U.S. Federal and State AI Laws in 2026: A Map for Regular People

How to read this guide. This is a general-audience map, current as of November 10, 2026. It is not legal advice. U.S. AI rules now differ by state, and a federal executive order is not the same thing as a statute passed by Congress. We cite official bill pages and government announcements where we can, and we say when a date has not yet arrived.

People often ask whether “the U.S. has an AI law yet.” In November 2026 the honest answer is: the United States still does not have a single, comprehensive federal AI statute that tells every company, in every state, what to do. It does have a growing pile of state rules, a new Colorado law that replaced an earlier one, California requirements that already started in 2026, and a presidential executive order that tries to push back against state regulation without, by itself, erasing those statutes.

There is still no one federal AI code

On 11 December 2025, President Trump signed Executive Order 14365, “Ensuring a National Policy Framework for Artificial Intelligence.” The official text is in the Federal Register (16 December 2025). It sets a policy of reducing what the administration calls onerous state AI rules: an Justice Department litigation task force, a Commerce Department evaluation of state laws, pressure on federal funding, and directions to agencies such as the FCC and FTC to consider federal standards or policy statements that might conflict with state requirements. The order also asked for legislative recommendations toward a uniform federal framework, with carve-outs such as child safety.

Two limits matter for a regular reader. First, in U.S. practice an executive order directs the federal executive branch. It does not usually wipe away a state statute the way an act of Congress can. An executive order directs the federal executive branch; it does not, by itself, usually wipe away a state statute the way an act of Congress can. Second, as of this writing Congress still had not enacted a comprehensive preemptive AI code that would settle the matter. Until that happens, the working assumption for a business — and the one those same analyses recommended — is that existing state laws continue to apply unless a court says otherwise.

If you see a headline that “the federal government banned state AI laws,” treat it as a policy fight, not as a completed legal fact.

California: frontier models and automated decisions, already in 2026

California has been writing at two levels: very large “frontier” models, and everyday automated decisions that affect people.

Frontier AI transparency. Governor Newsom signed SB 53 in September 2025. The Attorney General’s office maintains an SB 53 page on catastrophic risks in foundation models, alongside the governor’s signing announcement. The law is commonly called the Transparency in Frontier Artificial Intelligence Act. It is aimed at large developers of frontier models, not at every small app, and it took effect 1 January 2026. In broad terms it requires those developers to publish a frontier AI framework and, for new or substantially modified frontier models, transparency reports and catastrophic-risk assessment summaries. If you do not build frontier models, this is probably not a duty on you; if you rely on those models, it is still useful context for what the largest labs are supposed to disclose.

Automated decision-making (ADMT). Separate California Privacy Protection Agency regulations, expanding the California Consumer Privacy Act, govern automated decision-making technology used to make significant decisions. Mid-2026 legal summaries, such as Alston & Bird’s midyear review, describe obligations that began 1 January 2026, with later phased deadlines: a privacy impact assessment before using ADMT for a significant decision, disclosures about model methodology, and a 15-day clock to respond to consumer opt-out requests. If you are a Californian dealing with a lender, employer, or insurer that uses software to make a consequential decision, this is the body of rules that is meant to give you notices and choices — subject, always, to the official regulation text.

Colorado: the first comprehensive state AI law was replaced

Colorado’s 2024 law, Senate Bill 24-205, was widely described as the first comprehensive state AI statute in the country and had been scheduled to take effect on 30 June 2026. It did not simply go live. On 14 May 2026 the governor signed Senate Bill 26-189, which the official bill summary says “repeals and reenacts those provisions with new requirements regarding the use of automated decision-making technology in consequential decisions.”

The new framework, as described on the General Assembly page, is built around ADMT that “materially influence[s] a consequential decision.” Principal duties are written to start 1 January 2027 — a date that, in November 2026, is still in the future. Developers of covered systems are to give deployers technical documentation (intended uses, categories of training data, known limitations, and instructions for human review) and to notify them of material updates. Deployers are to give clear notice at the point of interaction, and, within 30 days after an adverse consequential decision, a plain-language description of the system’s role. Consumers gain rights to access and correct certain personal data and to request meaningful human review after an adverse outcome, in the terms the statute sets out. The attorney general is directed to adopt clarifying rules.

Coverage of the replacement law has also noted litigation over enforcement timing. That is a reminder to read the official bill and any court orders, not only a 2024 memo you already had in a compliance binder.

What a regular person can do with this map

• Do not assume the rules in your state match a national blog post about “U.S. AI law.” California and Colorado are the two detailed examples here because they moved first and then kept moving. Other states have narrower laws (deepfakes, government use of AI, child safety) that this article does not inventory.
• If an automated system denied you housing, credit, insurance, a job, or a similar consequential outcome, look at your state’s consumer-privacy and ADMT rules, and at whatever notice the company actually sent you. The helpful question is “what decision was made, with what system, and what appeal exists,” not “is AI legal?”
• If you work at a company that builds or uses these tools, 2026 is a year of overlapping calendars: California duties already running, Colorado’s new duties aimed at 1 January 2027, and a federal policy project that may produce lawsuits or future legislation but has not replaced those statutes on its own.
• If you want the court side of the story — training data, fair use, settlements — start with copyright and AI cases in 2026. For Europe’s staggered official calendar, see the EU AI Act in November 2026.