AI Regulation for In-House Counsel in 2026: A State and Federal Update

AI regulation for in-house counsel in 2026 is a state-led patchwork. As of October 11, 2026, we found no federal statute that regulates AI across the board or that overrides state AI laws. The live obligations come from state and city laws (Illinois, Texas, California, New York City and, in part, Connecticut), with Colorado's replacement law due January 1, 2027. The EU AI Act reaches providers that place AI systems on the EU market wherever they are based. The White House wants Congress to preempt the states, but no preemption bill has become law, so the state laws below still apply.

Reviewed and corrected on 12 October 2026. This is general information, not legal advice; check the cited statute or opinion before relying on it.

Picture a GC at a SaaS company with employees in Illinois and New York City, customers in Colorado, an EU sales motion and SEC filings. That one legal department is answering several AI regimes at once, and each routes a different artifact through a different team (HR, product, finance, legal).

Four things moved in 2026 alone:

• Colorado repealed and replaced its AI Act before the original version took effect. The replacement, SB 26-189, takes effect January 1, 2027.
• The EU AI Act delay is now law. The Digital Omnibus on AI was published as Regulation (EU) 2026/1744 on July 24, 2026 and moved the high-risk dates to December 2, 2027 and August 2, 2028.
• California's AI Transparency Act became operative on August 2, 2026.
• Connecticut's Public Act 26-15 (SB 5) began to apply on October 1, 2026.

President Biden's AI executive order was revoked in January 2025. On December 11, 2025 the president signed Executive Order 14365, which targets state AI laws, and in March 2026 the White House sent Congress a National Policy Framework that asks it to preempt them. Until Congress acts, the state regime governs.

A useful frame is three compliance tracks. Business-use AI (Colorado, Connecticut, state consumer-protection law). Employment AI (Illinois, New York City, California, Colorado, Connecticut). Frontier-model governance (California SB 53, Connecticut, the EU AI Act's general-purpose model rules). In our judgment, a company that mostly buys AI tools will meet the employment rules first, because HR software is the AI most companies already run.

TL;DR

• Four regulatory trajectories matter in 2026. Executive Order 14365 and the March 2026 National Policy Framework (a preemption push that is not binding law), the EU AI Act as amended by Regulation (EU) 2026/1744, state and city laws in CO, IL, TX, CT, CA and NYC, and ABA Formal Opinion 512 for lawyers' own use of AI.
• The state patchwork is enforceable now. Illinois HB 3773 and Texas HB 149 (TRAIGA) took effect January 1, 2026, as did California SB 53. California's AI Transparency Act (AB 853) became operative August 2, 2026. NYC Local Law 144 has been enforced since July 5, 2023. Connecticut's first provisions took effect October 1, 2026.
• Colorado hit reset. SB 24-205 was repealed and reenacted as SB 26-189, signed May 14, 2026, effective January 1, 2027, with a disclosure model in place of the duty-of-care model. A pending federal lawsuit and a court order can still move the timing of enforcement.
• The EU high-risk delay is final. Standalone (Annex III) high-risk duties now apply from December 2, 2027 and product-embedded (Annex I) duties from August 2, 2028. Article 50 transparency duties applied from August 2, 2026, and providers of generative systems already on the market before that date have until December 2, 2026 to meet the Article 50(2) marking duty.
• Federal preemption has not passed. The Senate stripped a 10-year moratorium from the 2025 budget bill 99-1, House Majority Leader Scalise said in December 2025 that Republicans would not attach preemption to the defense bill, and the FTC's proposed policy statement on state AI laws is still only a proposal.
• By year end every law department needs five things in place. An AI inventory, a vendor diligence template, an employment-AI notice file, an EU AI Act gap analysis if you sell into the EU, and a written governance program tied to Formal Opinion 512.

Part of our in-house counsel resource hub. For the program itself, see our AI governance policy template.

Official text, as of 11 October 2026

Three provisions that this post depends on, quoted from the official source we read.

• Texas, Bus. & Com. Code 552.056(b) (HB 149, enrolled text): "A person may not develop or deploy an artificial intelligence system with the intent to unlawfully discriminate against a protected class in violation of state or federal law." Subsection (c) adds that "a disparate impact is not sufficient by itself to demonstrate an intent to discriminate."
• Colorado SB 26-189, section 5 (bill page and signed act): "this act takes effect January 1, 2027," with a few sections effective on passage. The act applies to consequential decisions made on or after that date.
• EU Regulation 2024/1689, new Article 111(4), added by Regulation (EU) 2026/1744: providers of generative systems "placed on the market before 2 August 2026 shall take the necessary steps in order to comply with Article 50(2) by 2 December 2026."

What changed in 2026: Colorado replaced its Act, the Omnibus fixed the EU dates and added the Article 111(4) grace period, and Texas's chapter 552 took effect in January.

The federal picture: a framework and no statute

On December 11, 2025 the president signed Executive Order 14365, "Ensuring a National Policy Framework for Artificial Intelligence." Its first section recalls that Executive Order 14179 of January 23, 2025 "revoked my predecessor's attempt to paralyze this industry." In March 2026 the White House published the National Policy Framework for Artificial Intelligence, a set of legislative recommendations to Congress.

The framework is not binding law. It says Congress "should preempt state AI laws that impose undue burdens" and "should not create any new federal rulemaking body to regulate AI," relying instead on "existing regulatory bodies with subject matter expertise." It also says a national standard should not preempt "laws of general applicability against AI developers and users, including particular laws to protect children, prevent fraud, and protect consumers."

Congress has so far not enacted it by other routes. In 2025 a 10-year moratorium on state AI enforcement was part of the pending budget reconciliation bill (the One Big Beautiful Bill Act), and the Senate voted 99-1 to strip it out on July 1, 2025 (Nextgov). In early December 2025 House Majority Leader Steve Scalise said Republicans were no longer looking to attach state AI preemption to the National Defense Authorization Act, adding that supporters were "still looking at other places" (Broadband Breakfast). That is press reporting of a statement; we did not read the enrolled NDAA text. As of our October 2026 review we found no enacted preemption statute.

Four pieces matter today.

First, the carve-out. Because the framework would leave "laws of general applicability" alone, existing federal and state consumer-protection and anti-discrimination law would keep applying to AI-driven harms even if a preemption bill passed. Title VII still applies, though the EEOC's AI technical-assistance pages, which explained how, now return a 404 on eeoc.gov, and a K&L Gates alert of January 31, 2025 reports that the EEOC removed its AI-related guidance from its website on January 27, 2025.

Second, the executive branch machinery. EO 14365 directs the Attorney General to set up an AI Litigation Task Force within 30 days (section 3), the Secretary of Commerce to publish within 90 days an evaluation of state AI laws (section 4), and the FTC Chairman to issue within 90 days a policy statement on when state laws that "require alterations to the truthful outputs of AI models" are preempted (section 7). We could not confirm that Commerce has published its evaluation.

Third, the FTC and the Justice Department have moved against Colorado. On July 1, 2026 the FTC announced a proposed policy statement which says Colorado's Artificial Intelligence Act is "impliedly preempted to the extent it conflicts with a federal regulatory scheme." The vote to publish it was 2-0 and comments were due July 31, 2026. It is a proposal; we found no final version. Separately, the United States moved to intervene on April 24, 2026 in the suit brought by x.AI against the Colorado Attorney General, and is a plaintiff-intervenor in the court's April 27 order (described in the Colorado section).

Fourth, SEC enforcement on AI claims runs on its own track. On January 14, 2025 the SEC settled charges against Presto Automation over false and misleading statements about its AI product, Presto Voice, in its filings and public statements between November 2021 and May 2023 (Release No. 33-11352). The SEC's fiscal 2026 examination priorities, a separate track for registered advisers and broker-dealers, say the Division will "review for accuracy registrant representations regarding their AI capabilities" (priorities). The practical check: what your filings say about AI should match what the product does.

The state map: laws in force and arriving

The legislative-tracker view exaggerates the bill count. The operative reality is a smaller set of statutes already in force or arriving within months.

Here is the 2026 map at a glance, with the dates and enforcers that drive a compliance calendar.

Colorado: SB 24-205 repealed and reenacted as SB 26-189 (effective January 1, 2027)

The Colorado story changed twice in twelve months, so the date you may have written down is probably wrong. The original Colorado AI Act, SB 24-205, was first set for February 1, 2026, then moved to June 30, 2026 by SB 25B-004 (approved August 28, 2025).

Then Governor Polis signed SB 26-189 ("Automated Decision-Making Technology") on May 14, 2026. The act "repeals and reenacts" the 2024 provisions. By its own terms it takes effect January 1, 2027 and applies to consequential decisions made on or after that date.

The approach changed. SB 24-205 was a risk-based regime built around "high-risk" systems and a duty of reasonable care. SB 26-189 is disclosure-based. It covers automated decision-making technology (ADMT) that materially influences a decision about a person's education, employment, housing, financial or lending services, insurance, health-care services, or essential government services and public benefits. Developers must give deployers technical documentation. Deployers must give clear and conspicuous notice at the point of interaction and, within 30 days after an adverse outcome, a plain-language description of the ADMT's role. Consumers can request their personal data, ask for correction of factually incorrect data, and ask for meaningful human review of an adverse decision. Developers and deployers must keep records for at least three years.

The Attorney General enforces the act through the Colorado Consumer Protection Act. Before January 1, 2030 the AG must give a 60-day notice and chance to cure where a cure is possible. The act creates no new private right of action.

Colorado's AG has moved on rules. The Department of Law filed draft ADMT rules on August 11, 2026, released an interim draft on October 6, 2026, and set a hearing for October 26, 2026 (coag.gov). The AG's page also covers HB 26-1263, a chatbot safety act whose operator duties mostly start January 1, 2027. The AG's page gives a July 1, 2026 signing date, but the session law (Chapter 208, Laws of 2026) says "Approved: May 29, 2026" and the General Assembly's bill history shows the governor signed it on May 29, 2026.

The date is not fully safe. x.AI sued the Colorado Attorney General on April 9, 2026 (X.AI LLC v. Weiser, No. 1:26-cv-01515, D. Colo.), and the United States moved to intervene on April 24 (it is named plaintiff-intervenor in the order below). On April 27, 2026 a magistrate judge ordered that the AG "shall not initiate enforcement, including but not limited to the initiation of an investigation" for alleged violations of SB 24-205, or legislation replacing or amending it enacted that session, that occurred or may occur on or before 14 days after the court rules on x.AI's preliminary-injunction motion. x.AI must file that motion within 28 days after final adoption of rules implementing the law (the order). We found no ruling on the motion as of our review.

What this means in practice: do not build a high-risk impact-assessment program for Colorado. Build the notice, adverse-outcome disclosure, correction and human-review process, and aim it at January 1, 2027 while watching the rulemaking and the docket.

Illinois HB 3773 (effective January 1, 2026)

Illinois HB 3773 (Public Act 103-0804) added a subsection to the Illinois Human Rights Act, 775 ILCS 5/2-102(L). In recruitment, hiring, promotion, renewal of employment, selection for training or apprenticeship, discharge, discipline, tenure, or the terms, privileges or conditions of employment, an employer may not "use artificial intelligence that has the effect of subjecting employees to discrimination" on the basis of protected classes, or "use zip codes as a proxy for protected classes." It is also a violation "to fail to provide notice to an employee that the employer is using artificial intelligence" for those purposes. The Act took effect January 1, 2026 (Public Act 103-0804).

The statute tells the Illinois Department of Human Rights to write rules on when notice is required, the time period and the means of delivery. IDHR proposed rules in May 2026 (published in the Illinois Register on May 15, 2026 as proposed amendments to 56 Ill. Adm. Code 2520, issue 20), and then on June 2, 2026 postponed the rulemaking. The Illinois Register summary for June 26, 2026 lists the Department as having withdrawn the proposal "to further consult and collaborate with other State agencies." The Illinois Human Rights Commission's June 17, 2026 training slides list both steps. A Seyfarth alert of June 8, 2026 adds that the June 10 hearing was cancelled. We found no new timeline and did not find the postponement on IDHR's own pages, so check its Legislative Updates page for the current status. Either way, the notice duty is in the statute and applies today.

The law applies to an employer's "use" of AI, so a vendor module that scores candidates falls inside the statute even if the employer did not build it. Vendor diligence is the load-bearing compliance step. The notice is easy. Establishing that the upstream tool was audited and documented is harder.

Texas HB 149 / TRAIGA (effective January 1, 2026)

The Texas Responsible Artificial Intelligence Governance Act was signed June 22, 2025 and took effect January 1, 2026. It adds chapters 551 to 554 to the Business & Commerce Code. The substantive rules are in chapter 552, and they bind different people in different ways. Read from the enrolled text:

Rules for any person or business that develops or deploys AI in Texas (applicability is in section 551.002):

• A person may not develop or deploy an AI system "in a manner that intentionally aims to incite or encourage" a person to commit physical self-harm, harm another person, or engage in criminal activity (552.052).
• A person may not develop or deploy an AI system "with the sole intent" to infringe or impair a person's constitutional rights (552.055).
• A person may not develop or deploy an AI system "with the intent to unlawfully discriminate against a protected class." A disparate impact "is not sufficient by itself to demonstrate an intent to discriminate." The section does not apply to insurance entities already subject to insurance unfair-discrimination statutes, and a federally insured financial institution is treated as compliant if it complies with federal and state banking law (552.056).
• A person may not develop or distribute AI with the sole intent of producing child sexual abuse material or sexual deepfakes that violate Penal Code 21.165, or AI that holds text conversations simulating sexual conduct while impersonating a child under 18 (552.057).

Rules for government only:

• A governmental agency that offers an AI system meant to interact with consumers must tell each consumer, before or at the time of interaction, that they are dealing with AI. When AI is used in health care services, the provider of the service must give the same disclosure (552.051).
• A governmental entity may not use AI for social scoring (552.053) or to uniquely identify an individual from biometric data or scraped images without consent where that would infringe the individual's rights (552.054).

We found no provision in chapter 552 on political deepfakes, a general consumer notice duty for private businesses, or private-sector social scoring. HB 149 also amended the state biometric statute, Business & Commerce Code 503.001, so that an image on the internet does not by itself show consent to capture a biometric identifier for a commercial purpose, unless the individual made the image public.

Enforcement. The Texas Attorney General has exclusive authority and there is no private right of action (552.101). Before suing, the AG must give written notice and 60 days to cure (552.104). Uncured violations carry civil penalties of $10,000 to $12,000 for each curable violation, $80,000 to $200,000 for each uncurable violation, and $2,000 to $40,000 per day for continuing violations (552.105). There is a rebuttable presumption that a person used reasonable care. A defendant cannot be found liable if another person misuses its system, or if it discovers a violation through feedback from a developer, deployer or other person, adversarial or red-team testing, state-agency guidelines, or an internal review process (the last only if it substantially complies with the NIST AI Risk Management Framework Generative AI Profile or another recognized framework). A state agency can add sanctions against its own licensees on the AG's recommendation, up to $100,000 (552.106).

California AI laws (SB 53 and AB 853 in force; other rules too)

SB 53, the Transparency in Frontier Artificial Intelligence Act (Chapter 138, Statutes of 2025, approved September 29, 2025), took effect January 1, 2026. A "frontier model" is one trained with more than 10^26 operations. A "large frontier developer" is a frontier developer with more than $500 million in annual gross revenue. Large frontier developers must write, publish and follow a frontier AI framework and may not make materially false statements about it. The act also covers critical safety incident reporting and whistleblower protections for employees of frontier developers. Civil penalties are up to $1 million per violation, recovered only by the Attorney General (chaptered text).

AB 853 (Chapter 674, Statutes of 2025, approved October 13, 2025) delayed the operation of the California AI Transparency Act until August 2, 2026, and that date has now passed (chaptered text). A generative AI provider with more than 1,000,000 monthly visitors or users that is publicly accessible in California must offer a free AI detection tool. From January 1, 2027, large online platforms (more than 2,000,000 unique monthly users) must detect provenance data, and a GenAI system hosting platform may not knowingly make available a system that lacks the required disclosures. Capture-device manufacturers are covered for devices first produced for sale in the state on or after January 1, 2028. The civil penalty is $5,000 per violation, each day counts as a separate violation, and the Attorney General, a city attorney or a county counsel can sue.

Two other California rule sets matter to in-house teams:

• Civil Rights Council employment regulations. Regulations on automated-decision systems under the state's anti-discrimination law were approved on June 27, 2025 with an effective date of October 1, 2025 (Council rulemaking page). The Council's announcement says they require employers to keep employment records, including automated-decision data, for a minimum of four years, and define "agent" and "proxy" (announcement). The same rulemaking page also lists a January 2026 filing with an April 1, 2026 effective date under a contractor-nondiscrimination heading; we did not review that later filing, so check the Council's page for any change to the automated-decision rules.
• CCPA regulations on ADMT, risk assessments and cybersecurity audits. The California Privacy Protection Agency lists the package as adopted in September 2025 and the CCPA regulations as effective January 1, 2026 (CPPA). Under the text of section 7200, a business that already uses ADMT for a significant decision must comply with the ADMT article no later than January 1, 2027 (regulation text).

NYC Local Law 144 (enforced since July 2023)

NYC Local Law 144 prohibits employers and employment agencies from using an automated employment decision tool (AEDT) unless the tool has had a bias audit within one year of use, information about the audit is public, and the required notices have been given. The city's Department of Consumer and Worker Protection (DCWP) began enforcement on July 5, 2023, and says the notice must be given 10 business days before use of the tool (DCWP). The New York State Comptroller reports that civil penalties run from $500 to $1,500 per day.

On December 2, 2025 the New York State Comptroller issued audit 2024-N-6 of DCWP's enforcement. It found the complaint process "ineffective in ensuring that all complaints related to non-compliance with LL144 are routed to DCWP" (OSC). Treat the bias audit as a recurring annual workflow.

Connecticut Public Act 26-15 (SB 5): phased from October 1, 2026

Connecticut's SB 5, "An Act Concerning Online Safety," passed the Senate on April 21, 2026 and the House on May 1, 2026 and was signed on May 27, 2026 as Public Act 26-15. It is a 39-section act with many effective dates.

In force since October 1, 2026:

• Section 1: a provider of a paid AI subscription must give the consumer written notice of the key terms, including limits it may impose, before entering into or renewing the subscription.
• Section 2: whistleblower protections for employees of frontier AI developers.
• Section 13: use of an automated employment-related decision technology "shall not be a defense against a complaint alleging a discriminatory practice" under the state's employment discrimination statute.
• Section 15: generative AI providers with more than one million monthly users must, to the extent commercially and technically reasonable, include provenance data in audio, image and video content they create or materially alter.
• Section 26: employers that serve a WARN notice (29 USC 2102(a)) must tell the Labor Department whether the layoffs "are related to the employer's use of artificial intelligence or another technological change."

Later:

• January 1, 2027: the AI companion rules (sections 4 to 6), and the date by which each large frontier developer must have an internal anonymous process for employee reports (section 2).
• Sections 7 to 12, the employment-AI developer and deployer disclosure duties, are effective October 1, 2026 but apply to technology deployed on or after October 1, 2027.
• January 1, 2028: section 39, covering minors on online platforms.

The Labor Department disclosure and the Section 13 rule are the pieces most companies will touch first. Add them to the same HR-AI file you keep for Illinois and New York City.

The EU AI Act: extraterritorial reach and a high-risk deadline that moved

Regulation (EU) 2024/1689 phases in across several dates. Article 5 (prohibited practices) has applied since February 2, 2025. Chapter V (general-purpose AI models) has applied since August 2, 2025. The general date of application was August 2, 2026, and the high-risk obligations were meant to start then.

That date moved. The Digital Omnibus on AI is Regulation (EU) 2026/1744, signed July 8, 2026 and published in the Official Journal on July 24, 2026. It entered into force on the third day after publication, July 27, 2026. The Council gave its final green light on June 29, 2026. Chapter III, Sections 1 to 3 (the high-risk requirements) now apply from December 2, 2027 for systems classified as high-risk under Article 6(2) and Annex III, and from August 2, 2028 for systems under Article 6(1) and Annex I.

The Omnibus also added new Article 5 prohibitions on AI systems that generate non-consensual intimate imagery and child sexual abuse material (the "nudification" tools). Those prohibitions apply from December 2, 2026.

The undercounted piece is GDPR-style extraterritorial reach. The Act applies to providers placing AI systems on the EU market whether or not they are established in the Union, and to providers and deployers in third countries "where the output produced by the AI system is used in the Union" (Article 2(1)(a) and (c)). Under Article 99, fines for prohibited practices reach EUR 35 million or 7% of worldwide annual turnover, and most operator obligations, including the Article 50 transparency duties, reach EUR 15 million or 3%. For SMEs, including start-ups, each fine is capped at the lower of the percentage or the amount.

If your company sells a SaaS product into the EU with an AI feature, the exposure is real even without a European office. The near-term work is unglamorous: confirm no feature falls under Article 5, check each AI feature against the Article 50 duties, and for any generative system already on the market, schedule the Article 50(2) marking work before December 2, 2026. The heavier high-risk gap analysis against Articles 9 to 15 (risk management, data governance, technical documentation, logging, transparency, human oversight, accuracy) can now run toward the 2027 date. A US provider of a high-risk AI system must appoint an authorised representative established in the EU, by written mandate, before making the system available on the EU market (Article 22).

Across the three tracks: business-use AI is the hardest to evidence in diligence, because the artifact crosses three departments. Employment AI is the easiest to evidence and, in our judgment, the one a non-AI company is most likely to be asked about. Frontier-model governance carries the highest theoretical penalties and is the least likely to touch a company that does not train frontier models.

The ABA Formal Opinion 512 baseline

For the lawyers in your department, the regulatory question is narrower. ABA Formal Opinion 512, issued July 29, 2024, is the American Bar Association's guidance on lawyers' use of generative AI. State and local bars have issued their own, including California's 2026 Practical Guidance (which replaces the State Bar's 2023 version and addresses agentic AI) and Florida Ethics Opinion 24-1 (January 19, 2024, advisory and not binding). Some states now go beyond guidance. California's SB 574 (Chapter 858, Statutes of 2026), signed on September 30, 2026, adds Business and Professions Code § 6068.1. It requires a lawyer who uses generative AI to take reasonable steps to verify the output, including every case and statutory citation, and to disclose the use of generative AI to the court "for all documents submitted to the court." It also amends Code of Civil Procedure § 128.7 so that no paper filed in a California court may contain a citation the responsible attorney has not personally verified. The bill has no urgency clause, so it takes effect January 1, 2027 (bill text and status; Governor's September 30, 2026 signing announcement). Colorado's Supreme Court added AI language to its Rules of Professional Conduct on January 8, 2026 (Rule Change 2026(02): new Scope [20A] and Comment [9] to Rule 1.1).

The core obligations are the spine of any law-department AI program:

1. Competence (Rule 1.1): understand the capabilities and limitations of the AI tools you use.
2. Confidentiality (Rule 1.6): evaluate the data-handling posture of any tool before inputting client information. If you have never checked, start with whether ChatGPT is confidential for legal work.
3. Communication (Rule 1.4): Opinion 512 says the facts of each matter decide whether the lawyer must disclose AI use to the client, and that disclosure may be unnecessary. Lawyers must disclose if the client asks or requires it, and in some situations must raise it unprompted.
4. Candor toward the tribunal (Rule 3.3): verify AI-generated citations and content before filing. The cost of getting this wrong is the Mata v. Avianca sanctions order (S.D.N.Y. 2023).
5. Reasonable fees (Rule 1.5): a tool that works like overhead cannot be charged to the client absent a contrary disclosure in advance. A per-use third-party tool can ordinarily be billed at the actual out-of-pocket cost. You may not charge a client for time spent learning a tool you will regularly use.

For the long version, see our ABA Formal Opinion 512 guide.

One mistake to avoid: a single "AI policy" memo that tries to cover both the lawyers' use of AI (Opinion 512) and the company's use of AI for business decisions (the state regimes above). Those are two policies, with different owners, scopes and audit trails.

What AI regulation for in-house counsel requires in practice

Start by answering one question: which regimes even touch you? Most lean teams over-scope, then freeze. The decision is simpler than a tracker makes it look.

Once you know the map, five things, in priority order.

1. An AI inventory. Every AI-enabled tool deployed or being procured, tagged by business unit, vendor, data flows and consequential-decision exposure. One document, owned by a named compliance officer, refreshed quarterly. It surfaces the Colorado disclosure classification, the Illinois employment-notice question and the EU AI Act gap analysis at the same time.

2. A vendor diligence template with AI-specific clauses. Bias-audit deliverables for AEDTs, training-data provenance representations for generative-AI vendors, EU AI Act conformity-assessment representations for high-risk providers, and an information-security baseline for vendors handling client-confidential data. Negotiate it once at the contract level. The alternative is chasing it tool by tool after an enforcement letter.

A standing vendor questionnaire turns AI due diligence into a repeatable procurement step instead of a fire drill.

3. An employment-AI notice and audit file. Notice rules look procedural and tend to get deprioritized for that reason. Overlapping laws (Illinois HB 3773, NYC Local Law 144, California's Civil Rights Council regulations, Connecticut Public Act 26-15, and Colorado SB 26-189 from 2027) hit the same surface: every HR-tech vendor that scores, ranks or filters candidates. The artifact to keep ready is a per-tool file: the vendor's most recent bias audit, the notice text shown to candidates in each jurisdiction, deployment dates by jurisdiction, and sign-off from the HR business partner.

4. An EU AI Act gap analysis (if applicable). First screen for Article 5 prohibited uses and the Article 50 duties, which are the near-term items, and for generative systems already on the market, plan the Article 50(2) marking work before December 2, 2026. Then classify each AI feature shipping into the EU under Annex III and gap-analyze against Articles 9 to 15 toward December 2, 2027. The framework is straightforward and the documentation is the work. It is also what an EU authorised representative will ask for, since the mandate covers checking the declaration of conformity and the technical documentation (Article 22(3)).

5. A written AI governance program tied to Formal Opinion 512. Written as a program with a named owner, quarterly review cadence, approved-tools list, prohibited-inputs list, incident-reporting channel, training requirement, and annual sign-off from each practice-group lead.

One more thing on the federal fight: preemption is politically loud and operationally secondary to your 2026 program. The 2025 moratorium died 99-1, Republican leaders said in December 2025 that the defense bill was not the place for a second attempt, and the White House framework itself would leave "laws of general applicability" in place, so consumer-protection and anti-discrimination law would survive a preemption bill. Pausing AI governance work to wait for preemption trades enforcement exposure you can manage today for a hypothetical statute.

FAQ

Is there a federal AI law in the United States in 2026? We found no federal statute that regulates AI across the board. Federal oversight runs through existing agencies and statutes, Executive Order 14365, and a March 2026 National Policy Framework, which is a set of legislative recommendations and not binding law.

Did the federal moratorium on state AI laws pass? No. The Senate stripped a proposed 10-year moratorium from the 2025 budget bill 99-1, and House Majority Leader Scalise said in December 2025 that Republicans were no longer looking to attach it to the defense bill. The FTC has proposed a policy statement that calls Colorado's AI Act impliedly preempted, but it is a proposal and not a statute.

What happened to the Colorado AI Act? Colorado repealed and reenacted the original AI Act (SB 24-205) as SB 26-189, signed May 14, 2026. The new law replaces the risk-based duty of care with notice, adverse-outcome disclosure, correction and human-review rights. It takes effect January 1, 2027. A court order in the x.AI case bars the Attorney General from starting enforcement for violations that occur on or before 14 days after a ruling on x.AI's preliminary-injunction motion.

Which state AI laws are in effect right now? Illinois HB 3773, Texas HB 149 (TRAIGA) and California SB 53 took effect January 1, 2026. California's AI Transparency Act (AB 853) became operative August 2, 2026. NYC Local Law 144 has been enforced since July 5, 2023. Connecticut's Public Act 26-15 began to apply October 1, 2026, with more provisions in 2027 and 2028. Colorado's new law arrives January 1, 2027.

Does Texas require businesses to tell customers they are talking to an AI? Not under the TRAIGA text we read. The disclosure duty in section 552.051 applies to governmental agencies and to health-care providers using AI in care. Private businesses are bound by the prohibited-use rules, such as the bans on AI intended to incite self-harm, to infringe constitutional rights, or to unlawfully discriminate.

When does the EU AI Act apply to high-risk systems? Standalone (Annex III) high-risk obligations apply from December 2, 2027, and product-embedded (Annex I) obligations from August 2, 2028, under Regulation (EU) 2026/1744, published July 24, 2026. Prohibited-practice rules already apply. Article 50 transparency duties have applied since August 2, 2026, and providers of generative systems already on the market have until December 2, 2026 to meet the Article 50(2) marking duty.

Does the EU AI Act apply to US companies? Yes, if you place an AI system on the EU market or your AI output is used in the EU, wherever you are established. Fines for prohibited practices reach EUR 35 million or 7% of worldwide annual turnover, and EUR 15 million or 3% for most operator obligations including Article 50.

What is the difference between the state AI laws and ABA Formal Opinion 512? They govern different things. The state laws regulate a company's use of AI in business decisions (hiring, lending, consequential decisions). ABA Formal Opinion 512 governs a lawyer's professional use of generative AI under the Rules of Professional Conduct. They need two separate policies.

What should an in-house legal team have in place by year end? Five things: an AI inventory, a vendor diligence template with AI clauses, an employment-AI notice and audit file, an EU AI Act gap analysis if you sell into the EU, and a written governance program tied to Formal Opinion 512.

Build the AI governance program now

The 2026 takeaway is unglamorous: the state patchwork is the law you comply with today, and waiting on a federal preemption bill that may never pass only grows your exposure. Stand up the AI inventory, the vendor template and the governance program, and keep a dated source next to every effective date, because these dates keep moving. Start with our AI governance policy template.

For the US statutes, regulations and court rules these laws sit in, see the US primary law API.

Arshita Anand

Co-Founder & CEO · Attorney

Arshita leads product and strategy at Vaquill AI, the US primary law data API. As an attorney, she decides which law we carry, how each section is sourced and cited, and what legal AI and compliance teams need from the data.