US state AI laws in 2026: what to do while it settles

The short answer: do not wait for the preemption fight to resolve. State obligations remain in force in the meantime, and the common core across every version — disclose when a person is dealing with an AI system, keep a record of consequential decisions, keep a human able to intervene, and be able to explain what the system does — is stable across all of them. Build that, and the outcome of the federal argument changes your paperwork rather than your architecture.

Third-party figures on this page were checked on 26 September 2026 against the publishing organisation's own release or report. Research in this field ages quickly and definitions vary between surveys — treat any undated statistic with suspicion, including on our own pages.

Where things stand

• At least 29 states have enacted AI statutes, with a wide spread of scope. Some address deepfakes and synthetic media only; others reach algorithmic decisions in employment, lending, housing and insurance.
• Colorado's AI Act (SB 24-205) — the most comprehensive state framework, covering developers and deployers of systems making consequential decisions — took effect on 30 June 2026 after being delayed from February.
• Connecticut's SB 5, the Artificial Intelligence Responsibility and Transparency Act, was signed in May 2026 with obligations phasing in from October 2026 into 2027.
• Federal preemption is being pursued, not achieved. A December 2025 executive order set out to eliminate state-law obstruction of national AI policy; a National Policy Framework followed in March 2026 urging Congress to replace the patchwork. Executive action can direct agencies and shape litigation. Displacing state law generally takes Congress or a court.

The practical guidance from most counsel through 2026 has been consistent: plan as though existing state law stands in the short term, and watch how states and courts respond.

The part that is the same everywhere

Strip the statutes down and four duties recur, in different words and with different triggers:

1. Disclosure. A person dealing with an AI system should be able to know it. For an agent on a messenger or an inbox, this is configuration and copy — cheap to do, awkward to explain having skipped.
2. A record of consequential decisions. What the system did, on what input, and what a human did about it. Not a chat transcript — an action record.
3. Human involvement where it counts. Usually framed as the ability to intervene or appeal rather than a requirement to approve everything.
4. An explanation you can give. What the system is for, what it decides or does, what data it uses. If nobody in the building can answer that without asking the vendor, that is the gap.

If the federal framework lands, these are the duties most likely to survive in some form — they are the common denominator, not the outliers.

What a small or mid-sized business should actually do

The compliance burden of a fifty-state patchwork falls hardest on organisations without a compliance function, which is the stated reason for the preemption push. Four steps get most of the way, and none needs a lawyer to start:

1. Inventory your agents. What exists, what each is connected to, who owns it, and whether it touches anything consequential — hiring, credit, housing, insurance, education, or access to an essential service. Most businesses find their agents are nowhere near the regulated categories, and that knowledge is itself the answer to the question.
2. Turn on disclosure in customer-facing channels. Not a policy page. In the channel.
3. Make sure the action log exists and is readable. If you could not reconstruct what an agent did last Tuesday in under ten minutes, you have a records problem before you have a compliance problem.
4. Keep the approval boundary on irreversible actions. This is the control most often cited across the frameworks and, independently, the one that keeps agent deployments out of trouble. See approvals and trust.

Two mistakes to avoid

Waiting for clarity. Clarity in this area has been six months away for two years. Obligations that are in force are in force; a preemption argument is not a defence for the period before it succeeds.

Building fifty variants. Running one standard at the level of the strictest regime you are genuinely exposed to is almost always cheaper than maintaining an agent that behaves differently by state. The same conclusion holds across the Atlantic — the EU AI Act and AI agents arrives at it from the other direction.

Where this meets the technical decision

Every duty above assumes a record exists. An agent that keeps its own action log, attributes each action to the agent that took it and the human who approved it, and retains that where you can query it, satisfies the evidentiary half of most of these frameworks by construction. An agent running on a personal account with its history in a chat window satisfies none of them, and cannot be retrofitted to — the history it did not keep is gone.

That is the argument for settling where your agents run before the question is asked by someone with standing to ask it.

This is an orientation, not legal advice. This area is moving quickly; confirm current obligations with qualified counsel before relying on them.