As with seemingly every aspect of AI, legislative activity related to potential AI risks and harms has moved with unprecedented speed. Often it can take decades for policymakers to begin responding to new technologies with targeted laws. But after generative AI captured the world's attention, it took only a matter of months for U.S. state legislatures to consider responsive legislation. States are not waiting for federal action, instead adopting a remarkably active stance on regulations responding to concerns around many different types of AI systems and contexts.

Unpacking the themes of these legislative efforts is an ongoing undertaking. To help keep track of this rapidly changing landscape, the IAPP has published this tracker, which collates legislative activity and reflects emerging themes across AI governance policymaking at the U.S. state level.

Over the past few years, state responses have varied widely, reflecting the multifaceted challenges AI poses across legal domains. Initial legislative efforts focused on state government use of AI, with states creating new safeguards or outright bans on high-risk governmental AI applications. Other states have focused on implementing studies and task forces to assess AI’s risks and benefits before rushing to new regulations. The recent surge in generative AI has shifted legislative attention to commercial AI guardrails. These efforts typically fall within consumer protection law and aim to amend state legal codes accordingly. This tracker serves as a resource to monitor these developments.

The tracker is curated to spotlight legislation directly impacting private sector organizations, excluding government-only bills. While such standards influence AI policy, they generally do not impose immediate obligations on private sector organizations. Sectoral AI activities, despite their significance, are also omitted from the tracker due to their limited scope. The tracker instead focuses on broadly applicable laws affecting various types of AI systems. This approach acknowledges the complexity of crafting comprehensive AI governance legislation that addresses the spectrum of risks associated with diverse AI applications. The tracker features a scope column to indicate the types of AI systems each bill covers, ranging from generative AI to automated decision-making systems. It also categorizes obligations into broad themes, clarifying which provisions apply to developers and deployers. However, the legislative text can vary significantly, so a check mark in the chart does not imply identical obligations across proposals.

The IAPP additionally hosts a US State Privacy Legislation Tracker, which tracks laws with comprehensive approaches to governing the use of personal information.

Scoping this chart:

• Government-only bills and laws are not included. This chart focuses on bills that explicitly apply to private sector organizations, even though governmental rules will continue to shape AI governance practice.
• Similarly, bills that would create a state AI task force or advisory council are also excluded.
• Sectoral bills and laws such as New York City's employment law, Local Law 144, are excluded from this chart because of their narrow applicability. Nevertheless, they often have important implications for a broad set of businesses.
• For more information on the terms used in this chart, please see the IAPP's AI governance glossary. As the field evolves, terms may be given distinct meanings under laws and other frameworks. This tracker maps common themes. The presence or absence of a particular tracked provision is not meant to convey any editorial or policy position of the IAPP.
• The IAPP additionally published an article providing more information about the scope of this resource, as well as descriptions and examples of each category of obligations.

Enacted Private Sector AI Governance Laws

Only includes cross-sectoral laws with direct application to the use of AI systems in the private sector.

Colorado

Colorado AI Act
(effective 1 Feb. 2026)

Utah

Utah AI Policy Act
(effective 1 May 2024)