2026 AI Compliance: Upcoming Laws Every Organization Needs to Know

• • Voluntary 30-day Pre-release Review: 

• • • Developers of “covered frontier models” (a threshold to be set through a classified benchmarking process) may provide the federal government access to new models for up to 30 days before releasing them to trusted partners.

• • AI Cybersecurity Clearinghouse: 

• • • The US Department of Treasury, the National Security Agency (NSA), and the Cybersecurity and Infrastructure Security Agency (CISA) must establish a clearinghouse to coordinate AI-assisted vulnerability scanning, validate findings, and manage patch distribution across critical infrastructure.

• • • On July 14, the White House launched “Gold Eagle,” the clearinghouse platform intended to help companies identify, share, and address software vulnerabilities using advanced AI models.

• • “Trusted Partners” Early Access: 

• • • Developers are encouraged to collaborate with the government to identify partners who receive frontier model access ahead of general release.

• • Criminal Enforcement Priority: 

• • • The US Attorney General (AG) is directed to prioritize enforcement of existing federal criminal statutes (Computer Fraud Abuse Act (CFAA), wire fraud, identity fraud) against anyone using AI to illegally access or damage computer systems or deploying AI agents to unlawfully access data for criminal purposes, in particular as it relates to cybercrimes.

Although the order does not impose direct compliance obligations on most businesses, it signals a more hands-on approach to AI regulation, particularly regarding threats to national security and cybersecurity.

This executive order follows the Trump Administration’s export control concerns regarding Mythos and Fable 5, which are concerned about putting powerful AI in the hands of threat actors, including nation-state actors. A testing approach was developed to protect the critical infrastructure.

• • AI in Employment Decisions: 

• • • Beginning October 1, 2027, employers using AEDT must disclose when applicants or employees are interacting with such technologies and provide written notice before making an employment-related decision (such as hiring, promoting, disciplining, or discharging) using the tool.

• • • The “plain language” notice must include the technology used, the technology’s purpose, the nature of the decision, the name of the tool used, the categories and sources of personal data analyzed, how the data will be processed and assessed, and employer contact information.

• • • The Act also provides that use of an AEDT is not a defense to discrimination claims, although evidence of anti-bias testing may be considered.

• • Subscription-based AI Services: 

• • • Subscription-based providers offering AI technologies to Connecticut consumers must provide written notice of key subscription terms before entering into or renewing a subscription or collecting fees.

• • • The disclosure must include material limitations on the AI technology and whether the provider may limit, reduce, or eliminate access to AI functionality. Consumers must affirmatively accept the disclosed terms before fees may be charged.

• • AI Regulatory Sandbox: 

• • • The Act directs the Connecticut Commissioner of Economic and Community Development to develop a plan for an AI regulatory sandbox program that would allow approved applicants to temporarily test innovative AI products or services under reduced regulatory requirements.

• • • This regulatory sandbox is similar to the ones enacted in Texas, Utah, and Delaware.

The Act is enforced exclusively by the attorney general under the state’s unfair or deceptive trade practices statute. There is no private right of action.

Certain employment-technology violations occurring before December 31, 2027, are subject to a 60-day cure period.

• • Employers using AI in hiring, promotion, discipline, discharge, or other employment decisions should prepare for Connecticut’s notice requirements before October 1, 2027.

• • Companies offering AI tools through subscription models should review onboarding, renewal, and fee-collection processes to ensure required disclosures and affirmative acceptance mechanisms are in place.

• • Companies using innovative AI solutions should take advantage of regulatory sandboxes to get prerelease regulatory insights.

The Act applies to consequential decisions relating to employment, housing, lending, insurance, healthcare, education, and government benefits, where a covered ADMT materially influences the decision. 

• • Covered ADMT: 

• • • The law applies to technology that processes personal data and uses computation to generate outputs, including predictions, recommendations, classifications, rankings, or scores, that are used to make, guide, or assist decisions concerning individuals. There is no exclusion for a human in the loop.

• • • The tool becomes a “covered ADMT” when it materially influences a consequential decision.

• • Developer and Deployer Obligations: 

• • • Developers must provide deployers with documentation describing the ADMT’s intended uses, categories of personal data used in training data, known limitations and risks, and instructions for appropriate use and human review.

• • • Deployers must provide consumers with a pre-use notice before consumers use a covered ADMT and an additional notice within 30 days after an adverse outcome, which provides a plain-language explanation of the decision, the ADMT’s role, and available consumer rights.

• • • Post-adverse outcome decisions are being further explored through the rulemaking process.

The Act is enforced exclusively by Colorado’s Attorney General, with violations treated as deceptive trade practices. There is no private right of action. The Colorado Attorney General is required to issue post-adverse disclosure requirement rulemakings on or before January 1, 2027.

There is a 60-day cure period unless the violation was done knowingly or repeatedly. The right to cure sunsets January 1, 2030.

Companies using or developing ADMTs doing business in Colorado in employment, insurance, lending, healthcare, housing, education, or government-benefit decisions should start the risk assessment process to understand whether those tools qualify as covered ADMTs.

• • “Frontier Model” means a foundation model that was trained using a quantity of computing power greater than 10^26 integer or floating-point operations.

• • “Large Frontier Developer” means a frontier developer that, together with its affiliates, collectively had annual gross revenues in excess of $500,000,000 in the preceding calendar year. 

• • • Unlike California’s SB 53 and New York’s Responsible AI Safety and Education (RAISE) Act, Illinois is the first state to require large frontier developers to retain an independent third party to conduct annual audits of compliance with the AI Act’s frontier AI framework requirements.

• • • Beginning January 1, 2028, large frontier developers also must implement, publish, and annually review a frontier AI framework describing how they identify, assess, and mitigate “catastrophic risks,” including risks involving chemical, biological, radiological, or nuclear weapons, certain autonomous cyberattacks or criminal conduct, and loss of model control.

• • The AI Act takes effect January 1, 2027, but the frontier AI framework, publication, and third-party audit obligations for large frontier developers do not begin until January 1, 2028, or 90 days after a developer first qualifies as a large frontier developer, whichever is later. 

• • • A separate governmental disclosure-statement filing requirement for large frontier developers operating a frontier model in Illinois takes effect earlier, on January 1, 2027.

The Illinois Attorney General’s Office has exclusive authority to enforce the AI Act and bring civil penalty actions.

Frontier developers must report critical safety incidents within 72 hours of learning facts establishing a reasonable belief an incident occurred, or within 24 hours if the incident poses an imminent risk of death or serious physical injury.

Third-party audit requirements and disclosures will allow deployers more insight into the catastrophic and cybersecurity risks of these large models.

While the law does not impose current compliance obligations, it signals that Virginia may consider a future AI audit or certification regime, and other states could follow.

Laws have already been enacted in the following states, with effective dates ranging from laws already in force to provisions taking effect as late as July 2027:

• • California (SB 243)

• • Colorado (HB 1263)

• • Connecticut (SB 5)

• • Georgia (SB 540)

• • Idaho (SB 1297)

• • Iowa (SF 2417)

• • Maine (LD 1727)

• • Nebraska (LB 525)

• • New York (S 3008C)

• • Oregon (SB 1546)

• • Rhode Island (SB 2195)

• • Tennessee (SB 1700)

• • Washington (HB 2225)

While these laws share a common core of requiring AI disclosure, minor protections, and safety protocols, the definitions and compliance requirements diverge significantly across jurisdictions.

Key Compliance Requirements Include:  

1. 1. operators are required to disclose, at set intervals, that users are interacting with AI rather than a human;
   2. safety protocols preventing minors in particular from engaging in certain harmful or conversations;
   3. age verification; and
   4. prohibitions on the chatbot stating or implying that it is a licensed mental health professional.   

Many of the laws have exemptions for routine business tools, including customer service bots, internal research tools, and narrow single-purpose utilities.

Companies that use or develop these chatbots should understand the requirements of these laws in the states where they operate and establish a high-level compliance approach.