US state AI laws: what Colorado’s AI Act and Texas’s TRAIGA require

The short version

• There is no comprehensive US federal AI statute. The two leading cross-sectoral state AI laws are Colorado’s AI Act and Texas’s TRAIGA (the Texas Responsible Artificial Intelligence Governance Act).
• Colorado’s AI Act (SB 24-205, signed 17 May 2024) never took operative effect. Its start date moved from 1 February 2026 to 30 June 2026 (SB 25B-004), then SB 26-189, signed 14 May 2026, repealed and re-enacted it around automated decision-making technology, effective 1 January 2027. It is not yet in force.
• Texas’s TRAIGA (HB 149, signed 22 June 2025) took effect 1 January 2026 and is in force as of 10 November 2026; it bans listed AI uses, requires some disclosure, and is enforced by the Texas Attorney General.
• Both bind developers (who build or substantially change an AI system) and deployers (businesses that put one into use); both let only the Attorney General enforce; and neither creates a private right of action.
• Both can reach AI used in legal and dispute-resolution work. The EU AI Act is the broader, comparable regime, which we cover separately.^1,2,3,5,6

What are the main US state AI laws?

There is no comprehensive US federal AI law. The two cross-sectoral state statutes that bind private-sector developers and deployers are Colorado’s AI Act and Texas’s TRAIGA. Colorado built a duty-and-risk model aimed at discrimination in important decisions, recast in 2026 around automated decision-making technology; Texas lists prohibited AI uses and leaves enforcement to its Attorney General.^1,3,5

How courts and lawyers use AI, and how the law regulates AI more generally, including the federal executive order, is set out in AI in law. The overview and lead is AI in dispute resolution.

What does the Colorado AI Act require, and is it in force?

Not yet. The Colorado AI Act is not in effect as of 10 November 2026, and it does not take effect until 1 January 2027. SB 24-205 was repealed and re-enacted by SB 26-189 before it ever took effect, so the current version applies to consequential decisions made on or after that date.^1,3

SB 24-205 built a duty-of-care model. It applied to a high-risk artificial intelligence system, one that, when deployed, makes or is a substantial factor in making a consequential decision (6-1-1701(9)): a decision with a material legal or similarly significant effect on the provision or denial to a consumer of, or the cost or terms of, eight domains that included a legal service (6-1-1701(3)). Developers and deployers owed reasonable care against algorithmic discrimination, an AI system causing unlawful differential treatment or impact on protected grounds such as age, race, sex, religion or disability (6-1-1701(1)). The model carried disclosure, impact-assessment, consumer-notice and appeal duties, a standalone duty to tell a consumer they were dealing with an AI system (6-1-1704), and a rebuttable presumption (a starting assumption the Attorney General would have to disprove) of reasonable care for those who complied (6-1-1702 to 6-1-1703). These duties were to begin on 1 February 2026.¹

That start date was pushed back once, then the model changed. SB 25B-004, signed 28 August 2025, “extends the effective date of the requirements of Senate Bill 24-205 to June 30, 2026”. Before that date arrived, SB 26-189, signed 14 May 2026, repealed and re-enacted Part 17 around automated decision-making technology (ADMT), a technology that processes personal data and uses computation to generate output used to make, guide or assist a decision about an individual (6-1-1701(2)). A covered ADMT is one used to materially influence a consequential decision (6-1-1701(5)).^1,2,3

The re-enacted Act is lighter than the one it replaced. It drops the duty-of-care and impact-assessment machinery, the rebuttable presumption, and the standalone chatbot-disclosure duty. In their place, a developer must document a covered ADMT’s intended uses, training data and known limits for deployers (6-1-1702); a deployer must keep records, give consumers notice before a covered ADMT materially influences a decision, explain an adverse outcome within 30 days, and offer correction and meaningful human review (6-1-1703 to 6-1-1705). There is no new private right of action (6-1-1709), and the Attorney General makes rules to implement Part 17 and the adverse-outcome disclosures (6-1-1706(5); 6-1-1704(4), 6-1-1705(3)). The act “takes effect January 1, 2027” and applies to consequential decisions made on or after that date (section 5).³

The covered-domain list also changed, which matters for legal work. SB 24-205 named “a legal service” among the decisions it reached. The re-enacted list is education, employment, residential real estate in Colorado, a financial or lending service, insurance, health-care, and essential government services and public benefits (6-1-1701(6)), and no longer names legal services. A dispute tool can still fall inside a remaining domain, such as an insurance claim adjudication, and a narrow procedural task that does not materially influence a decision is carved out.^1,3

What does Texas’s TRAIGA require, and when did it take effect?

TRAIGA, the Texas Responsible Artificial Intelligence Governance Act (HB 149), took effect 1 January 2026 (section 10) and is in force as of 10 November 2026. It was signed on 22 June 2025, and unlike Colorado’s it is already in operation.⁵

HB 149 adds a new Subtitle D, “Artificial Intelligence Protection”, to the Texas Business and Commerce Code, across Chapters 551 to 554. Chapter 552, Subchapter B lists the prohibited and required uses; some bind government, some bind everyone.⁵

• Disclosure (552.051): a governmental agency offering an AI system for consumers to interact with must say so, in clear plain language, before or at the interaction and with no dark pattern (a design that nudges or tricks the user); a health-care provider must disclose AI use by the first service.
• No AI “intentionally aims to incite or encourage” self-harm, harm to others, or criminal activity (552.052).
• No social scoring (rating people by their behaviour or traits) by a governmental entity (552.053), and no AI used by a governmental entity to identify a person from biometric data or scraped images without consent where that would infringe a legal right (552.054).
• No AI with the sole intent to infringe a person’s constitutional rights (552.055); and no AI deployed “with the intent to unlawfully discriminate against a protected class”, where “a disparate impact is not sufficient by itself” to show intent, with carve-outs for insurers and federally insured financial institutions (552.056).
• No AI developed or distributed with the sole intent to produce or distribute child pornography (Penal Code 43.26) or sexually explicit “deep fake” videos or images of a person (Penal Code 21.165), and no AI that impersonates a child under 18 in text-based conversations simulating sexual conduct (552.057).⁵

A common summary, that TRAIGA makes every business disclose its AI, is wrong: the disclosure duty in 552.051 binds governmental agencies and health-care providers, not all businesses. The Act also amends the Texas biometric law (the Capture or Use of Biometric Identifiers Act, CUBI, at 503.001) to exempt AI training and security or fraud uses (section 2). Chapter 553 sets up a regulatory sandbox at the Texas Department of Information Resources, letting an approved system be tested for up to 36 months (553.053), though the Subchapter B prohibitions cannot be waived (553.051(e)). Chapter 554 creates an advisory Texas Artificial Intelligence Council that may not adopt binding rules (554.103).⁵

The deepfake prohibition connects to a wider evidence question, which we cover in AI-generated evidence and deepfakes. Whether a consumer-facing legal chatbot can give advice at all, without crossing into the unauthorised practice of law (giving legal advice without being licensed to), is the subject of AI legal advice chatbots and the unauthorized practice of law.

Who do these laws cover, and what counts as a regulated use?

Both laws bind developers and deployers: Colorado turns on whether AI drives a consequential decision, Texas on whether a use falls into one of its listed prohibitions.^3,5

In Colorado, developers and deployers are persons doing business in the state, and the trigger is a consequential decision about a consumer, a Colorado resident including an employee or job applicant (SB 26-189, 6-1-1701(4) to (8)).^1,3

Texas reaches more widely. TRAIGA applies to any person who promotes, advertises or conducts business in Texas, produces a product or service used by Texas residents, or develops or deploys an AI system in Texas (551.002). Its “consumer” is a Texas resident acting in an individual or household context, not a commercial or employment one (551.001).⁵

Texas’s TRAIGA and Colorado’s original SB 24-205 define an “artificial intelligence system” in the same broad, OECD-derived words, as “any machine-based system that, for any explicit or implicit objective, infers from the inputs the system receives how to generate outputs, including content, decisions, predictions, or recommendations, that can influence physical or virtual environments” (Texas 551.001; SB 24-205, 6-1-1701(2)). Colorado’s re-enacted Act dropped that term and turns instead on automated decision-making technology. The TRAIGA wording is wide enough to reach systems that plan and act over several steps, sometimes called agentic AI, an emerging label we explain in agentic AI in dispute resolution.^1,3,5

How are these laws enforced, and can individuals sue?

In both states the Attorney General enforces, and neither law creates a private right of action, so an individual cannot sue under them. In practice, the enforcement risk in each state runs to the Attorney General.^3,5

In Colorado, the Attorney General enforces Part 17 through the Colorado Consumer Protection Act, where a violation is a deceptive trade practice “enforceable exclusively by the attorney general” (SB 26-189, 6-1-1706). Before most enforcement, the Attorney General must give a 60-day chance to cure, unless the violation was knowing or repeated. Those rules are in train: the Colorado Department of Law filed proposed rules on 11 August 2026 and must adopt final rules by 1 January 2027 (6-1-1704(4); 6-1-1705(3)). The original SB 24-205 had offered a rebuttable presumption and an affirmative defence tied to the NIST AI Risk Management Framework, a voluntary US standard for managing AI risk; the re-enacted Act does not carry those over.^1,3,4

In Texas, the Attorney General has exclusive authority to enforce the chapter, except as provided by Section 552.106, which lets a licensing agency sanction its own licensees after an Attorney General finding; there is no private right of action (552.101). The Act requires a 60-day notice and cure before suit (552.104) and sets civil penalties of $10,000 to $12,000 for a curable violation, $80,000 to $200,000 for an uncurable one, and $2,000 to $40,000 a day for a continuing one (552.105). It gives a rebuttable presumption of reasonable care and a defence for substantial compliance with the NIST “Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile” or another recognised framework (552.105). The Act also set a 1 September 2026 deadline for the Attorney General to post an online complaint mechanism (section 8), a statutory deadline we have not confirmed as met.⁵

How do these differ from the EU AI Act?

The EU AI Act is one comprehensive, risk-tiered regulation, sorting AI into prohibited, high-risk, limited and minimal-risk uses across sectors, and it lists AI used in the administration of justice and in alternative dispute resolution among its high-risk uses (Annex III, point 8(a)). The two US state laws are narrower, each reaching only specified decisions or uses rather than all AI, with no comparable US federal statute.^1,5,6

Neither law is simply stricter than the other. Colorado reaches more decisions but is not yet in force, while Texas is in force, and although its social-scoring and biometric bans fall only on governmental entities, its discrimination, deepfake and manipulation bans reach everyone. The EU detail is in the EU AI Act and dispute resolution.^3,5,6

Why does this matter for AI in legal and dispute-resolution work?

An AI tool that helps triage, assess or decide a dispute can be a regulated system, and a neutral (an arbitrator, mediator or other independent decision-maker) who uses one is not outside these laws because the work is private. Texas’s TRAIGA reaches any AI used with Texas residents, so a dispute-resolution body’s tool is caught by its scope and the Subchapter B prohibitions, most directly its intent-based discrimination and deepfake bars (552.056, 552.057).⁵

Colorado’s original Act named “a legal service” among its consequential-decision domains, so AI affecting one was a high-risk system and a dispute chatbot triggered the 6-1-1704 disclosure duty. The re-enacted Act dropped both, so from 1 January 2027 a dispute tool is regulated in Colorado only where it materially influences a decision in a remaining covered domain, such as insurance. For a body running cases in both states, the safe assumption is that AI affecting the record or the outcome will draw notice, documentation and anti-discrimination duties under one law or the other, and an institution’s own AI arbitration rules sit on top.^1,3,5

The overview and lead is AI in dispute resolution. AI rulings inside arbitration are collected in AI arbitration case law. Institutional AI guidance is in the ADR rules tracker and the SVAMC AI guidelines.

What does this mean for anyone using AI in a dispute?

In our view, the detail of these statutes matters less than the direction they share. Colorado’s start date moved twice and its model was rewritten before it took effect, yet the throughline held. A named person stays responsible for a decision that affects someone, and AI use that shapes an important decision has to be open to checking, through notice, documentation and a route to correction or human review. A person, not the tool, has to be able to review and correct a decision the law lets a consumer challenge, which is what Colorado’s human-review duty requires. Texas reaches the same ground by banning intent-based discrimination and leaving a defence for those who document and test their systems, and the EU AI Act by risk tier. Most of this is old duties made explicit for AI, and because the rules move faster than any single statute, the safest reading is that those duties already govern AI use, with each new act spelling them out rather than inventing them.^1,3,5,6