What four state AI laws actually reach

Dario Amodei, the head of Anthropic, has asked the AI industry to slow down, and on 12 September the head of OpenAI agreed with him.¹ Senate negotiators are debating a bill that would require the most advanced AI developers to take reasonable precautions, and would block states from enforcing their own laws on certain model risks.² The states did not wait for any of this. California, New York and Colorado have passed AI statutes, and last December the President ordered the Commerce Department to publish a list of the state laws it considers onerous. The list was due on 11 March 2026. On 17 September, 190 days after the deadline, I could not find it.³

I build AI systems for a living, so I did the reading that list was supposed to do. I took four state laws and tested each against one company. The company is invented: a small American shop that fine-tunes open-weight models it did not train and serves them to business customers through an API. Some of those customers are in California, Colorado and New York, and the shop’s computing for any one model is far below the level the frontier laws use.

What follows is a reading of statutory text. It does not say whether any law is constitutional or whether any real company is covered, and it is not legal advice. My opinion comes at the end and is marked as opinion.

The case for the states

This section is the states’ argument, put as strongly as I can put it.

Their first argument is about power. The order does not displace any state law by itself. Among other things it tells federal agencies to list laws, sue over them and ask Congress for a statute, and I found no statute Congress has passed that preempts state AI law.³ A ten-year moratorium on state AI enforcement passed the House in 2025, and the Senate struck its version 99 to 1.⁴ Twenty-three attorneys general have told the FCC it has no authority to preempt state AI laws, and attorneys general from 21 jurisdictions have asked the FTC not to adopt its proposed statement on the subject.⁵

Their second argument is about harm, and each of the four laws answers a specific one. Colorado’s is written for automated decisions about hiring, housing and lending. AB 2013 asks developers whether their training sets contain copyrighted work and personal information. SB 53 and the RAISE Act are written for catastrophic misuse. The evidence legislatures hear can be grim. When Minnesota banned AI “nudification” tools this year, its legislature was given a study of one social media site’s image tool. In the tool’s first 11 days, users made about 3 million photorealistic sexualized images, and roughly 23,000 of those were of children. The Minnesota Senate passed the bill unanimously.⁶

Their third argument is that these two frontier laws ask for little. They require the largest developers to publish a safety framework, follow it and report serious incidents. The civil penalty is capped at $1 million per violation in California, and only the Attorney General can seek it.⁷ Illinois passed a third frontier law on 6 July 2026 that adds mandatory outside audits. I have not tested it here.⁸

Their fourth argument is the record in court, where no court has yet blocked any of these laws. One company, xAI, has sued three states over their AI laws. It asked two courts for a preliminary injunction and lost both times. The California court is the only one that reached the merits. It found that AB 2013 “likely constitutes a content-based speech regulation” and that xAI had shown “a distinct possibility of prevailing” on its First Amendment claim, but had not yet shown a likelihood of success.⁹ The Minnesota court found that xAI had waited too long and had shown no irreparable harm.⁶ In Colorado the court entered an agreed order and has decided no contested question.¹⁰ The United States has taken part in two of these cases. It intervened in Colorado and filed a statement of interest in Minnesota, both times on xAI’s side. I found no case it has filed on its own against a state AI law.¹¹

Two laws written around catastrophe

California’s SB 53 and New York’s RAISE Act share a definition. A “catastrophic risk” is a foreseeable and material risk that a frontier model will materially contribute to “the death of, or serious injury to, more than 50 people” or to more than $1 billion in property damage, in a single incident. The incident has to involve expert-level help with a chemical, biological, radiological or nuclear weapon, a cyberattack or serious crime carried out with no meaningful human oversight, or a model “evading the control of its frontier developer or user.”¹²

Both laws apply to a “frontier developer”, meaning a person who trains a model with more than 10²⁶ computing operations. The heavier duties fall on a “large frontier developer”, one whose group revenue passed $500 million in the previous year. A large developer must publish a safety framework, review it every year and send the state summaries of any assessment of catastrophic risk from its own internal use of its models. Any frontier developer must publish a transparency report when it deploys a new or substantially modified frontier model, and must report a critical safety incident to the state within 15 days in California and 72 hours in New York.¹³ California’s law took effect on 1 January 2026. New York’s takes effect on 1 January 2027.¹⁴

The penalty sections are narrower than the duties. In both states the civil penalty names only a large frontier developer. It runs up to $1 million per violation in California, and in New York up to $1 million for a first violation and $3 million after that. A large developer is also liable if it “fails to comply with its own frontier AI framework”, so these laws do hold a lab to the safety plan it publishes. Both laws bar false or misleading statements about catastrophic risk, and California protects employees who report it and lets them sue.⁷

The small shop’s own computing is far below 10²⁶ operations, so on this reading its own training leaves it outside both laws. One question is open, and neither text settles it. Both statutes say a model’s computing total “shall include” the original training run and “any subsequent fine-tuning” that “the developer applies to a preceding foundation model.” Read one way, that sentence describes the model, and a fine-tune of a very large base model is itself a frontier model. Read the other way, the definition of “frontier developer” counts only the computing power “the person has used.” California has told its Department of Technology to recommend changes to these definitions by 1 January 2027, and to weigh whether a person can tell in advance that the law covers them.¹⁵

New York adds two things California lacks. Its law applies to frontier models “developed, deployed, or operating in whole or in part in New York state.” A large frontier developer must also file a disclosure statement naming its significant owners, and pay an assessment, before it operates there.¹⁶

The version of New York’s law signed in December 2025 used a $100 million compute-cost test and penalties of $10 million and $30 million. A chapter amendment signed on 27 March 2026 repealed that article, put the current one in its place and moved the start date to 1 January 2027. Anyone quoting the larger figures is quoting repealed text.¹⁷

The law that can reach a small builder

California’s AB 2013 is a different kind of law, and it has nothing to do with catastrophe. It requires the developer of a generative AI system to post documentation about its training data. The documentation covers twelve listed topics, among them where the datasets came from, whether they contain copyrighted material or personal information, and whether they were bought or licensed.¹⁸

It names what the small shop does. A “developer” includes anyone who “substantially modifies” an AI system “for use by members of the public”, and the statute defines “substantially modifies” to include “the results of retraining or fine tuning.” A second definition says training “includes testing, validating, or fine tuning.” The law has no compute floor, no revenue floor and no small-business exemption. The duty has applied since 1 January 2026 to any covered system “made publicly available to Californians.”¹⁸

Two things in the text are unclear for a shop like this one. It is unclear whether an API sold to a limited set of business customers is a service “for use by members of the public.” It is also unclear how much a fine-tuner has to document. The duty covers “the data used by the developer to train” the system, which a fine-tuner can read as its own data only. The listed topics, though, describe “the datasets used in the development” of the system. For a fine-tuned model most of that is the base model’s training set, which the upstream publisher may never have disclosed. The statute gives no agency the power to write rules that would settle either question.¹⁸

The statute also names no penalty, no enforcing agency and no private right of action. That does not make it unenforceable. The Assembly committee that analyzed the bill expected enforcement “on the basis of California’s Unfair Competition Law”, and the federal court hearing xAI’s challenge noted that the Attorney General “is generally charged with enforcing California’s laws.”¹⁹ AB 2013 is the only one of the four that I found before a federal appeals court. The Ninth Circuit has the case on its calendar for 18 November 2026.²⁰

Colorado has already rewritten its law

Colorado is the only state the executive order names. The order says “a new Colorado law banning ‘algorithmic discrimination’ may even force AI models to produce false results.”³ That law, SB 24-205, put a duty of reasonable care on developers and deployers of high-risk AI systems, and required deployers to run risk-management programs and impact assessments.²¹

On 14 May 2026 the Governor signed SB 26-189, which repeals that law and replaces it on 1 January 2027. The replacement drops the duty of care, the risk-management program and the impact assessment.²² Until that date the original text is still in Colorado’s statutes, and by its own terms its duties have applied since 30 June 2026. The court in xAI’s case entered an agreed order on 27 April 2026. Under it the Attorney General may not start enforcement, or an investigation, over any violation that occurs up to 14 days after the court rules on a preliminary injunction motion. The order does not say it is limited to xAI, and xAI has not filed the motion.²³

The new law covers automated decision-making technology that is “used to materially influence a consequential decision” about a person in areas such as employment, housing, lending, insurance, health care and education. Deployers must give notice, explain an adverse outcome within 30 days and offer human review. Developers must give deployers documentation. Only the Attorney General can enforce those duties, as a deceptive trade practice, with penalties of up to $20,000 per violation and $50,000 where the consumer is 60 or older.²⁴

For the small shop the text is more specific than California’s. The words “fine-tune” and “retrain” appear nowhere in the act. A developer includes a person who “intentionally and substantially modifies” a system “such that it becomes a covered ADMT”, and the test is a change in the system’s “intended, documented, advertised, configured, or contracted use.” The developer’s documentation duty applies only where the system “was marketed, advertised, configured, contracted, sold, or licensed to be used to materially influence a consequential decision.” On that text the documentation duty does not attach to a general-purpose API sold for ordinary business use, and a customer’s unexpected use does not by itself bring it into play. The act still asks more of a shop that learns of such use, and its exclusion for chatbots depends on an acceptable use policy that forbids it. The Attorney General proposed implementing rules on 11 August, and comments run to 26 October, so this reading may change.²⁵

What Washington has not done

The order gave Commerce 90 days to “publish an evaluation of existing State AI laws that identifies onerous laws.” At a minimum the evaluation must identify laws that “require AI models to alter their truthful outputs”, or that “may compel AI developers or deployers to disclose or report information in a manner that would violate the First Amendment.”³

I could not find that evaluation. A search of the Federal Register on 17 September returned 21 Commerce documents that mention artificial intelligence since the order was signed, and none is a review of state laws. Searches of the Commerce and NTIA websites found nothing either. The order says “publish” and does not say where, so a posting I missed is possible.²⁶

The order set the same 90-day deadline for a second step. States “with onerous AI laws identified pursuant to section 4” are to lose certain broadband funds, under a notice NTIA was told to issue. I found no such notice, and NTIA’s notice of 3 September does not mention AI at all. A third step is timed from the list itself. The FCC was told to open a proceeding on a federal disclosure standard within 90 days of the list’s publication, so that clock has not started.²⁷

Washington has done other things. The Justice Department set up its litigation task force on time and has taken part in the two cases above. The White House sent Congress recommendations in March that ask it to “preempt state AI laws that impose undue burdens.” The FTC published a policy statement on 7 July 2026, as a proposal, and as of today it has not been made final.²⁸

On my reading of the text, three of the four laws say nothing about what a model outputs. Colorado’s is the only state law the FTC’s proposal names. The proposal says the revised law makes AI companies liable “for discriminatory outcomes caused by their customers’ use of their products.” Colorado’s text limits that liability to uses “intended, documented, marketed, advertised, configured, or contracted for by the developer.”²⁹ All four laws compel disclosure of some kind. In the xAI cases no court has yet granted relief on that theory.

Congress has not acted either. A House bill introduced in July, the FRONTIER Act, would bar states from imposing “new substantive obligations on artificial intelligence developers” in three areas tied to catastrophic risk: risk transparency, third-party auditing and incident reporting. It has not moved since it was referred to committee. On 16 September the House cancelled its remaining votes until after the midterm elections, and the Senate bill has not been introduced.³⁰

What could change this picture

California’s Governor has until 30 September to act on this year’s bills. As of 17 September no bill amending SB 53 or AB 2013 had reached his desk. Two pending bills with similar section numbers amend a different chapter, the AI Transparency Act.³¹ Colorado’s rules are still in draft. xAI has asked the Eighth Circuit for an emergency injunction against Minnesota’s law, and the Ninth Circuit has the AB 2013 case on its 18 November calendar.³² I will correct this piece in public if any of it moves.

My view

Everything above is evidence. This part is opinion.

Two of these four laws were written around one fear: a single incident in which a frontier model helps kill or injure more than 50 people, by way of a weapon, an unsupervised attack or an escape from its developer’s control. Written into statute, that fear became a duty to publish a safety plan, keep to it, tell the truth about it and report incidents, with penalties for the few companies above $500 million in revenue. In California and New York the testing, the containment and the fixes are still done by the labs, on the systems they build. Illinois has gone further and ordered outside audits.⁸ The law that can reach a small builder is about paperwork and has nothing to do with catastrophe. The federal answer so far is two court filings, a proposed FTC statement, a request to Congress and a list I could not find.

I think fear is the wrong place to start. Stop AI doomerism. Acceleration is the only way to solve the problem, and the problem has two parts.

One part is AI risk itself. We find out what a model can do by building it and testing it. July’s break-out at OpenAI happened during an evaluation that was run to find out what the models could do.³³ One man’s rogue agent is another man’s poor sandbox. OpenAI’s own account is harder on the models than that line is. It says the models “took actions that were misaligned with the goals of their assigned tasks”, and the company paused reinforcement learning training on its newest models in response.³³ I still read the incident as a reason to build stronger containment, and the people able to build it are the people working at the frontier. I have seen no evidence that a slower frontier is a safer one, and a cap rewards whoever ignores it.

The other part is America falling behind. China will not slow its development because we say so. The most prominent advocate of slowing down concedes part of this. Amodei writes that global pacing “will be much harder to achieve.” He also writes that if the United States restrains itself “in the belief that China will do the same, and then China defects”, the result could be Chinese dominance. His answer is to pace inside the democracies now, starting with outside evaluators inside the labs, and to use export controls to keep the lead over China wide while doing it.³⁴ Mine is to keep building.

His case deserves its strongest form. He argues that AI is now helping to build the next generation of AI, and that, left unchecked, this “could outrun our ability to understand and control these systems.” He argues that an extra year or two spent on alignment could greatly reduce the risk, and the OpenAI incident is his second reason.³⁴ Where pacing means outside evaluators with real access, better containment and more time on alignment before release, it is responsible development and I am for it. Where it means holding capability or capacity down on purpose, I am against it. Rules should follow evidence, such as incident reports and containment standards for dangerous tests. They should not follow a probability nobody can check.

I will change my mind if someone shows that a slower frontier is a safer one.

Notes

1. Dario Amodei, “We Must Pace the Frontier.” Source 2. The 12 September date and Sam Altman’s agreement are reported by CNBC, Source 3, which is secondary reporting. ↩

2. Reuters, 11 and 14 September 2026. Sources 4 and 5. Secondary reporting. No bill text is public. ↩

3. Executive Order 14365, sections 1, 3, 4 and 8. Source 1. Ninety days from 11 December 2025 is 11 March 2026, and 17 September is 190 days after that. ↩ ↩² ↩³ ↩⁴

4. H.R. 1, section 43201(c), as engrossed in the House, and Senate roll call vote No. 363 of 1 July 2025, which struck the AI section of the Senate substitute. Sources 33 and 6. ↩

5. Multistate reply comments to the FCC, 17 December 2025, and multistate comment FTC-2026-0859-0258. Sources 34 and 27. The FTC letter lists 21 jurisdictions; Regulations.gov titles it “20 Signatures.” ↩

6. X.AI LLC v. Ellison, order of 4 September 2026, at 4, 5 and 8 to 11. Source 7. The court describes the legislative record; I did not open the underlying study. ↩ ↩²

7. Cal. Bus. & Prof. Code sections 22757.12(e) and 22757.15; Cal. Lab. Code sections 1107 to 1107.2; N.Y. Gen. Bus. Law sections 1421(4) and 1427. Sources 8 and 10. ↩ ↩²

8. Illinois S.B. 315, Public Act 104-0538, approved 6 July 2026 and effective 1 January 2027, and the Governor’s release of the same day. Sources 35 and 36. I did not open the bill text. ↩ ↩²

9. X.AI LLC v. Bonta, order of 4 March 2026, at 11 and 12. Source 16. ↩

10. X. AI LLC v. Weiser, ECF Nos. 16 and 24. Source 21. ECF No. 16 granted the United States’ unopposed motion to intervene. ↩

11. Complaint in intervention, Weiser, ECF No. 17 (24 April 2026), and Statement of Interest, Ellison, ECF No. 42 (18 August 2026). Sources 21 and 23. “I found no case” is a negative search result. ↩

12. Cal. Bus. & Prof. Code section 22757.11(c)(1); N.Y. Gen. Bus. Law section 1420(3). Sources 8 and 10. New York spells out “fifty.” ↩

13. Cal. Bus. & Prof. Code sections 22757.11(h) to (j), 22757.12 and 22757.13(c); N.Y. Gen. Bus. Law sections 1420 to 1422. Sources 8 and 10. A separate 24-hour disclosure to a public safety authority applies where there is imminent risk of death or serious injury. ↩

14. S.B. 53, Stats. 2025, ch. 138; N.Y. Gen. Bus. Law art. 44-B. Sources 9 and 10. ↩

15. Cal. Bus. & Prof. Code sections 22757.11(h), (i)(2) and 22757.14; N.Y. Gen. Bus. Law section 1420(8) and (9). Sources 8 and 10. ↩

16. N.Y. Gen. Bus. Law sections 1425 and 1428. Source 10. ↩

17. L. 2025, ch. 699, and L. 2026, ch. 96. Sources 12 and 11. ↩

18. Cal. Civ. Code sections 3110 and 3111. Sources 13 and 14. ↩ ↩² ↩³

19. Assembly Committee on Privacy and Consumer Protection analysis, and X.AI LLC v. Bonta, order at 2. Sources 15 and 16. ↩

20. X.AI LLC v. Bonta, No. 26-1591 (9th Cir.), ECF No. 51. Source 17. The notice says the panel may decide the case on the briefs. ↩

21. Colo. S.B. 24-205. Source 20. ↩

22. Colo. S.B. 26-189, ch. 131, sections 1 and 5. Source 18. ↩

23. Colorado Revised Statutes 2026, title 6, part 17 (effective until 1 January 2027), and Weiser, ECF Nos. 22 and 24. Sources 19 and 21. ↩

24. C.R.S. sections 6-1-1701 to 6-1-1706 as reenacted, and C.R.S. section 6-1-112(1). Sources 18 and 19. ↩

25. C.R.S. sections 6-1-1701(2), (8), (12) and 6-1-1702(3), (5) as reenacted; Colorado Attorney General rulemaking page. Sources 18 and 22. ↩

26. Federal Register API search run on 17 September 2026. Source 24. ↩

27. Executive Order 14365, sections 5(a) and 6; NTIA notice of 3 September 2026. Sources 1 and 25. NTIA’s newsroom and publications listings sat behind a bot check and were not read. ↩

28. Attorney General’s memorandum of 9 January 2026; White House legislative recommendations, March 2026; FTC proposed policy statement, 91 Fed. Reg. 41638. Sources 37, 38 and 26. ↩

29. FTC proposed policy statement, sections I and IV, and C.R.S. section 6-1-1707(5) as reenacted. Sources 26 and 18. ↩

30. H.R. 9925, section 9(a) and (b), and The Washington Post, 16 September 2026 (secondary). Sources 28 and 29. The Senate bill is known only from the Reuters reports in Sources 4 and 5. ↩

31. California Senate legislative deadlines, and the status pages for S.B. 1000 and A.B. 2713. Sources 31, 32 and 39. ↩

32. X.AI LLC v. Ellison, No. 26-2806 (8th Cir.), motion filed 11 September 2026, and X.AI LLC v. Bonta, No. 26-1591 (9th Cir.). Sources 40 and 17. ↩

33. OpenAI, “The Hugging Face incident and the road ahead” (26 August 2026). Source 30. ↩ ↩²

34. Dario Amodei, “We Must Pace the Frontier.” Source 2. ↩ ↩²