The Fast Version
As of 20 October 2026, three state AI laws took effect on 1 January 2026: Texas TRAIGA, Illinois HB 3773 and the key provisions of California SB 53. California’s CCPA automated-decision rules began phasing in the same day. NYC Local Law 144 has been enforced since July 2023, and Colorado SB 26-189 takes effect 1 January 2027.
- Enforceable now: Texas, Illinois, California SB 53 and NYC LL144.
- Next deadline: 1 January 2027, when Colorado SB 26-189 and California’s ADMT notice and opt-out duties both start.
- Common thread: notice, decision records and retained evidence, which are data problems before they are legal ones.
- Caution: several dates rest on secondary reporting; each row below says which.
This register was last verified on 20 October 2026. We re-check it monthly, and anything scheduled after that date is shown as scheduled, not as having happened. Every date carries a status: verified-primary means we read it on the legislature, governor or regulator’s own page; secondary means it is consistently reported by multiple law firms but we could not open the primary text.
The register exists because the reporting drifts. Colorado is the clearest case. Its original AI Act, SB 24-205, was due to take effect on 30 June 2026 and never did: the Colorado General Assembly’s bill page shows SB 26-189 signed on 14 May 2026, replacing it with a narrower law effective 1 January 2027. Guides still quoting the June date are describing a law that no longer exists.
For a data team, the practical problem is not reading five statutes. It is producing, on request, a record of which automated system influenced which decision about which person, what they were told beforehand, and what happened when they asked for a human. That record lives in your data platform or nowhere.
Which State AI Laws Are in Force in 2026?
| Law | Who it reaches | Key date | Date status | What data teams must produce |
|---|---|---|---|---|
| Texas TRAIGA (HB 149) | Developers and deployers of AI systems used in Texas | Effective 1 Jan 2026 | Secondary | An inventory of AI uses and evidence that none fall in the prohibited categories |
| Illinois HB 3773 (Human Rights Act amendment) | Employers using AI in employment decisions | Effective 1 Jan 2026; proposed rules withdrawn 2 Jun 2026 | Secondary | Notice records and logs of which model influenced which employment decision |
| California SB 53 | Large frontier AI developers | Signed 29 Sep 2025; key provisions effective 1 Jan 2026 | Verified-primary | Mostly vendor-side; buyers ask vendors for their published framework |
| California CCPA ADMT regulations | Businesses using ADMT for significant decisions | Effective 1 Jan 2026; ADMT notice, opt-out and access by 1 Jan 2027 | Verified-primary | Pre-use notices, opt-out handling, access responses, risk assessments |
| NYC Local Law 144 | Employers and agencies using automated employment decision tools in NYC | Enforced since 5 Jul 2023 | Verified-primary | Annual bias audit, published summary, candidate notices |
| Colorado SB 26-189 | Developers and deployers of ADMT in consequential decisions | Signed 14 May 2026; effective 1 Jan 2027 | Verified-primary | Pre-use notice, adverse-outcome explanation within 30 days, human review, records kept 3 years |
What Does Each Law Actually Require?
Texas TRAIGA. The Texas Responsible Artificial Intelligence Governance Act took effect on 1 January 2026. According to Baker Botts’ summary, enforcement sits with the Texas Attorney General, who must give notice and a 60-day cure period before acting. Reported civil penalties run from $10,000 to $12,000 per curable violation, $80,000 to $200,000 per uncurable one, and $2,000 to $40,000 per day for a continuing violation. Treat those figures as secondary.
Illinois HB 3773. The amendment to the Illinois Human Rights Act makes it a civil rights violation for an employer to use AI that has a discriminatory effect, to use ZIP codes as a proxy for a protected class, or to use AI in employment decisions without notice, as Ogletree summarizes it. The core law has applied since 1 January 2026. The state’s proposed implementing rules were withdrawn on 2 June 2026, which leaves the duty in force without detailed rules on what the notice must say. Some guides read that withdrawal as a pause in the law itself. It is not: the rulemaking paused, the duty did not.
California SB 53. Governor Newsom signed the Transparency in Frontier Artificial Intelligence Act on 29 September 2025. The governor’s announcement says it requires large frontier developers to publish a framework describing how they incorporate national standards, creates a route to report critical safety incidents to the Office of Emergency Services, protects whistleblowers, and sets a civil penalty enforced by the Attorney General. Most mid-market companies are buyers here, not developers, so the useful move is asking your model vendors for their published framework.
California CCPA ADMT regulations. These are regulations under the CCPA rather than a new statute, and they took effect on 1 January 2026, according to the California Privacy Protection Agency. By 1 January 2027, businesses using automated decision-making technology for a significant decision (lending, housing, education, employment or healthcare) must give notice, honor opt-outs unless an exception applies, and answer access requests. Risk assessments for processing that began before 2026 and continues are due by 31 December 2027. Our CCPA automated decision-making guide maps those duties to tables and jobs.
NYC Local Law 144. The city’s Department of Consumer and Worker Protection has enforced it since 5 July 2023. It requires a bias audit within one year before a tool is used, public information about that audit, and notices to candidates and employees. In December 2025 the New York State Comptroller’s audit reported that the department’s review of 32 companies found one issue of non-compliance, while auditors reviewing the same companies identified at least 17 instances of potential non-compliance. A posted PDF is no longer a safe defense.
Colorado SB 26-189. The new law covers automated decision-making technology that materially influences a consequential decision about an individual. Deployers must give notice before use, a plain-language explanation within 30 days of an adverse outcome, and a route to meaningful human review. Developers must document intended uses, training-data categories and limits, and both sides must keep compliance records for at least three years. It creates no new private right of action. The Attorney General must adopt rules by 1 January 2027. According to the Attorney General’s rulemaking page, proposed rules were filed on 11 August 2026, an interim draft followed on 6 October 2026, and the rulemaking hearing is set for 26 October 2026, with written comments accepted through that date. Our Colorado AI Act post covers the build.
What Makes a State AI Register Hard to Keep Accurate?
Effective is not the same as enforceable
A law can be in force while its implementing rules are missing, withdrawn or still in hearing. Illinois has a live duty and no rules. Colorado has rules due on the same day the law starts. Your register needs both columns, or it reports a deadline you cannot meet as one you already have.
Scope words do not line up across states
Colorado says “consequential decision.” California says “significant decision” and excludes advertising to a consumer. NYC says “automated employment decision tool.” Texas reaches AI systems generally for certain prohibited uses. One internal tag such as decision_impacting cannot represent all four; you need a mapping per law.
Secondary reporting drifts from the statute
Colorado’s replaced June 2026 date still circulates. Vendor blogs restate penalty ranges without citing the bill. Every date in a register should carry its source and a status, and a secondary date should be re-checked before anyone builds a project plan on it.
The evidence sits in five systems
The notice went out from the CRM, the model ran in a notebook, the decision landed in the ERP, the appeal arrived by email and the logs expired after 90 days. No single owner can answer an Attorney General’s letter from that. This is a data silo problem wearing a legal label.
How Does a Lakehouse Produce the Evidence These Laws Ask For?
Every law in the register asks some version of the same four questions: which automated systems you run, which decisions they influence, what the person was told, and what record you can show later. A governed lakehouse answers each with a table rather than a scramble.
- System inventory: one Delta table of every model and agent, with owner, purpose, the laws it falls under and its status.
- Decision records: scoring jobs write the model version, input reference, output and timestamp for every decision that touches a consequential or significant outcome.
- Notice and opt-out log: notices sent and opt-outs received land in the same lakehouse, joined to the decision record by person and date.
- Retention: Databricks’ audit log system table is Public Preview with a 365-day default, so copy what you need into your own retained table to cover Colorado’s three years.
None of that makes you compliant on its own. It produces the evidence that counsel and a regulator read, and it turns a records request into a query against one governed platform.
If Your Company Looks Like This, What Should You Do First?
You hire at volume in New York City or Illinois. Start with employment. Inventory every screening and ranking tool, confirm the NYC bias audit is current and backed by the scoring data behind it, and log Illinois notices against each candidate record.
You lend, insure or price housing for consumers in Colorado or California. Your 1 January 2027 deadline is the hard one. Build the decision-record table and the adverse-outcome explanation workflow now, because a 30-day explanation clock cannot run on a manual search.
You only buy AI from vendors and build nothing. Ask each vendor for its published SB 53 framework where it applies, the documentation Colorado requires developers to provide, and where your data goes. Keep those answers in your inventory, not an inbox.
You run AI across many states with no inventory. Do the inventory before any single law. One list of systems, owners and the decisions they touch is the input every row of this register needs. Our data compliance deadlines page tracks the dates beyond these six. This register is general information, not legal advice, and your counsel makes the call on which laws apply to you.
Frequently Asked Questions (FAQs)
Which state AI laws take effect in 2026?
Texas TRAIGA, Illinois HB 3773 and the key provisions of California SB 53 took effect on 1 January 2026, as did California’s CCPA regulations on automated decision-making, which phase in through 2030. Those effective dates are consistently reported by law firms; we could not open every primary text.
When does the Colorado AI law take effect?
Colorado SB 26-189 takes effect on 1 January 2027. It replaced SB 24-205, which had been set for 30 June 2026 and never took effect.
Is NYC Local Law 144 still enforced?
Yes. The city has enforced it since 5 July 2023. A December 2025 State Comptroller audit criticized how the city enforced it, which points toward more scrutiny, not less.
Do these laws apply to companies headquartered in another state?
Often, yes. Most turn on where the affected person or the use is located rather than where the company is based. Counsel should confirm reach for your specific systems.
How often is this register updated?
Monthly. Each pass re-checks every date against its source, upgrades a secondary date to verified-primary when the primary text can be opened, and moves scheduled events such as Colorado’s rulemaking into the record once they happen.