US state AI laws for small businesses: what applies in 2026 and 2027
BuildAIPolicy Research · Published 1 November 2026 · 2 min read
There's no general federal AI statute in the US. Instead, a growing number of state laws cover specific uses of AI, especially decisions about people such as hiring, lending and housing. Most small businesses that use AI for drafting or research aren't directly affected; those that use AI to make or influence decisions about people may be. Here's the picture as of November 2026.
In force now
- Illinois (since January 1, 2026): amendments to the Illinois Human Rights Act make it a civil rights violation to use AI in employment decisions in a way that discriminates, and require employers to give notice when AI is used in hiring.
- Texas (since January 1, 2026): the Texas Responsible Artificial Intelligence Governance Act bans certain uses of AI by anyone, such as AI intended to unlawfully discriminate. Its disclosure duties mainly fall on government agencies and health care providers.
From January 1, 2027
- Colorado: SB 26-189, signed on May 14, 2026, replaced the Colorado AI Act before it took effect. Businesses that use automated decision-making technology that materially influences a consequential decision about a person, such as hiring, lending or housing, will need to give notice, explain adverse outcomes on request, allow corrections and offer human review. The Attorney General has said enforcement will wait until rulemaking is finished.
- California: under the California Consumer Privacy Act regulations, businesses covered by the CCPA that use automated decisionmaking technology to make significant decisions about consumers must give a pre-use notice and offer an opt-out or an appeal, among other requirements.
Our free checker shows in a few questions whether the Colorado and California rules are likely to apply to you, and our page on the Colorado and California rules covers them in more detail.
The federal picture
A December 11, 2025 executive order directed federal agencies to challenge state AI laws and to prepare a federal framework that would override them. A bipartisan discussion draft of a federal AI bill was released in June 2026. No federal law overriding state AI laws has been passed, so the state laws above still apply unless a court, Congress or the state changes them.
What a small business can do now
- List the AI tools your business uses and what each is used for.
- Flag any tool that makes or influences decisions about people: job applicants, employees, customers' credit or eligibility.
- For those tools, check which states the people affected are in, and ask your vendors for documentation on how the tool works and what data it uses.
- Prepare notices and a simple process for explanations and human review, so you're ready before January 1, 2027.
- Write the rules for everyday AI use into a policy, and give staff short training on it.
Our US sample pack shows an AI policy, risk register and tool inventory for a fictional accounting firm.
Related
Free checklist (PDF)
AI tools audit checklist
Find out which AI tools your team uses, how, and with what information. The first step in any AI policy.
- Where to look for AI tools, including ones built into software you already use
- What to record for each tool, from the data that goes in to who is responsible
- What to decide once you have the list
Free tools, no sign-up
- Free AI policy generatorA short AI use policy in a few minutes
- Australia: automated decisions checkerDoes the 10 December 2026 rule apply to you?
- US: Colorado and California checkerAutomated decision rules from 1 January 2027
- EU AI Act checkerWhich transparency duties apply to you
- AI regulations trackerAI rules by region, with email alerts
- Free checklistsAI tools audit and 10 December readiness, as PDFs
Sources
- GC AI: State AI laws in 2026 (updated October 2026)
- Snell & Wilmer: Colorado rewrites its AI law
- Crowell: Colorado hits reset on AI regulation, SB 26-189 repeals and reenacts the Colorado AI Act
- CPPA: California finalizes regulations to strengthen consumers' privacy
- K&L Gates: Pared back version of TRAIGA signed into law
- White & Case: Key takeaways from the executive order establishing federal AI policy framework
This article is general information, last checked against these sources on 1 November 2026. It isn't legal advice. For advice on your situation, speak to a qualified adviser.