US AI Laws: State Legislation Analysis & Expert Insights

The rush to regulate artificial intelligence isn’t happening in Washington, D.C. It’s unfolding, state by state and the emerging patchwork of laws is revealing some unexpected priorities and potential pitfalls. A recent analysis by the International Association of Privacy Professionals (IAPP) and GLACIS, along with ongoing tracking, shows states aren’t simply mirroring each other’s approaches. Instead, they’re grappling with AI’s implications across a surprisingly broad range of legal domains, from consumer protection to employment practices and even government operations.

A Fragmented Landscape

Unlike the European Union’s comprehensive AI Act, the United States is taking a decidedly fragmented approach. With federal legislation stalled, individual states are stepping into the void, creating a complex compliance environment for businesses operating nationally. This isn’t a sudden reaction; states began considering AI-related legislation years ago, initially focusing on internal government utilize. Early efforts centered on establishing safeguards or outright bans on high-risk applications of AI within state agencies, according to the IAPP’s tracker. However, the explosion of generative AI in late 2023 and early 2024 dramatically shifted the focus toward regulating commercial AI systems.

The current legislative activity is driven by several factors. Federal inaction is a primary catalyst, leaving a regulatory vacuum that states are eager to fill. Consumer protection concerns, fueled by instances of algorithmic bias in areas like hiring, lending, and insurance, are as well playing a significant role. States with existing privacy laws – California, Virginia, Connecticut, and Colorado, for example – are extending those frameworks to address the unique challenges posed by AI. Finally, there’s an element of economic competition, with states like California and Colorado aiming to position themselves as leaders in responsible AI governance. You can find a comprehensive overview of state AI laws at GLACIS’s US AI Laws Tracker.

Colorado Leads the Way, But at What Cost?

Colorado is currently the most advanced state in terms of comprehensive AI regulation. Its Artificial Intelligence Act (SB 24-205), signed into law in May 2024 and set to take effect June 30, 2026, is the first of its kind in the U.S. The law establishes a framework for regulating “high-risk AI systems,” but the definition of “high-risk” and the specific requirements for compliance remain areas of ongoing discussion and potential legal challenge. The law focuses on transparency and accountability, requiring developers to disclose how their AI systems work and to mitigate potential harms.

However, the Colorado law isn’t without its critics. Some businesses express concern that the regulations could stifle innovation and create unnecessary burdens, particularly for smaller companies. The potential for costly compliance measures and the risk of litigation are significant considerations. The IAPP notes that many of these legislative efforts fall under existing consumer protection laws, meaning amendments to state legal codes are the primary mechanism for regulation.

Employment AI: A Hotspot for Regulation

Beyond broad comprehensive laws, several states are focusing on specific applications of AI. Employment-related AI is emerging as a particularly active area of regulation. Illinois, New York, and Maryland have all enacted or are considering laws governing the use of AI in hiring, promotion, and termination decisions. These laws generally aim to prevent algorithmic discrimination and ensure fairness in the workplace. New York City’s Local Law 144, for example, requires employers using automated employment decision tools to conduct bias audits and provide notice to candidates.

The focus on employment AI reflects growing concerns about the potential for AI systems to perpetuate existing biases and create unfair labor practices. Algorithmic bias can arise from biased training data or flawed algorithms, leading to discriminatory outcomes. These laws seek to address these risks by requiring transparency and accountability in the use of AI in employment decisions.

Biometric Data and Privacy Concerns

Another key area of focus is biometric AI, particularly facial recognition technology. Illinois’ Biometric Information Privacy Act (BIPA) is already a landmark law in this space, and other states, including Texas and Washington, are considering similar legislation. These laws typically require companies to obtain informed consent before collecting and using biometric data and to implement robust security measures to protect that data.

The concerns surrounding biometric AI are multifaceted. Privacy advocates worry about the potential for mass surveillance and the misuse of biometric data. Civil rights groups raise concerns about the accuracy of facial recognition technology, particularly its tendency to misidentify people of color. The use of biometric data also raises security concerns, as breaches could expose sensitive personal information.

The Federal Shift and Its Ripple Effects

While states are leading the charge, federal policy is also evolving. In January 2025, President Trump signed an Executive Order “Removing Barriers to American Leadership in Artificial Intelligence,” effectively reversing President Biden’s earlier focus on safe and trustworthy AI. Leanware’s overview of US AI laws details this shift, which prioritizes innovation and competitiveness over strict regulation. This federal move doesn’t negate state-level efforts, but it does create a more complex regulatory landscape for businesses. Companies now demand to navigate a mix of federal policies and state laws, increasing compliance costs and complexity.

What’s Next: A Waiting Game and Potential Litigation

The next 18-24 months will be critical. Colorado’s AI Act goes into effect June 30, 2026, and businesses will need to prepare for compliance. Other states are likely to follow suit, enacting their own AI laws and regulations. The IAPP’s tracker will continue to be a valuable resource for monitoring these developments.

Expect legal challenges. The scope and interpretation of these laws are likely to be contested in court, particularly regarding the definition of “high-risk AI” and the requirements for compliance. Businesses should closely monitor these legal developments and seek legal counsel to ensure they are prepared to navigate this evolving regulatory landscape. The interplay between state and federal policy will also be a key factor to watch, as the federal government may attempt to preempt state laws in certain areas.