AI State Legislation

State of play.

• Illinois has enacted the most demanding state AI statute to date. SB315 makes Illinois the first state to mandate independent third-party safety audits, risk disclosures, and incident reporting for large frontier AI developers — a materially higher compliance bar than Colorado's transparency-and-notice retreat or Connecticut's employer disclosure regime .
• Colorado has completed its legislative reversal and Connecticut has entered the field. Governor Polis signed SB 26-189 replacing the original risk-based AI Act with a narrower ADMT transparency regime; Connecticut's SB 5 — the AI Responsibility and Transparency Act — passed on bipartisan supermajority votes, establishing the most detailed state AI workplace framework with October 2026 compliance deadlines .
• The White House is pressing for federal preemption while states accelerate. The administration's stated preference for a unified federal standard has not produced legislation, and more than two dozen states are now in active AI enforcement posture — California's transparency and training-data disclosure requirements have been in effect since January 2026, with state AGs positioned as primary enforcers .
• Political and market headwinds are reshaping the state legislative environment. Pennsylvania lawmakers have introduced bills to repeal AI data center tax incentives and impose an 18-month moratorium on new facilities; a Gallup poll found 67 percent of adults oppose AI data centers in their communities — signals that state legislatures are responding to constituent pressure, not just industry lobbying .
• For counsel advising AI developers and multi-state employers, the operative picture is a diverging patchwork: Illinois's third-party audit mandate is the new high-water mark, Colorado's rollback removes the most prescriptive compliance burden but Connecticut's October 2026 deadlines are immediate, and industry's failed preemption strategy has shifted to state-by-state lobbying for industry-friendly alternatives.

Where things stand.

• Illinois SB315 is the new compliance frontier for frontier AI developers. The law mandates independent third-party safety audits, risk disclosures, and incident reporting — obligations that go well beyond the transparency-and-notice model Colorado adopted and that no other state has yet matched .
• Colorado's SB 26-189 is the operative statute; SB24-205 is repealed. The new law covers "automated decision-making technology" in consequential decisions — employment, lending, housing, insurance, healthcare, education, government services. Developers owe technical documentation to deployers; deployers owe consumer notice and post-adverse-action disclosures; both retain records for three years. AG-only enforcement; no private right of action. Effective January 1, 2027 .
• Connecticut's SB 5 establishes a two-phase employer compliance clock. Beginning October 1, 2026, automated tools cannot be used as a defense against discrimination claims and WARN Act notices must disclose AI-driven layoffs. Beginning October 1, 2027, pre-decision disclosures and plain-language bot-disclosure requirements apply to any AI interacting with applicants or employees .
• Federal preemption is the administration's stated strategy, not yet law. The December 2025 EO and the March 2026 National Policy Framework proposed congressional preemption; the DOJ's Colorado intervention demonstrated the enforcement posture; no statute has passed .
• AI governance is shifting from policy documents to operational infrastructure. Enterprise vendors and federal regulators are building runtime enforcement and continuous monitoring into AI systems; the 2026 compliance landscape is expected to include inventory requirements, risk assessment protocols, and continuous monitoring for high-risk and agentic AI systems — but the binding legal framework has not solidified .
• California is building AI governance through executive action and procurement. Newsom's May 21 order targets labor-market disruption and directs agencies to develop WARN Act amendments, severance frameworks, and worker-ownership models; earlier requirements mandate bias, content, and supply chain certifications from AI vendors contracting with the state .
• New York's synthetic performer consent and disclosure laws take effect June 19, 2026. The Fashion Workers Act and companion statutes require explicit consent before digital replication of human models and mandatory disclaimers for AI avatars in advertising, with $500–$1,000 per-violation fines .
• State-level AI ownership law has broken from federal IP doctrine. Arkansas has enacted the first statute assigning ownership of AI-generated outputs to the prompt supplier — directly contradicting the human-authorship requirement left intact by the Supreme Court's denial of certiorari in Thaler v. Perlmutter — and other states are watching .
• Health insurance AI restrictions are proliferating at the state level. Alabama has enacted SB 63; Pennsylvania, New Hampshire, Louisiana, Hawaii, Oklahoma, and Virginia have introduced similar bills requiring human clinical override authority and transparency in AI-driven coverage decisions .
• West Coast chatbot disclosure laws create a January 1, 2027 compliance deadline, with Oregon's $1,000-per-violation private right of action as the sharpest litigation exposure for operators of AI systems designed to simulate ongoing relationships .

Latest developments.

• No new topics have been added since the last regeneration. The developments below reflect the most recent additions to the corpus.
• Illinois enacted SB315, becoming the first state to mandate independent third-party safety audits, risk disclosures, and incident reporting for large frontier AI developers, as OpenAI's Chris Lehane shifts to lobbying for industry-friendly alternatives in key states following failed federal preemption efforts .
• Pennsylvania lawmakers introduced bills to repeal AI data center tax incentives and impose an 18-month moratorium on new facilities, with a Gallup poll finding 67 percent of adults oppose AI data centers in their communities — a political dynamic shaping state legislative calendars .
• Arkansas enacted the first state AI ownership statute, assigning prompt-supplier ownership of AI-generated outputs in direct tension with federal copyright doctrine and the Supreme Court's denial of certiorari in Thaler v. Perlmutter .
• New York's synthetic performer laws — the Fashion Workers Act and companion disclosure statutes — take effect June 19, 2026, with the Department of Labor overseeing model agency registration .

Active questions and open splits.

• Whether Illinois's third-party audit mandate triggers a constitutional challenge. SB315's independent audit and incident-reporting requirements for frontier AI developers are the most prescriptive state obligations enacted to date; the same First Amendment compulsion and Commerce Clause theories xAI deployed against Colorado's original statute are available here, and industry has signaled it is lobbying rather than litigating — for now .
• Whether Colorado's SB 26-189 transparency-and-notice model becomes the national template. The pivot from risk-based governance — driven by industry pressure, constitutional litigation, and DOJ intervention — is now the most visible policy equilibrium; whether states holding comprehensive frameworks retreat to this model or hold is the defining question for the next legislative cycle .
• Scope of Connecticut SB 5's "automated employment decision tool" definition. The non-defense provision — stripping employers of the ability to use automated tools as a discrimination defense — is novel and its scope will be contested in implementation and litigation; what qualifies as a covered tool and how courts interpret the provision is unresolved .
• Preemption vulnerability of state AI ownership laws. Arkansas's prompt-supplier ownership statute directly conflicts with the Copyright Act's human-authorship requirement and Thaler v. Perlmutter's intact precedent — any client relying on that protection faces a statute that may not survive a preemption challenge, and whether Congress acts before more states follow is open .
• First Amendment and Equal Protection limits on state AI bias mandates. The xAI/DOJ constitutional theories — compelled ideological conformity and demographic-adjustment as Equal Protection violation — were never adjudicated on the merits; Colorado's legislative retreat leaves the doctrine available for the next state that attempts a risk-based or bias-audit regime .
• Scope of California's labor-market intervention. Newsom's executive order signals WARN Act amendments, severance mandates, and worker-ownership models tied to AI-driven productivity gains — the specific obligations and which industries are prioritized remain undefined pending agency recommendations .
• Health insurance AI: human override as a federal vs. state question. Multiple states are mandating that AI cannot override clinician judgment in coverage decisions — whether ERISA preemption applies to these state mandates is unresolved and will be the first litigation battleground when enforcement begins .

What to watch.

• Illinois SB315 implementation guidance — what "independent third-party audit" requires in practice will set the compliance standard that other states considering similar mandates will copy or modify.
• Connecticut Governor Lamont's signature on SB 5 — once signed, employers have until October 1, 2026 to inventory automated hiring tools and revise vendor contracts for indemnification and audit rights.
• California agency recommendations under Newsom's May 21 executive order — the specific WARN Act amendment proposals and severance frameworks will define the next wave of employer AI obligations and signal what other states will copy.
• New York synthetic performer law enforcement beginning June 19, 2026 — the first enforcement actions will test whether the consent-and-disclosure model survives the federal preemption challenge.
• Congressional action on federal AI preemption legislation — any bill that moves will immediately reshape the compliance calculus for every state program currently in development.
• Whether Pennsylvania's data center moratorium bills advance — if enacted, they would be the first state-level infrastructure restriction on AI buildout and a signal that constituent opposition is translating into binding law.