California AI Laws 2026: The AI Regulation Tracker for California and U.S. AI Laws, Enacted and Pending

On September 30, 2026, Governor Newsom signed the last of the AI bills from California’s 2026 session, twelve in one day and twenty-four over the month by this tracker’s count, and vetoed four more.¹ The day before, the White House had ordered the federal executive branch to stop saying “artificial intelligence” and say “Super Intelligence” instead; the same September 30, Newsom signed an executive order directing California’s agencies to keep saying “Artificial Intelligence” and “AI.”² Four months earlier, Colorado had repealed the AI Act that every compliance calendar in the country was built around, effective January 1, 2027, and replaced it with a narrower law that takes effect the same day.³ If your company’s AI compliance plan was written in 2025, it is aimed at the wrong laws.

This tracker, current to October 27, 2026, answers the questions I hear from founders and general counsel of California AI companies: which California AI laws bind you today, what the September signings add, what the other states did, whether there is a federal AI law, whether federal preemption will rescue anyone, who is actually enforcing, what compliance costs, and what is due when. The short version: the comprehensive frameworks shrank or stalled, the targeted statutes multiplied, and the January 1, 2027 cluster of effective dates is the one to calendar now.

Key Takeaways

• California’s live AI obligations are targeted, not comprehensive. The CCPA’s automated decisionmaking rules, the companion-chatbot law, the AI Transparency Act, the Civil Rights Council’s employment rules, and AB 316’s bar on blaming the AI are in force; SB 53’s frontier-model duties reach only developers training above 10^26 operations.⁴
• September 2026 added a second layer, mostly due in 2027. Twenty-four AI bills were chaptered between September 9 and September 30, among them SB 947’s bar on disciplining or firing by an automated decision system alone, an AI-layoff notice rule, a child-safety chatbot law, a bar on representing a customer-service chatbot as human, and the country’s first AI-auditor registry; most take effect January 1, 2027, and SB 1000 took effect on signature.¹
• Colorado’s AI Act is being replaced before it is enforced. SB 26-189, signed May 14, 2026, repeals and reenacts Part 17 effective January 1, 2027 as an Attorney-General-only notice-and-rights law; the 2024 duties nominally run from June 30 to December 31, 2026 under a stipulated no-enforcement order.³⁵⁶
• There is no federal AI law, and no state law has been preempted. The December 2025 preemption order produced a task force, a proposed FTC statement, and a legislative recommendation; the Commerce evaluation of “onerous” state laws that section 4 directed had not appeared in the Federal Register as of October 27, 2026, and the only AI statute a court blocked in 2026 is enjoined pending appeal in a First Amendment challenge.⁷⁸
• Enforcement runs under ordinary law, and the AI is treated as a tool. Ten state attorneys general, Florida, Texas, Nebraska, and the seven states Nebraska’s attorney general named, have sued OpenAI, Nebraska under its Consumer Protection Act, Uniform Deceptive Trade Practices Act, and Age-Appropriate Online Design Code Act, and the Ninth Circuit held in August that Perplexity’s shopping agent “is a tool, not a person for statutory purposes” under the Computer Fraud and Abuse Act, in a holding limited to who “accesses” a computer.⁹

Which AI laws are in force in California right now?

Nine California AI measures bind private companies as of October 27, 2026, and most startups fall under four or five of them. The table below is the California tracker: each row gives who the measure covers, what it requires, when it became operative, who enforces it, and whether a private plaintiff can sue.

The frontier-model law gets the headlines and reaches the fewest companies. SB 53, the Transparency in Frontier Artificial Intelligence Act, took effect January 1, 2026 and applies to developers that train models using more than 10^26 integer or floating-point operations, with its heaviest duties reserved for developers above $500 million in annual revenue; the Attorney General may seek civil penalties up to $1 million per violation.⁴ Everything else in the table reaches ordinary products.

California AI laws and regulations in force, October 2026

Two California AI election-deepfake statutes have been blocked in court, each only as to the parties that challenged them. AB 2655, the election-deepfake platform law, was held preempted by Section 230 of the Communications Decency Act as applied to X and Rumble in August 2025, and AB 2839 was permanently enjoined as to the plaintiffs the same month; the state’s appeal of the AB 2655 ruling is briefed in the Ninth Circuit with no argument date, and the Legislature rewrote AB 2839’s section by an urgency statute, AB 502, effective September 19, 2026.¹⁰ AB 2013, the training-data law, survived its challenge at the preliminary-injunction stage on March 4, 2026, when the court found xAI had shown “a distinct possibility” but not a likelihood of success; the Ninth Circuit hears argument on November 18, 2026.¹¹

If your product makes, or substantially replaces a human in making, a decision about a Californian’s job, credit, housing, education, or health care—the ADMT compliance date is January 1, 2027, and the employment rules already apply.

What AI bills did California sign in September 2026?

Between September 9 and September 30, 2026, the Governor signed twenty-four AI bills by this tracker’s count and vetoed four, and the Legislature’s chaptered record, not the press coverage, is the source for what each one does.¹ Three themes run through the batch: the workplace, children, and who gets to audit AI.

The workplace bills matter to every employer with California staff. SB 947 provides that “An employer shall not rely solely on an ADS when making a disciplinary or termination decision,” sets a $500 civil penalty per violation, and assigns enforcement to the Labor Commissioner and public prosecutors from July 1, 2027; SB 951 requires an employer giving Cal-WARN notice of a layoff “caused in whole or in substantial part by an AI system or other automated technology” to say so in the notice; and AB 1331 and AB 1883 bar bathroom surveillance and AI tools that infer employees’ emotional states or collect neural data.¹² The child-safety bills build on SB 243: SB 1119, “Adam’s Law,” requires a companion-chatbot operator that allows child users to “Perform and document a comprehensive risk assessment” before release from July 1, 2027, with independent child-safety audits due by January 1, 2029 for operators above $500 million in revenue, and civil penalties of up to $5,000 per affected child for a negligent violation and $15,000 for an intentional one; SB 867 bans toys with companion chatbots from January 1, 2027 until a January 1, 2031 sunset.¹³ The audit bills create something no other state has, on agency deadlines rather than company ones: SB 813 directs the Government Operations Agency to set criteria for independent verification organizations, AB 1405 requires that “Beginning January 1, 2029, a person shall not offer, sell, or conduct a covered AI audit unless the person is registered with the agency,” and an executive order signed September 18 moves the agency’s deadlines to May 1 and December 1, 2027 and orders recommendations by November 16, 2026 on “Requiring the creation of a ‘kill switch’ for frontier models.”¹⁴ Using a verification organization stays voluntary; registering as an auditor does not.

Two of the quieter bills reach the most readers. AB 1609 provides that “A large private business shall not represent that a customer service chatbot is a human,” for businesses above $500 million in revenue, with penalties of $5,000 for a first violation and $10,000 after. SB 574 provides that “An attorney shall not delegate the practice of law to generative artificial intelligence” and that an attorney must “Disclose the use of generative artificial intelligence to the court for all documents submitted to the court,” from January 1, 2027, a rule that reaches every litigator in the state, this firm included.¹²

The September 2026 California AI signings

What stalled is as telling as what passed. The automated-decision-systems bill, AB 1018, reached third reading and never received a final vote; the broad children’s chatbot bill, AB 2023, went to the inactive file on August 30; and the algorithmic-pricing bills, SB 295 and SB 384, had stalled in 2025. All were dead at the August 31 constitutional deadline, which is why California’s ADMT rules come from the Privacy Protection Agency’s regulations rather than from a statute.¹ The veto messages are short: SB 903, the psychotherapy bill, was “overly broad,” and AB 2656 “would impose redundant administrative layers on public agencies.”¹

If you employ people in California—SB 951’s layoff-notice rule reaches you on January 1, 2027 and SB 947’s discipline rule on July 1, 2027, whether or not you call your tool AI, because the statute defines automated decision systems by what they do.

What happened to Colorado’s AI Act?

Colorado replaced its 2024 AI Act with a narrower law before the first enforcement could begin. On May 14, 2026, Governor Polis signed SB 26-189, which repeals Part 17 of the Colorado Consumer Protection Act, the home of SB 24-205, and re-enacts it as a law about “covered ADMT,” automated decision-making technology “used to materially influence a consequential decision,” effective January 1, 2027.³ A 2025 special session had delayed the original act’s duties from February 1 to June 30, 2026; those duties are on the books from that date until the repeal takes effect, but under the stipulated stay in xAI’s suit the Attorney General may not enforce them for conduct in that window.⁵

The litigation explains the timing. xAI sued Colorado on April 9, 2026; the United States intervened on April 24 on an Equal Protection theory, not preemption; and on April 27 a magistrate judge entered a stipulated stay under which the Attorney General “shall not initiate enforcement,” including an investigation, for violations of SB 24-205, or any replacement enacted this session, that occur on or before 14 days after the court rules on xAI’s preliminary-injunction motion, a motion due 28 days after Colorado finally adopts its rules.⁶ Several firm alerts call that an injunction. The order is a stipulation, and the case is stayed, not decided.

Colorado’s AI Act, before and after

Colorado also enacted HB 26-1263 on May 29, 2026, a conversational-AI law requiring operators to estimate users’ ages and, from January 1, 2027, to apply disclosure and content safeguards to known minors.¹⁶

If you built a Colorado impact-assessment program in 2025—the duty runs out on December 31, 2026, and what replaces it is a notice, explanation, and appeal workflow due January 1, 2027.

Which other states passed AI laws in 2026?

Only two comprehensive AI laws passed in 2026, Colorado’s replacement and Connecticut’s, out of 280 AI enactments from 1,539 bills introduced, by the National Conference of State Legislatures’ count as of early October.¹⁷ The 2026 wave was narrower and more numerous than the headlines suggest: frontier-model laws in two more states, provenance mandates that reach mid-size generative-AI companies, and companion-chatbot statutes in ten states.

Connecticut’s Public Act 26-15, signed May 27, 2026, combines frontier-developer whistleblower protections, companion-chatbot crisis protocols, a disclosure duty for employment AI that interacts with applicants, and a provenance mandate for generative-AI providers with more than one million monthly users; its employment-AI disclosure and notice sections (§§ 8 to 11) are “enforced solely by the Attorney General.”¹⁸ Illinois SB 315, signed July 6, 2026, requires large frontier developers to retain a third party annually for an independent audit of compliance beginning January 1, 2028, which the Governor’s office calls the first such requirement in the nation.¹⁹ New York’s RAISE Act, signed December 19, 2025, was amended on March 27, 2026 to take effect January 1, 2027, with a frontier AI framework, 72-hour critical-incident reporting, and penalties of up to $1 million for a first violation and $3 million thereafter.²⁰ Texas’s H.B. 149, codified in chapter 552 of the Business and Commerce Code, has been in force since January 1, 2026; the Attorney General has exclusive enforcement authority, except that a state agency may sanction a person it licenses, registers, or certifies, including by a penalty of up to $100,000, once that person has been found in violation under Section 552.105 and the Attorney General has recommended additional enforcement, and the Attorney General must maintain an online mechanism for consumer complaints.²¹ Utah’s HB 276 imposes provenance and detection duties from January 1, 2027 on generative-AI providers with more than one million monthly users and on large platforms.²² Washington’s HB 1170 requires generative-AI providers with more than one million monthly users to embed provenance data in AI-generated image, video, and audio content from February 1, 2027, enforceable only by the Attorney General.²²

The 2026 state enactments that reach private companies

Which states have companion chatbot laws depends on the definition, which is why the trackers disagree. Counting statutes that impose disclosure, crisis-protocol, or minor-safety duties on operators of companion or conversational chatbots, ten states enacted one in 2026: Washington, Oregon, Idaho, Georgia, Colorado, Connecticut, Hawaii, Nebraska, Iowa, and Rhode Island. They join California, New York, Maine, Utah, Nevada, and Illinois, for at least sixteen.²³ Tennessee’s 2026 statute sits beside them rather than among them: it bars representing an AI system as a qualified mental-health professional and imposes none of the three duties. The design choice that matters most is enforcement: Oregon gives an individual “[t]he greater of the individual’s actual damages or statutory damages of $1,000 for each violation,” Washington, Tennessee, and Hawaii route violations through their consumer-protection or unfair-practices statutes (Hawaii expressly bars a private right of action), and the rest of the 2026 enactments are Attorney-General-only.²⁴

If your product talks to users as a persona or a companion—assume a disclosure duty in every state that has acted and a private plaintiff in Oregon.

Is there a federal AI law in 2026?

No. The TAKE IT DOWN Act, whose definitions reach intimate images “created through the use of software, machine learning, artificial intelligence,” requires a covered platform, “as soon as possible, but not later than 48 hours after receiving such request,” to remove a nonconsensual intimate image, with noncompliance treated as a violation of an FTC rule; the FTC began enforcing it on May 19, 2026.²⁵ The FY2026 defense authorization carries AI provisions that bind the Defense Department and its contractors, including a bar on DeepSeek models in contract performance, and nothing that preempts state law.²⁶

Federal AI policy therefore runs through executive orders. EO 14179 of January 23, 2025 set the deregulatory posture; the July 2025 AI Action Plan and its three companion orders followed; EO 14365 of December 11, 2025 opened the preemption campaign discussed below; EO 14409 of June 2, 2026 directed agencies to design, within 60 days, a voluntary pre-release framework for “covered frontier models” while stating that nothing in it authorizes “a mandatory governmental licensing, preclearance, or permitting requirement”; and EO 14434 of September 29, 2026 directs that the executive branch “shall use the terms ‘Super Intelligence’ and ‘SI’ in place of ‘Artificial Intelligence’ and ‘AI’” and orders a statutory definition proposal within 60 days.²⁷ NIST’s AI center is already restyled, and the Risk Management Framework remains at version 1.0 pending revision.²⁸

Congress moved bills without passing one. The GUARD Act, which would bar minors from AI companions with civil penalties up to $250,000 per violation, reached the Senate calendar on May 11, 2026; the NO FAKES Act of 2026 reached it on June 24; the Kids Online Safety Act was ordered reported on August 5; the House passed its kids-online-safety package 267 to 117 on June 29; and the CREATE AI Act was ordered reported 29 to 0 on June 25. The Algorithmic Accountability Act, the AI LEAD Act’s products-liability regime, the SANDBOX Act, and the AI Whistleblower Protection Act sit at referral.²⁹

The agencies have retreated from AI-specific rules and kept enforcing fraud. The FTC set aside its own Rytr order on December 22, 2025 as an undue burden on AI innovation, then in a proposed policy statement published July 7, 2026 treated an undisclosed suppression of accuracy in AI outputs as deception, which as of October 27, 2026 it has not finalized; its September 2025 orders to seven companion-chatbot companies have produced no public report as of that date.³⁰ The SEC filed settled charges on August 26, 2026 against GenesisAI, an AI start-up, over alleged misrepresentations of its revenue projections, valuation, and customer demand, and charged a fake AI trading-bot scheme on September 29.³¹ The CFPB withdrew its AI adverse-action circulars on May 12, 2025, and the EEOC’s AI guidance page no longer exists.³²

If you were waiting for a federal statute to tell you what to build—there is none, and the agencies that remain active are the ones that prosecute deception.

Will federal preemption override state AI laws?

Not yet, and not by executive order. Preemption of a state statute requires a federal statute or a validly promulgated regulation that conflicts with it, which is why EO 14365 itself directs a “legislative recommendation” to Congress and why the FTC’s proposed statement concedes that “the FTC Act does not expressly preempt State law” before arguing for implied preemption.³³ As of October 27, 2026, no state AI law has been preempted, enjoined, or struck on a preemption theory advanced by the federal government. Two facts could change that reading: a Ninth Circuit reversal in the AB 2013 case, set for argument on November 18, 2026, and a committee vote on the FRONTIER Act, the one live preemption bill.

Executive Order 14365, directive by directive

The White House’s own recommendation pairs broad preemption with express carve-outs. It asks Congress to displace “state AI laws that impose undue burdens,” would bar states from regulating “AI development,” and keeps states’ “traditional police powers” to enforce “laws of general applicability against AI developers and users, including particular laws to protect children, prevent fraud, and protect consumers.”³⁴ The FRONTIER Act is narrower still: it would bar states from imposing new substantive obligations on AI developers in three areas, frontier-risk transparency, third-party auditing, and incident reporting, and leaves deployment-side consumer, civil-rights, and privacy law in place.³⁵ Twenty-six attorneys general, including Republicans, asked Congress on September 24, 2026 for “[a] prohibition on preemption of state laws.”³⁶

The courts have done what the order could not, on grounds the order did not supply. The one AI-specific statute blocked in 2026 is Minnesota’s “nudification” ban, enjoined pending appeal by the Eighth Circuit on October 2 in xAI’s First Amendment challenge, after the district court had denied relief.⁸ The one preemption win against a California AI law came under a 1996 statute, Section 230, not under the executive order.¹⁰

If your compliance plan assumes Washington will clear the state laws before 2027—it rests on a bill with no vote and an order with no court win.

Who is actually enforcing AI law?

State attorneys general, under laws that predate AI. Florida sued OpenAI in June 2026 and moved for a temporary injunction on September 28; Nebraska sued on October 14 under its Consumer Protection Act, Uniform Deceptive Trade Practices Act, and Age-Appropriate Online Design Code Act, and its attorney general announced that seven other states, Iowa, Kansas, West Virginia, Arizona, Arkansas, Idaho, and Montana, had also sued OpenAI in their own courts; and Texas sued OpenAI and its chief executive on October 23 under the Deceptive Trade Practices Act, not under the Texas AI law it enacted a year earlier.³⁷ Kentucky sued Character Technologies in January under its consumer-protection and data-protection acts; Character Technologies resolved the Garcia wrongful-death case on January 7, 2026, then filed for Chapter 11 on October 12, 2026.³⁸ I have found no public enforcement action anywhere in the country that rests on an AI-specific statute.

That pattern is the point of my March 2026 analysis of deployer liability: the industry calls these systems agents, and the law calls them tools. An AI system has no legal personhood, so the defenses that agency law gives a principal, scope of employment, frolic and detour, independent contractor, are unavailable to the company that deploys one. What remains is direct liability of the operator for the tool, and 2025 and 2026 confirmed it from three directions.³⁹

The first is the operator path. On August 4, 2026, the Ninth Circuit vacated Amazon’s injunction against Perplexity’s shopping agent under the Computer Fraud and Abuse Act, holding that “the CFAA contemplates access by a person. However advanced the Assistant currently is, it is a tool, not a person for statutory purposes,” and that “[i]t is the user who ‘accesses’ Amazon’s computers.” The court expressly reserved whether Perplexity “can avoid liability for the Assistant’s actions” in tort; the holding is about who accesses a computer, not a general shield.⁹ California’s AB 316 reaches the same place by statute, barring a defendant from arguing that its AI acted autonomously.⁴⁰ The second is the maker path. In Garcia v. Character Technologies, the court let products-liability claims proceed against the chatbot’s maker, holding the app “is a product” for those claims and that it was “not prepared to hold that Character A.I.’s output is speech”; in July 2026 a Delaware court denied Google’s motion to dismiss an AI-defamation suit in its entirety, describing AI “tools” as “allegedly employed to effectuate the defamatory ends of their makers.”⁴¹ The third is the vendor path, and it cuts the other way in vocabulary while reaching the same result. In Mobley v. Workday, the court held an AI hiring vendor could be directly liable as the employers’ statutory “agent” under Title VII, reasoning that nothing in the statutes “distinguishes between delegating functions to an automated agent versus a live human one”; the agent there is Workday, a company, and the holding is direct vendor liability rather than a deployer’s vicarious liability for software.⁴²

Every 2026 enforcement action against an AI developer used consumer-protection, design-code, or tort law, and every 2026 court decision that reached the question treated the system as somebody’s tool. “The AI did it” is not a defense anywhere in the United States, and no AI statute was needed to make that true.—Chanté Eliaszadeh, Principal Attorney, Astraea Counsel APC

If you deploy an AI system that acts on customers, patients, or applicants—you are the operator of a tool, and the relevant statute is the one that already governs the act, not the one that mentions AI.

What does AI compliance cost in 2026?

Only one U.S. AI obligation has an official per-business cost estimate: California’s CCPA regulations on automated decisionmaking, risk assessments, and cybersecurity audits. The Privacy Protection Agency’s final economic statement, adopted with the rules in July 2025, puts “[t]ypical business initial costs” at “$6,058 - $63,133” and “ongoing costs” at “$19,750,” with small-business initial costs of $6,058 to $36,950 and ongoing costs of $15,831.⁴³ Those figures are in 2022 dollars.⁴⁴ The ten-year total fell from $9.725 billion in the proposed rules to $4.835 billion in the final ones, and cybersecurity audits are 71 percent of it.⁴³ The per-audit figures of $39,375 to $362,500 in the agency’s October 2024 impact assessment belong to the superseded proposal.⁴⁴ In September 2024 the Department of Finance said it “generally concurs with the methodology in the SRIA” for the proposed rules, with exceptions on the state-revenue, output, investment, and employment projections.⁴⁵

What drives a company’s number within that range is which rules reach it. The agency’s October 2024 model for the proposed rules assumed an ADMT program costs 240 to 360 hours of developer time, a risk assessment about 120 hours of blended compliance and legal time, and an audit 750 to 1,250 hours depending on revenue tier, reduced by about 30 percent for a company already running a recognized security framework.⁴⁴ For the final rules it cut audit hours by 25 percent and risk-assessment hours by 10 percent and applied the 30 percent framework reduction to every business.⁴³ On the proposed-rule model, a typical audit ran from $39,375 for a firm under $100 million already using a framework to $362,500 for a firm above $1 billion without one.⁴⁴

For every other obligation in this tracker, no official or market-sourced private-sector estimate exists, and I will not invent one. The legislative analyses for SB 53, SB 243, SB 1119, and SB 947, Colorado’s fiscal notes for both versions of its law, and Texas’s fiscal note for H.B. 149 each price only the state’s own costs, New York’s RAISE sponsor memo lists its fiscal implications as “None,” and none of the opposition arguments these analyses record, including one that cites costs to startups, gives a figure.⁴⁶ The nearest benchmark is the European Commission’s 2021 impact assessment for the EU AI Act, which estimated compliance for a high-risk system at “around €6 000 - €7 000” on average, and the study CEPS prepared to support it put a new quality-management system at EUR 193,000 to 330,000 for a company starting from nothing.⁴⁷ Bias audits under New York City’s hiring-tool law have only undated vendor list prices, from $1,500 to $5,500 for a single tool.⁴⁸

If a vendor quotes you a compliance cost for a law in this tracker other than the Privacy Protection Agency’s rules—ask for the source, because no official one exists.

What should an AI company do now?

Calendar January 1, 2027 first, because more of the measures above take effect that day than on any other. The table below is the compliance calendar as of October 27, 2026; dates marked default follow California’s rule that a non-urgency statute takes effect on January 1 after enactment.¹⁵

AI compliance calendar, November 2026 to 2029

In the next thirty days, inventory every system that makes or influences a decision about a person, and map each to the rows above; the covered-ADMT definition in Colorado turns on influence over a consequential decision, and California’s ADMT definition reaches technology that replaces or substantially replaces human decisionmaking, meaning a decision made from its output without qualifying human review; neither turns on what the vendor calls the product. Pull the Privacy Protection Agency’s regulation text and the Civil Rights Council’s employment rules and assign an owner to each duty. If you run a companion or conversational chatbot, draft the disclosure, the crisis protocol, and the minor safeguards once, to the strictest state’s standard, because the ten 2026 statutes differ in details and agree in shape.

Over the next two quarters, build the January 1, 2027 deliverables: the ADMT pre-use notice and opt-out, the Colorado notice-and-explanation workflow, the New York frontier framework and the Illinois disclosure statement if you train at that scale, and the employment-ADS retention and anti-discrimination controls that already apply in California. Decide whether your processing meets the § 7120(b) significant-risk thresholds that require a CCPA cybersecurity audit and, if so, which revenue tier sets your first report date, and whether an existing SOC 2 or ISO 27001 program can anchor it, since the agency’s own model prices that at about a 30 percent saving.

Over the longer term, treat the audit framework as the next market. California’s auditor registry, mandatory for anyone conducting a covered AI audit from January 1, 2029, its voluntary verification organizations, Illinois’s 2028 audit mandate, and SB 1119’s child-safety audits create demand for a credential that does not yet exist; a company that documents its systems to an audit-ready standard now will be the one that passes the first audit quickly. And watch the two events that could flip this tracker: the Ninth Circuit’s AB 2013 decision and any committee action on the FRONTIER Act.

The founders who get this right in 2027 will not be the ones who guessed correctly about federal preemption. They will be the ones who treated every AI system as a tool they are answerable for, under the laws that already applied to the decision it touches.—Chanté Eliaszadeh, Principal Attorney, Astraea Counsel APC

Conclusion

The 2026 lesson is that AI law in the United States is arriving as targeted statutes with 2027 effective dates and as enforcement under laws written long before AI, not as the comprehensive frameworks the debate was about. Which of the rows above reach your company, and in what order, is a question of what your systems do and where your users are, and it is worth an hour with counsel before the January deadlines land. This tracker is updated as the law moves; the change log below records each revision.

Related Resources

• State AI Law Patchwork: 50-State Compliance Map
• Federal AI Regulation Landscape: Where Things Stand in 2026
• California Frontier AI Law (SB 53): A Compliance Guide
• The EU AI Act Deadline That Did Not Move
• Not an Agent. Not a Defense: Seven Doctrines That Already Hold AI Deployers Liable

Change log

• October 27, 2026: first publication, current to the California Legislature’s September 30, 2026 signing deadline. To see this tracker’s updates highlighted in Google AI Mode and AI Overviews, you can add astraea.law as a preferred source.

This article provides general information for educational purposes only and does not constitute legal advice. Artificial intelligence regulation is evolving rapidly. Consult qualified legal counsel for advice on your specific situation.

Footnotes

1. California Legislative Information, bill history and chaptered text for the 2025—2026 Regular Session (bulk data refreshed October 25, 2026), https://downloads.leginfo.legislature.ca.gov/; Office of Governor Gavin Newsom, press releases of September 9, 10, 16, 18, 19, 27, 28, and 30, 2026, https://www.gov.ca.gov/2026/09/; veto messages on A.B. 2575 PDF, A.B. 2656 PDF, S.B. 903 PDF, and S.B. 1130 PDF (Sept. 30, 2026), https://www.gov.ca.gov/wp-content/uploads/2026/09/VETO-msg-AB-2656.pdf. Chaptered texts, Stats. 2026: A.B. 686, ch. 334 PDF; A.B. 1159, ch. 182 PDF; A.B. 1979, ch. 854 PDF; A.B. 2025, ch. 572 PDF; A.B. 2392, ch. 855 PDF; A.B. 2504, ch. 305 PDF; S.B. 503, ch. 857 PDF; S.B. 1050, ch. 246 PDF; S.B. 1111, ch. 862 PDF; S.B. 1159, ch. 863 PDF; S.B. 1276, ch. 192 PDF. The count of twenty-four is this tracker’s: the chaptered 2026 bills in the September 2026 signings table that regulate an AI system or AI-generated content, plus two that address AI without regulating it, AB 686 (a sunset extension of the deceptive-election-media rule) and AB 2504 (a community-college pilot reskilling creative workers displaced by generative AI), and excluding budget and trailer bills that mention AI. ↩ ↩² ↩³ ↩⁴ ↩⁵

2. Exec. Order No. 14434, Inaugurating the Era of Super Intelligence, 91 Fed. Reg. 63129 (Sept. 29, 2026) PDF, https://www.federalregister.gov/citation/91-FR-63129; Cal. Exec. Order No. N-10-26 (Sept. 30, 2026) (“All agencies and departments subject to my authority shall refer to Artificial Intelligence and AI as ‘Artificial Intelligence’ and ‘AI,’ notwithstanding any rebranded or different terminology used by the federal government, unless inconsistent with the law.”) PDF, https://www.gov.ca.gov/wp-content/uploads/2026/09/SIGNED_EO-N-10-26_9.30.26.pdf. ↩ ↩²

3. S.B. 26-189, 2026 Colo. Sess. Laws ch. 131 (signed May 14, 2026), §§ 6-1-1701 to 6-1-1706, 6-1-1709, and § 5 PDF, https://leg.colorado.gov/bills/sb26-189; S.B. 24-205, 2024 Colo. Sess. Laws ch. 198 (codified at Colo. Rev. Stat. §§ 6-1-1701 to 6-1-1707, repealed and reenacted effective Jan. 1, 2027, by S.B. 26-189, §§ 1, 5(1)) PDF; Colorado Department of Law, Notice of Proposed Rulemaking, 4 CCR 904-6, Automated Decision-Making Technology & Conversational Artificial Intelligence Service Rules, Colo. Sec’y of State tracking no. 2026-00360 (notice filed Aug. 11, 2026; 49 Colo. Reg. No. 16, Aug. 25, 2026), https://www.sos.state.co.us/CCR/eDocketDetails.do?trackingNum=2026-00360. ↩ ↩² ↩³ ↩⁴

4. Transparency in Frontier Artificial Intelligence Act, S.B. 53, Stats. 2025, ch. 138 PDF (Cal. Bus. & Prof. Code §§ 22757.11 to 22757.15 PDF; Cal. Lab. Code ch. 5.1); A.B. 2013, Stats. 2024, ch. 817 PDF (Cal. Civ. Code §§ 3110 to 3111 PDF); S.B. 942, Stats. 2024, ch. 291, as amended by A.B. 853, Stats. 2025, ch. 674, and S.B. 1000, Stats. 2026, ch. 861 PDF (Cal. Bus. & Prof. Code §§ 22757 to 22757.6 PDF); A.B. 2713, Stats. 2026, ch. 856 (Cal. Bus. & Prof. Code § 22757.3.1) PDF; S.B. 243, Stats. 2025, ch. 677 (Cal. Bus. & Prof. Code §§ 22601 to 22605) PDF; A.B. 489, Stats. 2025, ch. 615 (Cal. Bus. & Prof. Code §§ 4999.8 to 4999.9) PDF; S.B. 1001, Stats. 2018, ch. 892 (Cal. Bus. & Prof. Code §§ 17940 to 17943) PDF; Cal. Code Regs. tit. 11, §§ 7001(e), (j), (ddd) PDF, 7120 PDF, 7121 PDF, 7123(e)(8) PDF, 7150(b) PDF, 7152 PDF, 7155 PDF, 7157 PDF, 7200 PDF, 7220 PDF, 7221 PDF, 7222 PDF (2026); Cal. Civ. Code §§ 1798.150(c) PDF, 1798.155(a) PDF, 1798.199.90(a) PDF; Cal. Code Regs. tit. 2, §§ 11008(a) PDF, 11008.1 PDF, 11009(f) PDF, 11013(c) PDF; Chanté Eliaszadeh, California Frontier AI Law (SB 53): A Compliance Guide for AI Companies (June 14, 2026), https://astraea.law/insights/california-frontier-ai-law-sb-53. ↩ ↩²

5. S.B. 25B-004, 2025 Colo. Sess. Laws (1st Extraordinary Sess.) ch. 3 (effective Nov. 25, 2025) PDF; Legislative Council Staff, Final Fiscal Note, S.B. 25B-004 (Sept. 10, 2025) PDF, https://content.leg.colorado.gov/sites/default/files/documents/2025B/bills/fn/2025b_sb25b-004_f1.pdf. ↩ ↩²

6. X.AI LLC v. Weiser, No. 1:26-cv-01515 (D. Colo.), ECF No. 1 (complaint, Apr. 9, 2026) PDF, ECF No. 17 (complaint in intervention, Apr. 24, 2026) PDF and ECF No. 24 (minute order, Apr. 27, 2026) PDF, https://storage.courtlistener.com/recap/gov.uscourts.cod.253513/gov.uscourts.cod.253513.24.0.pdf; U.S. Dep’t of Justice, Office of the Attorney General, Memorandum for All Department of Justice Employees, Artificial Intelligence Litigation Task Force (Jan. 9, 2026) PDF, https://www.justice.gov/ag/media/1422986/dl?inline. ↩ ↩² ↩³

7. Exec. Order No. 14365, Ensuring a National Policy Framework for Artificial Intelligence, 90 Fed. Reg. 58499 (Dec. 11, 2025) PDF, https://www.federalregister.gov/citation/90-FR-58499; FTC, Policy Statement Concerning the Suppression of Accuracy in Artificial Intelligence Systems (proposed), 91 Fed. Reg. 41638 (July 7, 2026) PDF, https://www.federalregister.gov/citation/91-FR-41638; a Federal Register search run October 27, 2026 for Commerce Department and NTIA documents published since December 11, 2025 returned no section 4 evaluation, and NTIA’s twelve Federal Register documents in that window include no section 5 BEAD Policy Notice, which section 5 does not require to be published there. ↩ ↩² ↩³

8. X.AI LLC v. Ellison, No. 0:26-cv-03425, 2026 U.S. Dist. LEXIS 200330 (D. Minn. Sept. 4, 2026) PDF, ECF No. 54 PDF, https://storage.courtlistener.com/recap/gov.uscourts.mnd.235231/gov.uscourts.mnd.235231.54.0_1.pdf, injunction pending appeal granted sub nom. SpaceXAI LLC v. Ellison, No. 26-2806 (8th Cir. Oct. 2, 2026) PDF. ↩ ↩²

9. Amazon.com Servs., LLC v. Perplexity AI, Inc., 184 F.4th 1083, 1091—92 (9th Cir. 2026) PDF (slip op. at 15, 17) PDF, https://cdn.ca9.uscourts.gov/datastore/opinions/2026/08/04/26-1444.pdf; Nebraska Attorney General, press release (Oct. 14, 2026), https://ago.nebraska.gov/news/attorney-general-hilgers-announces-lawsuit-against-openai-deceiving-nebraskans-about-safety; the Florida and Texas releases are cited in the note on the ten state suits. ↩ ↩²

10. Kohls v. Bonta, No. 2:24-cv-02527 (E.D. Cal.), ECF No. 98, at 2 (Aug. 20, 2025) PDF (declaring AB 2655 “preempted by 47 U.S.C. § 230(c)(1), § 230(c)(2)(B), and § 230(e)(3), as-applied to X Corp. and Rumble”) PDF and ECF No. 101 (Aug. 29, 2025) PDF, reported at 797 F. Supp. 3d 1177, 1191 PDF (defendants “PERMANENTLY ENJOINED from enforcing AB 2839 against the named Plaintiffs”); notice of appeal, ECF No. 106 (Sept. 19, 2025), “as to 98 Order”; Babylon Bee, LLC v. Bonta, No. 25-6138 (9th Cir.), docket through Aug. 12, 2026, https://www.courtlistener.com/docket/71503636/the-babylon-bee-llc-v-bonta/; A.B. 502, Stats. 2026, ch. 333 (urgency; Elec. Code § 20012) PDF. ↩ ↩²

11. X.AI LLC v. Bonta, No. 2:25-cv-12295, 2026 U.S. Dist. LEXIS 48883, at *25 (C.D. Cal. Mar. 4, 2026) PDF, ECF No. 35 at 11 PDF, https://storage.courtlistener.com/recap/gov.uscourts.cacd.1000848/gov.uscourts.cacd.1000848.35.0.pdf; No. 26-1591 (9th Cir.), argument calendared Nov. 18, 2026. ↩

12. S.B. 947, Stats. 2026, ch. 859 (Cal. Lab. Code §§ 1522(b)(1), 1526.1(a), (b), (e), 1526.7) PDF; S.B. 951, Stats. 2026, ch. 860 (Cal. Lab. Code § 1401(d)(1)) PDF; A.B. 1331, Stats. 2026, ch. 851 (Cal. Lab. Code § 1561(a)) PDF; A.B. 1883, Stats. 2026, ch. 853 (Cal. Lab. Code §§ 1581(a), 1582(d)(1)) PDF; A.B. 1609, Stats. 2026, ch. 733 (Cal. Bus. & Prof. Code §§ 22625(g), 22626(a), 22628(b), (d)) PDF; S.B. 574, Stats. 2026, ch. 858 (Cal. Bus. & Prof. Code § 6068.1(a)(2), (a)(3)(C); Cal. Civ. Proc. Code § 128.7(b)(2)(A)) PDF; chaptered texts at https://leginfo.legislature.ca.gov/. ↩ ↩²

13. S.B. 1119, Stats. 2026, ch. 190 (Cal. Bus. & Prof. Code §§ 21810.5(j)(1)(B), 21812(a)(1), (e), 21814(a)(1)(A)(i), (c), 21816(a)(1)(A), (B)) PDF; S.B. 867, Stats. 2026, ch. 189 (Cal. Bus. & Prof. Code § 22604.5(a), (b)) PDF; Office of the Governor, press release (Sept. 10, 2026), https://www.gov.ca.gov/2026/09/. ↩

14. S.B. 813, Stats. 2026, ch. 179 (Cal. Gov. Code §§ 8898.1, 8898.4(a)(3)) PDF; A.B. 1405, Stats. 2026, ch. 178 (Cal. Gov. Code §§ 11549.82(a), 11549.82.5) PDF; Cal. Exec. Order No. N-9-26 (Sept. 18, 2026) PDF, https://www.gov.ca.gov/wp-content/uploads/2026/09/FINAL-N-9-26-AI-EO-9.18.26-SIGNED.pdf. ↩ ↩²

15. Cal. Const. art. IV, § 8(c)(1) (a statute enacted at a regular session goes into effect on January 1 next following a 90-day period from enactment, with stated exceptions) PDF, https://leginfo.legislature.ca.gov/faces/codes_displayText.xhtml?lawCode=CONS&division=&title=&part=&chapter=&article=IV. ↩ ↩²

16. H.B. 26-1263, 2026 Colo. Sess. Laws ch. 208 (signed May 29, 2026) PDF, § 6-1-1708, https://leg.colorado.gov/bill_files/116851/download. ↩

17. National Conference of State Legislatures, As Congress Deliberates, States Lead the Way on AI Regulation (Oct. 21, 2026), https://www.ncsl.org/state-legislatures-news/details/as-congress-deliberates-states-lead-the-way-on-ai-regulation. ↩

18. Conn. Pub. Act No. 26-15 (S.B. 5) (approved May 27, 2026), §§ 2, 4 to 6, 9, 12, 15 PDF, https://www.cga.ct.gov/2026/ACT/PA/PDF/2026PA-00015-R00SB-00005-PA.PDF. ↩ ↩² ↩³

19. Ill. Pub. Act 104-538 (S.B. 315) §§ 10(d), 15(c), 18, 25, 99 (approved July 6, 2026) PDF; Office of Governor JB Pritzker, press release on S.B. 315 (July 6, 2026), https://gov-pritzker-newsroom.prezly.com/gov-pritzker-signs-nation-leading-artificial-intelligence-safety-law. ↩

20. N.Y. Gen. Bus. Law §§ 1420(12), (16) PDF, 1421(1) PDF, 1422(1), (3)(a), (4) PDF, 1427(1) to (2) PDF (effective Jan. 1, 2027), enacted by S. 6953-B, ch. 699, L. 2025 (signed Dec. 19, 2025), as amended by S. 8828, ch. 96, L. 2026 (signed Mar. 27, 2026), https://nyassembly.gov/leg/?bn=S08828&term=2025&Summary=Y&Actions=Y. ↩

21. Tex. Bus. & Com. Code §§ 552.101 PDF, 552.102 PDF, 552.106 PDF (eff. Jan. 1, 2026) (enacted by Act of 2025, 89th Leg., R.S., ch. 1174 (H.B. 149), § 4), https://capitol.texas.gov/tlodocs/89R/billtext/html/HB00149F.htm. ↩

22. Utah Code §§ 13-72c-101 PDF, 13-72c-201 PDF, 13-72c-203, 13-72b-202 (H.B. 276, 2026 Gen. Sess.) PDF, https://le.utah.gov/Session/2026/bills/enrolled/HB0276.pdf; Wash. H.B. 1170, ch. 167, §§ 1(2), 2(1), 4(3), 9, Laws of 2026 PDF. ↩ ↩²

23. Wash. Substitute H.B. 2225, ch. 168, Laws of 2026 PDF, https://app.leg.wa.gov/billsummary?BillNumber=2225&Year=2025; Idaho S. 1297, ch. 249, 2026 Idaho Sess. Laws PDF, https://legislature.idaho.gov/sessioninfo/2026/legislation/S1297/; Ga. S.B. 540, Act 518 (approved May 11, 2026) (codified at O.C.G.A. § 39-5-6) PDF; 2026 Tenn. Pub. Acts ch. 647 (S.B. 1580) PDF; Act 247, 2026 Haw. Sess. Laws (H.B. 2137) PDF; Act 248, 2026 Haw. Sess. Laws (S.B. 3001) PDF; Neb. L.B. 525 (approved Apr. 14, 2026), https://nebraskalegislature.gov/bills/view_bill.php?DocumentID=59601&docnum=LB525&leg=109; Iowa S.F. 2417 (signed May 2, 2026), https://www.legis.iowa.gov/legislation/BillBook?ga=91&ba=SF2417; R.I. S. 2195 Sub. A, 2026 R.I. Pub. Laws ch. 376 (signed June 22, 2026), https://webserver.rilegislature.gov/PublicLaws/law26/law26376.htm; Utah H.B. 452, 2025 Gen. Sess. (Utah Code §§ 13-72a-101 to 13-72a-301; signed Mar. 25, 2025, effective May 7, 2025) PDF, https://le.utah.gov/Session/2025/bills/enrolled/HB0452.pdf. ↩

24. Or. S.B. 1546, 2026 Or. Laws ch. 85, § 2(1)(a) PDF, https://olis.oregonlegislature.gov/liz/2026R1/Measures/Overview/SB1546; 2026 Tenn. Pub. Acts ch. 647, § 1; Act 248, 2026 Haw. Sess. Laws, § 3. ↩

25. TAKE IT DOWN Act, Pub. L. No. 119-12, §§ 2(a), 3(a)(3), (b)(1), 139 Stat. 55, 55, 60—61 (2025) PDF, https://www.govinfo.gov/app/details/PLAW-119publ12; FTC, FTC Begins Enforcing the TAKE IT DOWN Act (May 19, 2026) PDF, https://www.ftc.gov/news-events/news/press-releases/2026/05/ftc-begins-enforcing-take-it-down-act. ↩

26. National Defense Authorization Act for Fiscal Year 2026, Pub. L. No. 119-60, §§ 1513, 1532, 139 Stat. 718, 1149—51, 1157—59 (2025) PDF, https://www.govinfo.gov/app/details/PLAW-119publ60. ↩

27. Exec. Order No. 14179, Removing Barriers to American Leadership in Artificial Intelligence, 90 Fed. Reg. 8741 (Jan. 23, 2025) PDF; Exec. Order No. 14409, Promoting Advanced Artificial Intelligence Innovation and Security, 91 Fed. Reg. 34565, § 3(b)—(c) (June 2, 2026) PDF, https://www.federalregister.gov/citation/91-FR-34565; Exec. Order No. 14434, Inaugurating the Era of Super Intelligence, 91 Fed. Reg. 63129, §§ 1, 3(b) (Sept. 29, 2026) PDF. ↩

28. NIST, AI Risk Management Framework, https://www.nist.gov/itl/ai-risk-management-framework; NIST, Center for Advancing Innovation and Standards for Super Intelligence, https://www.nist.gov/caissi. ↩

29. S. 3062, 119th Cong. (GUARD Act), reported and placed on the Senate calendar May 11, 2026, https://www.govinfo.gov/bulkdata/BILLSTATUS/119/s/BILLSTATUS-119s3062.xml; S. 4591 (NO FAKES Act of 2026), placed on the calendar June 24, 2026, https://www.govinfo.gov/bulkdata/BILLSTATUS/119/s/BILLSTATUS-119s4591.xml; S. 1748 (Kids Online Safety Act), ordered reported Aug. 5, 2026, https://www.govinfo.gov/bulkdata/BILLSTATUS/119/s/BILLSTATUS-119s1748.xml; H.R. 7757 (KIDS Act), passed the House June 29, 2026, Roll No. 228, https://www.govinfo.gov/bulkdata/BILLSTATUS/119/hr/BILLSTATUS-119hr7757.xml; H.R. 2385 (CREATE AI Act), ordered reported June 25, 2026, https://www.govinfo.gov/bulkdata/BILLSTATUS/119/hr/BILLSTATUS-119hr2385.xml; S. 2164, S. 2937, S. 2750, and S. 1792, all at referral, https://www.govinfo.gov/bulkdata/BILLSTATUS/119/s/BILLSTATUS-119s2164.xml, https://www.govinfo.gov/bulkdata/BILLSTATUS/119/s/BILLSTATUS-119s2937.xml, https://www.govinfo.gov/bulkdata/BILLSTATUS/119/s/BILLSTATUS-119s2750.xml, https://www.govinfo.gov/bulkdata/BILLSTATUS/119/s/BILLSTATUS-119s1792.xml. ↩

30. Order Reopening and Setting Aside Order, In re Rytr LLC, FTC Docket No. C-4806 (Dec. 22, 2025) PDF; FTC, Policy Statement Concerning the Suppression of Accuracy in Artificial Intelligence Systems (proposed), 91 Fed. Reg. 41638 (July 7, 2026) PDF; FTC, press release, FTC Launches Inquiry into AI Chatbots Acting as Companions (Sept. 11, 2025) (6(b) orders to Alphabet, Character Technologies, Instagram, Meta, OpenAI, Snap, and X.AI) PDF, https://www.ftc.gov/news-events/news/press-releases/2025/09/ftc-launches-inquiry-ai-chatbots-acting-companions. ↩ ↩²

31. SEC v. GenesisAI Corp., Litigation Release No. 26619 (Aug. 26, 2026) PDF; SEC v. TSAI Pro Ltd., Litigation Release No. 26654 (Sept. 29, 2026) PDF, https://www.sec.gov/enforcement-litigation/litigation-releases. ↩

32. CFPB, Interpretive Rules, Policy Statements, and Advisory Opinions; Withdrawal, 90 Fed. Reg. 20084, 20086 (May 12, 2025) PDF, https://www.federalregister.gov/citation/90-FR-20084; the EEOC’s former technical-assistance page on AI, https://www.eeoc.gov/ai, returns no page as of Oct. 26, 2026 (archived Jan. 26, 2025 at https://web.archive.org/web/20250126101228/https://www.eeoc.gov/ai). ↩

33. Exec. Order No. 14365, §§ 3—8, 90 Fed. Reg. at 58499—501 PDF; 91 Fed. Reg. at 41641 PDF. ↩

34. The White House, National Policy Framework for Artificial Intelligence: Legislative Recommendations § VII, at 4 (Mar. 20, 2026), https://www.whitehouse.gov/wp-content/uploads/2026/03/03.20.26-National-Policy-Framework-for-Artificial-Intelligence-Legislative-Recommendations.pdf. ↩ ↩²

35. H.R. 9925, 119th Cong. § 9(a)—(c) (introduced July 23, 2026) PDF, https://www.congress.gov/bill/119th-congress/house-bill/9925. ↩ ↩²

36. Office of the New York Attorney General, Attorney General James Calls on Congress to Protect Americans from Unchecked AI Development (Sept. 24, 2026), https://ag.ny.gov/press-release/2026/attorney-general-james-calls-congress-protect-americans-unchecked-ai-development. ↩

37. Nebraska Attorney General, press release (Oct. 14, 2026), https://ago.nebraska.gov/news/attorney-general-hilgers-announces-lawsuit-against-openai-deceiving-nebraskans-about-safety; Florida Attorney General, press releases (June 1, 2026), https://web.archive.org/web/20260601184446/https://www.myfloridalegal.com/newsrelease/attorney-general-james-uthmeier-files-first-nation-state-led-lawsuit-against-openai-ceo, and (Sept. 28, 2026), https://web.archive.org/web/20260928200437/https://www.myfloridalegal.com/newsrelease/attorney-general-james-uthmeier-files-temporary-injunction-against-openai-and-its-ceo; Texas Attorney General, press release (Oct. 23, 2026), https://www.texasattorneygeneral.gov/news/releases/attorney-general-ken-paxton-sues-openai-and-ceo-sam-altman-lying-users-and-harming-texans. ↩

38. Garcia v. Character Technologies, Inc., No. 6:24-cv-01903 (M.D. Fla.), docket, https://www.courtlistener.com/docket/69300919/; In re Character Technologies, Inc., No. 26-11603 (Bankr. D. Del. filed Oct. 12, 2026); Kentucky Attorney General, press release (Jan. 8, 2026), https://www.kentucky.gov/Pages/Activity-stream.aspx?n=AttorneyGeneral&prId=1857. ↩

39. Chanté Eliaszadeh, Not an Agent. Not a Defense: Seven Doctrines That Already Hold AI Deployers Liable (Mar. 18, 2026), https://astraea.law/insights/ai-agent-deployer-liability. ↩

40. A.B. 316, Stats. 2025, ch. 672 PDF (Cal. Civ. Code § 1714.46 PDF). ↩

41. Garcia v. Character Technologies, Inc., 785 F. Supp. 3d 1157, 1179—80 (M.D. Fla. 2025) PDF; Starbuck v. Google LLC, C.A. No. N25C-10-211 MAA, 2026 Del. Super. LEXIS 341, slip op. at 1 (Del. Super. Ct. July 24, 2026) PDF, https://courts.delaware.gov/opinions/download.aspx?id=398660. ↩

42. Mobley v. Workday, Inc., 740 F. Supp. 3d 796, 806—07 (N.D. Cal. 2024) PDF (ECF No. 80 at 9—10) PDF, https://www.courtlistener.com/docket/66831340/. ↩

43. California Privacy Protection Agency, Final Statement of Reasons and Updated Informative Digest, CCPA Updates, Cyber, Risk, ADMT, and Insurance Regulations, at 54—56 (2025) PDF, https://cppa.ca.gov/regulations/pdf/ccpa_updates_cyber_risk_admt_fsor_and_uid.pdf. ↩ ↩² ↩³

44. California Privacy Protection Agency, Standardized Regulatory Impact Assessment, ISOR Appendix A, at 49—63 (Oct. 2024) PDF, https://cppa.ca.gov/regulations/pdf/ccpa_updates_cyber_risk_admt_ins_impact.pdf. ↩ ↩² ↩³ ↩⁴

45. California Department of Finance, comment letter on the CPPA Standardized Regulatory Impact Assessment, at 1 (Sept. 20, 2024) PDF, https://dof.ca.gov/media/docs/forecasting/economics/major-regulations/major-regulations-table/CPPA-Finance-comment-letter-ADA.pdf. ↩

46. Senate Floor Analysis of S.B. 53 (Unfinished Business, as amended Sept. 29, 2025) PDF, https://leginfo.legislature.ca.gov/faces/billAnalysisClient.xhtml?bill_id=202520260SB53; Senate Floor Analysis of S.B. 243 (Unfinished Business, as amended Sept. 4, 2025); Assembly Appropriations Committee Analysis of S.B. 1119 (Aug. 5, 2026); Senate Floor Analysis of S.B. 947 (Unfinished Business, as amended Aug. 21, 2026); Colorado Legislative Council Staff, Final Fiscal Note, S.B. 24-205 (Aug. 12, 2024) PDF, https://content.leg.colorado.gov/sites/default/files/documents/2024A/bills/fn/2024a_sb205_f1.pdf, and Final Fiscal Note, S.B. 26-189 (Sept. 8, 2026) PDF, https://leg.colorado.gov/bill_files/117715/download; Texas Legislative Budget Board, Fiscal Note, H.B. 149 (as passed 2d House) (May 26, 2025) PDF, https://capitol.texas.gov/tlodocs/89R/fiscalnotes/pdf/HB00149F.pdf; N.Y. S. 6953-A sponsor memorandum, https://www.nysenate.gov/legislation/bills/2025/S6953/amendment/A. ↩

47. European Commission, Impact Assessment Accompanying the Proposal for a Regulation Laying Down Harmonised Rules on Artificial Intelligence, SWD(2021) 84 final, pt. 1, at 67—69, 71—72 (Apr. 21, 2021) PDF, https://artificialintelligenceact.eu/wp-content/uploads/2022/06/AIA-COM-Impact-Assessment-1-21-April.pdf; Moritz Laurer, Andrea Renda & Timothy Yeung, Clarifying the Costs for the EU’s AI Act, CEPS (Sept. 24, 2021), https://www.ceps.eu/clarifying-the-costs-for-the-eus-ai-act/. ↩

48. Vendor list prices published by Bias Audit USA, https://biasauditusa.com/pricing/, and AEDT Audits, https://aedtaudits.com/, accessed Oct. 26, 2026; neither is a market survey. ↩