State AI law after the 99-to-1 vote: build for notice, explanation and human review
The Senate’s removal of a federal moratorium left AI compliance to the states. The durable core across their laws was notice, explanation, human review and records. Programs that built that core first could absorb shifting assessment and disclosure rules.
Looking Back revisits one week at a time, from January 2020 to today, and asks what it meant for the banks, health systems and public agencies we serve. The series was written in 2026, with the benefit of hindsight, and each article says which week it looks back on.
The week
On July 1, 2025, the Senate voted 99 to 1 to strip a moratorium on enforcing state artificial intelligence laws from the budget reconciliation bill. The House-passed version, approved in May, would have barred states from enforcing AI regulations for ten years. Senate drafters had tied a version of the provision to federal broadband funding, and a late compromise to shorten it to five years with carve-outs collapsed. A bipartisan group of state attorneys general, governors and legislators had opposed it. The Senate passed the bill without the moratorium later that day. The House passed it on July 3, and the President signed it on July 4. States remained free to enforce existing AI laws and pass new ones.
For much of 2025, many compliance teams hoped federal preemption would spare them a growing body of state AI law. The Senate vote ended that hope for the near term. It created no new obligations. It left existing ones in place and signaled more would follow. The practical question for banks, health systems and agencies was how to build an AI compliance program on moving ground. Our answer starts by sorting state AI laws into three types: laws on consequential decisions, laws on specific uses or sectors, and laws on transparency and disclosure. Within each type, some obligations recur in almost every version and others change from bill to bill. The program should build the recurring core first.
Laws on consequential decisions
The first type regulates AI used to make, or substantially influence, important decisions about people: lending, employment, housing, insurance, education and health care. Colorado’s AI Act, enacted in 2024, was the leading example in mid-2025. It placed duties on developers and deployers of high-risk systems, including risk management programs, impact assessments, consumer notices, a route to appeal adverse decisions and a duty of reasonable care to avoid algorithmic discrimination.
Those duties fall into two layers. The first is procedural and faces the consumer: tell people when AI is involved in a decision about them, explain adverse outcomes, let them correct their data and offer human review. That layer echoes long-standing rules. Lenders already give adverse action notices under the Equal Credit Opportunity Act and the Fair Credit Reporting Act. Health systems already run appeals and clinical review. The second layer is programmatic: risk management frameworks, annual impact assessments and attorney general notification. This layer is where legislatures and industry argue, and where drafts change most.
A bank or health system can build the procedural layer once and reuse it across states. That means a register of decision points where AI materially influences an outcome, standard notice and explanation templates, a human review queue with service levels, and records retained long enough to answer a complaint. Programmatic duties can then be added state by state as they settle. Organizations should check with counsel on exemptions for entities already supervised under federal law, because they vary by statute.
The procedural layer also produces evidence that regulators of every kind understand. Useful measures include the share of adverse decisions with a completed explanation, the time taken to complete a human review, and the rate at which reviews overturn the original outcome. A high overturn rate is an early sign that a model needs attention, well before any statute requires a formal assessment. Model risk and fair lending teams can feed those measures into existing reporting instead of building a separate AI dashboard.
Laws on specific uses or sectors
The second type targets particular applications. Examples include New York City’s audit and notice rules for automated employment decision tools. Others are Colorado’s 2021 law on insurers’ use of external consumer data and algorithms. Illinois has rules on AI analysis of video job interviews, and California has a requirement that health care providers disclose generative AI use in certain patient communications. Many state insurance regulators have also adopted guidance based on the NAIC’s 2023 model bulletin on insurers’ use of AI.
These laws are narrow but concrete. They require specific notices, bias audits or human review at defined points. The control that scales is a use case inventory tagged by function, sector and jurisdiction. When a new law targets AI in hiring or in patient messaging, the compliance team can query the inventory and find every affected use within a day. Without it, each new law starts with a survey of business units, which takes weeks and misses shadow deployments bought on a corporate card.
The inventory has a cost. Someone must keep it current as vendors add AI features to existing products, which happens through routine software updates. Procurement is the natural control point. A standard contract clause requiring vendors to disclose new AI functionality keeps the inventory honest without a separate discovery exercise.
Laws on transparency and disclosure
The third type requires organizations to tell people when they are dealing with AI, to label synthetic content or, for developers of large models, to publish information about safety practices. Utah’s disclosure rules for generative AI, which apply with particular force to regulated occupations, and state laws on deepfakes in political advertising fall here.
For most banks, health systems and agencies, these laws mainly touch customer-facing chatbots, virtual assistants and generated letters. The controls sit at product level: standard disclosure language, logs of AI-generated content and a pre-launch review against current state requirements. The logs serve a second purpose. When a customer disputes what an assistant told them, the organization needs the transcript. Building logging once, for all customer-facing AI, costs less than retrofitting it for each new law.
Public agencies have one more layer. Several states have passed laws requiring their own agencies to inventory AI systems and assess them before use. An agency’s program should fold those duties into the same inventory, so that one record supports both public reporting and internal governance.
With hindsight
States kept legislating. Texas enacted its Responsible AI Governance Act in June 2025, effective January 2026, and California enacted a frontier AI transparency law in September 2025. In December 2025, an executive order directed the Justice Department to form a task force to challenge state AI laws it considered burdensome, and asked Commerce to evaluate them.
Colorado shows why the procedural core was the safer investment. In August 2025, lawmakers delayed the AI Act to June 30, 2026. In May 2026, the legislature repealed and replaced it with a narrower law, signed on May 14 and effective January 1, 2027. The replacement dropped the impact assessment and risk management program requirements. It kept consumer notice, explanation of adverse decisions, data correction, human review and record retention. Organizations that had built those capabilities lost little. Those that had invested mainly in assessment paperwork had to rework it. Preemption litigation and federal legislation remain open questions to follow with counsel.