State-by-State AI Communications Reference

Originally published June 2026. Updated September 29, 2026.

The AI regulatory patchwork is now an operating reality

In brief: State AI legislation accelerated through 2025 and 2026. Every brand operating across multiple states is now subject to a patchwork of disclosure rules, claim standards, and enforcement priorities that vary substantially by jurisdiction. This is the reference framework, organized by tier, updated quarterly.

Key facts, as of May 2026

Which states have active comprehensive AI regulation?

California

California operates under multiple overlapping AI regimes. AB 2013 governs disclosure of AI training data for generative AI providers. SB 942 addresses watermarking and provenance of AI-generated content. The 2024 AI-bias employment regulations apply to algorithmic decision tools.

Brand communications should anticipate California AG enforcement priorities around AI-generated content fraud, deceptive AI claims, and discrimination in consumer-facing AI.

Operational requirements:

• AI-generated promotional content distributed in California should carry disclosure consistent with state law.
• Employment-related AI tools should have documented bias audits.
• AI-driven consumer-facing decisions should support consumer right-to-correction processes.

New York

New York City Local Law 144 requires bias audits for automated employment decision tools and notice to candidates. State-level AI advertising rules continue to emerge. NY DFS has expanded AI scrutiny in financial services.

Operational requirements:

• Employment AI tools used to evaluate New York candidates must have current bias audits.
• Financial services using AI must maintain documented model governance.
• Consumer AI claims should be substantiated.

Illinois

Illinois BIPA extends to AI applications involving biometric processing, including facial recognition, voice analysis, and similar technologies. Damages provisions remain substantial. Illinois also maintains AI-specific labor protections affecting employer AI use in workforce decisions.

Operational requirements:

• Any AI processing biometric data of Illinois residents requires informed consent.
• Employer AI use in workforce decisions must have documented governance practices.

Colorado

The Colorado AI Act is the first comprehensive AI consumer protection law in the United States. It applies to high-risk AI systems used in consequential decisions involving employment, housing, lending, healthcare, education, insurance, and government services.

Operational requirements:

• High-risk AI systems must complete impact assessments.
• Consumer disclosures must remain specific and accessible.
• Right-to-correction processes must be operational.
• Adverse incidents must be reported within statutory timelines.

Utah

Utah maintains AI disclosure requirements for high-risk consumer applications. The regime is narrower than Colorado's but highly specific. Brand communications using AI in regulated consumer applications should anticipate Utah AG attention.

Texas

Texas currently maintains sector-specific AI rules across healthcare, insurance, and selected consumer applications. The legislative environment remains highly active, with the rule set expanding quarterly.

Which states are actively monitoring AI without comprehensive laws yet?

Washington, Massachusetts, New Jersey, Virginia, and Connecticut

Each of these states has signaled active interest in AI consumer protection. Specific legislation is either pending or recently enacted in narrower domains. Brand communications teams should monitor:

• Attorney general enforcement actions
• Sector-specific regulatory guidance
• Consumer protection updates
• AI disclosure developments

Which states limit AI regulation to specific sectors?

Florida, Georgia, North Carolina, and Ohio

These states currently focus primarily on insurance regulation, healthcare AI oversight, and select consumer applications. General consumer brands face limited state-specific AI obligations beyond existing federal frameworks.

Which states have minimal AI-specific regulation?

Most remaining states have not enacted comprehensive AI legislation as of May 2026. For these jurisdictions, the primary regulatory environment remains federal, including FTC oversight, EEOC guidance, CFPB enforcement, SEC disclosure expectations, and sector-specific federal regulators.

How should brands communicate across the AI patchwork?

Three operational principles matter most.

Communicate to the strictest standard

A brand operating nationally should design AI disclosure language that simultaneously satisfies California, Colorado, New York, and Illinois requirements. The result is a communications framework that satisfies less restrictive jurisdictions by default.

Maintain a jurisdictional matrix

Every brand AI deployment should maintain an internal jurisdictional map documenting applicable laws, disclosure obligations, enforcement exposure, consumer rights requirements, and reporting timelines. The matrix supports rapid response during enforcement inquiries.

Treat compliance as a competitive advantage

The patchwork is not just a compliance burden. Brands that build sophisticated state-by-state communications and compliance posture earn institutional buyer trust that less-disciplined competitors cannot replicate.

What is the takeaway for brands operating nationally?

The state-by-state AI patchwork is the operating reality for the next several years. Federal preemption remains possible but not imminent. Brand communications operating without state-level discipline are operating with unhedged exposure. Use the reference framework above as the foundation for the brand's jurisdictional matrix, and build the discipline before the enforcement letter arrives.

What are the key differences between state AI regulations?

State AI regulations differ primarily in scope, enforcement mechanisms, and sector focus. Tier 1 states impose comprehensive disclosure requirements across consumer-facing AI applications, mandate bias audits for employment tools, and establish private rights of action or AG enforcement pathways. Colorado's AI Act, for example, requires impact assessments for high-risk systems and incident reporting within statutory timelines. Illinois BIPA creates statutory damages for biometric processing violations, making it the most financially consequential regime for brands using facial recognition or voice analysis.

Tier 2 states have signaled enforcement intent through AG guidance and pending legislation but lack comprehensive statutes. Tier 3 states limit AI regulation to insurance, healthcare, and select consumer verticals. Tier 4 states rely on federal frameworks, including FTC Act Section 5, EEOC guidance, and sector regulators, without state-specific AI obligations. The operational implication: a brand deploying AI-driven customer service in California, New York, and Florida faces three distinct compliance postures, requiring jurisdictional mapping at the deployment level.

How should brands document AI compliance across multiple states?

Effective multi-state AI compliance documentation requires three core artifacts: a jurisdictional matrix, deployment-level disclosure records, and incident response protocols. The jurisdictional matrix maps each AI system to applicable state laws, disclosure obligations, consumer rights such as right-to-correction in Colorado, and reporting timelines. Deployment-level records document the specific disclosure language used in each state, bias audit results for employment tools, and impact assessments for high-risk systems.

Incident response protocols define escalation paths, AG notification timelines, and remediation procedures for adverse AI outcomes. Brands operating in Tier 1 states should maintain audit-ready documentation that satisfies the strictest standard, typically California or Colorado, and apply that framework nationally. This approach reduces compliance complexity and positions the brand favorably during enforcement inquiries or institutional buyer due diligence.