2027 AI Law Check

Pick your states and how you use AI. See which AI laws may apply in 2026 and 2027, what they require and when, with a source for every rule. Not legal advice.

Checked October 9, 2026. Not legal advice.

Colorado SB 26-189 (automated decision tools) (CO, from January 1, 2027). You do business in Colorado and let an AI tool materially influence a major decision about a person: a job, housing, a loan, insurance, education, health care or government benefits. No small-business exemption. Requires: Tell people before AI helps make a major decision about them; Explain within 30 days when the decision goes against them; Let them correct wrong data and ask for human review; Keep records for at least three years.
Colorado HB 26-1263 (chatbot safety) (CO, from January 1, 2027). You offer an AI chatbot that the public in Colorado can use. Proposed rules exempt simple menu or button bots on narrow topics and staff-only tools. Requires: Disclose that users are talking with AI; Estimate users' ages and add protections for minors; Set up a response plan for suicide and self-harm messages; File an annual report with the attorney general.
California CCPA rules on automated decision-making (ADMT) (CA, from January 1, 2027). The CCPA covers you (over $26.6M revenue, or you buy, sell or share data on 100,000+ Californians, or half your revenue comes from selling or sharing data) and AI makes or replaces human decisions on jobs, lending, housing, education or health care. Requires: Give a notice before using AI for these decisions; Let people opt out, or offer a human appeal where the rules allow; Answer requests about how the AI reached a decision; Do a written risk assessment (required since Jan 1, 2026).
California Civil Rights Council rules on automated hiring tools (CA, from October 1, 2025). You have 5 or more employees and use AI, algorithms or scoring tools in hiring, pay, promotion or other job decisions for California workers or applicants. Requires: Keep hiring records, including AI tool data, for four years; Test AI hiring tools for bias and keep the results; Offer accommodations when a tool could screen out people with disabilities; Treat a vendor that screens for you as your agent; you share the liability.
California SB 947 (No Robo Bosses Act) (CA, from July 1, 2027). You employ people in California and use software built on AI, machine learning or data analytics to help decide discipline or firing. Simple tools such as spam filters and calculators are excluded. No size threshold was reported. Requires: Never let an automated system be the only basis for disciplining or firing someone; If you rely mainly on its output, have a person corroborate it with other facts, such as manager reviews and personnel records; Give the worker a separate written notice that the system was used, with a human contact; Let the worker ask for a description of the data it used, and do not retaliate.
California SB 951 (AI layoffs in Cal/WARN notices) (CA, from January 1, 2027). You have a California site with 75 or more employees and a layoff, relocation or closing that triggers a Cal/WARN notice, caused in whole or in large part by AI or other automation. Requires: Put "This notice is for a technology displacement" at the top of the notice; List the number, job types and work locations affected; Name the job functions being automated and the type of AI or technology used.
California AB 1883 (AI emotion reading at work) (CA, from January 1, 2027). You use software or devices that monitor California workers (calls, video, keystrokes, wearables) and the tool uses AI to read emotions, such as stress or engagement from tone of voice or facial expressions. No size threshold. Requires: Do not use AI monitoring tools that recognize or predict workers' emotional states; Do not collect workers' neural (brain or nervous system) data; Ask call-center, video and HR vendors whether any feature reads emotions, and turn it off.
California SB 1050 (AI performers in ads) (CA, from January 1, 2027). Your ads reach California and show or voice a human-like AI performer who is not a real, identifiable person. Covers audio-only ads too. Requires: Add a clear label such as "this performance features a synthetic performer"; Make the label hard to miss, in video and audio ads alike; Ask your agency and ad platforms to confirm they apply it.
California SB 243 (companion chatbots) (CA, from January 1, 2026). Only if your AI acts as a companion that builds an ongoing, social relationship with users in California. Bots used only for customer service or business operations are excluded. Requires: Tell users it is AI if they could think it is a person; Set up a crisis plan for suicide and self-harm talk; Add extra protections for minors.
California AB 325 (shared pricing algorithms) (CA, from January 1, 2026). You set prices in California with software that other businesses also use and that draws on competitors' data. Tools that use only your own data are not covered. Requires: Check whether your pricing tool uses competitors' data; Do not use shared pricing software to align prices with competitors; Do not pressure others to adopt the tool's recommended prices.
Illinois HB 3773 (AI in job decisions) (IL, from January 1, 2026). You have 1 or more employees in Illinois and use AI in recruiting, hiring, promotion, discipline, firing or other job decisions. Requires: Tell workers and applicants when AI is used in job decisions; Make sure the AI does not discriminate against protected groups; Do not use ZIP codes as a stand-in for protected traits.
Illinois Biometric Information Privacy Act (BIPA) (IL, from October 3, 2008). Your AI tool captures face scans, voiceprints or fingerprints of people in Illinois, such as voice ID on calls, face matching or some video interview tools. Requires: Get written consent before collecting face or voice data; Publish a policy for how long you keep it and when you delete it; Never sell or profit from the data; Delete it on schedule.
Texas Responsible AI Governance Act (TRAIGA) (TX, from January 1, 2026). You do business in Texas or serve Texans and use AI. For most businesses it bans harmful uses; health care providers must also disclose AI use to patients. Requires: Do not use AI to discriminate on purpose against protected groups; Do not use AI designed to push people toward self-harm or crime; Tell patients when AI is used in their care (health care only).
Utah Artificial Intelligence Policy Act (UT, from May 1, 2024). You use generative AI to talk with Utah consumers. Licensed professions (such as health, finance or legal) have stricter rules for high-risk conversations. Requires: Answer truthfully when someone clearly asks if they are talking to AI; Disclose AI up front in high-risk conversations if you are a licensed profession; Own what your AI says; blaming the tool is not a defense.
NYC Local Law 144 (automated hiring tools) (NYC, from July 5, 2023). You hire or promote for jobs in New York City and use a tool that scores, ranks or screens candidates to substantially help decide. Requires: Get an independent bias audit every year; Post the audit summary on your website; Notify candidates at least 10 business days before using the tool; Tell them how to ask for another process or an accommodation.
New York synthetic performer ad disclosure law (NY, from June 9, 2026). Your ads in New York show a human-like AI performer who is not a real, identifiable person, and you know it. Audio-only ads are not covered. Requires: Clearly disclose AI-generated performers in your ads; Ask your agency to tell you when an ad uses one.
New York Algorithmic Pricing Disclosure Act (NY, from November 10, 2025). You sell to New York consumers and an algorithm sets their prices using their personal data. Insurers, regulated banks and some subscription pricing are exempt. Requires: Show "THIS PRICE WAS SET BY AN ALGORITHM USING YOUR PERSONAL DATA" next to the price; Make the notice easy to see online and in store.
Connecticut PA 26-15 (AI in employment) (CT, from October 1, 2026). You employ people in Connecticut and use AI in hiring, promotion, discipline or firing, or you file a Connecticut layoff (WARN) notice. Requires: State in any layoff (WARN) notice whether AI played a role (from Oct 1, 2026); Give written notice before AI-assisted job decisions (from Oct 1, 2027); Tell people when they are chatting with an AI hiring tool, unless obvious (from Oct 1, 2027); Keep proof of bias testing; using AI is no defense to discrimination.
New Jersey disparate impact rules (AI tools) (NJ, from December 15, 2025). You use automated or AI tools to screen, score or decide in hiring, housing, lending, contracting or serving the public in New Jersey. Requires: Check AI tools for unfair impact on protected groups; Use a less harmful option when one works as well; Hold vendor tools to the same standard; you are responsible.
Maine chatbot disclosure law (LD 1727) (ME, from September 24, 2025). You use an AI chatbot or voice bot to deal with Maine consumers in a way a reasonable person could mistake for a human. Requires: Tell customers clearly they are not talking with a human; Apply the same notice to AI voice bots on your phone line.
Oregon SB 1546 (AI companions) (OR, from January 1, 2027). Only if your AI is designed to act as an ongoing companion or friend to users in Oregon. Customer service, business and productivity bots are excluded. Requires: Tell users clearly they are talking with AI; Detect suicide and self-harm talk and refer users to 988; Add protections for minors; File an annual report with the Oregon Health Authority.
Washington HB 2225 (AI companion chatbots) (WA, from January 1, 2027). Only if your chatbot keeps an ongoing relationship with Washington users and draws emotional responses. Customer service and business bots that do not are excluded. Requires: Disclose it is AI at the start and every 3 hours (hourly for minors); Set up a plan for suicide and self-harm talk; Add protections for minors.
Nebraska LB 525 (Conversational AI Safety Act) (NE, from July 1, 2027). You offer a public AI chat service in Nebraska that goes beyond customer service. Bots used only for customer service or product info, internal tools and narrow-topic bots are excluded. Requires: Tell users it is AI if a reasonable person could think it is human; Adopt a suicide and self-harm response plan; Add protections for minor account holders; Never claim it provides mental health care.
Idaho SB 1297 (Conversational AI Safety Act) (ID, from July 1, 2027). You offer a public AI chat service in Idaho that goes beyond customer service. Bots used only for customer service or business operations are excluded. Requires: Tell users it is AI if a reasonable person could think it is human; Adopt a suicide and self-harm response plan; Add protections for minor account holders.
FCC ruling: AI voices are "artificial" under the TCPA (US, from February 8, 2024). You place phone calls that use an AI-generated or cloned voice, including AI receptionists that call customers back. Requires: Get prior express consent before AI-voice calls (written consent for marketing); Say who is calling at the start of the call; Give people a way to opt out; Keep records of consent.
FTC Act: deceptive AI claims (Operation AI Comply) (US). Any US business that markets AI features or uses AI with customers. There is no size threshold. Requires: Back up any claim about what your AI does or saves; Call a product AI-powered only if it truly is; Check what your AI tells customers; you are responsible for it.
FTC rule on fake reviews and testimonials (US, from October 21, 2024). You post, buy or ask for reviews or testimonials, including ones written with AI. Requires: Do not post or buy fake reviews, including AI-written ones; Do not present AI-made testimonials as real customers; Disclose reviews written by employees or insiders.
EU AI Act Article 50 (AI transparency) (EU, from August 2, 2026). Your AI chats with people in the EU, or you publish AI-made content they see. Applies to non-EU companies too. Requires: Tell people they are talking with AI (the chatbot's maker must build this in); Label realistic AI images, audio and video (deepfakes); Label AI-written public-interest text unless a person reviewed it; Tell people when you use emotion-recognition or biometric tools.
EU AI Act high-risk rules (moved by the AI Omnibus) (EU, from December 2, 2027). You use AI for high-risk uses such as hiring or credit decisions about people in the EU. Requires: Use the AI as the vendor instructs; Assign a trained person to oversee it; Tell workers and affected people when high-risk AI is used; Keep the system's logs.