State AI Laws: What Every U.S. State Has Passed, Proposed, or Pending (2026)

By Tracey Birkenhauer, journalist and Chief Impact Officer, STACK Cybersecurity

State legislatures have moved quickly to fill the regulatory gap left by limited federal action on artificial intelligence. MultiState reported that 1,200 AI-related bills were introduced across all 50 states in 2025, and by March 2026 lawmakers in 45 states had already introduced 1,561 more. NCSL’s Artificial Intelligence Legislation Database, updated monthly, tracks introduced and enacted bills across topics including health care, discrimination, deepfakes, education, and governance.

That matters because the rules are no longer confined to one industry or one state. If you use AI in hiring, customer interactions, health care workflows, insurance decisions, or consumer-facing content, you may already have obligations in places where you do business.

Update History

June 13, 2026: Updated Connecticut SB 5 signed status, confirmed Washington HB 1170 and HB 2225 signed and effective dates, confirmed Georgia SB 540 and SB 444 signatures and effective dates, confirmed Colorado SB 26-189 signed status and Jan. 1, 2027 effective date, confirmed Michigan SB 760 remains pending in the House, confirmed Missouri SB 1019 effective date, and refreshed the TAKE IT DOWN Act enforcement language.

May 28, 2026: Added Illinois SB 315 sent to the governor, updated Colorado SB 26-189, added Georgia SB 540 and SB 444, and launched our State AI Chatbot Laws page.

May 9, 2026: Added Connecticut SB 5, Michigan SB 760, Washington developments, and separated broader federal and international content into a dedicated Federal AI Policy page.

AI Compliance Dates

Note: Dates can still shift through rulemaking, court challenges, or delayed implementation. Colorado's SB 26-189 is signed and slated to take effect Jan. 1, 2027, but parts of the disclosure framework depend on attorney general rulemaking. Illinois SB 315 has passed both chambers but has not been signed into law as of the latest official legislative status. Check state legislative sources before relying on any single deadline.

Quick Navigation

California: The Most Active State

California remains the most active state in AI regulation. Instead of passing one sweeping law, the state has built a stack of targeted requirements that now touch training data transparency, synthetic content labeling, frontier model safety, companion chatbots, health care disclosures, and algorithmic decision-making.

You can review the full California picture on our California AI laws page.

Transparency Requirements

AB 2013 took effect Jan. 1, 2026 and requires developers of public-use generative AI systems intended for Californians to publish high-level information about training data. SB 942 takes effect Aug. 2, 2026 and requires certain large public-facing systems to disclose when content is generated or modified by AI. SB 53, which took effect Jan. 1, 2026, targets large frontier developers and requires safety and transparency reporting.

California also adopted health care-focused rules. AB 489 bars AI systems from falsely claiming health care credentials, and other California rules now require disclosure when AI communicates directly with patients in certain contexts.

Companion Chatbots

California’s SB 243 regulates companion chatbots and requires operators to disclose when users are interacting with AI. It also requires safety protocols tied to self-harm content and related risks. For a state-by-state breakdown, see our State AI Chatbot Laws guide.

Deepfakes and Election Integrity

California continues to regulate deepfakes aggressively, especially in election and intimate-image contexts. The state has enacted multiple laws requiring disclosures, platform reporting pathways, and civil or criminal remedies tied to synthetic media misuse.

Colorado: From Broad AI Law to Narrower ADMT Transparency

Colorado’s original AI Act never took effect. In 2026, the state repealed and replaced it with SB 26-189, a narrower law focused on automated decision-making technology, adverse outcomes, notices, and consumer rights.

SB 26-189 was signed May 14, 2026 and takes effect Jan. 1, 2027. It removes the original law’s duty-of-care standard, annual impact assessments, and broader risk management expectations. The attorney general still has rulemaking authority, and some disclosure details depend on that process. For a fuller breakdown, review our Colorado AI laws page.

What Changed

The new law centers on automated decision-making technology used to materially influence consequential decisions in areas such as employment, education, housing, lending, insurance, health care, and public benefits. Consumers get notice, explanation, correction, and human review rights after adverse outcomes.

If you operate in Colorado, the compliance burden is lighter than what the 2024 law originally proposed, but it is not gone. You still need documentation, notices, and a plan for human review when AI influences consequential decisions.

The xAI Lawsuit and Stay

The challenge to Colorado’s original AI law helped accelerate the political shift. With the older law repealed and replaced, the practical question now is not whether SB 24-205 will take effect. It won’t. The question is how the attorney general will finalize implementation under SB 26-189.

Tennessee: Voice and Mental Health Restrictions

Tennessee’s ELVIS Act, effective July 1, 2024, was one of the earliest broad laws protecting voice and likeness from unauthorized AI cloning. In 2026, Tennessee added SB 1580, which takes effect July 1, 2026 and prohibits marketing AI as a qualified mental health professional. That law includes a private right of action.

Utah: Narrower Disclosure Rules

Utah’s AI Policy Act was one of the first consumer disclosure laws, but later amendments narrowed the practical burden. In many cases, disclosure obligations now attach only when a consumer asks or when the interaction involves higher-risk data or use.

Texas: TRAIGA

Texas enacted the Responsible Artificial Intelligence Governance Act through HB 149, effective Jan. 1, 2026. The law prohibits developing or deploying AI systems for certain harmful purposes and is paired with other state activity focused on governance and public-sector use.

Michigan

Michigan’s enacted AI laws still focus mostly on political deepfakes and nonconsensual intimate deepfakes. The state also has an active chatbot bill, SB 760, but it has not become law. The bill passed the Senate on April 29, 2026, and remains pending in the House Committee on Communications and Technology.

Michigan also has broader policy activity underway, including proposals tied to AI use in state government and guidance from the Michigan Civil Rights Commission around algorithmic discrimination.

New York: RAISE Act and Frontier AI Governance

New York’s RAISE Act focuses on frontier model safety and transparency. The initial law was signed in December 2025, and a chapter amendment signed March 27, 2026 produced the final version that takes effect Jan. 1, 2027.

The law applies to large frontier developers and requires safety plans, incident reporting within 72 hours, and related disclosures. New York lawmakers have also become active in the federal preemption debate, pushing back on efforts to override state AI laws.

Washington: Three AI Laws in 2026

Washington enacted three notable AI laws in 2026. SSB 5886 expands personality-rights protections to cover forged digital likenesses created with AI and took effect in mid-June 2026. HB 2225, signed March 24, 2026, regulates AI companion chatbots and takes effect Jan. 1, 2027. HB 1170, also signed March 24, 2026, requires disclosures when content is developed or modified by AI and takes effect Feb. 1, 2027.

Connecticut

Connecticut passed one of the country’s broadest AI bills when Senate Bill 5 was signed by Gov. Ned Lamont on May 27, 2026. The law covers subscription-based AI disclosures, frontier model whistleblower protections, synthetic content detection, automated employment-related decision processes, AI companion rules, and state AI infrastructure. Effective dates are staggered beginning Oct. 1, 2026, with additional requirements moving into 2027.

On employment, the law regulates automated employment-related decision technology, requiring developers to provide compliance information to deployers and requiring deployers to notify affected employees and applicants of the technology’s use. The law also makes clear that using an automated tool is not a defense to a discrimination claim, while allowing courts to consider anti-bias testing as a mitigating factor. Developer obligations begin Oct. 1, 2026. Deployer pre-decision notice requirements begin Oct. 1, 2027.

The chatbot provisions take effect Jan. 1, 2027 and are among the strictest in the country. Operators must notify users they are interacting with AI and include recurring reminders every three hours. The law also includes broad restrictions around minors, self-harm, manipulation, romantic or sexually explicit interactions, and emotionally dependent design patterns.

Georgia

Georgia Gov. Brian Kemp signed two AI bills into law in May 2026. SB 540, the state’s chatbot safety law, was signed May 11, 2026, and takes effect July 1, 2027. SB 444, which prohibits health insurance coverage decisions from being based solely on AI, was signed May 5, 2026, and takes effect Jan. 1, 2027.

SB 540 requires AI chatbot disclosures, child-safety guardrails, privacy tools, and crisis-response protocols. SB 444 bars adverse health coverage decisions that rely solely on AI without human clinical review.

Illinois

Illinois advanced one of the most significant frontier AI safety bills in the country when SB 315 passed both chambers in late May 2026. As of the latest official legislative status, the bill is enrolled and has not yet been signed into law. If enacted, it would take effect Jan. 1, 2027, require large frontier developers to maintain safety frameworks, report critical safety incidents, and undergo annual independent third-party audits.

If the bill is signed, Illinois would become one of the states setting frontier model expectations at a level that goes beyond basic transparency and pushes toward third-party review.

Additional State Initiatives

Arkansas enacted measures addressing digital likeness, AI-generated content ownership, and public entity AI policy requirements.

Missouri completed legislative action on SB 1019, an omnibus health care bill that includes a prohibition on offering AI therapy chatbots. The bill is slated to take effect Aug. 28, 2026.

Oregon, Idaho, Iowa, Nebraska, Maine, and Georgia have all enacted chatbot disclosure or safety laws in 2025 and 2026. If your product includes a chatbot, this is one of the fastest-moving multi-state risk areas.

Maryland moved early on algorithmic pricing and AI policy study work. Delaware created an agentic AI sandbox. Vermont and Virginia have also built AI policy infrastructure that could shape future legislation.

AI-Generated Child Sexual Abuse Material

One of the broadest areas of state legislative activity involves AI-generated child sexual abuse material. States continue to close gaps in existing laws to make clear that synthetic or heavily manipulated content can still be criminally prohibited.

Political Deepfakes and Election Integrity

Political deepfakes remain one of the most active legislative areas, but states have learned from litigation. Many are leaning toward disclosure requirements rather than outright bans because of constitutional concerns.

Trends for 2026

Chatbot regulation: This is the clearest trend. States are focused on disclosures, minor protections, manipulation limits, and crisis-response requirements.

Frontier model safety: A handful of states are beginning to regulate the largest AI developers with safety plans, reporting, and transparency requirements.

Health care and insurance: Legislatures are trying to stop AI-only decision-making in areas where people can be harmed by unreviewed outputs.

Algorithmic pricing and automated decisions: More states are likely to test narrower rules that target pricing, eligibility, and high-stakes automation.

Definitional drift: States still define AI, chatbots, frontier models, and automated decision systems differently. That means your compliance burden grows if your business spans multiple jurisdictions.

International Approaches to AI Regulation

The EU AI Act remains the most comprehensive international framework. Its Aug. 2, 2026 compliance milestone for high-risk systems matters if you serve European customers or work with EU partners. For details, see our EU AI Act guide.

Common Regulatory Themes

Three themes show up repeatedly: transparency, risk-based regulation, and consumer protection. Whether the law is focused on hiring, chatbots, health care, or synthetic media, lawmakers keep returning to notice, review, and accountability.

What This Means for Michigan Businesses

If you’re based in Michigan, the temptation is to treat this as someone else’s problem until Michigan passes its own sweeping AI law. That would be a mistake. The more immediate question is where your tools, customers, and users already place you under other states’ laws.

California matters if your AI systems are accessible there or your user base is large enough to trigger disclosure rules.

Colorado still matters if you influence consequential decisions there. The framework changed, but the state did not walk away from regulation.

Chatbot laws now matter across multiple states. If your business offers a conversational AI product, the compliance question is no longer hypothetical.

Health care and employment workflows deserve immediate attention. These are the contexts drawing the heaviest regulation and the highest litigation risk.

Federal and international overlap is real. If you serve European customers, work with public-sector entities, or operate in regulated fields, AI governance now intersects with broader compliance programs.

Governance Requires Balance

States are moving unevenly, but the direction is clear. AI governance is becoming more specific, more enforceable, and more tied to real-world use cases. Waiting for one federal law to simplify everything is not a strategy.

The businesses that handle this well won’t be the ones that stop using AI. They’ll be the ones that know where it’s in use, document what matters, and put guardrails around tools before those gaps show up in a complaint, contract review, or enforcement action.

Frequently Asked Questions (FAQs)

Do these state AI laws matter if your business is based in Michigan?

Yes. If you serve customers, employees, applicants, or users in states with active AI laws, those requirements can apply even if your headquarters is in Michigan. The issue is where the AI system is used, not just where your office is located.

What kinds of AI use are drawing the most regulation?

The most active areas are employment decisions, health care, chatbot safety, deepfakes, synthetic content disclosure, and frontier model governance. States are also starting to take a closer look at pricing systems and more autonomous AI tools.

What is the biggest compliance mistake businesses make with AI?

Most businesses assume AI adoption is a future decision. In reality, AI is already built into employee workflows, SaaS tools, and vendor platforms. The biggest mistake is not knowing where it’s already in use or what data it touches.

Are chatbot laws becoming a serious business issue?

Yes. By 2026, multiple states had enacted chatbot disclosure and safety laws, and more were advancing. If your business offers conversational AI to consumers, minors, or patients, this is one of the fastest-moving risk areas.

What should you do first if your team is already using AI?

Start by identifying where AI is already in use, what data it touches, and whether those uses affect hiring, health care, customer interactions, or sensitive content. Once you have that picture, you can decide what governance controls you need.

Does the EU AI Act matter if you only have a few international customers?

It can. The EU AI Act applies based on where AI systems are used and who they affect, not just where your office is located. If you serve EU customers or partners, you should review whether your AI tools create obligations there.