What AI laws apply to US businesses in 2026?

No single federal AI law covers US businesses in 2026. The rules come from existing federal law enforced by the FTC, a federal deepfake takedown law and a December 2025 executive order aimed at state AI laws. On top sit state laws in California, Texas, Colorado, Illinois, Utah and New York. Which ones apply depends on where your customers and staff are and what your AI decides.

Most questions about AI laws in the US come from three situations. A business adds a chatbot, an employer screens resumes with AI, or a company's software makes decisions about loans, housing, insurance or jobs. This guide maps each one to the laws in force as of October 2026. It is general information, not legal advice, so have counsel review your specific use before launch.

On this page

• Is there a federal AI law in the US
• What the December 2025 executive order changes
• State AI laws in effect or coming in 2026 and 2027
• What Texas TRAIGA requires
• Colorado's AI law after the 2026 rewrite
• California AI rules that reach ordinary businesses
• AI in hiring: New York City, Illinois and Colorado
• Chatbots, AI disclosure and deepfakes
• Does the EU AI Act apply to US businesses
• Which AI laws apply to your business
• An AI compliance checklist for 2026

Is there a federal AI law in the US

Congress has not passed a general AI law. Federal rules still reach AI through existing statutes. The FTC Act bans deceptive and unfair practices whether a human or a model is involved. Civil rights, credit and employment laws apply to decisions an AI system makes or shapes.

Federal regulators have said so directly. On September 25, 2024, the FTC announced Operation AI Comply, a sweep of five enforcement actions. Its chair stated that "there is no AI exemption from the laws on the books." One target was DoNotPay, which marketed itself as a robot lawyer.

One AI-specific federal law does apply to many websites. The TAKE IT DOWN Act, Public Law 119-12, became law on May 19, 2025. Covered platforms had one year to set up a process for removal requests. They must take down nonconsensual intimate images, including AI deepfakes, within 48 hours of a valid request, and the FTC enforces the law. Any site or app that hosts user uploads should confirm whether it counts as a covered platform.

What the December 2025 executive order changes

Executive Order 14365, "Ensuring a National Policy Framework for Artificial Intelligence," was signed on December 11, 2025 (90 FR 58499). It sets up a federal push against state AI laws the administration considers onerous:

• The Attorney General had 30 days to create an AI Litigation Task Force to challenge state AI laws in court.
• The Commerce Department had 90 days to publish an evaluation naming onerous state laws.
• States on that list risk losing non-deployment BEAD broadband funds.
• The FTC must issue a policy statement on how the FTC Act applies to AI models, and the FCC must consider a federal disclosure standard.
• Recommended federal legislation should not preempt state child safety laws, data center rules or state government use of AI.

An executive order doesn't repeal a state statute. State AI laws stay enforceable until a court strikes them down or Congress preempts them. Plan to comply with the state laws that apply to you while the litigation plays out.

State AI laws in effect or coming in 2026 and 2027

State laws follow the people affected. A company based in Florida that screens candidates for Chicago jobs or serves customers in Texas falls under those states' rules.

What Texas TRAIGA requires

The Texas Responsible Artificial Intelligence Governance Act took effect on January 1, 2026. For private businesses it works mostly as a list of banned uses. It prohibits developing or deploying AI that intentionally encourages self-harm, harm to others or crime. It also bans AI built with intent to discriminate unlawfully against a protected class, and AI made with the sole intent of producing illegal sexual content or deepfakes.

Intent decides the discrimination ban. The statute says a disparate impact is not sufficient by itself to show intent to discriminate. Disclosure duties fall on government agencies that offer AI to consumers and on health care providers. Providers must disclose AI use in treatment by the date the service is first provided.

The Attorney General has exclusive enforcement power, and there is no private right of action. The AG must give notice and a 60-day cure period before suing. Penalties run $10,000 to $12,000 per curable violation, $80,000 to $200,000 per uncurable violation, and $2,000 to $40,000 per day for continuing violations. A regulatory sandbox lets approved companies test AI systems for up to 36 months.

Colorado's AI law after the 2026 rewrite

Colorado's 2024 AI Act never took effect in its original form. In May 2026 the legislature passed SB 26-189, which repeals the 2024 law and replaces it with a narrower framework for automated decision-making technology. The new rules apply to consequential decisions made on or after January 1, 2027, according to the Baker Botts summary of SB 26-189.

• Deployers must give clear notice before using covered AI in a consequential decision, such as one about employment, lending, housing or insurance.
• After an adverse outcome, the deployer has 30 days to give a plain-language explanation, a way to ask for more information and a statement of the consumer's rights.
• Consumers can ask to correct inaccurate personal data and request meaningful human review, where commercially reasonable.
• Deployers keep records for at least three years, and developers must give deployers documentation on intended uses, training data categories and known limits.

The rewrite drops the old law's impact assessments, risk management program and reporting to the Attorney General. Enforcement sits with the Attorney General under the Colorado Consumer Protection Act, with a 60-day cure period for most violations and no private right of action.

California AI rules that reach ordinary businesses

Most of California's headline AI laws target the companies that build models. SB 53, signed on September 29, 2025, requires large frontier developers to publish a safety framework. It also sets up safety incident reporting to the Office of Emergency Services and protects whistleblowers. AB 2013 requires generative AI developers to publish summaries of their training data. A business that only uses ChatGPT, Claude or Gemini is not the target of either law.

The rule that reaches ordinary companies is privacy law. The California Privacy Protection Agency's regulations on automated decisionmaking technology, risk assessments and cybersecurity audits were approved on September 22, 2025. They took effect on January 1, 2026, with later compliance dates for parts of them. Any business covered by the CCPA that uses AI to make major decisions about consumers should map those uses now.

AI in hiring: New York City, Illinois and Colorado

Hiring is where small and mid-size businesses meet AI law first. New York City's Local Law 144 has been enforced since July 5, 2023. An employer may use an automated employment decision tool only after a bias audit within the prior year. A summary of the results must be public, and candidates get notice 10 business days before the tool is used.

Illinois HB 3773 took effect on January 1, 2026. It bars employers from using AI in ways that discriminate against protected classes, and from using ZIP codes as a stand-in for protected traits. Employers must also give notice when AI is used in employment decisions. Colorado adds employment decisions to its consequential decision rules from January 1, 2027.

Federal anti-discrimination law applies on top of all three. A resume screener that rejects older applicants at a higher rate creates the same exposure whether a person or a model made the call. Test outcomes by group before and after launch.

Chatbots, AI disclosure and deepfakes

Utah's AI Policy Act requires businesses to disclose generative AI use when a consumer asks, and up front in regulated occupations such as health care. Its sunset now runs to July 1, 2027. Texas requires disclosure from government agencies and health care providers. Neither state requires a general disclosure banner from every private chatbot, but disclosing anyway costs one sentence and heads off complaints that a customer was misled.

Voice and likeness have their own rules. Tennessee's ELVIS Act, in force since July 1, 2024, targets unauthorized AI copies of a person's voice. An AI receptionist that answers calls should use a licensed or synthetic voice, never a cloned one, and should say it is an AI when asked.

Data handling sits under every one of these laws. Before staff paste customer records into a public model, read the guide on whether ChatGPT is safe for business data.

Does the EU AI Act apply to US businesses

It can. The EU AI Act reaches companies outside the EU that place AI systems on the EU market or whose AI output is used in the EU. A US software company selling an AI hiring tool to a client in Germany is inside its scope. The current implementation timeline lists these dates:

Dates come from the AI Act implementation timeline. A US business with no EU customers or users can set the Act aside for now.

Which AI laws apply to your business

Say a 40-person staffing firm in Texas uses an AI screener for roles in Chicago and New York City and runs a website chatbot. It needs a bias audit and 10-business-day notices for the NYC roles, an Illinois notice and a ZIP code check for Chicago, and TRAIGA's intent rule in Texas. That is three sets of obligations from one tool.

An AI compliance checklist for 2026

1. List every AI tool in use, including features inside your CRM, help desk and hiring software.
2. Note which decisions each tool makes or shapes, and where the affected people live.
3. Match each use to the laws in the decision table above.
4. Add AI disclosure to chatbots and voice agents, and to any consequential decision covered by Colorado from 2027.
5. Test hiring and eligibility tools for different outcomes by group, and book the NYC bias audit if you hire there.
6. Keep records of model versions, prompts, decisions and human reviews for at least three years.
7. Review vendor contracts for who handles audits, notices and data deletion.
8. Recheck the list every quarter, because new state laws keep arriving.

Build compliance into the product before launch. Disclosure, logging and human review add little to the cost of an AI chatbot build or an AI agent when they are designed in from day one. Retrofitting them later costs more.

Start with the inventory in step 1, because no other step works without it. The AI development team at Techno Mantra builds chatbots, agents and decision tools with disclosure text, audit logs and human review steps. Data controls are set up for the states you serve. Send a short description of your AI use through the contact page or to info@technomantraa.com. Every inquiry gets a reply within one business day.