State-Level AI Regulation

State-level AI regulation is the body of US AI law and rulemaking enacted or proposed by individual states. As of May 2026 it was the principal field of US AI regulation, given the unresolved federal-preemption fight (Executive Order 14365, Techno-Federalism). Individual instruments are tracked in legislation/; this page is the cross-cutting index. Aggregate counts of how many states have acted, and what those counts include, are treated separately at Counting state AI legislation; the National Conference of State Legislatures reported that 38 states adopted or enacted around 100 AI measures in the 2025 session, a figure whose unit is measures including resolutions rather than obligation-imposing statutes (Source: ncsl.org).

State landscape (May 2026)

Most-active states

Regulatory modes used by states

Multistate AG action against a frontier developer

On August 3, 2026 the attorneys general of fifteen states — Iowa, Alabama, Arkansas, Florida, Idaho, Indiana, Kansas, Missouri, Montana, Nebraska, Oklahoma, Pennsylvania, South Carolina, Texas and Utah, led by Iowa's Brenna Bird — wrote to OpenAI chief executive Sam Altman stating that the company "may have violated State and federal law, including consumer-protection and data-privacy statutes that many Attorneys General are charged with enforcing" over the July 2026 Hugging Face intrusion (Letter from fifteen State Attorneys General to Sam Altman on the July 2026 Hugging Face intrusion (August 2026)). The letter demands preservation of eleven enumerated categories of materials with an express spoliation warning, assurance that no personnel face adverse action for protected whistleblowing, and that OpenAI "immediately cease and desist" from internal evaluations prompting its models "to pursue advanced exploitation using complex attack paths."

The instrument extends the state-AG enforcement mode in the table above from applying consumer-protection law to AI products to demanding changes in a developer's internal research practice. No case has been filed, and every factual assertion in the letter is prefaced "based on public reporting."

One signatory moved from demand to compulsory process three weeks later. Alabama Attorney General Steve Marshall issued Subpoena Duces Tecum #26-0007 to OpenAI OpCo, LLC on August 20, 2026, under Section 8-19-9 of the Code of Alabama, the investigative-demand provision of the state's Deceptive Trade Practices Act, and announced the investigation on August 24 (Alabama Attorney General, Subpoena Duces Tecum #26-0007 to OpenAI OpCo, LLC (August 20, 2026)). The subpoena's sixteen requests are confined to the July 2026 intrusion and its surrounding practice, and two of them carry the coalition letter's research-practice theory into enforceable process: one demands all materials on any evaluation that "prompt[s] [OpenAI] models to pursue advanced exploitation using complex attack paths," naming ExploitGym as the coalition letter's preservation demand did, and another demands the identity of every employee who has raised any safety or security concern about model testing together with the documents recording those concerns. Production is due September 14, 2026.

Two features distinguish the instrument from its coverage and bear on how the mode is described. It runs to the company rather than to Altman personally, notwithstanding an announcement headline naming both; and it invokes one statute rather than the Deceptive Trade Practices Act "and other state consumer protection laws" that the announcement describes. Whether other signatories to the August 3 letter have issued their own process is not established.

A second multistate letter turned from the developer to Congress. On September 23, 2026 the attorneys general of 24 states, the District of Columbia and American Samoa, led by New York's Letitia James and New Jersey's Jennifer Davenport, asked congressional leadership for comprehensive federal regulation of frontier AI, stating that they are "actively working to hold AI labs accountable under our respective state laws—including fairness obligations and AI-specific safety requirements" and citing California SB 53, New York's RAISE Act and Illinois SB 315. The letter asks that any federal law prohibit preemption of state law and give state officials "full authority to enforce these federal protections" (Letter from state attorneys general to congressional leadership urging federal frontier AI regulation (September 2026)). Oklahoma's Gentner Drummond is the only attorney general to have signed both the August 3 and the September 23 letters.

Federal preemption of state law

The xAI v. Colorado case (filed April 9, 2026, with the DOJ moving to intervene on 14th Amendment grounds on April 24; xAI LLC v. Weiser (challenging the Colorado AI Act)) and the Trump preemption EO are the live legal tests of whether state AI laws survive federal action. Their outcomes will shape the state-versus-federal balance through 2026–2027. A parallel constitutional front is SpaceXAI v. Bonta (AB 2013 challenge), SpaceXAI's First Amendment challenge to California AB 2013's training-data disclosure mandate: an appeals ruling adopting strict scrutiny could bear on the transparency provisions of SB 53, Illinois SB 315, and New York's RAISE Act (Source: transformernews.ai).

The preemption question was live in the Senate Commerce Committee as of late July 2026. Reporting published July 28, 2026 said Senate Democrats planned to offer amendments during the committee's AI markup to weaken proposed preemption of state AI laws, and to raise alleged conflicts of interest in the Trump administration's AI and technology deals. Only the lede of that account was retrievable; the markup date and the bill number were not recovered (Source: washingtonpost.com).

California-sized markets can create universal-compliance economics that resist preemption in practice, a propagation dynamic tracked on California Effect. California EO N-5-26 illustrates a separate route: state procurement, which is described as preemption-resistant under Section 8 of the Trump EO, an approach other states may follow. State AG enforcement of existing consumer-protection and anti-discrimination law operates independently of state AI statutes, and may be harder to preempt.

State preemption of local AI rules

A second preemption front opened in May 2026. The Local Solutions Support Center reported on 2026-05-11 that 9 states were considering 12 bills to preempt local AI regulation, including "Right to Compute" bills in New Hampshire, Ohio, South Carolina, and Virginia based on an American Legislative Exchange Council (ALEC) model; Montana enacted a Right to Compute Act in 2025 as the prototype. The center characterized the pattern as state legislatures invoking preemption against local governments while resisting federal preemption against themselves (Source: route-fifty.com).

The "Right to Compute" framing casts AI deployment as a commerce-clause-style protected economic activity, the same theory the DOJ may invoke against state AI regulations, and positions ALEC-model legislation as a convergence vehicle for the substantive-preemption Republican position (compare the Blackburn TRUMP AMERICA AI Act). If municipalities lose footing for local AI rules, such as San Francisco surveillance ordinances and New York City bias-audit ordinances, regulatory authority would shift up to the state level.

2026 legislative sessions

As state legislatures moved to close their 2026 sessions, a May 29, 2026 legislative update found AI bills remaining in play in several states. Louisiana lawmakers were set to adjourn June 1, with three AI-related bills sent to Gov. Jeff Landry and two awaiting final votes. Illinois headed toward Sunday adjournment with nine AI bills still alive, spanning chatbots, children's online safety, and privacy, including Illinois SB 315 (frontier safety framework with mandatory third-party audits), Illinois SB 317 — Consumer Artificial Intelligence Notice Act, and Illinois SB 3444 — Artificial Intelligence Safety Act (Source: transparencycoalition.ai).

In Colorado, Gov. Jared Polis vetoed the state's algorithmic-pricing bill on June 5, 2026, amid what one report described as "dueling stakeholder narratives" over whether the measure protected consumers or chilled legitimate pricing software, continuing the contested course of Colorado AI legislating seen in the much-amended Colorado AI Act (SB 24-205) (Source: insideaipolicy.com). In California, State Sen. Jerry McNerney withdrew his bill regulating utilities' use of AI on June 5, 2026, after a fiscal panel made "unwanted changes" that weakened it (Source: insideaipolicy.com).

In Arizona, Governor Katie Hobbs vetoed HB 2311 on June 19, 2026. The bill, passed by the Legislature on June 12, would have added A.R.S. §§ 18-801 and 18-802 imposing AI-disclosure, sexual-content, minor-protection, suicide and self-harm protocol and age-assurance privacy duties on operators of conversational AI services, enforceable only by the attorney general with civil penalties of $1,000 per violation capped at $500,000 per operator and no private right of action (Arizona HB 2311 — Bill Text (Senate Engrossed with Farnsworth Floor Amendment #2, 2026)). Hobbs's veto letter objected to those remedies and to the bill's limits on the attorney general's rules, guidance and settlements (HB 2311 Veto Letter — Gov. Katie Hobbs (Arizona, June 19, 2026)).

California lawmakers approved a set of AI regulation bills on August 13, 2026, ahead of an August 14 deadline for fiscal committees to act. The measures reported include establishing a state-specific auditing and standards system, call-center oversight, and restrictions on AI-aided employment decisions. Technology firms and industry groups oppose the measures, and Governor Gavin Newsom's position on them was not clear at the time of reporting (Source: insideaipolicy.com). Only the article lede was retrievable and the bill numbers were not recovered, so the measures are recorded by subject rather than by designation; the auditing-and-standards item is consistent with the California SB 813 (AI independent verification organizations) and AB 1405 track described under Independent Verification Organizations (IVOs), but no source confirms that identification.

The legislature sent the package to Newsom when its session closed on August 31, 2026. The bills reported as reaching his desk cover restrictions on automated decision-making systems in employee discipline and termination, tighter chatbot rules, and third-party assessment and verification of AI risks; many were scaled back or given exemptions in the final week of session (Source: insideaipolicy.com). This reporting also returned only the lede, so the bill designations, the specific amendments and Newsom's signing deadline are not established here.

State action in this period also extended to AI's physical footprint. Illinois Gov. JB Pritzker will pause data-center tax-incentive processing from July 1, 2026, and on July 14, 2026 Gov. Hochul imposed a one-year moratorium on new data centers drawing 50 MW or more by executive action, leaving the legislature's 20 MW-threshold bill unsigned (Source: reuters.com; New York Data-Center Moratorium (2026)); both are covered on AI Data Centers and Data Center Siting / AI Power Politics. California enacted seven data-center statutes on September 21, 2026 (Chapters 434–440), covering energy reporting, utility tariffs, water and workforce disclosure, and CEQA review (California data-center laws (2026)).

Professional-licensure regulation emerged as a further state vehicle: Pennsylvania Rep. Brenda Pugh introduced HB 2678 on June 29, 2026, amending Title 63 of the state's consolidated statutes governing licensed professions to address artificial intelligence; the bill was referred to the House Professional Licensure Committee (Source: palegis.us).

Tracking infrastructure has followed the activity: on July 12, 2026, technology lawyer Ray Sun expanded his Global AI Regulation Tracker to cover all 50 US states in both website and API form, citing state-level activity on algorithmic discrimination, chatbot disclosure, deepfakes, children's safety, and health AI as where most binding US AI regulation now sits (Source: techieray.substack.com).

Frontier-lab positioning on state legislation sharpened in mid-July. In a Wired interview published July 16, 2026, Anthropic said the transparency-based state AI laws it endorsed in 2025 "may already be outdated," and backed an Illinois measure requiring third-party model audits and a Massachusetts proposal empowering the state attorney general to seek injunctive relief — a state-by-state strategy that contrasts with OpenAI's push for federal preemption. David Sacks called the effort "a sophisticated regulatory capture strategy based on fear-mongering" (Source: wired.com; transformernews.ai).

Criminal-law measures on synthetic imagery also continued to advance: Pennsylvania SB 1413, introduced July 8, 2026 by Sen. Tracy Pennycuick and referred to the Senate Judiciary Committee, would criminalize AI-generated intimate depictions of a person without consent under the state's invasion-of-privacy statute (Source: palegis.us). In the same chamber's workforce lane, Pennsylvania HB 2705, directing a state report on AI in the workforce, was introduced and referred to the House Labor & Industry Committee on July 16, 2026 (Source: palegis.us).

Rent-pricing algorithms became the subject of a fourth state law on July 20, 2026, when New Jersey Gov. Mikie Sherrill signed the Forbidding the Algorithmic Inflation of Rent (FAIR) Act, barring rent-setting software from pooling nonpublic pricing data (Source: nj.gov). See Algorithmic Pricing and Antitrust. Sherrill had earlier signed A-5328 on June 30, 2026 — two days after its introduction — creating a data broker and "data collector" registration regime with annual fees scaling to $1.5 million by data volume and prohibiting sales of sensitive data; privacy practitioners have questioned both the compressed timeline and the breadth of the covered-entity definition (Source: wilmerhale.com; iapp.org).

By August 2026 the activity had shifted from enactment toward implementation and enforcement machinery. New York Gov. Kathy Hochul and Attorney General Letitia James announced final implementing rules for the state's SAFE for Kids Act on July 28, 2026: where an operator lacks actual knowledge that a user is a minor, it must apply an age assurance method meeting the certification standards of Section 700.4, covering documentation, accuracy, data processing, security and testing. Three further bills awaited Hochul's action — S 9051 on companion chatbots, S 9408 on chatbots in toys, and S 9269 on consumer health. Vermont Attorney General Charity Clark separately proposed rules under the state's Age Appropriate Design Code (S 69) requiring a graduated-escalation approach to age assurance tied to method intrusiveness, with comments closing October 2 (Source: thealgorithmicupdate.substack.com).

California opened the first formal compliance audit under this wave. The California Privacy Protection Agency targeted whether gig economy platforms let consumers and workers — including the independent contractors who make up most gig platform workers — exercise CCPA access rights within the required 45-day window. A new Audits Division under chief auditor Sabrina Ross runs it, separate from enforcement though findings may be referred; under 11 CCR § 7304 the agency may examine business practices without a prior complaint or settlement. The announcement followed by one month Illinois's enactment of the first compliance-audit requirement under its frontier model law (Illinois SB 315 (frontier safety framework with mandatory third-party audits)) (Source: thealgorithmicupdate.substack.com). The audit power is a distinct regulatory mode from the disclosure and prohibition instruments catalogued above: it reaches practice rather than published policy, without requiring a complaint.

Federal activity ran alongside rather than displacing this. The Senate Committee on Commerce, Science, and Transportation was set to mark up five bills on August 5, 2026 — S. 737 (SCREEN Act), S. 1748 (KOSA), S. 4199 (Youth AI Privacy Act), S. 4407 (CHATBOT Act) and S. 5171 (Children's AI Toy Safety Act) — without COPPA 2.0 or the federal data broker registry carried in the House-passed KIDS Act (Source: thealgorithmicupdate.substack.com). See Kids Internet and Digital Safety Act (KIDS Act, H.R. 7757).

Congressional testimony arguing the preemption case against this activity — and the competing reverse-federalism reading of the same evidence — is summarized at AI at a Crossroads: A Nationwide Strategy or Californication? — Testimony of Kevin Frazier (September 2025).

State attorneys general as a 2026 campaign issue

Paxton set out his own position the same month. He posted a four-part "Texas first" plan in the week before August 25, 2026 for protecting children from harm related to AI chatbots, one piece of which would impose criminal liability. Adam Thierer, a free-market technology-policy analyst, said the plan would impose a "destructive theory" of liability on data center operators. The article body is paywalled and only the lede was retrievable, so the plan's four parts and the mechanism connecting chatbot harms to data-center operator liability are not established here (Source: insideaipolicy.com). See AI Data Centers.

State AI enforcement entered attorney-general campaigning in August 2026. Nathan Johnson, the Democratic nominee for Texas attorney general, said on August 21, 2026 that if elected he would review the state's consumer-protection, fair-competition, and employment laws and deliver a list of recommendations to the legislature within his first 30 days in office. Johnson said Texas AI statutes fall short, citing the absence of any requirement that employers disclose when AI determines who is fired, and said of the incumbent, Ken Paxton, "Paxton has gone after a lot of tech giants, but he leaves alone anyone affiliated with Elon Musk." Paxton's office did not respond to a request for comment (Source: axios.com).

Platform-layer age assurance

California's Digital Age Assurance Act, operative 1 January 2027, places age assurance at the operating-system layer: the device platform collects the user's age at account setup and passes an age-bracket signal to application stores and developers, who are then deemed to have actual knowledge of the user's age range "even if the developer willfully disregards the signal." Enforcement runs through the Attorney General, at up to $2,500 per affected child for a negligent violation and $7,500 for an intentional one. AB 1856 (Wicks), which amends all five sections of the title, passed the Senate 39–0 on 26 August 2026 and the Assembly concurred 69–0 the following day (Source: leginfo.legislature.ca.gov).

The statute's definition of "operating system provider" excludes entities distributing software "under license terms that permit a recipient to copy, redistribute, and modify" it — a licence-characteristic test rather than a list of named licences (California Digital Age Assurance Act).

Relationships

• related: Techno-Federalism (the cross-cutting federalism concept), California Effect (the propagation dynamic).
• related: Procurement-Driven AI Governance (the state-procurement-seam alternative).
• related: Executive Order 14365, America's AI Action Plan (federal-preemption instruments).
• related: all legislation/* state pages.
• related: Arizona HB 2311 (artificial intelligence service; disclosures; requirements), Arizona HB 2311 — Bill Text (Senate Engrossed with Farnsworth Floor Amendment #2, 2026) — vetoed Arizona conversational-AI bill of the 2026 session
• related: Letter from state attorneys general to congressional leadership urging federal frontier AI regulation (September 2026), Letter from fifteen State Attorneys General to Sam Altman on the July 2026 Hugging Face intrusion (August 2026) — the two 2026 multistate attorney-general letters on frontier AI

Sources

Stub created 2026-05-11.