Constangy Cyber Advisor 

Many states -- including California, Texas, and New York -- have advanced targeted and sector-specific AI laws focusing on consumer protection, employment, and transparency. Meanwhile, Colorado recently repealed its landmark, comprehensive AI law targeting algorithmic discrimination, replacing it with less stringent requirements for developers and deployers.

Globally, we are seeing similar trends. The European Union’s “Digital Omnibus” initiative reflects growing pressure to delay and soften aspects of its AI Act, particularly for high-risk systems.

The United States: A patchwork of state laws

In the absence of a comprehensive federal AI statute, U.S. states have taken the lead in regulating AI. More than 1,000 AI-related bills were introduced in 2025. Numerous state AI laws took effect on January 1, 2026, including legislation in California and Texas. 

State laws generally focus on three key areas: Algorithmic discrimination and civil rights, transparency and disclosure obligations, and sector-specific regulation (such as employment, health care, financial services).

To date, 46 states have enacted laws regulating AI.

California, New York, and Texas

California has multiple effective and proposed laws addressing automated decision-making technology, consumer privacy, and frontier AI transparency obligations for large developers.

New York has taken both municipal and statewide approaches. New York City Local Law 144 (in force since July 5, 2023) regulates the use of automated employment decision tools, known as “AEDTs.” Local Law 144 requires annual third-party bias audits, public disclosure of audit results, and candidate notice requirements. Recent developments include increased enforcement activity, including initial fines issued in 2026 for noncompliance and a 2025 audit finding enforcement gaps, prompting commitments to strengthen oversight. At the state level, New York’s Responsible AI Safety and Education Act (RAISE Act) will take effect in 2027. 

The Texas Responsible Artificial Intelligence Governance Act took effect in 2026. It prohibits certain harmful uses of AI but generally avoids imposing extensive compliance requirements. 

Colorado’s AI Act is recalibrated

Colorado’s AI Act (SB 24-205) was the most comprehensive AI law in the United States, modeled in part on the risk framework of the European Union AI Act. The Colorado Act was enacted in 2024 with an initial effective date of February 1, 2026.

The law imposed significant obligations on developers and deployers of high-risk AI systems. The mandates included risk management programs, impact assessments, consumer disclosures, and preventing and reporting “algorithmic discrimination.”

In August 2025, Colorado enacted SB 25B-004, which delayed the law’s effective date to June 30, 2026. The delay was intended to allow further refinement of the law amid industry concerns regarding feasibility, scope, and innovation.

Then, in May 2026, Colorado enacted SB 26-189, which repealed and replaced the original AI Act. The revisions in the new, “softer” law include the following:

• A shift from algorithmic discrimination governance toward a transparency-based framework.
• Narrower system coverage.
• An emphasis on consumer disclosure and rights (notice, explanation, appeal).
• Alignment of enforcement with existing anti-discrimination laws rather than the creation of new AI-specific liability standards.

SB 26-189 also delays implementation of the AI Act to January 1, 2027. Details about the current version of the Colorado law are available here.

European Union AI Act and Digital Omnibus

The European Union’s AI Act, which took effect in August 2024, remains the most comprehensive AI regulatory framework in the world. The Act has different obligations based on the risks of the applicable systems, with strict obligations for “high-risk” systems.

However, even the EU law is softening. The European Commission has introduced the “Digital Omnibus” to simplify overlapping digital regulations. As part of this Omnibus, in May 2026, the European Parliament and Council reached a provisional agreement to modify the AI Act.

Key changes include the following:

• Extended deadlines. Compliance deadlines have been delayed to December 2, 2027 (for standalone high-risk systems) and August 2, 2028 (for embedded high-risk systems).
• Narrower scope and reduced overlap. Certain uses of industrial AI that were already governed by EU product safety laws are carved out. In addition, the definition of “high-risk systems” has been narrowed. Both changes reduce the number of systems subject to the most stringent requirements.
• Reduced compliance burden and added flexibility. The amendments apply simplified compliance measures to mid-sized companies, streamline bias detection requirements, and provide additional implementation guidance.
• Targeted adjustments (and limited expansions). Transparency obligations remain in place, but some deadlines have been pushed back and additional guidance has been provided. On the other hand, there are some new prohibitions, such as restrictions on non-consensual intimate content.

These changes have been widely characterized as a “watering down” of the original framework, driven by concerns regarding competitiveness, feasibility, and regulatory complexity.

But the core architecture of the AI Act remains intact. The following have been preserved:

• Risk-based framework. The AI Act’s core structure, categorizing AI by risk level, remains unchanged.
• Substantive obligations for high-risk systems. Requirements relating to risk management, data governance, documentation, human oversight, and system robustness continue to apply.
• Transparency and prohibitions. Key disclosure requirements and existing prohibitions (such as prohibitions on social scoring and manipulative practices) remain in force, with only limited timing adjustments.

Penalties are also still significant despite the revisions. The Omnibus amendments do not materially reduce the AI Act’s penalties, which remain among the most stringent globally:

• Up to €35 million or 7 percent of global annual turnover for violations involving prohibited AI practices.
• Up to €15 million or 3 percent of global annual turnover for violations of core obligations, including transparency requirements.
• Exposure to civil damages, including damages for violation of EU product liability provisions, particularly for harmful AI outputs.

The EU approach contrasts with Colorado’s more limited enforcement model, where authority rests with the Attorney General and there is no private right of action. However, both laws are moving away from highly prescriptive, front-loaded regulation toward more flexible, implementation-focused approaches.

In Part Two of this post, we’ll discuss what businesses should be doing to ensure compliance.

The Constangy Cyber Team assists businesses of all sizes and industries with compliance needs. If you would like additional information about state or federal data privacy laws, please contact us at cyber@constangy.com.