State AI Laws: A New Era for Data Protection & Regulation

In Colorado, lawmakers initially proposed a sweeping artificial intelligence bill with mandatory risk assessments and a broad 'duty of care' for AI developers. This ambitious framework aimed to establish comprehensive safeguards for AI technology regulation. However, the legislation was significantly scaled back before its enactment in 2026, shifting towards a more limited, transparency-focused regime, a clear retreat from earlier, more robust consumer protection measures.

U.S. states are rapidly enacting AI legislation, but their approaches are highly divergent and often retreat from comprehensive risk-based frameworks, creating a fragmented regulatory environment. This tension between the urgent need for AI governance and the varied state-level responses complicates the future of data protection and legislative trends.

The current trend suggests a complex, state-by-state regulatory maze for AI, where specific, narrow harms are addressed. A unified, robust framework for broader AI risks remains elusive, likely leading to compliance challenges for businesses and inconsistent protections for citizens.

The Evolving Landscape of State AI Laws

The Colorado AI Act underwent substantial revisions, moving from its initial broad risk-based framework to a more limited, transparency-focused regime, according to Wiley Rein. This revised approach notably removed mandatory risk management programs, annual impact assessments, and broad 'duty of care' obligations from the original 2024 proposal, according to Wiley Rein. The scaling back of the Colorado AI Act reveals a systemic reluctance among states to impose broad accountability on AI developers or empower individuals with extensive redress mechanisms.

Similarly, Texas's TRAIGA 2.0 legislation introduces specific carve-outs in areas typically subject to stringent privacy protections. TRAIGA 2.0 exempts the training and development of AI models processing biometric data from Texas's existing consent-and-retention requirements, albeit with certain limits, as reported by Duane Morris LLP. TRAIGA 2.0's exemption for training and development of AI models processing biometric data effectively creates a loophole for AI where privacy is paramount, potentially weakening overall data protection under the guise of AI regulation.

Legislation	Enforcement Authority	Individual Recourse	Scope of Accountability
Colorado Revised AI Act	State Attorney General	Limited	Transparency-focused, specific harm prohibitions
TRAIGA 2.0 (Texas)	Texas Attorney General (Exclusive)	None (No individual lawsuits)	Unlawful to develop/deploy AI with intent to discriminate; unequal outcomes alone do not establish violation

While global leaders align on a shared vocabulary for frontier AI risks, U.S. states largely focus on narrower, consumer-facing applications. The alignment of global leaders on a shared vocabulary for frontier AI risks, while U.S. states largely focus on narrower, consumer-facing applications, reveals a strategic disconnect between high-level policy discussions and on-the-ground legislative action. The stark contrast between the global call for 'frontier-AI risk' management and the U.S. state-level focus on specific, often reactive, harms, such as Arizona's synthetic depiction bill, suggests a dangerous gap where systemic AI risks are being overlooked in favor of addressing symptoms rather than root causes.