AI Legislation Is Accelerating

The Rise of AI Regulation in the United States

The United States is in the middle of a regulatory transformation unlike anything seen in technology law since the early internet era. State legislatures, frustrated by federal inaction and motivated by a string of high-profile AI incidents, have turned to their own lawmaking powers to fill the void. The result is a patchwork of laws — dozens already in force, hundreds more working through the legislative process — that compliance teams are now racing to understand and address.

Why AI Legislation Is Accelerating

Three forces are driving the surge in AI bills. First, public concern about AI has reached a tipping point. Incidents involving AI-generated deepfakes used for nonconsensual intimate imagery, algorithmic discrimination in hiring and lending, and the use of AI to impersonate public figures have generated sustained press coverage and constituent pressure on legislators to act. State attorneys general and consumer protection agencies have received thousands of AI-related complaints in 2025 and 2026.

Second, the EU AI Act, which entered into force in August 2024, gave state legislators a concrete international model to draw from. The EU's risk-tiered approach — categorizing AI systems as unacceptable, high, limited, or minimal risk — has been directly referenced in bills introduced in Colorado, California, New York, and Texas. Legislators and their staff no longer need to draft from scratch; there is a sophisticated global template to adapt.

Third, industry incidents have created political urgency. The deployment of large language models in legal, medical, and financial contexts — sometimes without adequate safeguards — produced a series of embarrassing and harmful failures that were widely reported. A New York attorney was sanctioned for submitting AI-generated case citations that did not exist. An AI hiring tool used by a major retailer was found to screen out candidates based on protected characteristics. These concrete cases gave legislators specific harms to legislate against, making it easier to build coalitions and move bills forward.

Key Trends in 2026 AI Legislation

Four legislative trends dominate the 2026 session landscape. The first is chatbot transparency and disclosure: legislators across more than 35 states have introduced bills requiring businesses to disclose when consumers are interacting with an AI system rather than a human, especially in customer service, healthcare, and financial services contexts. These bills are relatively uncontroversial and are passing at higher-than-average rates. See the AI Disclosure tracker for state-by-state status.

The second trend is frontier AI model safety requirements. California SB 53 (effective January 1, 2026) and New York's RAISE Act (effective January 1, 2027) impose transparency and safety-incident reporting duties on large frontier model developers. Separately, Colorado's broader high-risk AI law (SB 24-205) became operative June 30, 2026; SB 26-189, signed in May 2026, replaces it on January 1, 2027 with a narrower notice-and-explanation law.

The third major trend is algorithmic pricing regulation. Following enforcement actions against AI-driven price coordination in the rental housing market, California (AB 325), New York (S.7882), and Connecticut (HB 8002) have enacted laws restricting algorithmic pricing, with dozens of additional states proposing similar bills in 2026. This is a newer legislative category with significant business implications for e-commerce, hospitality, and real estate.

The fourth trend is deepfake regulation, which has expanded well beyond electoral deepfakes to cover nonconsensual intimate imagery, fraud, and commercial impersonation. As of October 23, 2026, 48 states have an enacted deepfake law in our deepfake tracker. See the Deepfakes tracker for the current map.

The Federal vs. State Dynamic

The absence of federal AI legislation is the single most important structural fact in U.S. AI compliance. Despite dozens of federal AI bills being introduced in the 119th Congress — including the AI Act of 2025, the Algorithmic Accountability Act, and various sector-specific proposals — none have advanced to a floor vote. Congressional gridlock, lobbying by major technology companies, and disagreements over preemption of state law have stalled federal action.

The Trump administration's approach has further reduced the likelihood of near-term federal legislation. Executive Order 14179, signed January 23, 2025, revoked Biden's AI executive order and directed agencies to prioritize AI innovation over precautionary regulation. See the full Federal AI Policy Tracker for detailed analysis. The Trump administration's philosophy — that AI regulation should be handled through market forces and voluntary standards — is fundamentally in tension with the state legislative movement.

The result is a growing federal-state tension. Some technology companies have begun lobbying for a federal AI preemption statute specifically to displace state laws — a strategy that has historically succeeded in areas like data breach notification and financial regulation, but faces significant political obstacles in the current Congress. For now, states remain the primary source of binding AI compliance obligations.

What This Means for Businesses

For companies deploying AI systems, the proliferation of state AI laws creates what lawyers are calling a "patchwork problem" — the need to comply simultaneously with overlapping, sometimes inconsistent requirements across multiple jurisdictions. A national retailer using AI in hiring, customer service, and pricing may face obligations under Colorado's ADMT Act (from 2027), New York City's Local Law 144 (AI hiring bias audits), California's forthcoming AI legislation, Illinois's AEIA, and more — each with different definitions, timelines, and audit requirements.

The compliance burden is substantial. Third-party AI bias audits, mandated in several states for employment AI systems, typically cost $15,000 to $30,000 per tool, with full annual compliance programs (covering multiple tools, legal review, candidate notification, and training) running $80,000 to $160,000 or more. Disclosure requirements, while less costly to implement technically, require careful legal analysis of which systems trigger each state's definition of "AI" or "automated decision-making." Privacy impact assessments, bias risk assessments, and consumer notice programs all require dedicated compliance infrastructure.

The most practical response for most organizations is a tiered monitoring and compliance program: (1) continuously track new AI legislation across all operating states using tools like AI Laws by State; (2) conduct a gap analysis mapping current AI systems against enacted and near-enacted requirements; (3) prioritize compliance with laws that have short implementation windows or significant penalty exposure; and (4) build an AI governance framework — ideally aligned with the NIST AI Risk Management Framework — that can adapt as new requirements emerge. Businesses that wait for the patchwork to consolidate into a single federal standard may find themselves facing multiple simultaneous enforcement actions before any federal law ever passes.