US State AI Law Tracker

Scope

High-risk AI systems making or substantially influencing consequential decisions about Colorado consumers (employment, education, financial services, healthcare, housing, insurance, legal services, government services).

Who it applies to

Developers (entities building or substantially modifying HR-AI systems) AND Deployers (entities using HR-AI systems for consequential decisions about Colorado consumers).

Obligations

• Risk management policy (deployer) — aligned to NIST AI RMF or ISO/IEC 42001
• Annual impact assessment per high-risk system
• Pre-decision consumer notice when HR-AI is used
• Adverse decision notice with principal reasons and right to appeal
• Right to opt out / human review where technically feasible
• Annual public summary of HR-AI systems deployed
• AG notification within 90 days of discovering algorithmic discrimination

Penalties

Civil penalties under the Colorado Consumer Protection Act. No private right of action.

Scope

Generative AI developers training models released or substantially modified on or after January 1, 2022.

Who it applies to

Any business that develops a generative AI system or substantially modifies an existing system, and makes it available to Californians.

Obligations

• Public disclosure on developer website by January 1, 2026, describing training datasets
• Disclose whether datasets contain personal information, intellectual property, or aggregated data
• Disclose whether datasets are publicly available, licensed, or proprietary
• Disclose any modifications made by the developer to source datasets
• Disclose dataset time range and known limitations or bias

Penalties

Up to $5,000 per violation. No private right of action. Each unlawful sale or display constitutes a separate violation.

Scope

Online communications using AI bots to interact with Californians for the purpose of inducing a sale or influencing a vote.

Who it applies to

Any person using a bot to communicate with Californians for commercial sale or to influence elections.

Obligations

• Disclose that the communication is from a bot, not a human
• Disclosure must be clear, conspicuous, and reasonably designed to inform a reasonable person

Penalties

Civil penalties under California UCL. No private right of action for disclosure violations.

Scope

Automated employment decision tools (AEDTs) used to substantially assist employment decisions about NYC-based jobs or candidates residing in NYC.

Who it applies to

Employers and employment agencies using AEDTs for hiring or promotion decisions in NYC.

Obligations

• Independent annual bias audit by an unaffiliated auditor
• Public posting of bias audit summary on the employer's website
• Pre-use notice to candidates at least 10 business days before AEDT use
• Identify job qualifications and characteristics the AEDT will assess
• Provide accommodations or alternative selection processes on request

Penalties

$500-$1,500 per violation; first day of unlawful use is one violation, each additional day is another.

Scope

AI analysis of video interviews of applicants for positions based in Illinois.

Who it applies to

Employers using AI to analyze applicant video interviews for Illinois-based positions.

Obligations

• Notify applicant before the interview that AI may be used
• Provide information about how the AI works and what general types of characteristics it uses to evaluate applicants
• Obtain consent from applicant to be evaluated by AI
• Limit sharing of applicant video to persons whose expertise or technology is necessary
• Destroy videos within 30 days of applicant request
• Report demographic data annually to the Illinois Department of Commerce if AI is the sole basis of decisions

Penalties

Civil action under Illinois Human Rights Act for discrimination. No statutory damages specifically for AIVIA violations.

Scope

Employer use of AI for recruitment, hiring, promotion, discipline, or discharge decisions.

Who it applies to

Illinois employers with 15+ employees.

Obligations

• Prohibit AI use that subjects employees to discrimination based on protected classes
• Notify employees when AI is used for employment-related decisions
• Disclose what classes of personal information the AI considers

Penalties

Damages and remedies under the Illinois Human Rights Act, including reinstatement, back pay, attorney fees.

Scope

Use of an individual's voice, image, or likeness — including AI-generated replicas — without consent for commercial purposes.

Who it applies to

Any person making, distributing, or using AI-generated voice or visual likenesses of individuals in Tennessee.

Obligations

• Obtain consent before producing AI-generated voice or visual likeness
• Right of publicity descends 10 years post-mortem
• Civil liability for unauthorized AI replication of voice/image

Penalties

Actual damages, statutory damages, attorney fees, and injunctive relief. Class C misdemeanor for knowing violations.

Scope

Use of generative AI in regulated occupations (where occupational licensing requires disclosure) and in any consumer-facing transaction.

Who it applies to

Any person using generative AI to interact with Utah consumers in a regulated profession (legal, medical, mental health, financial) or consumer transaction.

Obligations

• Disclose that the consumer is interacting with generative AI when asked
• Proactive disclosure required in regulated occupations regardless of consumer inquiry
• Establish Office of AI Policy to research and recommend AI policy framework

Penalties

Up to $2,500 per violation; treble damages for repeat offenders. Private right of action available.

Scope

Consumer personal data processing by businesses serving Texas residents; includes profiling and automated decision-making provisions.

Who it applies to

Businesses that conduct business in Texas or produce products/services consumed by Texans, processing personal data of 100K+ Texans (or 25K+ if 50%+ revenue from data sales).

Obligations

• Privacy notice disclosing data categories and purposes
• Consumer rights: access, correction, deletion, portability, opt-out of targeted advertising / sale / profiling
• Data protection impact assessments for profiling that presents reasonably foreseeable risk
• Opt-out signals (Global Privacy Control) honored

Penalties

Up to $7,500 per violation. Cure period of 30 days. No private right of action.