Short answer: To build a multi-state AI compliance program, inventory every AI system that influences a consequential decision, map each one to the states where the affected people live, and run all of them through one governance structure aligned to the NIST AI Risk Management Framework. Each state law then becomes a short list of add-on controls (notices, explanations, bias testing, record retention) instead of a separate compliance track. As of October 2026, no federal law has displaced these state rules, so waiting for Washington is not a plan.
Most mid-market companies never set out to become regulated AI users. They bought an applicant tracking system that ranks résumés, a claims platform with automated triage, a chatbot that pre-screens applicants. Each purchase quietly pulled the company into state-by-state AI compliance requirements, often in states where it has no office.
The common reaction is to handle each law as it arrives: a Colorado project, a California project, an Illinois project. That approach multiplies templates, owners, and audit trails. The playbook below consolidates them into one multi-state compliance program, built on the data and AI governance foundation your AI projects need anyway.
Why shouldn’t mid-market companies wait for a federal AI standard?
Because the federal effort so far does not reach the obligations most mid-market companies actually carry.
- The executive order is a litigation strategy, not a law. Executive Order 14365, signed December 11, 2025, directed the Justice Department to form an AI Litigation Task Force to challenge state AI laws (Latham & Watkins). An executive order cannot repeal a state statute; only Congress or the courts can.
- Congress is targeting developers, not deployers. The bipartisan House draft released in June 2026 would preempt state laws that regulate how AI models are developed for three years, while preserving state authority to regulate how AI is used, including in employment (Epstein Becker Green). Its July rework, the FRONTIER Act, likewise preserves state regulation of deployers and users (The Regulatory Review).
Most mid-market companies are deployers. The rules that govern you are the ones least likely to be preempted. Meanwhile, the volume keeps rising: lawmakers in 45 states introduced 1,561 AI-related bills by March 2026, compared with 635 in all of 2024 (MultiState).
Which state AI laws apply to a typical mid-market business?
It depends on what your AI decides and where the affected people live, not where you are headquartered. These are the laws most likely to appear on a mid-market compliance map for 2026–2027:
| Jurisdiction and law | Triggered when you… | Core obligations | In effect |
|---|---|---|---|
| Texas: TRAIGA (HB 149) | Deploy AI in Texas or for Texas residents | Avoid listed prohibited uses; affirmative defense for substantial compliance with NIST’s AI framework (its Generative AI Profile) (Skadden) | Jan 1, 2026 |
| Colorado: SB 26-189 | Use automated decision-making technology (ADMT) that materially influences a consequential decision about a Colorado consumer | Notice before use; plain-language explanation within 30 days of an adverse outcome; access, correction, and human review; three-year records (Finnegan) | Jan 1, 2027 |
| California: CCPA ADMT regulations | Are covered by the CCPA and use ADMT for significant decisions | ADMT notices and consumer rights; documented privacy risk assessments (Alston & Bird) | ADMT: Jan 1, 2027; first risk-assessment attestations due Apr 1, 2028 |
| California: FEHA automated-decision system rules | Use AI or algorithms in hiring, promotion, or other employment decisions | No discriminatory effect; keep automated-decision data and employment records four years (Mayer Brown) | Oct 1, 2025 |
| Illinois: HB 3773 | Use AI to influence employment decisions about Illinois applicants or employees | Notice to applicants and employees; no discriminatory effect (Fisher Phillips, Illinois Human Rights Commission event) | Jan 1, 2026 |
| New York City: Local Law 144 | Use an automated tool to screen NYC candidates for hiring or promotion | Annual independent bias audit; public audit summary; advance candidate notice (DLA Piper) | Enforced since July 5, 2023 (NYC DCWP) |
Treat this as a starting point: insurance, healthcare, and lending add sector-specific AI rules, and new chatbot and disclosure laws keep arriving.
Step 1: Inventory every AI system that touches a consequential decision
Start with what you run, not with the statutes. For each system, record:
- Business owner and vendor
- Model or product version
- The decision it influences (hiring, promotion, pricing, eligibility, claims, admissions)
- Personal data categories it uses
- Whether a human reviews the output before it takes effect
- Who is affected, and where they live
Include AI embedded in vendor software. The riskiest systems are often not models your team built, but AI features switched on inside your ATS, CRM, or claims platform.
Step 2: Map each system to the states where affected people live
Jurisdiction follows the person. Illinois’s law applies to employers with or without a physical location in the state, NYC’s law covers candidates who live in the city, and TRAIGA reaches businesses whose AI products are used by Texas residents.
Pull residency counts from your HRIS and CRM, then build a matrix: AI system × jurisdiction × obligation triggered. That matrix becomes your single source of truth for state-by-state AI compliance requirements. Keep it in your data platform, refreshed from source systems, not in a spreadsheet.
Step 3: Anchor the program to the NIST AI Risk Management Framework
NIST’s AI RMF is the framework state legislatures actually point to. Texas grants an affirmative defense to companies that substantially comply with it, specifically its Generative AI Profile, or with another recognized risk management framework. Colorado’s 2024 law offered a similar defense, but the 2026 rewrite repealed and reenacted the statute without it, and dropped its risk-management and impact-assessment mandates (Crowell & Moring).
Even where a statute does not reward it, NIST gives you one structure that maps cleanly to every obligation above. One caution: the framework is still version 1.0, and NIST has been directed to revise it (NIST). Build around its four functions rather than specific section numbers that may change.
How do the four NIST AI RMF functions map to state obligations?
| NIST function | What it means in practice | State obligations it covers |
|---|---|---|
| Govern | Named owner, written AI policy, approval gate for new AI tools, vendor contract terms | Developer documentation to deployers (CO); evidence for the TRAIGA defense (TX) |
| Map | AI inventory and jurisdiction matrix from Steps 1–2 | Scoping for every law |
| Measure | Scheduled bias and performance testing | NYC bias audit; discriminatory-effect exposure (IL, CA FEHA); CCPA risk assessments |
| Manage | Notices, explanations, human review, appeals, incident response | CO notices and 30-day explanations; CA ADMT notices; IL and NYC candidate notices |
Step 4: Build one control set at the strictest common denominator
Instead of six notice templates and six retention rules, adopt the most demanding version of each control once:
- Notice before use for every AI-influenced consequential decision, with NYC’s lead time setting the schedule for hiring tools
- Adverse-decision explanations within 30 days, matching Colorado’s clock
- A human review path for anyone who receives an adverse outcome
- Four-year retention of AI decision records, since California’s four years exceeds Colorado’s three
- Annual independent bias testing of hiring tools, reused as evidence everywhere
- A documented risk assessment for each system
Then keep a short list of state-specific items that cannot be harmonized, such as posting NYC audit summaries publicly or filing California risk-assessment attestations. Limiting notices to required states is a valid choice, but it adds routing logic to maintain.
Step 5: Turn compliance evidence into a data pipeline
Substantial compliance is proven with records, not intentions. Log every AI-influenced decision with the model version, the data used, the notice sent, the explanation issued, and the human review outcome, and store it in your warehouse with lineage and access controls.
This is where data and AI governance converge. If you cannot trace which data fed a decision, you cannot explain it within 30 days or correct it when a consumer asks. A solid data governance program is what makes AI governance auditable. For what happens when that foundation is missing, see what Air Canada, Workday, and Cigna teach mid-market leaders.
Step 6: Review the map every quarter
Colorado repealed and reenacted its AI law about six weeks before it was due to take effect, moving the date from June 30, 2026 to January 1, 2027 (Hunton). Illinois’s Department of Human Rights proposed detailed notice rules on May 15, 2026 and withdrew them on June 2 (Burke, Warren, MacKay & Serritella). NIST’s framework revision is still pending.
Each quarter, re-run the inventory, update the jurisdiction matrix, check upcoming effective dates (Colorado and California both land on January 1, 2027), and re-certify that controls are operating.
What does a consolidated AI compliance program look like in practice?
Consider a hypothetical 600-person transportation and logistics company headquartered in California. It hires drivers and dispatchers in Texas, Colorado, and Illinois, and runs a recruiting team in New York City. Three AI tools influence consequential decisions: a résumé ranker in its ATS, a vendor chatbot that pre-screens applicants, and a driver-scoring model used in promotion and discipline.
Run state by state, that is up to 18 separate tool-by-law reviews (three tools across six regimes), each with its own templates and owners. Consolidated, it becomes one inventory, one jurisdiction matrix, one notice template with state addenda, one adverse-decision workflow, one four-year retention rule, and one annual bias test whose summary doubles as the NYC public posting.
Where should you start?
If you do not have an AI inventory yet, start there. Data-Sleek’s AI Readiness Assessment is a fixed-scope engagement that maps your systems, data flows, and governance gaps before you commit to building anything. To talk through your state map, book a free consultation.
Don’t Have an AI Inventory Yet?
Our fixed-scope AI Readiness Assessment maps your AI systems, data flows and governance gaps, so your state map starts from facts, not guesses.
This article is general information, not legal advice. Confirm the obligations that apply to your business with qualified counsel.
Sources
- Latham & Watkins, AI Executive Order Targets State Laws and Seeks Uniform Federal Standards (Dec 2025)
- Epstein Becker Green, Workplace AI Regulation in 2026: How Employers Can Navigate the Changing Legal Landscape (Sep 2026)
- The Regulatory Review, The Hidden Costs of AI Preemption (Oct 2026)
- MultiState, AI Legislation Tracker 2026: All 50 States (data as of Mar 2026)
- Skadden, Texas Charts New Path on AI With Landmark Regulation (Jun 2025)
- Finnegan, Colorado Replaces Landmark AI Act: An Overview of the New SB 26-189 Framework (May 2026)
- Colorado General Assembly, SB26-189 Automated Decision-Making Technology (May 2026)
- Crowell & Moring, Colorado Hits Reset on AI Regulation: SB 26-189 Repeals and Reenacts the Colorado AI Act (May 2026)
- Hunton Andrews Kurth, Colorado AI Act Amended and Effective Date Delayed (May 2026)
- Alston & Bird, California Expands the Impact of the CCPA with New Rules on Cybersecurity Audits, ADMT and Privacy Risk Assessments (Oct 2025)
- Mayer Brown, California Adopts New Employment AI Regulations Effective October 1, 2025 (Sep 2025)
- Fisher Phillips at an Illinois Human Rights Commission event, Cracking the Code: Demystifying Illinois’ New AI Employment Law (Apr 2026, PDF)
- Burke, Warren, MacKay & Serritella, Illinois Department of Human Rights Withdraws Proposed AI in Employment Rules (Jun 2026)
- DLA Piper, Critical Audit of NYC’s AI Hiring Law Signals Increased Risk for Employers (Jan 2026)
- NYC Department of Consumer and Worker Protection, Automated Employment Decision Tools (AEDT)
- NIST, AI Risk Management Framework
FAQ: multi-state AI compliance for mid-market companies
Do state AI laws apply if we have no office in that state?
Often, yes. Most of these laws follow the affected person, not your office: an Illinois applicant, a New York City candidate, or a Texas customer can each bring your AI into scope.
Will federal preemption make state AI compliance unnecessary?
Not in the near term. The executive order directs litigation but cannot invalidate state laws on its own, and the leading congressional proposals target AI development, not AI use. Until a court or Congress acts, state obligations remain enforceable.
Is the NIST AI Risk Management Framework mandatory?
No, it is voluntary. But Texas rewards substantial compliance with an affirmative defense, and its four functions give you one structure for every state’s requirements, which makes it the practical backbone for AI governance.
How does data governance relate to AI governance?
Data governance controls the data itself: quality, lineage, access, and retention. AI governance controls how models use that data to make or influence decisions. Every state obligation, from explaining a decision to correcting a consumer’s data, assumes you can trace the data behind it, which is why data and AI governance work best as one program.
