2026 is the year US AI regulation stops being theoretical. Four states — Texas, Illinois, California, and Colorado — now have AI-specific laws on the books, and three of them are already in effect. If you build, deploy, or integrate AI systems that touch users in any of these states, you have compliance obligations right now.

This isn’t a policy overview. It’s a practical guide for developers and engineering teams who need to understand what these laws actually require, what deadlines matter, and what you need to build into your systems.

The 2026 Timeline

Three laws are already enforceable. Two more deadlines are coming fast. Let’s break each one down.

Texas — TRAIGA (In Effect)

The Texas Responsible AI Governance Act applies to anyone deploying AI that interacts with Texas residents — not just companies headquartered in Texas. If your SaaS product serves Texas users and makes consequential decisions, you’re in scope.

What it requires:

• Governance documentation — maintain written records describing how your AI systems work, what data they use, and how decisions are made.
• Consumer disclosures — when AI drives a consequential decision (credit, insurance, employment, healthcare), you must tell the affected person that AI was involved and explain the basis for the decision.
• High-risk controls — systems touching healthcare, biometrics, or discrimination-sensitive categories need additional safeguards and documentation.
• Regulatory sandbox — Texas created a statewide AI advisory council and sandbox program. If you’re building experimental AI, this is worth watching.

Developer action: Audit your systems for Texas-facing consequential decisions. Add disclosure mechanisms and document your AI pipelines. If you’re using third-party AI APIs for decision-making, you still own the compliance obligation.

Illinois — HB 3773 (In Effect)

Illinois went narrow but deep: this law targets AI in employment decisions — hiring, evaluation, promotion, and termination. It applies to employers with one or more employees in Illinois, which makes the scope enormous.

What it requires:

• No disparate impact — AI tools used in employment cannot create discriminatory outcomes against protected classes. You need to prove this with data.
• Notice to applicants and employees — anyone subject to an AI-driven employment decision must be notified that AI was used, what it evaluated, and how it factored into the outcome.
• Documentation retention — keep evaluation evidence, audit results, and decision records. Expect regulators to ask for them.

Developer action: If you build HR tech, recruiting tools, or performance-evaluation systems, this is your law. Implement bias testing as part of your CI/CD pipeline. Build notification hooks into your employment-decision workflows. Log everything.

California — AB 2013 + SB 53 (In Effect)

California passed two complementary laws that took effect January 1. Together, they cover training-data transparency and frontier-model safety.

AB 2013 — Training-Data Transparency

If you develop or provide generative AI, you must publicly describe the categories and sources of your training data. This includes:

• What types of data were used (web scrapes, licensed datasets, user-generated content, synthetic data)
• Where the data came from
• Safety documentation describing how the data was filtered or curated

This is a disclosure law, not a consent law — you don’t need permission for the data, but you do need to tell people what you used. If you’re fine-tuning models on proprietary data, check whether your data pipeline documentation meets the standard.

SB 53 — Frontier Model Safety

SB 53 targets developers of large-scale frontier models. Requirements include:

• Safety reports — publish detailed assessments of model capabilities and risks
• Risk-mitigation frameworks — document what you’re doing to prevent misuse
• Catastrophic-risk plans — yes, you need a written plan for worst-case scenarios
• Incident reporting — critical safety incidents must be reported
• Whistleblower protections — employees who flag safety concerns are legally protected

Most indie developers won’t hit the frontier-model threshold, but if you’re building on top of a covered model, understand that your upstream provider has obligations that may affect your access and usage terms.

For more on how data privacy intersects with AI development, see our AI and data privacy guide.

Colorado — SB 24-205 (June 30, 2026 Deadline)

This is the big one. Colorado’s AI Act is the most comprehensive AI law in the United States and draws direct parallels to the EU AI Act. If you’ve been tracking European regulation, Colorado will feel familiar — and that’s intentional.

Scope — high-risk AI systems used in:

• Hiring and employment
• Housing
• Credit and lending
• Insurance
• Education
• Healthcare

Obligations for Developers

If you build AI systems that deployers use in high-risk contexts, you must:

• Document functionality, limitations, and known risks — not marketing copy, real technical documentation
• Provide evaluation guidance — give deployers the information they need to assess whether your system is appropriate for their use case
• Disclose known harms — if you’re aware of failure modes, bias patterns, or accuracy limitations, you must say so

Obligations for Deployers

If you deploy AI in high-risk decisions, you must:

• Maintain a risk-management program — ongoing, not one-time
• Conduct impact assessments — before deployment and periodically after
• Disclose AI use to affected individuals — people must know AI is involved
• Provide contest opportunities — individuals must be able to challenge AI-driven decisions

This is the first US state law that creates EU-style governance obligations for both sides of the AI supply chain. The June 30 deadline is 10 weeks away. If you ship AI products used in any of those high-risk categories, start your documentation and impact-assessment work now.

For teams already working on EU compliance, there’s significant overlap — see our EU AI Act developer guide and GDPR guide for AI.

California — SB 942 + AB 853 (August 2, 2026 Deadline)

The final 2026 deadline targets AI-generated content transparency. Starting August 2, California will require:

• Visible notices on AI-generated content — users must be able to tell that content was created by AI
• Embedded disclosure (watermarking) for AI-generated images, audio, and video
• Platform compliance — large platforms and hosting providers must support and preserve these disclosures

This applies to generative AI providers, large online platforms, and hosting providers. If you’re building image generators, voice synthesis tools, video generation, or any content-creation AI, you’ll need watermarking infrastructure in place by August.

Developer action: Evaluate watermarking solutions now. C2PA (Coalition for Content Provenance and Authenticity) is emerging as the leading standard. Build content-provenance metadata into your generation pipelines rather than bolting it on later.

What This Means for Developers

The common thread across all six laws: documentation, transparency, and auditability. Here’s what changes in practice:

• Logging is no longer optional. Every AI-driven decision in a regulated category needs an audit trail — what model was used, what inputs it received, what output it produced, and what the human (if any) did with it.
• Disclosure is a product feature. Multiple laws require telling users that AI is involved. Build notification systems into your UX, not as afterthoughts.
• Bias testing is a legal requirement. Illinois mandates it for employment. Colorado mandates it for high-risk systems. Integrate fairness metrics into your testing pipeline.
• Documentation is a deliverable. Colorado requires developers to ship technical documentation with their AI products. Treat model cards and system documentation as first-class artifacts.
• Geography doesn’t protect you. Texas, Illinois, and Colorado all use residency-based jurisdiction. If your users are in those states, the laws apply to you regardless of where you’re incorporated.

Compliance Checklist for Development Teams

For tooling recommendations, see our guide on AI compliance automation.

Related Reading

• EU AI Act — What Developers Need to Know
• AI and GDPR — A Developer’s Guide
• AI Compliance Automation Tools
• AI-Generated Code and Data Privacy
• Who Owns AI-Generated Code?

---

This guide covers laws enacted as of April 2026. State AI regulation is evolving rapidly — additional bills are moving through legislatures in New York, Connecticut, and Virginia. We’ll update this guide as new laws pass.