6 min read
Have you seen a headline about a new state AI law and quietly wondered whether you are now breaking it every time you ask ChatGPT to draft an email? You are not alone. In the U.S. Chamber of Commerce’s 2026 Empowering Small Business report, published October 2, six in ten small businesses said they worry about rising litigation and compliance costs from a patchwork of state privacy and AI laws.
That worry is understandable, and for most solo owners it is also bigger than the actual risk. This guide starts from zero: what these laws are, which ones exist today, what they usually target, and the small set of habits that keep a one-person business comfortably on the right side of them. It is a plain-English starting point, not legal advice. If your business makes decisions about people (hiring, lending, housing, insurance, health care), talk to a lawyer in your state.
What an “AI law” usually means
When politicians say “AI law,” they rarely mean rules about writing blog posts with a chatbot. Most state laws focus on a narrower idea called consequential decisions, meaning decisions that seriously affect someone’s life, such as whether they get a job, an apartment, a loan or medical care.
The worry behind these laws is automated decision-making, which simply means software that decides, or heavily influences a decision, about a person with little or no human review. If an AI tool screens out job applicants or sets someone’s insurance price, the law wants a human in the loop, a way to explain the result, and protection against unfair bias.
If you use AI to write captions, summarize meetings, draft invoices or brainstorm product names, you are almost certainly outside that target zone.
The three states everyone is talking about
Colorado: rewritten, now starting January 1, 2027
Colorado passed the first broad state AI law in 2024, then delayed it twice. In May 2026 the state repealed and replaced it with a narrower version. As Goodwin’s summary of the new law explains, it now focuses on automated decision-making technology that processes personal data and materially influences consequential decisions. It takes effect January 1, 2027, the state attorney general enforces it, and individuals cannot sue under it directly.
Texas: in force since January 2026, but narrow
The Texas Responsible Artificial Intelligence Governance Act (known as TRAIGA) took effect January 1, 2026. The version that passed was heavily pared back. According to K&L Gates’ analysis, most of its obligations fall on government agencies, and the private-sector rules target a short list of clearly harmful uses, such as AI built to manipulate people into self-harm or to unlawfully discriminate. Only the attorney general can enforce it, and businesses get a 60-day notice to fix a problem before penalties.
California: a stack of narrower rules
California has several AI-related laws with staggered dates. Most target the companies that build large AI models and platforms, not the people who use them. The rule most relevant to small businesses is the state privacy agency’s regulation on automated decision-making, which applies only if your business is already large enough to be covered by California’s consumer privacy law. Most solo businesses are well below those thresholds.
A quick self-check: are you in the target zone?
Answer these five questions honestly:
- Do you use AI to decide who to hire, or to rank or reject applicants?
- Do you use AI to approve or deny credit, leases, insurance or payment plans?
- Do you use AI to make health, legal or financial recommendations to clients without reviewing them yourself?
- Does an AI tool set different prices or terms for different people based on their personal data?
- Do you let an AI chatbot talk to customers without telling them it is a bot?
If every answer is no, the current state AI laws are very unlikely to require anything new from you. If any answer is yes, that specific use deserves a closer look, and probably a conversation with an attorney before January.
Five habits that cover most of the risk
Even if no law applies to you today, these habits are cheap, build trust, and line up with where nearly every proposal is heading.
1. Keep a human on every decision about a person
Let AI summarize resumes or draft a rental reply, but make the call yourself. “AI suggested, I decided” is the single most protective sentence in this whole area.
2. Tell people when they are talking to a bot
If your website chat or phone line uses an AI assistant, say so up front. A one-line disclosure costs nothing. We argued for broader openness in our piece on telling clients you use AI.
3. Keep personal data out of tools that do not need it
Before pasting anything into an AI assistant, strip out details the task does not require, such as full names, addresses, account numbers or health information. Privacy laws, not AI laws, are still where most small businesses get into trouble.
4. Write down what you use, in one paragraph
A short note listing your AI tools and what you use each for is enough. If a client, platform or regulator ever asks, you will have a clear answer. It also makes your yearly tool review easier, which we built into our one-page 2027 AI plan.
5. Read your tools’ terms once a year
Ownership and data-use terms change. Our myth-busting guide on who owns AI content covers the questions worth checking.
Where this is all heading
Expect more states to propose AI rules in 2027, and expect most of them to look like Colorado’s new version: focused on high-stakes decisions about people, enforced by attorneys general, and lighter on everyday productivity use. There is also ongoing debate in Washington about whether a federal standard should override the state patchwork. Nothing is settled, so the smartest move for a solo owner is not to track every bill. It is to make the five habits above part of how you work, so that whatever passes, you are already most of the way there.
Your first step this week
Take ten minutes and run the five-question self-check above. Write your answers in the same note where you list your AI tools. If you answered no five times, you can stop worrying and get back to work. If you answered yes even once, you now know exactly which use to bring to a professional, which is a far better position than a vague sense of dread.
Which of the five questions surprised you most? Share it in the comments, and we will cover the most common one in more depth.
