEDTs for NYC roles | Annual independent bias audit; published summary; 10-business-day candidate notice | Impact-ratio publication (no pass/fail line) | DCWP penalties | Enforced since Jul 5, 2023 |
Texas TRAIGA | Developers, deployers, government agencies | Intent-based prohibitions; government AI disclosure; healthcare disclosure; sandbox | Intent required — disparate impact alone insufficient | AG only; 60-day cure; tiered penalties; NIST RMF defense; no PRA | Eff. Jan 1, 2026 |
Utah AI Policy Act | GenAI users in consumer-protection contexts; regulated occupations | Disclosure on request; proactive disclosure for regulated occupations; mental-health chatbot rules | — | Division of Consumer Protection; Learning Laboratory mitigation agreements | Eff. May 1, 2024; sunsets Jul 1, 2027 |
NY RAISE Act | Frontier-model developers | Safety protocols; incident reporting | — | AG | Signed Dec 19, 2025; eff. Jan 1, 2027 |
Which state laws hit this deployment?
Interactive decision tree — outcomes:
- Frontier-developer stack
California SB 53 now (published frontier AI framework, transparency reports, Cal OES incident reporting, whistleblower duties) and NY RAISE from January 1, 2027 (safety protocols, incident reporting) — plus everything downstream: AB 2013 training-data posting and SB 942 provenance duties if the model is generative and consumer-facing.
- Consumer GenAI stack
AB 2013 training-data documentation (look-back to 2022), SB 942/AB 853 manifest and latent disclosures, Utah disclosure duties in consumer-protection contexts (proactive if users include regulated occupations), California B.O.T. Act and SB 243 if the bot sells, persuades, or acts as a companion — and TRAIGA’s prohibitions apply to everyone operating in Texas.
- GenAI developer, backend only
AB 2013 still applies if the system is available to Californians (including via customers’ products — check the making-available analysis). If deployers will use outputs in consequential decisions, expect Colorado SB 26-189-style documentation demands contractually even where the statute’s developer duties don’t directly reach you.
- Decision-tool developer duties
Colorado SB 26-189 developer technical documentation (from January 1, 2027): intended uses, training-data categories, limitations, human-review instructions, update notices. TRAIGA’s intent-based prohibitions apply. Your deployer customers will pass through their own notice/explanation duties as contract terms — plan the documentation once, for all of them.
- Consequential-decision deployer stack
Colorado SB 26-189 (notice, 30-day adverse-decision explanation, correction and human-review rights, 3-year records), CCPA ADMT regs for California residents (pre-use notice, opt-out, access — full compliance by January 1, 2027; risk assessments due from April 1, 2028), TRAIGA prohibitions in Texas, plus sectoral federal law (ECOA adverse-action notices for credit). Strictest-state design is mandatory here.
- Hiring stack, NYC included
NYC LL144 annual independent bias audit + published summary + 10-business-day candidate notice; Illinois HB 3773 non-discrimination and notice for Illinois workers; Colorado SB 26-189 employment ADMT duties; CCPA ADMT regs for California applicants; Title VII/EEOC exposure throughout. The full employment gauntlet.
- Hiring stack, no NYC
No LL144 audit mandate — but Illinois HB 3773, Colorado SB 26-189, and the CCPA ADMT regs still apply to workers in those states, and a voluntary LL144-grade audit remains the best evidence of the “reasonableness” every regime rewards.
- Baseline: federal law still applies
No state AI statute bites — but Title VII disparate-impact law, the ADA, and EEOC scrutiny apply everywhere, and the moment one remote candidate sits in Illinois, Colorado, California, or NYC, the state stack lights up. Geography-based scoping decays fast; design for the strictest state you could plausibly touch.
- Light-touch zone — for now
Outside consequential decisions and frontier scale, the heavy state duties don’t attach. What remains: Utah/B.O.T.-style bot disclosure if consumer-facing, SB 942 provenance if generating content at scale, TRAIGA’s intent-based prohibitions, and FTC Section 5 over any AI claim you make in marketing.
Tool: Which Rules Apply? — Answer the wizard’s questions about your role, states, and use cases, and get a personalized obligation matrix across all ten regimes with citations and effective dates.
Interactive checkpoint quiz (1 questions) — open this page in a browser to take it.