While the US lacks a single federal "AI Act" in 2026, a patchwork of state laws has created a dangerous minefield. The biggest update is the aggressive entry of Illinois into the fray.
No Federal Safety Net
Without unified federal AI legislation, companies must navigate conflicting state requirements—each with its own enforcement mechanisms and penalty structures.
1. Illinois: The Civil Rights Evolution (HB 3773)
Illinois expands its privacy stance to general AI use in the workplace.
The Rule: Amending the Human Rights Act, it is now a civil rights violation to use AI in employment decisions if it has a discriminatory effect.
The Risk: Damages for these violations can be uncapped.
2. Colorado: The Consumer Shield (CAIA)
Colorado's Consumer AI Act takes a consumer protection approach.
The Approach: Colorado treats violations as Deceptive Trade Practices.
The Penalty: Civil penalties up to $20,000 per violation. With AI affecting thousands of users, fines can scale rapidly.
3. California: The Transparency Trap
California's AB 2013 focuses on AI transparency requirements.
The Requirement: Developers must publicly disclose training data details under AB 2013.
The Risk: Failure to disclose triggers Attorney General enforcement under Unfair Competition laws.
The Patchwork Problem
Operating across state lines means juggling multiple, sometimes conflicting requirements:
- Illinois focuses on employment discrimination—HR and hiring teams are primary risk zones
- Colorado emphasizes consumer protection—customer-facing AI is the exposure point
- California demands transparency—your AI development and training processes are under scrutiny
A company using AI for hiring (Illinois), customer service (Colorado), and product development (California) faces three distinct compliance regimes—each with its own documentation requirements, disclosure obligations, and penalty structures.
What This Means for Your Business
- Map your AI exposure by state. Know which AI systems touch which jurisdictions.
- Document employment decisions. Illinois requires proof that AI-assisted hiring doesn't discriminate.
- Track per-user impacts. Colorado's per-violation penalties mean one bad AI deployment can multiply fast.
- Prepare disclosure documentation. California wants to see your training data practices.
- Train your people. Human operators need to understand the rules—and the stakes.
Navigate the Minefield
BaseState helps you build compliance foundations that work across jurisdictions.
Take the Free Readiness Test Get Started with BaseState