38 US states enacted AI laws in 2025.
Most businesses don't know they apply.
There is no single federal AI law — which is why most businesses assume the state ones cannot reach them. California, Texas and Illinois laws are live right now.
Illinois follows your staff. Use AI in any US hiring, promotion or performance decision and HB 3773 requires written notice first, for employers with 15 or more employees — whichever state you are in.
California follows your customers. If your customers are in California, California law reaches the automated decisions you make about them, wherever your business sits.
Your own state passing nothing changes little. State privacy laws across twenty states already cover automated decision-making on personal data, and most AI tools qualify. Most businesses are non-compliant and do not know it.
Not sure where you stand? Answer 7 questions and get your free US AI compliance exposure report — instant, no sign-up.
Take the Free Check →"No federal AI law" does not mean "no obligation."
The most common mistake US businesses make is waiting for federal legislation before acting. State laws don't wait. They're enforced now. And most of them apply to you regardless of which state your business is registered in — it's about where your employees and customers are.
Illinois HB 3773 applies to any employer using AI in hiring, promotion, or performance review decisions — regardless of which state the employer is based in. Written notice is required.
Colorado SB 26-189 applies from 1 January 2027 and will require impact assessments and consumer disclosure rights for automated decision-making technology influencing decisions about employment, credit, housing, insurance, education, or healthcare. It replaced SB 24-205, which never took effect — so build against SB 26-189.
The California AI Transparency Act and Automated Decision-Making Technology regulations require disclosure and opt-out rights for consumers subject to AI-driven decisions.
Texas RAIGA prohibits intentional AI discrimination and requires policies and audit trails for AI systems used in employment, lending, housing, education, and healthcare decisions.
In 2025, state legislators introduced over 1,100 AI-related bills across all 50 states. 145 were enacted. More are coming.
US AI law moved faster than anyone expected.
Illinois amends its AI Video Interview Act. New York City Local Law 144 requires bias audits for AI hiring tools. The foundation is laid.
Colorado passes the most comprehensive US state AI law. California enacts multiple AI transparency measures. The patchwork accelerates.
38 states enacted AI legislation in 2025. Three major state AI compliance regimes are now fully enforceable, and Colorado's SB 26-189 follows on 1 January 2027. If you haven't built your compliance framework yet, you're already behind.
Congress has not passed a federal AI law. Bills that would set one national standard and override the state rules have been introduced, and none has passed — the Senate has already voted down an attempt to freeze state enforcement. Nothing at federal level changes what your states require of you today.
14 dates that decide whether you are compliant.
8 of them have already passed.
United States is one line of 6. A business with US staff usually sits on more than one. Yours is marked. The others reach you through your customers, your staff and your suppliers, wherever you are incorporated.
Europe
- in force Obligations for general-purpose AI models.
- in force Article 50 transparency duties, deployer obligations, and enforcement powers for national regulators.
- coming New prohibitions, and Article 50(2) marking of synthetic content.
- coming Every Member State must have an AI regulatory sandbox running.
- coming High-risk obligations for Annex III systems — including AI used in recruitment, credit scoring, education and essential services.
- coming High-risk obligations for Annex I systems — AI embedded in products already covered by EU product safety law.
United Kingdom
- in force Most Part 5 data protection provisions of the Data (Use and Access) Act 2025, including the wider lawful bases for solely automated decisions and the safeguards that come with them.
- in force The duty on controllers to operate a complaints procedure and respond to data protection complaints within set time limits.
United States this page
- in force Texas HB 149, the Responsible Artificial Intelligence Governance Act — prohibited uses, government AI disclosure, and Attorney General enforcement.
- in force California SB 942, the AI Transparency Act — free AI detection tool and latent provenance disclosure for large generative AI providers. Delayed from 1 January 2026 by AB 853.
- coming Colorado SB 26-189 — developer and deployer duties for automated decision-making technology used in consequential decisions. It repealed and reenacted SB 24-205, which never took effect.
Canada
- in force Ontario ESA / O. Reg. 476/24 — a publicly advertised job posting must disclose the use of AI to screen, assess or select applicants. Employers of 25 or more, including where a third party screens on their behalf.
Australia
- coming Privacy Act 1988 (Cth), APP 1.7 — a privacy policy must say what kinds of personal information a computer program uses to make decisions that could reasonably be expected to significantly affect a person, and what kinds of decisions those are.
United Arab Emirates
- in force DIFC Data Protection Regulation 10 — a business deploying an autonomous or semi-autonomous system that processes personal data must tell users, on first use, what the system decides for itself, what it was built to do and what it does with the output.
If any of these apply to your business, you have compliance obligations today.
- Using AI tools to screen CVs, rank candidates, or assist with any US hiring decision
- AI-assisted performance reviews, promotion decisions, or disciplinary actions for US employees
- AI chatbots or automated systems interacting with California, Colorado, or Texas customers
- Automated decision-making affecting consumer credit, insurance, or housing for US residents
- AI tools processing personal data of residents in any of the 20 states with active privacy laws
- Any business that wants to be ready for federal AI legislation when it passes
Read it before you buy it.
This is not a mock-up or a contents page. It is a genuine US AI Compliance pack — all 14 documents — produced by the same system that will produce yours, for a fictional marketing agency we invented to test it. They publish AI-written work for clients across four states, so the pack is written around that. Yours is written around whatever your business does.
Opens the PDF exactly as a client receives it. Yours is written around your business, your tools and your sector — not this one.
The states disagree on the wording. They agree on what you have to be able to prove.
Chasing fifty statutes one at a time is how this gets expensive. Underneath the drafting, the live regimes ask for the same short list: tell people before an automated system decides something about them, assess the system before you deploy it, test whether its outputs fall unevenly on people, keep a human who can review a decision, and hold records that show all of it. Illinois asks for the notice. Colorado's regime asks the Attorney General's questions. The state privacy laws ask about the data.
So the durable move is to build to the list, not to a state line. Do that and one framework covers the states you already trade into — and if a federal framework does arrive, it tests something you already hold rather than something you write under deadline. That is what the annual renewal is for: as states add requirements, your framework absorbs them, and you are not paying to start again.
Not sure which states already reach you? Seven questions, no sign-up.
Take the free check →
Your customers decide which law
applies to you. Not your address.
Where your customers are, where your staff are and where your AI has effect — those decide, not where the business is registered. We write frameworks to four legal systems, and serve four more on request.
- United Kingdom UK GDPR, in force now. The Data (Use and Access) Act added automated-decision duties from 5 February 2026.
- European Union The EU AI Act. General-purpose AI obligations already apply; enforcement begins 2 August 2026.
- United States State by state, not federal. Texas from 1 January 2026, California from 2 August 2026, Colorado from 1 January 2027.
- Canada PIPEDA plus provincial law. Ontario's AI hiring disclosure rules applied from 1 January 2026.
US AI Compliance Packages.
Every package builds a documented compliance position for your business. Prices in GBP — approximate USD and EUR equivalents shown. Stripe accepts all major cards.
~$250 · ~€230
- AI Acceptable Use Policy
- Employee AI guidelines
- AI tool inventory template
- Plain-English summary of obligations by state
Best for: small businesses wanting a baseline policy that covers all 50 states before specific obligations kick in.
In your inbox by the end of the business day
Buy now — £197 →~$1,010 · ~€930 per year
- Everything in US AI Policy
- State obligations assessment (CA, CO, TX, IL)
- Employment AI disclosure notices
- Algorithmic discrimination prevention procedures
- Consumer-facing AI transparency disclosures
- Data processing documentation for AI tools
Best for: businesses operating in or serving customers in California, Colorado, Texas, or Illinois — or any business using AI in US employment decisions.
In your inbox by the end of the business day · Covers you for 12 months, renews yearly
Book a scoping call → or buy directly — £797/yr~$1,900 · ~€1,750 per year
- Everything in US AI Compliance Foundation
- Multi-state compliance matrix
- Full HR AI procedures and disclosure templates
- Impact assessment templates for high-risk AI use
- Incident response procedure
- Federal legislation readiness assessment
Best for: multi-state businesses, businesses with 15+ employees, or any business wanting a comprehensive position ahead of federal legislation.
In your inbox by the end of the business day · Covers you for 12 months, renews yearly
Renews yearly — new state laws applied to your framework throughout your cover.
Book a scoping call → or buy directly — £1,497/yrEvery framework is annual — your fee covers 12 months of protection, with new state AI laws monitored and applied to your framework as they pass, and renews yearly so your cover never lapses.
How we build your US AI compliance framework.
Audit
We identify every AI tool your business uses, what decisions it influences, and which employees and customers are affected.
Assess States
We map your operations against active state laws — California, Texas and Illinois, and any other states you operate in — and identify your specific obligations.
Document
We build your compliance framework — acceptable use policy, state-specific disclosures, HR notices, impact assessments, and incident procedures.
Maintain
Throughout your 12-month cover, we monitor new state laws and federal developments and update your framework automatically — so you never have to track this yourself. Renews yearly.
Straight answers.
Does US state law apply to a non-US business?
In many cases, yes. If you have US-based employees or customers in states with active AI laws, those laws can apply to you regardless of where your business is incorporated. California law applies based on where your customers are. Illinois employment AI law applies based on where your employees are. If you're a UK or European business with US operations or staff, you're likely in scope for at least some of these laws.
What does Illinois law actually require?
Illinois HB 3773 requires employers to provide written notice before using an AI system to make or assist with employment decisions — including hiring, firing, promotion, demotion, and performance evaluation. This applies to employers with 15 or more employees. The notice must explain how the AI is used and what characteristics it evaluates. Violation can result in complaints to the Illinois Department of Human Rights.
My business is in a state that hasn't passed AI laws. Am I safe?
Not necessarily. Two things still apply to you: first, if you have customers or employees in California, Colorado, Texas, or Illinois, those states' laws apply. Second, state privacy laws (CCPA in California, VCDPA in Virginia, the Colorado Privacy Act, and others in 20 states) already cover automated decision-making systems that process personal data — and most AI tools qualify. A baseline AI policy protects you regardless of your state.
Is a federal AI law coming?
Congress has not passed a federal AI law, and there is no agreed timetable for one. Bills that would set a single national standard and override conflicting state laws have been introduced, and none has passed; the Senate has already voted down one attempt to freeze state enforcement. Nothing at federal level changes what your states require of you today. Whatever eventually arrives will be built on the same ideas as the Colorado and California rules — so a business that meets those now will be testing a framework it already holds, rather than writing one against a deadline.
What happens if I don't comply?
Penalties vary by state. California's AI transparency laws carry significant fines for non-compliance. Colorado's SB 26-189 will allow the Attorney General to enforce violations from 1 January 2027, with civil penalties per affected consumer. Illinois employment AI violations can be filed with the state Department of Human Rights. Beyond direct fines, non-compliance creates exposure in employment disputes and consumer litigation where your AI practices come under scrutiny.
Is this legal advice?
No. We produce compliance documentation frameworks and policy documents — we are not US attorneys. For businesses in regulated sectors or facing specific enforcement actions, we recommend reviewing your documentation with US-qualified legal counsel. For most businesses using standard AI tools, our frameworks provide a practical, well-documented compliance position that demonstrates good-faith effort.
Get compliant before more states add requirements.
145 AI bills were enacted in the US in 2025. That number will be higher in 2026. Building your compliance framework now means you adapt, not scramble, as new laws pass.
See the Packages →Or book a free 20-minute call to discuss your situation — hello@opsintel.io