US State AI Laws: a patchwork of obligations with no federal floor

Colorado SB 26-189: disclosure, human review, and three-year record retention for automated consequential decisions

Colorado SB 26-189 (signed May 14, 2026, effective January 1, 2027) Replaces the original SB 24-205, removing the duty of care, impact assessments, and risk management programs. Deployers must provide clear and conspicuous notice before using automated decision-making technology (ADMT) in consequential decisions covering employment, housing, lending, healthcare, education, and government services. Within 30 days of an adverse outcome, deployers must supply understandable descriptions of the outcome and the role ADMT played. Trained individuals must be designated for human review and override of automated decisions. Developers must provide deployers with technical documentation covering intended uses, known risks, system limitations, and instructions for meaningful human review. Both developers and deployers must retain compliance records for at least three years. Consumer rights include data access, correction, and human review of adverse decisions. A 60-day cure period applies through January 1, 2028.

→ Nexovern's runtime evidence captures the full decision chain for every AI agent session, supporting Colorado's notice requirements, 30-day adverse outcome explanations, and the three-year record retention obligation with searchable, exportable records.

Texas TRAIGA (HB 149): intent-based prohibitions, government and healthcare disclosure, and a NIST AI RMF safe harbor defense

Texas HB 149 (signed June 22, 2025, effective January 1, 2026) Applies to any entity promoting or conducting business in Texas. Prohibits intentional discrimination against protected classes, systems designed to incite self-harm or criminal activity, government social scoring, CSAM generation, and unlawful deepfakes. Government agencies must disclose AI use before or during consumer interactions in plain English, without dark patterns. Healthcare providers must disclose AI use on the date of treatment. Companies that follow the NIST AI Risk Management Framework gain an affirmative defense against liability. A 36-month regulatory sandbox program allows controlled AI testing with quarterly reporting. Third-party misuse protections shield developers from liability when others misuse their systems. Cure period: 60 days after receiving notice of a violation.

→ Nexovern's evidence exports are structured to support NIST AI RMF alignment, enabling organizations to document the testing, monitoring, and governance practices that activate the Texas TRAIGA safe harbor defense.

California SB 53: safety frameworks, transparency reports, and incident disclosure for frontier AI models

California SB 53 (signed September 29, 2025, effective January 1, 2026) Applies to developers of frontier models trained with 10^26 or more FLOPs. Large frontier developers (annual revenue exceeding $500M) must publish annual safety frameworks covering catastrophic risk identification, mitigation, governance structures, and cybersecurity practices. All frontier developers must publish transparency reports before deployment, detailing model capabilities, intended uses, modalities, restrictions, and catastrophic risk assessments. Safety incidents must be reported to the California Office of Emergency Services within 15 days of discovery, or within 24 hours if imminent danger exists. Covered incidents include unauthorized tampering causing harm, materialized catastrophic risks, loss of control resulting in injury, and deliberate evasion of safeguards. Whistleblower protections prohibit retaliation against employees or contractors who report catastrophic risk activities. Large developers must maintain anonymous internal reporting channels.

→ Nexovern's incident detection and alerting supports the 15-day and 24-hour reporting windows by capturing the evidence needed for California's safety incident disclosure, and providing the continuous monitoring that transparency reports require.

Illinois HB 3773: strict liability for discriminatory AI in employment, with a private right of action

Illinois HB 3773 (signed August 9, 2024, effective January 1, 2026) Amends the Illinois Human Rights Act. Employers must provide notice when AI is used in employment decisions, including recruitment, hiring, promotion, training, discharge, discipline, and tenure. Strict liability attaches when AI produces a discriminatory effect on protected classes, regardless of whether the discrimination was intentional. ZIP codes may not be used as a proxy for protected classes in AI-driven employment processes. Individuals may bring civil rights complaints directly, making Illinois one of the few states with a private right of action for AI discrimination in employment. Penalties escalate based on prior violations.

→ Nexovern's automated AI inventory surfaces which agents are involved in employment decisions, enabling compliance teams to direct bias testing where the strict liability exposure is highest and build the evidence trail needed to respond to private complaints.

Connecticut SB 5: staggered AI governance covering employment decisions, frontier models, and content provenance

Connecticut SB 5 (signed May 27, 2026) Anti-discrimination amendments, the developer-deployer framework, and WARN Act disclosure requirements take effect October 1, 2026. Interactive disclosure and pre-decision notice obligations for automated employment decision tools follow on October 1, 2027. Pre-decision notice must identify the automated tool being used, its purpose, the trade name of the technology, categories and sources of personal data analyzed, how the data is assessed, and contact information. Using automated employment decision technology is not a defense to discrimination claims under the Connecticut Fair Employment Practices Act, though courts may consider anti-bias testing efforts as a mitigating factor.

→ Nexovern's jurisdiction-aware evidence mapping tracks which AI agents affect Connecticut residents and employees, ensuring that disclosure and anti-discrimination obligations are met in advance of each enforcement milestone.