As AI adoption accelerates, states across the US continue to introduce new laws governing its use. The result is an increasingly complex regulatory landscape spanning the consumer, health care and employment arenas.  

With 2026 legislative sessions now closing across the country, this is a useful point at which to assess the year’s developments. Unlike some national parliaments, most US state legislatures meet for a limited period each year. Once a legislative session ‘adjourns’, the opportunity to pass most new legislation closes until the legislature reconvenes. This article provides a comprehensive overview of the AI legislation that has been enacted, the patterns that have emerged, and the compliance obligations businesses should prioritise heading into the second half of the year. 

In the continued absence of a comprehensive federal AI statute, states have filled the void with laws reflecting sharply different regulatory philosophies. Some states have enacted broad consumer-facing transparency frameworks that require disclosure whenever AI is used in a consequential decision. Others have taken a targeted approach, focusing narrowly on health care coverage determinations or employment screening tools. A few states have adopted risk-based frameworks that impose more demanding obligations on higher-risk applications while permitting lighter-touch treatment of lower-stakes deployments. 

The result is a patchwork of compliance obligations that vary by jurisdiction, sector, and use case. A business that uses AI to screen job applicants, generate patient-facing communications, and make automated coverage determinations may face three distinct regulatory regimes simultaneously, potentially from the same state.  

Omnibus AI statutes continued to expand in 2026. These laws impose broad transparency, disclosure, risk assessment, and accountability requirements that apply across industries and use cases. They often require businesses to notify consumers when AI or automated decision-making affects them, to document training data and model behaviour, and to establish liability frameworks for AI-caused harm.  

California, Colorado, and Utah remain the most active states in this space, with new legislation refining and extending the frameworks those states established in prior sessions. 

A notable trend in 2026 is the emergence of requirements specifically targeting generative AI and large language models. Several states enacted or proposed disclosure requirements that are triggered by the deployment of generative AI systems above specified scale thresholds, a category of obligation that did not exist in most state frameworks even two years ago. Businesses using generative AI in consumer-facing applications should evaluate whether these new requirements apply to their deployments. 

Health care remained the most active arena for AI regulation in 2026, driven by persistent concerns that automated systems are influencing clinical and coverage decisions without adequate human oversight. The primary focus of enacted legislation in this category was prior authorisation: multiple states strengthened or clarified prohibitions on AI serving as the sole basis for coverage denials, requiring human review of AI-assisted determinations and mandating documentation sufficient to support appeals. 

A second wave of health care AI legislation targeted AI-generated patient communications, requiring health care organisations to disclose when a communication was generated or substantially drafted by an AI system and to ensure that patients can access a human alternative. States active in this area include California, Colorado, and New York. Smaller states that had not previously enacted health care AI legislation began moving in this direction in 2026 as well, suggesting that the sector-specific frameworks pioneered by early-mover states are now being adopted more broadly. 

State regulation of AI in the employment context has matured significantly in 2026.  

The early generation of employment AI laws focused primarily on disclosure requirements. Employers must notify applicants and employees when automated decision-making tools are used in hiring or performance evaluation. That first wave is now largely enacted.  

The 2026 session has seen states move to a second generation of requirements: auditing, reporting, and affirmative anti-discrimination obligations that require employers not just to disclose AI use but to demonstrate that their AI systems do not produce discriminatory outcomes. 

Illinois, which enacted the first US law regulating the use of AI in job interviews in 2019, continued to refine its framework in 2026. Connecticut enacted new mandates governing workplace AI and disclosure requirements for reductions in force involving AI-assisted decision-making. Colorado’s Senate Bill 26-189, which addresses employer obligations for AI used in consequential employment decisions, was closely watched throughout the session and represents one of the most significant pieces of employment AI legislation enacted this cycle. 

Compliance deadlines are arriving: Unlike early AI legislation, which often carried long lead times before taking effect, some 2026 enactments have shorter implementation windows. Businesses that have not yet mapped their AI deployments against the applicable state law landscape should do so now. The key questions for any business deploying AI are straightforward: which states’ laws apply to this system, what obligations are triggered, and when do they take effect? 

Deployers, not just developers, bear compliance responsibility: Most state AI laws impose obligations on businesses that deploy or use AI in their operations, not just on the companies that develop the underlying technology. A business that integrates a third-party AI tool into its hiring workflow, clinical decision support system, or consumer-facing communications platform is a deployer under most state frameworks and bears compliance responsibility accordingly. Contracts with AI vendors that do not address compliance obligations and risk allocation may leave significant gaps. 

Federal pre-emption remains unlikely in the near term: Congress has not enacted a comprehensive federal AI law, and the prospect of legislation that would pre-empt the growing body of state regulation remains uncertain. Businesses cannot rely on federal pre-emption, that is, the invalidation of a US state law that conflicts with federal law, to simplify their compliance posture. Until Congress acts, the multi-state compliance framework is the operative reality, and businesses operating across state lines must manage their AI governance programmes accordingly. 

The 2026 legislative sessions confirm that AI regulation has moved from the periphery to the centre of state policy agendas. With nearly 80 percent of state legislatures adjourning by June and a surge of enacted AI legislation across consumer transparency, health care, and employment, businesses face a compliance landscape that is both broader and more demanding than it was a year ago. Organisations that have not yet inventoried their AI deployments against applicable state law frameworks should do so as a matter of priority. Below, we summarise some of the key points employers need to be aware of:  

• AI regulation is now a compliance requirement, not an emerging issue – With the 2026 legislative cycle largely complete, state AI laws are already in effect across consumer transparency, health care, and employment. Businesses operating in multiple states now face enforceable obligations that apply immediately. California, Colorado, Utah, Illinois, and New York remain the most active jurisdictions. 

• Your organisation bears compliance responsibility, not just your vendors – State frameworks impose obligations on businesses that deploy or use AI in operations, not only on the technology developers. Even if you’re integrating a third-party AI tool, your organisation is the responsible party under most state laws, and gaps in vendor contracts create significant compliance risk. 

• Health care providers face intensified scrutiny on AI-driven decisions – Health care AI regulation dominated the 2026 legislative session, with states tightening rules on prior authorisation, clinical communications, and algorithmic decision-making. Providers must ensure human review requirements are built into workflows. 

• Employment obligations beyond disclosure – Early state legislation focused on disclosure of the use of AI in employment decision-making. New laws prescribe requirements for auditing and reporting and impose affirmative anti-discrimination obligations. 

• Simplified compliance obligations through federal pre-emption is unlikely - Congress has not acted on comprehensive federal AI legislation, and pre-emption is unlikely in the near term. Until it does, multi-state compliance is your operating reality, and your AI governance programme needs to account for 50 different regulatory frameworks. 

Epstein Becker & Green, P.C., the US member of Ius Laboris, tracks every enacted state AI law across three policy domains, omnibus consumer transparency, health care and life sciences, and employment and workforce, via its AI Enacted Bills Map. It is updated continuously as new legislation is signed.