Why the states moved first

Lesson 1 of 6 in State AI Laws in Depth: Colorado, California, Texas, Illinois, NYC, and Beyond.

Ask where American AI law lives and the honest answer, as of September 2026, is: in the states. Congress has passed no comprehensive AI statute. The executive branch has issued orders, memos, and an Action Plan — binding on federal agencies, advisory to everyone else. Meanwhile state legislatures introduced AI bills by the hundreds between 2024 and 2026, and enough of them passed that a single product launch can now trigger obligations in Colorado, four separate California statutes, Illinois, New York City, Texas, and Utah simultaneously.

Why states? Three forces converged. First, the federal vacuum: every year without a national statute is a year state AGs and legislators face constituents harmed by algorithmic decisions with no federal remedy to point to. Second, model-legislation networks: the same multistate working groups of legislators that produced look-alike privacy laws circulated AI drafts, which is why Colorado’s SB 24-205 and Connecticut’s and Virginia’s bills read like siblings. Third, California’s gravity: any rule the fifth-largest economy on Earth imposes on AI developers becomes a de facto national floor, exactly as its privacy and emissions rules did.

The wave was never uniform, and it met resistance from the start. Virginia’s legislature passed HB 2094 — a Colorado-style high-risk AI act — and Governor Youngkin vetoed it in March 2025, calling it a burden on innovation. That veto previewed the larger fight: in mid-2025 the House attached a ten-year moratorium on state AI enforcement to the reconciliation bill, and the Senate stripped it out 99–1 on July 2, 2025. The administration answered with EO 14365 (December 11, 2025), directing DOJ to challenge state AI laws in court and conditioning federal funds on state compliance — with carve-outs for child-safety, data-center, and procurement laws.

The pressure changed what kind of laws states pass — you will watch Colorado retreat from a duty-of-care regime to a disclosure regime in the next lesson — but it did not stop them passing laws. States kept legislating straight through 2026. For a compliance team the practical takeaway is blunt: plan around the patchwork, because no one is going to preempt it for you on a schedule you can bet on.

The state wave, 2023–2027

  • 2019-05-14 — San Francisco bans government facial recognition:

    The first big-city ban — the beginning of the US municipal wave against biometric surveillance.

  • 2021-12-11 — NYC enacts Local Law 144:

    The first mandated bias audits for automated employment decision tools — enforcement begins July 2023. Impact ratios become a legal requirement, not a research metric.

  • 2024-05-17 — Colorado AI Act signed (SB 24-205):

    The first comprehensive US state AI law: algorithmic-discrimination duties for developers and deployers of high-risk systems. Later delayed, then repealed and replaced in 2026.

  • 2024-08-09 — Illinois amends its Human Rights Act for AI (HB 3773):

    AI-driven employment discrimination becomes a civil-rights violation, effective 2026 — states legislating through existing rights law.

  • 2025-12-01 — New York signs the RAISE Act:

    Frontier-model safety duties — protocols, incident reporting — arrive at state level, effective early 2027.

  • 2026-01-01 — Texas TRAIGA takes effect:

    Prohibited-uses framing (behavioural manipulation, social scoring, certain biometric uses) with a regulatory sandbox — the red-state model of AI law.

  • 2026-01-01 — California SB 53 takes effect:

    Frontier AI transparency: published safety frameworks and critical-incident reporting for large developers — the first binding US frontier-model law.

  • 2026-05-01 — Colorado repeals and replaces its AI Act (SB 26-189):

    After two delays, the pioneering duty-based law gives way to a disclosure-based regime — a live lesson in how hard first-mover state regulation is.

Key terms: consequential decision, algorithmic discrimination, deployer, developer, preemption, cure period

Interactive checkpoint quiz (2 questions) — open this page in a browser to take it.