AI State Legislation

State of play.

• Federal preemption pressure has intensified but remains unlegislated, while bipartisan criticism of White House inaction is creating a new political fault line. The Great American AI Act would impose a three-year freeze on new state AI development laws; simultaneously, critics from both parties argue Trump's tech-donor ties have dampened federal enforcement following AI security incidents involving OpenAI and Anthropic — a split that directly determines whether states retain room to regulate .
• The FTC has entered the state-federal collision directly, proposing a Section 5 framework that treats undisclosed AI output steering as presumptively deceptive and specifically targets Colorado's AI Act as impliedly preempted — meaning state-law compliance is not a federal safe harbor .
• Seven states have enacted restrictions on AI mental health chatbots, with Colorado, Maine, Rhode Island, Tennessee, and Vermont joining Illinois and Nevada in 2026 — the most active sector-specific state AI enforcement wave to date, operating entirely without federal standards .
• Texas has layered court-imposed obligations on top of TRAIGA, with the Texas Supreme Court proposing attorney certification and sanctions rules for AI-assisted filings — the first state judiciary to operationalize a comprehensive AI governance statute through procedural rules .
• For counsel advising AI developers, multi-state deployers, and regulated-industry clients, the operative picture is a three-front exposure: state sector-specific restrictions are proliferating without federal floors, the FTC's output-steering framework means state compliance does not extinguish federal risk, and the Great American AI Act's preemption scope — particularly its carve-outs — remains undefined.

Where things stand.

• Illinois SB315 remains the compliance frontier for frontier AI developers. The law mandates independent third-party safety audits, risk disclosures, and incident reporting — obligations that go well beyond the transparency-and-notice model Colorado adopted and that no other state has yet matched .
• Colorado's SB 26-189 is the operative statute; SB24-205 is repealed. The new law covers automated decision-making technology in consequential decisions — employment, lending, housing, insurance, healthcare, education, government services. AG-only enforcement; no private right of action. Effective January 1, 2027 .
• Connecticut's SB 5 establishes a two-phase employer compliance clock. Beginning October 1, 2026, automated tools cannot be used as a defense against discrimination claims and WARN Act notices must disclose AI-driven layoffs. Beginning October 1, 2027, pre-decision disclosures and plain-language bot-disclosure requirements apply to any AI interacting with applicants or employees .
• The FTC's proposed output-steering framework creates a federal enforcement layer that state compliance does not satisfy. The July 1, 2026 proposed policy statement treats undisclosed model alignment — including reinforcement learning from human feedback — as a Section 5 deception violation regardless of state-law compliance, and specifically frames Colorado's Act as impliedly preempted where it compels output alteration .
• Seven states have enacted AI mental health chatbot restrictions with no federal floor. Colorado bars AI therapy chatbots entirely; Maine treats unauthorized AI therapy as an unfair trade practice; Rhode Island prohibits AI from making independent treatment decisions; Tennessee bars AI systems from advertising as qualified mental health professionals; Vermont prohibits AI from independently delivering mental health services; Illinois and Nevada enacted similar restrictions in 2025 .
• Texas TRAIGA is in effect and the Texas Supreme Court is layering procedural obligations on top of it. TRAIGA, effective January 1, 2026, carries civil penalties of $10,000 to $200,000 for AI misuse; the Supreme Court's proposed certification and sanctions rules target filing attorneys directly, shifting liability to the end-user rather than the developer .
• Federal preemption is the administration's stated strategy, not yet law. The Great American AI Act would freeze new state AI development laws for three years while preserving existing state authority over consumer protection, civil rights, privacy, and deployment — but the scope of that carve-out is undefined and the bill has not passed .
• California is building AI governance through executive action and procurement. Newsom's executive order targets labor-market disruption and directs agencies to develop WARN Act amendments, severance frameworks, and worker-ownership models; earlier requirements mandate bias, content, and supply chain certifications from AI vendors contracting with the state .
• State-level AI ownership law has broken from federal IP doctrine. Arkansas has enacted the first statute assigning ownership of AI-generated outputs to the prompt supplier — directly contradicting the human-authorship requirement left intact by the Supreme Court's denial of certiorari in Thaler v. Perlmutter .
• West Coast chatbot disclosure laws and New York synthetic performer laws create near-term compliance deadlines, with Oregon's $1,000-per-violation private right of action as the sharpest litigation exposure for operators of AI systems designed to simulate ongoing relationships .
• The EU Digital Omnibus on AI has reset the international compliance clock. Regulation (EU) 2026/1744 defers major high-risk obligations to December 2027 for stand-alone systems and August 2028 for AI embedded in regulated products, while August 2, 2026 transparency requirements remain in force — a material reset for any client with EU-facing AI deployments .

Latest developments.

• Bipartisan criticism of White House AI inaction — Steve Bannon and Senator Ron Wyden among critics arguing Trump's tech-donor ties dampened enforcement following AI security incidents involving OpenAI and Anthropic; the fault line directly implicates whether federal preemption legislation advances or stalls .
• Seven states have enacted AI mental health chatbot restrictions in 2025-2026, with Colorado, Maine, Rhode Island, Tennessee, and Vermont joining Illinois and Nevada — the most concentrated sector-specific state AI enforcement wave, operating without any federal standard .
• EU Digital Omnibus on AI entered into force July 27, 2026, deferring high-risk compliance deadlines to December 2027 and August 2028 while preserving August 2 transparency obligations .
• Anthropic appointed former California Supreme Court Justice Tino Cuéllar as its first chief global affairs officer, signaling that policy and regulatory engagement have become board-level priorities at a major frontier AI developer .
• The Great American AI Act released — bipartisan House proposal would impose a three-year freeze on new state AI development laws while preserving existing state authority over consumer protection, civil rights, and privacy, with the scope of carve-outs undefined .
• FTC proposed Section 5 policy statement on AI output steering, treating undisclosed model alignment as presumptively deceptive and specifically targeting Colorado's AI Act as impliedly preempted .
• Texas Supreme Court proposed attorney certification and sanctions rules for AI-assisted filings, layering court-imposed obligations on top of TRAIGA's existing civil penalty regime .
• Norway enacted a near-total prohibition on generative AI for primary school students (grades 1-7), with tiered restrictions through secondary school — a tiered age-based model that may influence US state education technology regulation .
• Silicon Valley backlash against Anthropic over its closed-platform strategy and "responsible AI" positioning is intensifying, with implications for how safety-first regulatory positioning plays in industry and policy debates .

Active questions and open splits.

• Whether state-law compliance shields AI companies from FTC Section 5 enforcement. The FTC's output-steering proposal explicitly rejects state compliance as a federal defense and frames Colorado's Act as impliedly preempted — if finalized, companies face a scenario where exceeding state requirements still leaves federal exposure, and the interaction between the FTC framework and the Great American AI Act's preemption carve-outs is entirely unresolved .
• Scope of the Great American AI Act's state-law carve-outs. The proposal preserves existing state authority over consumer protection, civil rights, privacy, and deployment — but whether that carve-out swallows the freeze for most state AI laws, or leaves a meaningful federal floor, is undefined and will be the central lobbying and drafting battleground .
• Whether Illinois's third-party audit mandate triggers constitutional challenge. SB315's independent audit and incident-reporting requirements are the most prescriptive state obligations enacted to date; the First Amendment compulsion and Commerce Clause theories deployed against Colorado's original statute remain available, and industry has so far chosen lobbying over litigation .
• ERISA preemption of state health insurance AI mandates. Multiple states now require human clinical override authority in AI-driven coverage decisions — whether ERISA preempts these mandates is unresolved and will be the first litigation battleground when enforcement begins .
• Preemption vulnerability of state AI ownership laws. Arkansas's prompt-supplier ownership statute directly conflicts with the Copyright Act's human-authorship requirement and Thaler v. Perlmutter's intact precedent — clients relying on that protection face a statute that may not survive a preemption challenge .
• Scope of Connecticut SB 5's "automated employment decision tool" definition. The non-defense provision — stripping employers of the ability to use automated tools as a discrimination defense — is novel; what qualifies as a covered tool and how courts interpret the provision is unresolved, with October 1, 2026 compliance already in effect .
• Whether the Trump coalition split on AI safety translates into legislative movement. The bipartisan criticism of White House inaction following AI security incidents has created rare cross-aisle pressure; whether it accelerates federal safety mandates, shifts the preemption calculus, or dissipates without legislative action will determine the regulatory environment for the next cycle .

What to watch.

• FTC finalization of the output-steering policy statement — if adopted, it resets the compliance calculus for every AI company operating under state AI laws and will immediately generate challenges to the Colorado preemption theory.
• Great American AI Act progress — any committee movement will clarify the scope of the state-law carve-outs and signal whether the three-year freeze is a credible threat to state legislative calendars.
• Illinois SB315 implementation guidance — what "independent third-party audit" requires in practice will set the compliance standard that other states considering similar mandates will copy or modify.
• Connecticut SB 5 enforcement beginning October 1, 2026 — the first enforcement actions or litigation under the non-defense provision will test the scope of "automated employment decision tool" and generate the first case law on the statute.
• California agency recommendations under Newsom's executive order — the specific WARN Act amendment proposals and severance frameworks will define the next wave of employer AI obligations.
• Whether additional states adopt AI mental health chatbot restrictions following the seven-state wave — the absence of federal standards means the sector-specific patchwork will continue to expand, and any federal behavioral health AI guidance would immediately reshape the compliance picture.