US state AI laws as the AIGP tests them

The AIGP's Body of Knowledge names "federal and state AI laws that apply to private sector organizations" among the current AI laws a candidate must understand, and the United States is where that phrase moved most in 2026. There is still no comprehensive federal AI law. Colorado, whose 2024 AI Act was the model most people meant by a state AI law, repealed and replaced it in May 2026 with a narrower law on automated decision-making technology that starts on January 1, 2027. Texas's Responsible Artificial Intelligence Governance Act has applied since January 1, 2026. California enacted SB 53 on frontier AI models. And a December 2025 executive order set the federal government against state AI laws it considers onerous. This guide sets out each from its own text, what changed after the Body of Knowledge was approved, and how to answer a question that may have been written before the changes.

The short answer

• Colorado: SB 26-189, approved May 14, 2026, repeals and reenacts the 2024 AI Act as a law on automated decision-making technology (ADMT) used in consequential decisions. Developers document, deployers give notice and explain adverse outcomes, consumers can correct data and ask for human review. The duty of care, risk management programs and impact assessments are gone. It "takes effect January 1, 2027".
• Texas: TRAIGA (HB 149) has applied since January 1, 2026. It prohibits a short list of intentional harms, requires government agencies and health care providers to disclose AI, and is enforced only by the attorney general, after a 60-day chance to cure, with civil penalties up to US$200,000 per uncurable violation.
• California: SB 53, signed September 29, 2025, applies to developers of the largest frontier models: publish a frontier AI framework, report critical safety incidents, protect whistleblowers.
• Federal: no comprehensive AI statute. An executive order of December 11, 2025 creates a Justice Department task force to challenge state AI laws and asks for federal legislation that would preempt conflicting ones.
• For the exam: the Body of Knowledge was approved on September 9, 2025, before Colorado's replacement, TRAIGA's start and the executive order. Know the 2024 Colorado model, which older questions may describe, and know what replaced it.

What the AIGP asks about US AI law

Domain II is "Understanding how laws, standards and frameworks apply to AI". Its description names "the EU AI Act, the South Korean AI Basic Law, federal and state AI laws that apply to private sector organizations", and its competencies divide the ground in two.

Competency II.B is existing law applied to AI. Two of its indicators are mostly American in practice: "Understand how nondiscrimination laws apply to AI (e.g., in the employment, credit, lending, housing and insurance contexts)" and "Understand how consumer protection laws apply to AI (e.g., prohibiting unfair and deceptive acts or practices)". Competency II.C is AI-specific law: risk classification, requirements, enforcement and penalties, and "the differences in requirements based on organizational context (e.g., providers, deployers, importers and distributors)". The state laws below are where II.C meets the United States, and their split between developers and deployers is the part of II.C they illustrate best.

Colorado: from the AI Act to an ADMT law

Colorado's 2024 act, SB 24-205, was a comprehensive, risk-based law built on a duty to avoid algorithmic discrimination. It never applied. Its start was moved once, and in May 2026 the General Assembly replaced it. The IAPP summarized the change: "Senate Bill 189 replaces the AI Act's original risk-based framework with new disclosure and transparency requirements. The shift means the law no longer carries obligations for a duty of care, risk management programs or impact assessments." AI impact assessments as the AIGP tests them covers the assessments that EU law still requires.

The new law, Chapter 131 of the 2026 Session Laws, was "Approved: May 14, 2026". Its main pieces, from the act itself (Colorado Revised Statutes, part 17 of article 1 of title 6):

• What it covers. Automated decision-making technology is technology that processes personal data and uses computation to generate output, such as predictions, scores or rankings, used to make, guide or assist a decision about an individual (section 6-1-1701(2)). A covered ADMT is one used to "materially influence" a consequential decision: its output is a non-de minimis factor in the decision and affects the outcome (6-1-1701(5) and (13)). Consequential decisions are those about access to, eligibility for, selection for or the price of seven covered domains: education, employment, residential real estate, financial or lending services, insurance, health care services, and essential government services and public benefits (6-1-1701(3) and (6)). Calculators, spam filters, spreadsheets without machine learning and tools that only summarize for human review are excluded.
• Developers. From January 1, 2027, a developer must give each deployer the intended and known harmful uses, the categories of training data, known limitations and risks, instructions for use, monitoring and human review, and the information the deployer needs for its own notices; must notify deployers of material updates; and must keep records for three years (6-1-1702).
• Deployers. Before using a covered ADMT, a deployer gives a clear and conspicuous notice, which a prominent public notice at the point of interaction satisfies. After an adverse outcome, it gives within 30 days a plain-language description of the decision and the ADMT's role, a way to request more information, and an explanation of the consumer's rights. It keeps records for three years (6-1-1703 and 6-1-1704).
• Consumers. After an adverse outcome, a consumer may ask for instructions to obtain and correct inaccurate personal data, and for meaningful human review and reconsideration of the decision, to the extent commercially reasonable (6-1-1705). Meaningful human review is defined: a trained reviewer with authority to approve, modify or override the decision, who considers the evidence and does not simply default to the system's output.
• Enforcement. Only the attorney general enforces the law, as a deceptive trade practice under the Colorado Consumer Protection Act. Before acting, the attorney general must give notice where a cure is possible and allow 60 days; knowing or repeated violations get no cure period, and the cure provision itself is repealed on January 1, 2030. There is no new private right of action (6-1-1706 and 6-1-1709).
• Timing. "this act takes effect January 1, 2027", and "This act applies to consequential decisions made on or after January 1, 2027." The attorney general must adopt rules on the post-adverse-outcome disclosures and on consumer rights on or before January 1, 2027.

The IAPP's coverage quoted a practitioner on what to watch: "One of the most important topics will be developing the definition of 'materially influences,'" because every obligation turns on it.

Texas: TRAIGA

The Texas Responsible Artificial Intelligence Governance Act, House Bill 149, is short on duties and long on intent. Its section 10: "This Act takes effect January 1, 2026."

• Disclosure. A governmental agency that offers an AI system to interact with consumers must disclose that the consumer is interacting with AI, even where that would be obvious to a reasonable consumer, and health care providers must disclose AI used in a patient's service or treatment (section 552.051).
• Prohibitions. No one may develop or deploy an AI system that intentionally aims to incite self-harm, harm to others or crime (552.052); that has the sole intent of infringing constitutional rights (552.055); or that intends to unlawfully discriminate against a protected class (552.056), where "a disparate impact is not sufficient by itself to demonstrate an intent to discriminate". Government may not use AI for social scoring (552.053) or, in specified circumstances, for biometric identification without consent (552.054). Systems built to produce child sexual abuse material or unlawful sexual deepfakes are banned (552.057).
• Enforcement. The attorney general has exclusive authority and there is no private right of action (552.101). The attorney general must give written notice and may not sue before the 60th day, or at all if the violation is cured and documented in time (552.104). Uncured violations carry civil penalties of US$10,000 to US$12,000 each if curable, US$80,000 to US$200,000 each if not, and US$2,000 to US$40,000 a day for a continuing violation (552.105).
• A governance safe harbor. A defendant may not be found liable where it finds a violation through testing, including "adversarial testing or red-team testing", or through an internal review process while substantially complying with NIST's generative AI profile or "another nationally or internationally recognized risk management framework for artificial intelligence systems" (552.105(e)).

The act also creates a regulatory sandbox and a Texas Artificial Intelligence Council. For an AIGP candidate, the safe harbor is the line worth remembering: it is a state law that rewards following the frameworks of Domain II.

California: SB 53

California's Transparency in Frontier Artificial Intelligence Act regulates developers, not deployers, and only the largest. The IAPP's analysis: SB 53 applies to "frontier developers" and "large frontier developers", which train a "frontier model", defined as a "foundation model that was trained using a quantity of computing power greater than 10^26 integer or floating-point operations". It adds: "A frontier developer gets scoped as a large frontier developer when, together with its affiliates, it collectively sees annual gross revenues over USD500 million in the preceding calendar year."

The duties, as the IAPP reports them: the bill requires a "large frontier developer to write, implement, and clearly and conspicuously publish on its internet website a frontier AI framework that applies to the large frontier developer's frontier models"; developers must report critical safety incidents to the Governor's Office of Emergency Services "within 15 days or 24 hours if there is imminent risk of death or serious physical injury"; whistleblowers are protected; and "Violators of the law could face a civil penalty of up to USD1 million."

The scope point matters most for governance programs. The IAPP's contributor put it directly: "SB 53 is very unlikely to apply to organizations that would be considered deployers under the EU AI Act." A company that calls a frontier model through an interface is not training one.

The federal layer: an order against state laws

There is no federal AI statute of general application, and the federal government's main act on state law is an executive order, "Ensuring a National Policy Framework for Artificial Intelligence", signed on December 11, 2025. Its policy: "to sustain and enhance the United States’ global AI dominance through a minimally burdensome national policy framework for AI."

It directs, in turn:

• An AI Litigation Task Force at the Justice Department, within 30 days, "whose sole responsibility shall be to challenge State AI laws inconsistent with the policy set forth in section 2 of this order".
• An evaluation of state AI laws by the Commerce Department within 90 days, identifying onerous ones.
• Funding conditions, starting with remaining broadband (BEAD) funding and extending to agencies' discretionary grants.
• Federal standards: an FCC proceeding on "a Federal reporting and disclosure standard for AI models that preempts conflicting State laws", and an FTC policy statement on how the FTC Act's ban on unfair and deceptive practices applies to AI models.
• Legislation: a recommendation for "a uniform Federal policy framework for AI that preempts State AI laws that conflict with the policy set forth in this order", which is not to propose preempting state laws on child safety, AI compute and data center infrastructure, or state government procurement and use of AI.

The order names Colorado's original act as an example, objecting to "a new Colorado law banning “algorithmic discrimination”". It does not repeal any state law; it directs federal agencies and asks Congress to act. The IAPP's coverage was titled with the point: "legal questions remain".

Other states

Colorado, Texas and California are the laws an AIGP candidate is most likely to meet, but they are not the only activity. The IAPP's analysis of the 2026 sessions: "At the macro level, state legislators are introducing more AI bills than ever before." It found that "In lieu of an omnibus approach, model-specific regulation has become more popular with policymakers", most visibly in "bills focused on chatbots, health-related systems and algorithmic pricing". The IAPP keeps a tracker of cross-sectoral bills; this guide covers the three enacted laws that matter most to a governance program.

What changed after the Body of Knowledge was approved

The Body of Knowledge v2.1 was approved on September 9, 2025. Every development in this guide came after that: SB 53 was signed on September 29, 2025, the executive order on December 11, 2025, TRAIGA began to apply on January 1, 2026, and Colorado's replacement was approved on May 14, 2026. The IAPP updates the exam yearly and gives "at least 90 days" notice of new content.

So an exam question on US state law may have been written for the Colorado model of 2024: a risk-based law with a duty of care against algorithmic discrimination, developer and deployer obligations, risk management programs and impact assessments. Read such a question on its own facts. If it asks what a deployer of a high-risk system must do under a comprehensive state AI law, it is testing the developer-deployer structure, which survives in Colorado's new law in a lighter form, and the answer the question supports is the one to choose. If it asks about Colorado by name and date, check which law the date points to.

Where to start

The AIGP's first competency, AI and the need for governance, is free in full with a free account: five lessons, 100 questions and 118 flashcards on the concepts every one of these laws assumes, from what counts as AI to the developer and deployer roles. The rest of the course takes the Body of Knowledge through the laws with practice in the exam's format. The EU AI Act as the AIGP tests it covers the law the US states were measured against, and The NIST AI RMF as the AIGP tests it the framework Texas rewards.