As the state AI patchwork grows in 2026, chatbots, kids, and high-risk areas become the focus

As most state legislatures wrap up their work for the year, the focus on artificial intelligence across the country is unmistakable, creating new rules in several states for startups developing and deploying AI. Lawmakers in 45 states introduced more than 1,500 AI-related bills this session. The broad, cross-sector frameworks that once looked like the model for the country lost ground. In their place, lawmakers turned toward narrower rules aimed at specific products and uses. For startups, the central problem is not any single rule but the lack of consistency across them. A company with users in a dozen states can face a dozen different sets of obligations.

Broad frameworks pull back

The biggest story of the session is the widespread retreat from the comprehensive, high-risk model that Colorado pioneered, and Colorado itself led that retreat. After delaying its landmark AI Act the previous summer, the legislature did not amend the law so much as replace it. On May 14, Governor Jared Polis signed SB 189, which repealed and replaced the 2024 Colorado AI Act before its delayed June 30 effective date arrived. SB 189 is built around notice and disclosure rather than the risk management programs, impact assessments, and duty of care at the heart of the 2024 law. The new version takes effect in January 2027 and is enforced only by the Attorney General. The replacement came after sustained legal and political pressure, including a federal lawsuit challenging the original law's constitutionality that the Department of Justice joined, and a court order pausing enforcement before the law ever took effect.

After two failed attempts in prior sessions, Connecticut moved a narrowed AI bill through the legislature. Instead of advancing the comprehensive developer-and-deployer model that had failed to pass in past sessions, Connecticut adopted SB 5, which regulates frontier model developers, sets up a regulatory sandbox, and adds rules for chatbots and youth safety. 

But not every state has walked away from the broad model. New York pushed it hardest this session, with its Senate passing S 1169, the New York AI Act, a Colorado-style framework that targets algorithmic discrimination and requires independent audits of high-risk systems, before sending it to the Assembly in June. Virginia, which vetoed its own high-risk bill in 2025, returned with a different design in HB 797, signed into law in 2026. Rather than regulating high-risk systems directly, it directs the Joint Commission on Technology and Science to study the feasibility of a framework for independent verification organizations that would assess AI systems against best-practice standards.

Regulating AI in high-risk areas

As the broad frameworks faltered, lawmakers narrowed their aim to specific high-risk uses; health care and insurance coverage decisions drew the most attention. Even as Colorado scaled back its main AI law, the state adopted HB 1195 to restrict AI in mental health therapy and HB 1139, which bars health insurers from denying coverage based solely on AI-generated group data and requires a qualified person to make the final call on any AI-recommended denial. Alabama advanced SB 63, and Washington passed SB 5395 on the same subject. The same use-specific approach reached other domains, with California's AB 1883 regulating AI workplace surveillance and the use of AI in employment decisions, which passed the Assembly in May, and the state’s SB 1011, which would have required human review of AI systems that make operational decisions about utility infrastructure and was considered by set aside. For startups building clinical, administrative, insurance, workforce, or infrastructure tools, the retreat from comprehensive regulation does not mean a retreat from regulation; instead, the obligations are migrating into a set of use-specific rules that vary by state and by industry.

Frontier model rules coalesce 

New York resolved its own pending frontier bill when the governor signed an amended version of the RAISE Act, which closely aligned with California’s SB 53, which California passed in 2025. The result is that the states most central to AI development now share a template, which may suit the largest developers but should worry everyone else, because a standard built around the most resource-heavy models still impacts the startups that build on top of them.

If California and New York set the template in 2025, Illinois solidified the template by adopting it in 2026. Illinois passed SB 315, becoming the third state to enact frontier AI safety legislation aimed at catastrophic risks from the most advanced models. The bill tracks the California and New York transparency requirements but goes further by adding mandatory third-party audits beginning in 2028. The response from some in the industry demonstrates the widespread impact these state frontier model laws are having. While OpenAI had opposed similar earlier efforts, the company endorsed the Illinois bill and described it as a kind of reverse federalism, in which a few large states set a de facto national standard the rest of the market follows.

Chatbots become the center of gravity

Lawmakers introduced close to 100 chatbot bills across 34 states, and at least a dozen became law, far outpacing any other category of AI legislation. The volume matters less than the requirements and prohibitions in the bills, which have grown more aggressive. Oregon enacted the first chatbot law with a private right of action, SB 1546, which lets individuals sue and creates exactly the kind of litigation exposure that drives up costs and invites bad-faith claims against small companies. drives up costs and invites bad-faith claims against small companies. Tennessee enacted SB 1493, which makes it a Class A felony to knowingly train AI to do things as ordinary as simulate human conversation or provide emotional support, backs that criminal liability with a private right of action carrying $150,000 in damages, and lets courts order that offending models be shut down or retrained. For a company that builds conversational AI, treating core training decisions as a felony is the most aggressive line any legislature has drawn. The same session also produced the Curbing Harmful AI Technology Act, SB 1700, signed into law in 2026, which took the opposite approach and commissioned a state study of chatbot regulation rather than imposing rules directly.

Georgia's SB 540 stands out for covering chatbots embedded in other platforms with no exemption, reaching products that earlier proposals left alone. Washington enacted HB 2225, requiring companion chatbots to identify themselves as non-human and to flag and respond to users who express thoughts of self-harm, joining California and Oregon as states with chatbot laws aimed at protecting minors. Michigan's SB 760 (which requires chatbot providers to verify users’ ages and limits the features they can offer to children) passed the Senate in April, and Missouri has sent SB 1019, which includes an AI therapy chatbot ban, to the governor’s desk. Maine, which in 2025 required only that businesses disclose when a consumer is talking to AI, enacted a therapy chatbot ban, LD 2082, this session.

California's most consequential chatbot fight moved off the legislative calendar entirely. After the governor vetoed the LEAD for Kids Act in 2025, its backers turned it into a ballot initiative, the Kids AI Safety Act, which is expected to qualify for the November 2026 ballot and would impose some of the strictest limits in the country on minors' access to chatbots. For any startup with a conversational interface—a category that now includes tutors, translators, customer service tools, and productivity assistants—the practical effect is a thicket of overlapping disclosure, safety, age-verification, and liability rules that differ in every state.

Digital Replicas

States have had more success with narrowly targeted rules against synthetic media than with broad AI regulation, and that work continued this session on two tracks. On the first, states kept expanding protections for individuals. Washington enacted SB 5886, which establishes a property right in a person's forged digital likeness, alongside SB 5105, which addresses sexually explicit deepfakes. These build on a 2025 wave in which several states passed digital replica laws and dozens addressed nonconsensual intimate imagery. 

The second track is newer and matters more for startups, because liability would extend not just to the people creating deepfakes but to the services they use to create those deepfakes. California's AB 621 extends liability to providers that keep supporting a deepfake pornography service after notice, with a presumption of liability and statutory damages. The next round of state bills is expected to reach further up the stack, including to generative AI tools, payment processors, hosting platforms, and cloud providers. For startups that offer image, audio, or video generation, the extension of liability to AI developers will place responsibility for misuse on the tool and its creator rather than the user.

Transparency & Content provenance

Transparency and provenance rules advanced on two tracks this session. The first concerns what goes into a model. California'straining data transparency law took effect in January, requiring developers of generative AI systems to publish high-level information about the training data used to train their models, and it survived an early test when a federal court declined to block it in a challenge brought by a major developer. New York is advancing a nearly identicaltraining data transparency bill. At the same time, California is looking to push transparency requirements further with AB 412, which would require developers to create and maintain databases of all copyrighted content that is included in vast training data sets. As Engine has explained in letters to California lawmakers, the requirements in the bill are not technically or financially feasible for startups, given the broad scope and diverse nature of training data sets.

The second track concerns what comes out of a model. A growing number of states, including Washington, Arizona, California, Illinois, and New York, moved bills requiring providers to attach provenance metadata to AI-generated or AI-modified content so that consumers and platforms can tell what was synthetic. California'sbroader AI transparency law, which mandates disclosure tools and watermarking for large platforms, had its effective date pushed to later in 2026.

Proposals to support AI innovation

Not every state moved toward new restrictions. A parallel set of efforts aimed to support AI development and adoption rather than constrain it. Connecticut's new law includes aregulatory sandbox that lets companies test AI products under relaxed requirements, an approachTexas adopted in 2025 and that several states continued to pursue. Arizona became the first state to convene a dedicated House committee on AI and innovation, and advanced ameasure directing state agencies to find opportunities to deploy AI and to remove regulations that stand in the way of adoption. Other states funded pilot programs and AI literacy efforts, and the right-to-compute laws that began in 2025 continued to frame access to computational resources as a protected activity. These proposals are the most startup-friendly category of the session, and they offer a template for states that want to encourage innovation rather than only constrain it.

The federal landscape

Given the number of states that moved a wide array of AI proposals in the last year, the pressure is increasing on Congress to create an overarching AI framework. But while the Congress did pass narrow AI-adjacent legislation in 2025—the Tools to Address Known Exploitation by Immobilizing Technological Deepfakes on Websites and Networks (TAKE IT DOWN) Act, which, as of May 2026, requires platforms to remove nonconsensual intimate content, including deepfakes, within 48 hours—it has yet to consider a broader AI framework to replace the state patchwork.

After the proposed federal moratorium collapsed in 2025, supporters tried again to attach preemption language to the annual defense bill, and that effort failed too amid bipartisan opposition. With Congress unwilling to act, the administration turned to executive power. In December, the President signed anexecutive order directing the Attorney General to lead a litigation task force to challenge state AI laws and pressing federal agencies to withhold certain broadband funds from states with rules the administration considers onerous. In March of this year, the White House laid out its wishlist for a federal AI framework, which started to entangle some of the more straightforward AI policies with complex and contentious online kids safety issues. More recently, lawmakers unveiled the Great American AI Act, a discussion draft from Reps. Jay Obernolte (R-Calif.) and Lori Trahan (D-Mass.) that would codify parts of the administration's AI agenda. Whichever path Congress takes, it’s crucial that they find a bipartisan way forward on a framework that creates consistent protections for consumers and obligations for the companies developing and deploying AI, no matter where they are in the country.