The United States lacks a comprehensive federal AI law, but a rapidly growing patchwork of state regulations is creating meaningful compliance obligations — and significant compliance complexity — for businesses operating across multiple states. Understanding which regulations apply to your operations requires mapping your AI use cases against the specific laws in each jurisdiction where you operate or have customers.
California: the de facto national standard
California's AI regulation ecosystem is the most comprehensive in the country and functions as a de facto national standard because its market size makes it impractical to build California-specific product variants. Key California laws affecting AI include AB 2013 (requires disclosure of training data for AI systems used in employment, housing, and credit decisions), SB 1047 (safety requirements for large AI models, currently under implementation), and multiple CCPA amendments that impose consumer rights regarding automated decision-making.
California's influence is amplified by the fact that most major AI vendors are headquartered in California and thus subject to its laws regardless of where their customers are located.
Colorado, Connecticut, and the expanding state roster
Colorado's AI Act (effective February 2026) introduces consumer protection requirements for AI systems used in consequential decisions — employment, credit, housing, education, insurance. It requires developers and deployers to provide transparency about AI decision-making, implement risk management programs, and enable consumer opt-outs from automated decisions.
Connecticut, Texas, and Virginia have all introduced or passed AI transparency and accountability legislation. Illinois's biometric information privacy law (BIPA) is being applied to AI systems that process facial recognition data, generating significant litigation. New York City's Local Law 144 requires annual bias audits of AI hiring tools.
The compliance strategy for multi-state operators
The most efficient compliance strategy for businesses operating in multiple states is to build to the highest common denominator — implement the requirements of California's comprehensive framework plus Colorado's consumer rights model across all operations, rather than building state-specific compliance programs.
This approach has three advantages: it future-proofs against states that will adopt similar legislation (the trend is clearly toward more regulation, not less), it simplifies your compliance documentation (one set of policies, not fifty), and it positions your organization favorably if federal legislation eventually arrives with standards similar to the California/Colorado model.
Preparing now for federal legislation
Federal AI legislation is no longer a question of if, only when. The most probable near-term federal framework combines: mandatory transparency and disclosure requirements for AI used in high-stakes decisions, a federal AI incident reporting system similar to SEC cybersecurity disclosure requirements, and preemption of some (but probably not all) state laws. Organizations building their AI governance programs now should architect them to accommodate federal requirements, which will likely arrive within the next 24 months.
Found this useful? Share it.