State AI Regulations in 2026: Colorado, Texas, California, Illinois, and What's Coming

While Congress debates whether to preempt them, states have kept writing AI law. State AI regulations now range from Colorado's comprehensive AI Act and Texas's Responsible AI Governance Act to California's and New York's frontier-model statutes and Illinois's first-in-the-nation annual AI audit requirement. In the last two weeks of March 2026 alone, governors signed 19 new state AI laws. Each takes a different approach and creates distinct obligations, and for a carrier writing in multiple states, the compliance surface keeps expanding.

This guide covers what the major state AI laws require, how insurance-specific AI rules sit alongside them, where privacy law collides with AI models, what federal preemption means in practice, and how to build one governance program that holds up across jurisdictions. It reflects our review as of October 2026. Statutes and effective dates in this area move, so confirm current text with counsel before relying on any summary, including this one.

State AI regulations at a glance

Carriers face two layers. General state AI laws, enforced by attorneys general, reach any business making consequential decisions with AI. Insurance-specific AI rules, enforced by the department of insurance, reach carriers directly. The table below covers the states with the most activity.

Beyond these, 24 states plus the District of Columbia had adopted the NAIC model bulletin as of April 1, 2026. Our state-by-state insurance AI governance tracker lists each state's citation and effective date.

Why state AI laws are multiplying

In the last two weeks of March 2026, governors in seven states signed 19 new AI laws, taking the year's total from 6 to 25. Another 27 bills had passed both chambers at that point, and across 45 states legislators had introduced 1,561 AI-related bills.

Legislatures pass laws in bursts because many sessions run only a few months, and late March is the final stretch. The surge still reflected political consensus. These bills were introduced months earlier and advanced by bipartisan coalitions.

The March laws clustered around four themes:

• Transparency and content provenance. Washington's HB 1170 requires AI providers with over one million monthly users to embed "latent disclosures," provenance markers, in AI-generated or modified content. Utah's provenance bill adds similar requirements.
• Harmful synthetic content. Utah's HB 276 criminalizes non-consensual AI-generated intimate images, and HB 289 addresses AI-generated child sexual abuse material. Idaho's S 1297 regulates conversational AI services.
• Consumer-facing AI interactions. Washington's HB 2225 requires chatbot operators to disclose AI interaction, protect minors, and safeguard against self-harm facilitation, with specific rules on what disclosures say and when they appear.
• Insurance and healthcare AI. Utah's SB 319 increases disclosure requirements for AI in health insurance preauthorization. Washington's SB 5395 restricts how health carriers use AI in prior authorizations. The pattern is clear: AI-assisted coverage and claims decisions are being treated as consumer protection issues.

The Colorado AI Act (SB 24-205)

Colorado's AI Act, signed in May 2024, is the most comprehensive state AI law in the country. It sets obligations for developers, who build AI systems, and deployers, who use them to make consequential decisions.

The original effective date of February 1, 2026 was moved to June 30, 2026 by SB 25B-004. Because the date has already shifted once, carriers should confirm the law's current status and text before relying on the version summarized here.

Who it covers

The law targets high-risk AI systems: any AI system that makes, or is a substantial factor in making, a consequential decision about a consumer in education, employment, financial or lending services, essential government services, healthcare, housing, insurance, or legal services. Jurisdiction follows the consumer. A carrier headquartered in Texas whose underwriting model evaluates a single Colorado applicant is in scope.

What developers must do

Developers must publish transparency statements and give deployers documentation sufficient to understand the system, including reasonably foreseeable uses and known harmful uses, the type of training data, known limitations and risks of algorithmic discrimination, and the system's purpose and intended benefits.

What deployers must do

Deployers, a category that includes carriers using AI in underwriting, pricing, or claims, carry the heavier burden:

1. A risk management policy and program governing high-risk AI systems.
2. An impact assessment for each high-risk system before deployment and annually after, documenting purpose, risk evaluation, data categories, known limitations, and discrimination mitigations.
3. Consumer notice that AI is being used to make a consequential decision.
4. An opportunity to appeal, with human review, when a consequential decision is adverse, plus an explanation and a chance to correct inaccurate data.
5. Disclosure to the Colorado Attorney General within 90 days of discovering algorithmic discrimination.

Records (impact assessments, monitoring logs, incident reports) must be retained for three years. The law's "should have discovered" language means the clock can start even if nobody was watching.

Enforcement and safe harbor

The Colorado Attorney General has exclusive enforcement authority under the Colorado Consumer Protection Act, with penalties up to $20,000 per violation and no private right of action. Developers and deployers owe reasonable care to protect consumers from known or reasonably foreseeable risks of algorithmic discrimination. Building the program on the NIST AI Risk Management Framework or ISO/IEC 42001 gives a deployer a statutory safe harbor.

Colorado's insurance AI rules: SB 21-169 and Regulation 10-1-1

Colorado carriers face a second, older regime that is easy to confuse with the AI Act. SB 21-169, signed July 6, 2021, prohibits carriers from using external consumer data and information sources (ECDIS), algorithms, and predictive models in ways that unfairly discriminate on the basis of race, color, national or ethnic origin, religion, sex, sexual orientation, disability, gender identity, or gender expression. Regulation 10-1-1 (3 CCR 702-10), adopted in September 2023, requires a governance and risk-management framework around that use. Colorado runs this instead of the NAIC model bulletin.

The rules arrived line by line:

• Life carriers filed an initial progress report by June 1, 2024 and had to meet the full governance-framework requirements by December 1, 2024. Carriers that do not use ECDIS file an attestation.
• Private passenger auto and health benefit plan carriers were brought under the framework next, with annual compliance reports due to the Division of Insurance beginning July 1, 2026.
• Farm and commercial P&C lines are not yet covered. The Division has expanded the rules one line at a time, so carriers in those segments should watch rulemaking.

What Colorado expects in practice

The regime asks carriers to stand up board- and senior-management oversight of ECDIS and model use, inventory the data sources and models in use (third-party tools included), test for unfairly discriminatory outcomes and correct them, and file the required reports. Testing measures actual outcomes. A model designed to be neutral that still produces disparate impact fails.

The regulation leaves room on methodology. A defensible approach has four parts:

• Disparate impact analysis. Compare outcomes across protected classes using the four-fifths rule as a baseline: if any class's favorable-outcome rate falls below 80% of the most favored class's rate, investigate. Apply it to approvals, pricing tiers, and claims decisions. Some regulators and courts apply stricter standards.
• Proxy variable auditing. Protected attributes rarely appear as direct inputs; they show up as proxies such as ZIP code, occupation, or credit score. Measure each feature's proxy strength and influence, and remove or constrain proxies that drive disparate impact without actuarial justification.
• Intersectional testing. A model can treat women and Black applicants fairly in aggregate and still disadvantage Black women. Colorado's current quantitative testing regulation focuses on race, but the breadth of protected classes in SB 21-169 suggests intersectional analysis will matter more as the framework matures.
• Counterfactual analysis. Change only the protected attribute and see whether the decision changes. It is computationally heavy and produces the most direct evidence of encoded bias.

The Division has indicated it will judge both the substance and the rigor of submissions. The file should include a current AI system inventory (purpose, inputs, decision scope, risk class, deployment date, owner), impact assessment records that reflect real analysis rather than boilerplate copied across systems, bias test results with thresholds and the rationale for them, consumer notification logs, continuous monitoring evidence (quarterly batch reports fall short), and incident records. An empty incident log tends to tell an examiner that detection is missing.

Texas: TRAIGA (HB 149) and the TDI bulletin

The Texas Responsible Artificial Intelligence Governance Act was signed by Governor Abbott on June 22, 2025 and took effect January 1, 2026. The final version was pared back from earlier drafts. Its strongest requirements fall on state agencies, which must disclose when consumers interact with AI; healthcare providers must disclose AI use in treatment.

For private businesses, TRAIGA prohibits developing or deploying AI that intentionally aims to incite self-harm, harm to others, or criminal activity. Liability is intent-based, a different philosophy from Colorado's impact-based approach.

The provision that matters most for enterprise compliance is the safe harbor. Organizations that substantially comply with the NIST AI Risk Management Framework or another recognized standard gain protection against enforcement, as do organizations that find violations through their own adversarial testing and red-teaming. The Attorney General enforces with tiered civil penalties: $10,000 to $12,000 per curable violation, $80,000 to $200,000 per uncurable violation, and up to $40,000 per day for ongoing violations. There is no private right of action.

Texas carriers have a separate insurance layer. On June 12, 2026, the Texas Department of Insurance issued Commissioner's Bulletin B-0003-26, reminding regulated entities that AI-supported decisions must comply with existing Texas insurance law, including unfair trade practice and discrimination statutes, and setting out how TDI expects carriers to govern the development, acquisition, and use of AI. Texas does not adopt the NAIC model bulletin.

California: SB 53, Bulletin 2022-5, and CCPA

California's SB 53, the Transparency in Frontier Artificial Intelligence Act, was signed by Governor Newsom on September 29, 2025, a year after he vetoed the broader SB 1047. It targets frontier developers training models with more than 10^26 operations (fine-tuning and other material modifications count). Covered developers must maintain a safety and security protocol and publish a plain-language summary updated at least annually, report safety incidents to the California Office of Emergency Services, confidentially submit summaries of catastrophic-risk assessments, and refrain from retaliating against whistleblowers. "Large frontier developers," those with annual revenue above $500 million, face additional obligations. The Attorney General can seek up to $1 million per violation. The California Department of Technology can recommend updates to the thresholds, subject to legislative adoption.

No carrier trains frontier models, so SB 53 reaches carriers indirectly, through the vendors they buy from. The direct insurance rule is Bulletin 2022-5, issued June 30, 2022, which warns that AI and Big Data may not produce conscious or unconscious bias in marketing, rating, underwriting, claims, or fraud investigation, and that inputs without a sufficient actuarial nexus to risk of loss can be unfairly discriminatory. It reaches every line affecting California residents. California also runs the most developed privacy regime, covered below.

New York: the RAISE Act and Circular Letter No. 7

New York's Responsible AI Safety and Education (RAISE) Act applies to developers of advanced frontier models. In March 2026, Governor Hochul signed amendments to the RAISE Act requiring critical safety incidents to be reported within 72 hours of determination, much faster than most federal frameworks allow. The law also asks covered developers for an independent audit.

For carriers, the operative rule is DFS Insurance Circular Letter No. 7, issued July 11, 2024, which governs AI systems and ECDIS in underwriting and pricing. Carriers must show these tools are not unfairly discriminatory, govern them under board and senior-management oversight, and be transparent with consumers. It reaches every carrier authorized in New York across health, life, and P&C.

New York City's Local Law 144, in force since 2023, requires employers using automated employment decision tools to commission annual bias audits and publish the results, a template other jurisdictions have borrowed.

Illinois: SB 315 and Company Bulletin 2024-08

Governor JB Pritzker signed SB 315, the Artificial Intelligence Safety Measures Act, on July 9, 2026, making Illinois the third state to regulate frontier developers after California and New York. It became Public Act 104-0538.

The Act covers "large frontier developers": companies that train a model with more than 10^26 floating-point operations and whose corporate family reported more than $500 million in prior-year revenue. It takes effect January 1, 2027, with substantive duties starting January 1, 2028. Covered developers must publish a safety framework for catastrophic risk (defined as a foreseeable, material risk of contributing to the death or serious injury of more than 50 people, or more than $1 billion in damage, from a single incident), file transparency reports at deployment, and report critical safety incidents within 72 hours, or 24 hours when there is imminent risk of death or serious injury. Penalties run up to $1 million for a first violation and $3 million for each one after.

The first-in-the-nation piece is the audit. Each year, a covered developer must retain an independent third party to audit its compliance, publish a redacted version, and send it to the state. California required a published framework; New York added a single audit; Illinois made it annual. Each law raised the evidentiary bar the last one set.

SB 315 does not bind carriers. Illinois carriers already answer to Company Bulletin 2024-08, issued March 13, 2024, which adopts the NAIC Model Bulletin on the Use of AI Systems by Insurers and expects a written AIS Program sized to potential consumer harm. The two laws share no text and no enforcement path. They share a premise: an organization running consequential AI should be able to produce documented evidence, on demand, that it governs those systems. The direction is away from self-attestation and toward independent verification on a schedule, and insurance examiners are moving the same way.

Illinois's AI Video Interview Act also remains in effect, requiring employers who analyze video interviews with AI to notify candidates, explain how the AI works, obtain consent, and delete recordings within 30 days of a request.

Utah, Washington, and other state AI laws to watch

Utah. Governor Spencer Cox signed nine AI bills in 2026, eight in the last two weeks of March, covering AI literacy in schools, deepfake criminalization, defamation updates for AI-manipulated content, expanded government AI oversight, and health insurance preauthorization disclosure. Utah layers targeted rules across domains instead of passing one framework, so obligations are spread across statutes.

Washington. Governor Bob Ferguson signed HB 1170 and HB 2225, on AI content disclosure and chatbot safeguards, alongside SB 5395 on health insurance prior authorization.

Maryland and Vermont introduced 2026 bills addressing AI in hiring, insurance underwriting, and consumer lending. As of our March 2026 review they were still in committee. Both states already adopted the NAIC bulletin for carriers.

Where privacy law meets AI governance

State privacy statutes are a quieter source of AI obligations for carriers. The California Consumer Privacy Act, as amended by the California Privacy Rights Act, gives residents the right to know, delete, opt out of sale or sharing, and limit use of sensitive personal information. Colorado, Connecticut, Virginia, Utah, Texas, Oregon, Montana, and others have passed laws on the same architecture.

Carriers often assume the Gramm-Leach-Bliley carve-out takes them out of scope. It is narrower than that. GLBA covers information collected to provide a financial product. Telematics from a driving app, web behavior used for marketing, and smart-home sensor data used for risk assessment can fall squarely within CCPA. Four collisions follow:

• Data minimization versus model performance. Collection must be "reasonably necessary and proportionate." A carrier using 200 underwriting variables or ten years of claims history should be able to justify each. Testing model performance with and without a sensitive feature gives the evidence: a 0.3% accuracy loss and an 8% loss support very different decisions.
• Deletion and trained models. Suppose a carrier deletes 12,000 policyholder records within the 45-day window, but its pricing model was trained on them and keeps using what it learned. Whether model parameters count as personal information is unsettled. The FTC has ordered companies to delete both improperly obtained data and the models trained on it. Carriers need a documented position, whether periodic retraining that excludes deleted records, differential privacy, or federated approaches, plus thresholds for when accumulated deletions trigger retraining.
• Opt-outs and uneven degradation. If younger drivers opt out of telematics sharing at twice the rate of older drivers, pricing accuracy degrades for that group, and the carrier may fall back on demographic proxies. The privacy team sees opt-out rates; the data science team sees accuracy. Only monitoring both on the same segments catches the disparate-impact risk.
• Automated decision-making rights. CPRA gives consumers rights to information about, and in some contexts to opt out of, automated decision-making. "Our model determined your risk changed" will not answer "why did my premium go up?" Carriers need per-decision explainability, such as feature attributions or counterfactual explanations, generated on demand.

The practical answer is joint governance: one data inventory and retention schedule serving privacy and AI, deletion workflows that check which models used the data, integrated monitoring, and a single explanation system serving consumers, examiners, and internal review.

Federal preemption and state AI laws

On March 20, 2026, the White House published a "National Policy Framework for Artificial Intelligence Legislative Recommendations," urging Congress to adopt a "minimally burdensome national standard" and preempt state AI laws that impose "undue burdens." Senator Blackburn's proposed TRUMP AMERICA AI Act would codify preemption, though passage was uncertain. Executive Order 14365, signed in December 2025, asserts federal authority over state AI regulation with no insurance carve-out, and the NAIC has opposed it; we cover that fight and the McCarran-Ferguson question in our guide to the NAIC AI bulletin.

Deferring compliance while hoping for preemption is a bet that Congress will move on technology regulation faster than it has in twenty years. Meanwhile regulators in Colorado, New York, Utah, and Washington are training examiners and deploying oversight tools.

What state AI laws have in common

Beneath the differences, nearly every state AI law and regulation asks for the same handful of capabilities, and they overlap with the EU AI Act and the CFPB's position that creditors must explain algorithmic credit decisions with no exception for complex models. For the EU side, see our EU AI Act compliance guide.

• Transparency. Being able to explain what a model does and why it reached a specific decision, to a regulator, an auditor, or the affected person. Techniques like Shapley values show which features drove an individual prediction.
• Non-discriminatory outcomes. Avoiding disparate impact, beyond simply excluding protected characteristics as inputs, and documenting how disparities are addressed.
• Human oversight. For high-risk uses, a reviewer with enough context to evaluate the AI's recommendation. A human in the loop who lacks that context adds little.
• Audit trails. Records of inputs, processing, and outputs sufficient to reconstruct a challenged decision. Retrofitting logging is far harder than building it in.

Building a multi-state AI compliance program

Building a separate program for each state does not scale. A framework-based approach builds one governance infrastructure that satisfies the common core and adjusts parameters per jurisdiction.

1. Map the AI inventory. Every AI system across Colorado's eight consequential decision domains, including vendor-embedded models, ML features inside larger platforms, and decision components nobody calls AI. Capture purpose, data, decisions influenced, and states of operation. Shadow AI deployed by individual teams belongs on the list too. It is the first thing every regulator asks for.
2. Adopt NIST AI RMF as the baseline. Colorado and Texas both reward it with safe harbors, Colorado's impact assessments map to its risk identification and mitigation practices, and California's transparency expectations align with its documentation guidance. Layer the NAIC AIS Program on top for insurance departments.
3. Make impact assessments continuous. Assess each high-risk system before deployment and again as the system, its data, or the rules change.
4. Monitor continuously and define incidents. Colorado's 90-day discrimination disclosure, New York's and Illinois's 72-hour frontier incident windows, and California's incident reporting all assume detection. Monitor fairness, drift, and safety on the same segments regulators will ask about.
5. Build consumer notification and appeal workflows. Notice when AI is involved, an explanation when the outcome is adverse, and a path to human review. Designing these in now costs a fraction of retrofitting them.
6. Generate documentation as you operate. Training data descriptions, evaluation results, mitigations, and audit trails, retained at least three years to meet Colorado. Evidence produced continuously answers an inquiry faster than evidence assembled under deadline.
7. Join privacy and AI governance. Shared inventories, deletion-aware retraining, and one explanation system.
8. Train the people involved. Business, legal, and executive teams need to understand the obligations; technical teams need to know how their work supports them. Refresh as the rules change.

State AI regulation is the operating environment for any carrier using AI in underwriting, claims, or pricing, and it keeps growing every legislative session. If you want governance that runs continuously, maps to NAIC and state requirements, and keeps an audit-ready record of every AI interaction, see how Swept handles AI governance.