The New York AI hiring law isn't a New York law
If you have read anything about AI in hiring, you have read about the bias-audit requirement — the rule that says you must have an automated employment decision tool independently audited before you use it to screen candidates, and tell candidates you are using it.
That rule is real. It is New York City Local Law 144, and it binds employers acting within New York City.
New York State has no statewide AI hiring statute at all.
This matters in a way that is easy to underestimate. An employer in Buffalo, Rochester or Albany reading a tracker that lists "New York" in an AI-hiring column may reasonably conclude it has audit obligations it does not have. An employer hiring into Manhattan reading that the obligation is statewide may assume its Jersey City office is covered too. Both are wrong, in opposite directions, from the same error.
New York State has done plenty on AI — the RAISE Act imposes genuine frontier-model oversight, the LOADinG Act requires meaningful human review before a state agency makes benefit decisions by automation, and there are AI-companion self-harm protocols in force. Hiring simply is not among them.
About twenty "state AI laws" never actually passed
The second finding is more systemic. A bill that is introduced generates headlines. A bill that dies quietly in committee generates nothing. Trackers built from news coverage and press releases inherit that asymmetry, and the result is a long tail of laws that do not exist.
Some of the clearest examples we verified individually:
- Virginia's general AI act was vetoed. HB 2094 would have imposed Colorado-style duties on developers and deployers of high-risk AI. It passed both chambers, the Governor vetoed it on 24 March 2025, and the veto was sustained. Virginia has no general AI act.
- Virginia also has chapters that were signed but never took effect. Its synthetic-media provisions carried a clause conditioning them on reenactment by a later session, which never happened. The statutory section they would have created does not exist — yet the chapters appear in trackers as live law.
- Connecticut's comprehensive AI bill died twice. It passed the Senate in 2024 and again in 2025, and died on the House calendar both times. Connecticut has no comprehensive AI act.
- North Dakota's deepfake bill failed 17–69. Not stalled — voted down. North Dakota has no deepfake offence. Its only general AI law is five words long: "person" does not include artificial intelligence.
- Oklahoma's AI rights bill passed the House 89–0 and then sat in Senate Judiciary until the session ended. A unanimous chamber vote is not a law.
Missouri is the clearest illustration of the pattern: roughly twenty AI bills in the 2026 session, and not one of them passed. A tracker that counts activity rather than enactment would rank Missouri as a leading AI-regulation state. It has none.
What states are actually regulating
The popular framing is that states are regulating algorithmic discrimination. They are mostly not.
Exactly one state — Colorado — has a general algorithmic-discrimination law, and it only came into force on 30 June 2026 after a delay. Everything else clusters elsewhere: deepfakes and non-consensual imagery first, election synthetic media second, and chatbot and companion-AI duties as the fastest-moving category, with a group of them landing on 1 January 2027.
The three states most often called "comprehensive" alongside Colorado are weaker than the label suggests. Texas's act is built on intent — disparate impact is expressly not enough, and there is no private right of action. Utah's was narrowed in 2025 so that disclosure is required only if a user asks, and it sunsets in July 2027. Virginia's, as above, was vetoed.
And one state runs entirely the other way: Montana's "Right to Compute" act is deregulatory, declaring computation a protected right and constraining how the state may restrict it. Any claim that states are uniformly tightening AI rules is simply false.
Why we checked it this way
Every entry was checked against the state's own legislature, code, session law or agency. Law-firm summaries and news articles were used only as pointers to a primary document, never as the basis for a status.
Two findings show why title-level keyword searching isn't enough. Nebraska's rule that an AI algorithm may not be the sole basis of a utilization-review denial is buried inside a prior-authorization insurance act whose title never mentions AI. Washington's AI-CSAM provision surfaced only after reading all 1,491 governor-signed bills, because its title carries no AI term either. Both are invisible to a keyword sweep — which is how most aggregators work.
We also published what we could not verify. Alaska's legislature site blocks automated access, so Alaska is marked "could not verify" rather than "no law" — those are different claims, and collapsing them is exactly the error we set out to avoid. Indiana's effective dates are left open rather than filled in with the state's usual default. Two Wisconsin entries were reachable only through a proxy, and say so.
A tracker is worth what its weakest entry is worth. We would rather show you the weak entries.
The tracker
The full picture — all fifty states and DC, with status, plain-language coverage, effective dates and an official source link for every entry — is free at kcalbin.com/ai-state-law-tracker. Forty-six of the fifty-one have AI law already in force.
If you need the insurance-specific picture — NAIC model-bulletin adoption state by state — that lives separately at AI Insurance Watch.
Informational only. Not legal advice, and not a compliance determination. Every claim above traces to an official source checked on 29 September 2026; read the linked document before relying on it.