The States Are Going Full Force On Regulating AI

Here’s a comprehensive overview of the state AI regulatory landscape as of May 2026, with particular attention to areas most relevant to financial services, credit, and collections:

The Big Picture

State activity has exploded. Multistate.ai’s tracker counts 1,561 AI-related bills introduced across 45 states as of March 2026 — already surpassing the full-year 2024 total of 635 bills. Of 1,208 bills introduced in 2025, 145 were enacted into law.

The overarching tension: the Trump administration’s December 2025 Executive Order directed the DOJ to challenge state AI laws inconsistent with a deregulatory federal posture — but Congress rejected a 10-year preemption moratorium in the Senate, leaving state enforcement authority intact.

Key Enacted Laws

Colorado AI Act (Effective June 30, 2026)

The most consequential for financial services. Expressly classifies credit decisions, loan modifications, and financial services as “consequential decisions” triggering the full compliance regime. Requires developers and deployers of high-risk AI systems to:

• Implement risk management programs and impact assessments

• Provide consumer disclosures and right to appeal adverse decisions

• Use “reasonable care” to prevent algorithmic discrimination

• Penalty: up to $20,000 per violation

California (Multiple Laws, Effective Jan. 1, 2026)

• SB 942 (AI Transparency Act) — AI-generated content disclosure; delayed to August 2, 2026

• SB 53 (Frontier AI Act) — Safety and oversight frameworks for large model developers; up to $1M per violation

• AB 2013 (Training Data Transparency) — Training dataset disclosures

• CCPA Automated Decision-Making Regulations — Consumer opt-out rights and pre-use notices for ADM; full provisions effective January 1, 2027

Texas TRAIGA (Effective Jan. 1, 2026)

Narrowed during legislative process to focus primarily on government use and categorical bans (behavioral manipulation, deepfakes, social scoring). Civil penalties $10,000–$200,000 per violation.

Utah AI Policy Act (In effect, May 2025)

Regulates generative AI in consumer transactions and financial, legal, and medical services, requiring disclosures when AI interacts with consumers. Importantly establishes that using AI is not a defense to consumer protection violations.

New York RAISE Act

Safeguards and reporting for large AI model developers; AG enforcement with penalties up to $1M (first violation) and $3M (subsequent).

Illinois AI Video Interview Act (Feb. 2026)

Employer notification and consent requirements when AI analyzes job candidate interviews.

The 18-State Automated Decision-Making Cluster

This is most directly relevant to your space. Eighteen states have passed laws giving consumers opt-out rights from automated processing for decisions with legal or significant effects — explicitly including the provision or denial of financial/lending services:

California, Colorado, Connecticut, Delaware, Florida, Indiana, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Virginia

Key variances across these states:

• Delaware limits scope to “solely automated” decisions; Colorado’s broader “automated processing” language may capture decisions with some human involvement

• Florida penalties can reach $50,000 per violation; Connecticut caps at $5,000

• California adds a pre-use notice requirement

Financial Services & Collections: Specific Pressure Points

Per Venable’s analysis, the regulatory stack layering on financial services AI now includes:

• FCRA — Proprietary ML loan scores may qualify as “credit scores,” triggering disclosure requirements; AI-generated consumer reports create secondary market complications

• ECOA/Reg B — No AI exemption from specific adverse action notice requirements (CFPB has been explicit: “the algorithm decided” is not a valid explanation)

• FDCPA — Contact timing, frequency, and harassment standards apply to automated collection workflows

• Colorado AI Act — Loan modifications classified as consequential decisions requiring governance controls

• Proposed Maryland legislation — Would require human review before AI-assisted collections actions — one to watch

• NYC Local Law 144 — Bias audit regime for automated employment decision tools, serving as a template others may adopt for credit

What to Watch

1. Colorado’s June 30, 2026 effective date is the most immediate hard deadline for any lender or servicer using AI in credit decisions

2. Maryland’s proposed human-review requirement for collections AI could be a significant operational burden if enacted

3. California CCPA ADM Rules (full consumer opt-out provisions, Jan. 2027) will be the most expansive consumer rights framework touching credit and collections

4. The Trump National AI Legislative Framework announced March 2026 signals federal preemption efforts will continue, but the legal battles over which state laws survive will play out over years