State legislatures have spent 2026 building out a patchwork of AI regulation that reaches into hiring, health care, and everyday consumer transactions.

Employers operating across state lines now face a compliance map that shifts at every border.

Eleanor T. Chung, Julia Rioux Thayer, and Jean-Claude Velasquez, attorneys at Epstein Becker Green, co-authored "AI Regulation in the US: The New State Laws Employers Can't Ignore" in Ius Laboris. The article examines the growing number of state AI laws that employers need to navigate.

The piece walks through how 2026 state sessions moved AI regulation from an emerging issue to an active compliance obligation across three areas: consumer transparency, health care, and employment. California, Colorado, and Utah continued to expand omnibus transparency and accountability statutes, while a newer wave of laws now targets generative AI systems once they cross certain scale thresholds. In health care, states focused heavily on prior authorization, tightening limits on AI-only coverage denials and requiring human review and documentation to support appeals. A parallel track requires disclosure whenever a patient communication is AI-generated, paired with a guaranteed path to a human alternative.

On the employment side, the authors describe a shift from first-generation disclosure duties to a second generation of auditing, reporting, and anti-discrimination requirements. Illinois, an early mover on AI in hiring, kept refining its framework in 2026, and Connecticut added new AI-related notice duties, including disclosure when workforce reductions rely on AI-assisted decisions. Colorado's Senate Bill 26-189, covering AI used in consequential employment decisions, stood out as one of the year's most closely watched employment AI laws. The piece points readers to Epstein Becker Green's AI Enacted Bills Map, which tracks every state AI law enacted across these three domains.

"AI regulation is now a compliance requirement, not an emerging issue. With the 2026 legislative cycle largely complete, state AI laws are already in effect across consumer transparency, health care, and employment. Businesses operating in multiple states now face enforceable obligations that apply immediately. California, Colorado, Utah, Illinois, and New York remain the most active jurisdictions."

Get in Touch

To learn more about this topic, contact Eleanor Chung at echung@ebglaw.com, Julia Thayer at jthayer@ebglaw.com, or Jean-Claude Velasquez at jvelasquez@ebglaw.com.

Jump to Page
Advanced Search ›

Privacy Preference Center

When you visit any website, it may store or retrieve information on your browser, mostly in the form of cookies. This information might be about you, your preferences or your device and is mostly used to make the site work as you expect it to. The information does not usually directly identify you, but it can give you a more personalized web experience. Because we respect your right to privacy, you can choose not to allow some types of cookies. Click on the different category headings to find out more and change our default settings. However, blocking some types of cookies may impact your experience of the site and the services we are able to offer.

Strictly Necessary Cookies

These cookies are necessary for the website to function and cannot be switched off in our systems. They are usually only set in response to actions made by you which amount to a request for services, such as setting your privacy preferences, logging in or filling in forms. You can set your browser to block or alert you about these cookies, but some parts of the site will not then work. These cookies do not store any personally identifiable information.

Performance Cookies

These cookies allow us to count visits and traffic sources so we can measure and improve the performance of our site. They help us to know which pages are the most and least popular and see how visitors move around the site. All information these cookies collect is aggregated and therefore anonymous. If you do not allow these cookies we will not know when you have visited our site, and will not be able to monitor its performance.