US AI Laws in 2026 for Security Teams: SB 53, the RAISE Act, Colorado, Texas and the Federal Challenge

If you read only headlines, US AI law in 2026 looked like chaos: a state law delayed, sued and replaced, another amended before it started, and a federal order aimed at all of them. For a security team the picture is simpler once each law's status and scope are clear.

The four laws and the federal position

California SB 53, the Transparency in Frontier Artificial Intelligence Act, has applied since 1 January 2026 to developers of foundation models trained with more than 10^26 operations. All of them publish transparency reports for new frontier models and report critical safety incidents to the state's Office of Emergency Services within 15 days, or 24 hours when there is imminent risk of death or serious injury. Large developers, with more than $500 million in revenue, also publish a frontier AI framework: how they assess and mitigate catastrophic risks, use third-party assessments, govern decisions and secure unreleased model weights. Whistleblowers are protected, and the Attorney General can seek up to $1 million per violation.

New York's RAISE Act was signed in December 2025, amended in March 2026 to look much more like SB 53, and takes effect on 1 January 2027. Notable differences: incidents go to a new office within the state's financial regulator within 72 hours, and penalties are up to $1 million for a first violation and $3 million after that, far lower than the original bill's figures.

Colorado's 2024 AI Act, which would have required impact assessments for high-risk AI decisions, never took effect. Its start was delayed to June 2026, it was challenged in federal court with the Justice Department joining, enforcement was paused by a stipulated order in April 2026, and in May 2026 the state replaced it with a narrower law on automated decision-making. From 1 January 2027 that law requires notice, explanations of adverse decisions, data correction and human review, without the original impact assessments.

Texas TRAIGA has applied since 1 January 2026. It prohibits developing or deploying AI with intent to cause certain harms, adds disclosure duties for government agencies and health-care providers, gives the Attorney General exclusive enforcement with a 60-day cure period, and offers a safe harbour for problems found through testing aligned with NIST guidance.

Federally, Executive Order 14365 of December 2025 set up a Justice Department task force to challenge state AI laws and called for a national framework. An executive order cannot preempt state law by itself, and Congress had not passed preemption by November 2026, so state laws in force still apply.

What this means for a security team

• If you train frontier models, SB 53 makes weight security, catastrophic-risk evaluation and incident detection public commitments with deadlines. Your published framework has to stay true as models change.
• If you deploy AI in decisions about people, Colorado's 2027 duties need logging and explanations for automated decisions, and sector regulators apply existing law.
• Everyone benefits from evidence of testing aligned with NIST's AI Risk Management Framework, which Texas explicitly rewards.

Build one programme to the strictest shared version of each duty: an inventory of models and uses, a risk framework, the shortest incident-reporting clock, whistleblower channels and a named owner who tracks changes, because these laws changed several times in a single year.

Go deeper

The full scored answer with a what-if ladder is US AI law in 2026. For practical security controls, see AI security baselines, and for the European side, EU AI Act dates and penalties.