Every AI compliance deadline we track.

Never went away: Title VII and the ADA reach AI hiring tools; ECOA/Regulation B requires specific reasons for AI credit denials; the FCRA governs consumer-report data in screening; HIPAA follows PHI into AI tools; FTC Act §5 covers deceptive AI claims and undisclosed bots. Federal AI guidance was largely withdrawn in 2025; the statutes were not.

Annual independent bias audit before using an automated employment decision tool on NYC candidates, public posting of results, and 10-business-day advance notice.

Prohibited-practices bans and AI-literacy duties — for any US company with an EU connection, including when AI output is merely used in the EU. Does the Act reach you? →

Businesses using conversational generative AI in a Utah consumer transaction must disclose it is AI (not a human) on the consumer's request, with an optional up-front safe harbor. A heightened, proactive duty applies to regulated occupations in high-risk interactions, and a separate overlay covers mental-health chatbots.

Automated-decision system regulations for employers of 5+: no discriminatory tools or proxies, anti-bias testing as the de facto defense, four-year record retention, vendor-agent liability.

New Jersey's civil-rights disparate-impact rules reach automated decision-making tools in employment, housing, public accommodation, and contracting: a facially neutral tool that produces a disparate impact is unlawful without proof of intent, and using a vendor's system does not shift the liability.

Illinois: AI with the effect of employment discrimination is a civil rights violation (no intent required), plus a ZIP-code-proxy ban and employee notice. Texas: intent-based prohibited-uses screen, healthcare AI disclosure, and a NIST-alignment safe harbor.

CCPA-covered businesses must complete written risk assessments before high-risk processing — including using or training automated decision-making technology for significant decisions.

For regulated insurers, not general deployers: Colorado's Division of Insurance requires a governance and risk-management framework for AI, algorithms, and predictive models (auto and health from this date; life already in force), and New York DFS guidance sets anti-discrimination and governance expectations for AI in underwriting and pricing.

Chatbot disclosure and AI-content labeling duties begin (with a marking grace period to Dec 2, 2026 for generators already on the market).

PA 26-15: using automated employment-decision technology is no defense to a discrimination complaint (anti-bias testing weighs in your favor), and WARN filings must disclose AI-related layoffs.

SB 26-189 covers automated decision-making technology (ADMT) — software that helps decide things about people. From this date: pre-use consumer notice, 30-day adverse-outcome explanations, meaningful human review on request, and developer documentation. Attorney general implementing rules are due by the same date (draft rules expected end of summer 2026).

HB 26-1263 covers companion-style public conversational AI: AI-not-human disclosure, age estimation and minor safeguards, and suicide-referral protocols. Customer-service and transactional bots are expressly excluded, but every chatbot should be screened.

Notice, opt-out, appeal, and access rights for automated decision-making technology used in significant decisions: finance, housing, education, employment, healthcare.

Covered chatbot operators begin annual crisis-protocol and safeguard-efficacy reports to the Colorado attorney general.

Interaction disclosure and six-item pre-decision written notices for automated employment-decision technology deployed on or after this date.

The heavy deployer obligations for Annex III systems: oversight by trained staff, input-data controls, monitoring and suspension duties, six-month log retention, worker and affected-person notices, and impact assessments for some deployers.

First submission of CCPA risk-assessment attestations and summaries to the California Privacy Protection Agency (covering assessments conducted in 2026–2027), then annually.

High-risk obligations for AI embedded in regulated products (Annex I) take effect.

Under the current OMB memoranda, federal agencies must designate a Chief AI Officer, maintain a public AI use-case inventory, and apply minimum risk-management practices to high-impact AI (deadlines already passed). Section 508 accessibility reaches agency AI interfaces such as chatbots and kiosks.

AI sold to federal agencies now carries required contract terms: no training on non-public agency data without consent, anti-lock-in and testing-access rights, and (for large language models) transparency terms that are material to payment. A defense-contract prohibition bars specific foreign AI models in contract performance.

The ADA Title II web rule requires state and local government web content and mobile apps, including AI-driven features, to meet WCAG 2.1 AA. Large entities comply by April 26, 2027; smaller entities and special districts by April 26, 2028.