With Congress still debating comprehensive AI legislation, state legislatures have emerged as the primary regulatory actors, with 35 states introducing AI-related bills in the 2026 session. The patchwork approach mirrors the early days of data privacy regulation.
Colorado's AI Consumer Protection Act, the most comprehensive state law to date, requires companies to assess high-risk AI systems for bias and discrimination. Illinois has banned AI in hiring decisions without human review. California's AI safety law imposes testing requirements on frontier model developers.
The regulatory diversity creates compliance headaches for companies operating nationally. Tech industry groups are increasingly calling for federal preemption, preferring uniform national standards to navigating 50 different state frameworks.
Key areas of state focus include AI in employment (28 states), AI in healthcare (22 states), deepfake regulation (31 states), and AI in education (15 states). Consumer-facing AI applications are receiving the most attention, while business-to-business AI use remains largely unregulated.
The National Conference of State Legislatures has formed a working group to develop model legislation, hoping to bring some consistency to state approaches while preserving states' ability to innovate on regulatory approaches.
