The State AI Law Everyone Told You to Prepare For Was Repealed Before It Took Effect

Disclosure, up front

We are an automation company, not a law firm, and none of this is legal advice. We wrote it because clients keep forwarding us compliance material about a law that no longer exists. Every date, bill number and obligation below is read from law firm analyses and the Colorado legislature's own bill record, on 9 September 2026. Where something is genuinely your lawyer's call rather than ours, we say so at the end.

For two years, the single most-cited example of American AI regulation was the Colorado AI Act. It was going to be the template. Compliance vendors built offerings around it. A great deal of the "prepare for state AI regulation" content still circulating is really content about that one law.

It never took effect. It was repealed and replaced in May 2026, before its own start date.

Meanwhile a different set of laws quietly came into force on 1 January 2026, in Texas, California and Illinois, and those are the ones that can actually reach an ordinary business today. And a federal effort is under way to override the states entirely, which has not yet changed what you have to do.

Here is the current map, which parts of it plausibly touch a small business, and why the whole episode is a lesson about the shelf life of compliance advice.

The short version

Colorado's AI Act is gone. Repealed by SB 26-189, signed 14 May 2026. A narrower automated-decision law replaces it, effective 1 January 2027.
Texas is the broad one. TRAIGA has applied since 1 January 2026 to anyone doing business in Texas or serving Texas residents, with no size threshold.
Illinois matters if you hire with AI. Employers may not use AI that discriminates against protected classes.
Most of California's package is not aimed at you — it targets developers of AI systems, not businesses that use them.
The federal government is trying to pre-empt all of it, and until a court says otherwise, the laws in force remain fully enforceable.

01What actually happened to Colorado

The timeline is worth having straight, because almost every retelling stops early.

May 2024: Governor Polis signs SB 24-205, the Colorado AI Act, with publicly stated reservations, explicitly asking the legislature to refine it before it took effect.
Through 2025: it becomes the reference point for US AI regulation, and its start date is pushed back, eventually to 30 June 2026.
27 April 2026: a federal court pauses enforcement.
9 May 2026: the legislature passes SB 26-189, a bipartisan rewrite, after a workgroup convened by the Governor recommends a narrower approach.
14 May 2026: Polis signs it. SB 24-205 is expressly superseded, having never applied to anyone.

What replaces it is narrower and differently framed. The category "high-risk artificial intelligence system" is gone, replaced by automated decision-making technology that "materially influences" a consequential decision. The obligations centre on disclosure, transparency and targeted consumer protections rather than the broader duties in the original. It takes effect 1 January 2027 and applies to decisions made on or after that date.

So if you have been told to prepare for the Colorado AI Act, you have been given a 2024 answer. There is a real Colorado obligation coming, it is a different law, and it is more than a year away.

02What actually took effect on 1 January 2026

US state AI laws in force as of September 2026, and who they reach
Law	Reaches	Core obligation	Likely relevant to a small business?
Texas TRAIGA	Developers and deployers doing business in Texas or serving Texas residents. No size threshold.	Prohibits AI used for restricted purposes: encouraging self-harm, infringing rights, unlawful discrimination, child sexual abuse material.	Yes — the broadest reach of any of them.
Illinois HB 3773	Employers using AI.	Amends the Human Rights Act to bar employer use of AI that discriminates against protected classes.	Yes, if you use AI anywhere in hiring.
California AB 2013	Developers of generative AI offered in California.	Publish a high-level summary of training data.	Only if you build generative AI. Using a vendor's tool is not developing one.
California AB 489	AI communicating with patients.	No implying a healthcare licence; disclosure required.	Only in healthcare.
California SB 243	Companion chatbots.	Disclosures, safety protocols, protections for minors.	Rarely — a support bot is not a companion chatbot.
California AB 325	Competitors using shared pricing algorithms.	Bars algorithmic price fixing.	Only if you price via a shared algorithm with competitors.
California TFAIA / SB 53	Frontier developers: models above 10²⁶ operations, revenue over $500m.	Publish a safety framework; report critical incidents.	No. If you are reading this, it is not about you.

Compiled 9 September 2026 from law firm analyses of the January 2026 effective dates and from the Colorado General Assembly's record for SB 26-189. The "likely relevant" column is our reading for a typical small business and is not legal advice. Scope questions here turn on facts about your business that we cannot see.

03The distinction that decides most of this

Nearly every one of these laws splits duties between whoever builds an AI system and whoever uses one. Most small businesses are only ever the second, and most of the heavy obligations land on the first.

California's package is the clearest example: AB 2013's training-data disclosure and SB 53's frontier-model duties are aimed squarely at developers. Buying a subscription to somebody's AI tool does not make you its developer.

The exception worth checking is white-labelling. If you put someone else's AI in front of your customers under your own name, you may have stepped across that line — the same trap we flagged for the EU AI Act. People are routinely surprised which side of it they are on, and it is the question most worth putting to an actual lawyer.

Texas has a safe harbour, and it is the useful part

Substantial compliance with the NIST AI Risk Management Framework earns an enforcement safe harbour under TRAIGA. That is unusually practical: it means one recognised, freely published framework can carry most of your posture rather than a separate exercise per state. If you are going to do anything structured about AI governance, doing it against the NIST framework is the version that also buys you something legally.

04The federal effort to override the states

On 11 December 2025 an executive order, "Ensuring a National Policy Framework for Artificial Intelligence", set out to curb state AI regulation. It directed the creation of a Department of Justice AI Litigation Task Force — established 9 January 2026 — to challenge state AI laws in federal court on grounds including unconstitutional burdens on interstate commerce and federal pre-emption. It directed Commerce to publish a review of burdensome state laws and the FTC to issue a pre-emption policy statement, both by 11 March 2026, and floated conditioning federal funding on states avoiding "onerous" AI laws.

The Colorado law was named as a target.

What this changes for you today: nothing. The consistent read across the legal analyses is that state laws already in force remain fully enforceable absent court action. An executive order directing litigation is not itself a repeal. Texas TRAIGA and the California statutes apply now.

What it does mean is that the map is unstable in both directions. Colorado's law was withdrawn by its own legislature. Others may be narrowed by courts. New ones will pass. Any compliance posture that depends on the precise contours of one state's statute is going to need maintenance, which is an argument for the framework-based approach rather than a per-law scramble.

05What to actually do

For an ordinary small business using bought-in AI tools, the honest list is short and mostly free.

Write down every AI tool in use. What it is, what data it touches, who owns it internally. This single artefact answers the first question in every one of these regimes, and almost nobody has one. Include the AI features that arrived inside software you already had — those are the ones people forget.
Name one person to review it quarterly. Not a department. A person, with a recurring date.
Check whether you touch the two that actually bite. Do you serve Texas residents? Do you use AI anywhere in hiring, including CV screening or scheduling tools with ranking built in?
If you use AI in hiring, treat that as the priority. Employment discrimination is the area with the longest-established law, the clearest liability and the most active enforcement. It does not depend on a new AI statute existing.
Map your posture to the NIST AI RMF if you are going to formalise anything, because of the Texas safe harbour.
Keep evidence that you thought about it. One page, dated. The usual failing in a small-business review is not an absent control but no record that anyone considered the question.

06The real lesson: compliance advice has a shelf life

This is the second time in a year that the headline AI obligation has moved before it applied. The EU pushed its high-risk regime to December 2027 a week before people expected it to bite. Colorado repealed its law outright.

In both cases the marketing kept running on the old timetable, because urgency sells and updating an offering is expensive. The practical defence is not to follow the news more closely. It is to ask any compliance claim for a bill number and a date, then check that the law still says what the person selling to you says it says. That takes minutes and it would have caught both of these.

It is also why we date every claim on this blog and tell you when we checked. Not as a flourish — because this article will itself be wrong at some point, and the date is how you will know to distrust it.

07When to stop reading and call a lawyer

You use AI in hiring, promotion, or termination. Real liability, established law, active enforcement.
You white-label someone else's AI under your own brand. That may make you a developer with the heavier duties.
You are in healthcare, lending, insurance, housing or education. Consequential-decision territory, and where Colorado's 2027 law will land.
A customer contract asks you to warrant AI compliance. That is a commercial risk-allocation question, and a different one from whether you comply.

08The honest summary

The law everyone prepared for was repealed before it applied. The laws that actually took effect on 1 January 2026 are narrower than the coverage suggests, and most of them target the people who build AI rather than the people who use it. Texas is the broad exception, Illinois matters if you hire with AI, and Colorado's real obligation arrives in 2027 in a different shape.

Write down what you run, name someone to own it, check Texas and hiring, and ask anyone selling you compliance for the bill number.

09Common questions

Is the Colorado AI Act still coming?

No. SB 24-205, the Colorado AI Act, was repealed and replaced by SB 26-189, which Governor Polis signed on 14 May 2026 after the legislature passed it on 9 May. It never took effect on anyone. A federal court had paused enforcement on 27 April 2026 and a workgroup convened by the Governor recommended a narrower approach. The replacement covers automated decision-making technology that materially influences a consequential decision, focuses on disclosure and transparency, and takes effect 1 January 2027 for decisions made on or after that date.

Which US state AI laws are actually in force right now?

As of September 2026: Texas TRAIGA, California AB 2013, AB 489, SB 243, AB 325 and the frontier-model provisions of SB 53 / TFAIA, and Illinois HB 3773 — all effective 1 January 2026. Texas has the broadest reach because it applies to anyone doing business in Texas or serving Texas residents with no size threshold. Most of the California package targets developers of AI systems rather than businesses that merely use them.

Does Texas TRAIGA apply to my business if I am not in Texas?

Possibly. It reaches developers and deployers who conduct business in Texas or provide products or services used by Texas residents, and it specifies no size threshold. Its core prohibitions concern using AI for restricted purposes including encouraging self-harm, infringing rights, unlawful discrimination, and child sexual abuse material. It also provides an enforcement safe harbour for substantial compliance with the NIST AI Risk Management Framework.

I use AI tools but do not build them. Which laws apply to me?

Far fewer than the coverage suggests. Nearly all these statutes split duties between whoever builds an AI system and whoever uses one, and the heavier obligations sit with the builder. California's AB 2013 training-data disclosure and SB 53's frontier-model duties are aimed at developers; buying a subscription does not make you one. The exception worth checking is white-labelling: putting someone else's AI in front of your customers under your own name may put you on the developer side.

What does the federal executive order do to state AI laws?

The order of 11 December 2025, titled Ensuring a National Policy Framework for Artificial Intelligence, directed a Department of Justice AI Litigation Task Force — established 9 January 2026 — to challenge state AI laws in federal court, directed Commerce to review burdensome state laws and the FTC to issue a pre-emption policy statement by 11 March 2026, and floated conditioning federal funding. It does not repeal anything. State laws already in force remain fully enforceable absent court action.

What should a small business actually do about AI regulation?

Write down every AI tool in use, including AI features that arrived inside software you already had, with what data each touches and who owns it internally. Name one individual to review that inventory quarterly. Check the two that actually bite: whether you serve Texas residents, and whether AI touches any part of your hiring. Map anything you formalise to the NIST AI Risk Management Framework, since that earns a safe harbour in Texas. Keep one dated page showing you considered the question.

Which AI use carries the most legal risk for a small business?

Hiring, and it is not close. Employment discrimination has the longest-established law, the clearest liability and the most active enforcement, and it does not depend on any new AI statute existing. Illinois HB 3773 makes the point explicit by amending the Human Rights Act to bar employer use of AI that discriminates against protected classes, but the underlying exposure exists regardless of state. If AI touches CV screening, ranking or scheduling in your hiring, treat that as the priority.

How do I avoid acting on out-of-date compliance advice?

Ask for a bill number and a date, then check the law still says what the person selling to you says it says. That takes minutes and would have caught both of the past year's big reversals: Colorado repealing its AI Act before it applied, and the EU pushing its high-risk regime to December 2027. Urgency sells and updating an offering is expensive, so marketing tends to keep running on the old timetable well after the timetable changed.

Send us your AI inventory

List the AI tools you actually run, including the features that arrived inside software you already had, and tell us whether you serve Texas residents or use AI anywhere in hiring. We will tell you which of the laws in force plausibly reach you and which do not. If the answer is that none of them touch you today, that is what you will get, and the audit is free either way.

Ask for a scope check

Sources, read 9 September 2026: the Colorado General Assembly's record for SB 26-189, and analyses from Baker Botts, Davis Wright Tremaine, Finnegan, Seyfarth Shaw and Epstein Becker Green on the repeal and replacement of SB 24-205; King & Spalding and Paul Hastings on the 1 January 2026 effective dates and the executive order of 11 December 2025; and Ropes & Gray on the federal pre-emption recommendations. The obligations and dates are theirs; the "likely relevant to a small business" column and the practical steps are our reading. This describes legislation and is not legal advice, and scope questions turn on facts about your business we cannot see. This area has reversed twice in a year, so verify before acting. Related: The EU AI Act's August 2026 Rules and Which Decisions You Should Never Hand to an AI Agent.

Hero image from Unsplash, used under the Unsplash License.