Tuesday, September 15$199late booking, seats still openBook a seat
AI Ninja AcademyLive AI classes
← All guides

Which US state AI laws actually apply to my small business?

Fewer than the headlines suggest. Most state AI laws target model developers, large platforms, or specific decisions like hiring and lending. If you use AI to draft copy and take notes, the rules that bite are about hiring, disclosure, and recording. Colorado's original AI Act never took effect. It was repealed and replaced in May 2026. This is general information, not legal advice.

By Uvin Vindula · Checked 2026-09-03 · 11 min read

Start here: the Colorado advice you have read is probably stale

This is the single most valuable correction on this page, because the wrong version is still everywhere.

Colorado SB 24-205, the Colorado AI Act, was signed in May 2024 and set to take effect 1 February 2026. On 28 August 2025, Governor Polis signed SB 25B-004 in a special session, postponing it to 30 June 2026 (akingump.com).

Then it was scrapped. On 14 May 2026, Governor Polis signed SB 26-189, which repeals and reenacts SB 24-205 with a different framework (leg.colorado.gov). SB 24-205 never took effect at all.

Some articles still tell you to prepare a risk management program, run annual algorithmic discrimination reviews, or complete impact assessments. They are describing a law that no longer exists. Those duties are gone (crowell.com). So is the safe harbour for following the NIST AI Risk Management Framework or ISO/IEC 42001.

What Colorado actually requires now, and the exemption that disappeared

SB 26-189 is titled "Automated Decision-Making Technology". It takes effect 1 January 2027 and applies to decisions made on or after that date (leg.colorado.gov).

It covers automated decision-making technology that materially influences a "consequential decision" about education, employment, housing, financial or lending services, insurance, healthcare, or essential government services (nortonrosefulbright.com).

Deployers have five duties (crowell.com). Give clear and conspicuous notice before the technology influences a consequential decision. Describe the decision and the technology's role within 30 days of an adverse outcome. Allow data correction requests. Provide meaningful human review by trained personnel who can override the outcome. Retain records for three years.

Now the part small businesses need to know. The small-business exemption did not survive. SB 24-205 had exempted deployers with fewer than 50 full-time equivalent employees from the risk management program, subject to four conditions (trustarc.com). SB 26-189 carries no employee-count exemption. Analysis of the new statute states plainly that the original small business exemption was removed and that the law applies to deployers of any size (natlawreview.com).

I found one circulating claim that the threshold was lowered to 40 employees rather than removed. I could not confirm that against the enrolled bill or against any law firm analysis, and the better-sourced accounts say there is no size carve-out. Treat "we are too small for Colorado" as unsafe.

The Colorado Attorney General has exclusive enforcement authority. There is no private right of action. Violations are deceptive trade practices, with a 60-day notice and cure opportunity that expires on 1 January 2030 (ourtake.bakerbotts.com).

The laws most likely to actually reach you

Law Who it reaches What it requires In force
Illinois HB 3773 (Human Rights Act amendment) Employers using AI in employment decisions No discriminatory effect; notice to applicants and employees; no ZIP code as a proxy 1 January 2026
Illinois BIPA Anyone capturing voiceprints or face data in Illinois Written notice and consent, retention schedule; $1,000 / $5,000 statutory damages In force
California FEHA automated-decision rules Employers with 5+ employees in California No discriminatory ADS use; retain ADS and selection data 4 years 1 October 2025
Texas HB 149 (TRAIGA) Anyone developing or deploying AI in Texas, or serving Texans Bans specific intentional harms; AG enforcement with 60-day cure 1 January 2026
Utah AI Policy Act (SB 149, as amended) Licensed occupations and high-risk consumer interactions Disclose that the consumer is dealing with generative AI In force to July 2027
NYC Local Law 144 Employers and agencies using AEDTs for NYC jobs Annual independent bias audit, published results, candidate notice In force since 2023
Colorado SB 26-189 Deployers of ADMT in consequential decisions, any size Notice, adverse-outcome explanation, human review, 3-year records 1 January 2027
California CCPA / CPPA ADMT rules Businesses meeting CCPA thresholds Pre-use notice, opt-out, access and appeal for significant decisions Compliance by 1 January 2027
California SB 942 (AI Transparency Act) GenAI services with 1m+ monthly users Latent and manifest content disclosures, free detection tool 2 August 2026

Read that table for what is missing. Nothing there regulates using ChatGPT to draft a newsletter, summarize a document, or clean up a quote.

Illinois: two separate problems

Illinois HB 3773 amended the Illinois Human Rights Act, effective 1 January 2026. It bars employers from using AI that has the effect of discriminating on a protected basis. The covered decisions are recruitment, hiring, promotion, training selection, discharge, discipline, tenure, and terms of employment. It also requires notice when AI is used for those purposes, and bars ZIP code as a proxy for a protected class (crowell.com).

The Illinois Department of Human Rights withdrew its proposed implementing rules, so the exact form of compliant notice is still unclear (seyfarth.com). The statutory duty applies anyway.

The Illinois Human Rights Act reaches employers with even one employee in the state for most purposes, so there is no small-business hiding place here either.

BIPA is the separate problem, and it is the one that generates lawsuits. If your AI tool captures voiceprints or facial geometry from Illinois residents, including meeting participants who are not your customers, you need written notice, written consent, and a published retention schedule. That is the theory behind the AI notetaker cases.

Texas and Utah: narrower than the coverage suggests

Texas HB 149, the Responsible Artificial Intelligence Governance Act, took effect 1 January 2026. It reaches anyone developing or deploying an AI system in Texas, promoting or conducting business in the state, or offering products used by Texas residents (nortonrosefulbright.com).

That sounds broad. In practice it is narrow, because the final version is intent-based. It prohibits specific intentional conduct rather than imposing impact-based liability, and the Texas Attorney General has exclusive enforcement with a 60-day cure period (klgates.com). A firm using AI for drafting and scheduling is not doing anything TRAIGA prohibits.

Utah's AI Policy Act was the first US generative AI statute, effective 1 May 2024. SB 226 and SB 332, effective 7 May 2025, narrowed it and extended it to July 2027. Disclosure is now required when a consumer asks whether they are dealing with AI (fpf.org). It is also required up front in "high-risk" interactions: health, financial, legal or mental health advice, or where sensitive data is collected.

If you run an AI chat on a site serving Utah consumers, the compliance step is a sentence. If you are a licensed professional using AI in client-facing interactions, read the statute properly.

California: three separate regimes, only one of which is size-blind

California's employment rules bite first. The Civil Rights Council's automated-decision system regulations under FEHA took effect 1 October 2025, and FEHA applies to employers with five or more employees. They confirm that ADS use can violate FEHA directly or through disparate impact, and they extend record retention for ADS and selection data to four years (mayerbrown.com).

The CCPA regime is different. It only applies if you meet a threshold: gross revenue above the inflation-adjusted figure of $26,625,000, or buying, selling or sharing the personal information of 100,000 or more California consumers or households a year, or deriving 50% or more of revenue from selling or sharing personal information (jacksonlewis.com). Most small businesses do not meet any of the three.

If you do, the CPPA's finalised ADMT rules require compliance by 1 January 2027: pre-use notice, an opt-out with exceptions, access rights, and an appeal, for significant decisions (whitecase.com).

SB 942, the California AI Transparency Act, is easy to dismiss correctly. It applies to generative AI services with more than one million monthly visitors or users, and AB 853 pushed its operative date to 2 August 2026 (morganlewis.com). If that is not you, it is not your problem.

NYC Local Law 144 is about a tool, not a city

Local Law 144 applies where an automated employment decision tool substantially assists hiring or promotion for a job located in New York City. It requires an annual independent bias audit, publication of a summary of results, and notice to candidates. It took effect 1 January 2023, with enforcement from 5 July 2023 by the Department of Consumer and Worker Protection.

Penalties are modest per instance: up to $500 for a first violation, and $500 to $1,500 for each subsequent one. But each day and each tool can count separately.

A December 2025 New York State Comptroller audit concluded DCWP had been enforcing the law ineffectively, after which the agency formalised its enforcement procedures (osc.ny.gov). Expect more enforcement, not less.

The trap is that this reaches employers who are not in New York. If you hire for a role based in the five boroughs and your applicant tracking system scores or ranks candidates, you are covered.

The federal preemption fight, and why it should not change your plan

On 11 December 2025, President Trump signed Executive Order 14257, "Ensuring a National Policy Framework for Artificial Intelligence". It establishes an AI Litigation Task Force at the Department of Justice, operating from 10 January 2026, to challenge state AI laws in federal court (paulhastings.com). It also directed the Secretary of Commerce to identify candidate laws by 11 March 2026.

An executive order does not repeal a state statute. Until a court enjoins a specific law, that law applies to you. The practical effect for a small business is uncertainty, not relief.

Meanwhile the volume keeps rising. MultiState's tracker recorded 1,561 AI bills introduced across 45 states as of March 2026 (multistate.ai). Most will not pass, and most of those that pass will not reach you.

A one-hour check you can run yourself

  1. List where your people are. Employees, contractors, and the states where you advertise jobs. That is your exposure map, not where your office is.
  2. Separate drafting from deciding. Write two lists: AI that produces text a human edits, and AI that scores, ranks, filters or recommends about a person. Only the second list carries most of these obligations.
  3. Check the second list against hiring rules first. Illinois, California FEHA, NYC LL144 and Colorado from 2027 all target decisions about people.
  4. Check whether you meet the CCPA thresholds. Revenue over $26,625,000, 100,000+ California consumers, or 50% of revenue from selling data. If no, drop the whole CCPA branch.
  5. Add a disclosure line wherever a customer talks to a bot. One sentence covers Utah, and it is good practice everywhere.
  6. Write down your recording consent routine. Recording law reaches far more small businesses than AI law does.
  7. Diary 1 January 2027. Colorado SB 26-189 and the California ADMT rules both land then.

This page summarizes statutes and regulations as of 3 September 2026. It is general information, not legal advice. State AI law is moving quickly, and a federal preemption fight is live. Confirm anything you plan to rely on with a lawyer licensed in your state.

Where these figures come from

People also ask

A page of standing instructions that writes your weekly document for you

Rather do this with someone than read about it?

Automate reports and documents with AI is a live two-hour class built on exactly this problem. 25 seats, your own files, and you leave with a saved set of instructions that writes that document for you, the way you want it.

Read next

Can lawyers use ChatGPT and keep client confidentiality?

Yes. ABA Formal Opinion 512, issued 29 July 2024, permits generative AI use under the existing Model Rules.

Can my ChatGPT conversations be subpoenaed?

Yes, and they already have been. In New York Times v. OpenAI, a court ordered OpenAI to produce 20 million de-identified ChatGPT conversations.

How do I stop AI making things up in my documents?

You cannot turn it off, so you build a checking step instead. Feed the AI your own source files, make it quote and cite, then verify every name, number…