Colorado AI Act vs Texas TRAIGA: Two Opposite Models for US State AI Law

Two states have shaped the US debate on AI regulation more than any others, and they started from opposite ends. Colorado passed the country's first comprehensive AI law in 2024, borrowing the risk-based architecture of the EU AI Act. Texas passed the Texas Responsible Artificial Intelligence Governance Act (TRAIGA) in 2025, deliberately rejecting that model in favour of a short list of banned practices, enforced only where there is intent.

The story has moved quickly since then. Colorado's original law, SB 24-205, never took effect. On 14 May 2026 it was repealed and replaced by SB 26-189, a narrower law on automated decision-making technology that applies from 1 January 2027. TRAIGA has been in force since 1 January 2026. Both now sit under federal pressure from Executive Order 14365 and the Department of Justice's AI Litigation Task Force.

Plenty of online coverage still describes Colorado's superseded 2024 law. This guide compares the two laws as they actually stand in November 2026: what each requires, who it covers, how it's enforced, and what a company operating in both states should do now.

The short answer

Colorado regulates how AI is used in important decisions about people. If automated decision-making technology materially influences whether someone gets a job, a loan, housing, insurance, education, health care or essential government services, the business must tell them, explain adverse outcomes, let them correct their data and, where commercially reasonable, offer human review.

Texas regulates what AI must never be built or used to do. TRAIGA bans a specific set of harmful practices, such as manipulating people towards self-harm or crime, intentional unlawful discrimination and generating child sexual abuse material, and adds disclosure duties mainly for government agencies and health care providers. Most private businesses face no process obligations at all, provided they don't cross the prohibited lines.

How Colorado got here: from SB 24-205 to SB 26-189

Colorado's original law was signed in May 2024 with an effective date of 1 February 2026. It imposed a duty of reasonable care to avoid algorithmic discrimination, risk management programmes, annual impact assessments and public summaries. Governor Polis signed it with reservations and asked lawmakers to revisit it.

They tried for two years. The 2025 regular session failed to agree on amendments. An August 2025 special session (SB 25B-004) only pushed the start date back to 30 June 2026. In April 2026, xAI challenged the law in federal court, the United States intervened in support, and on 27 April 2026 a stipulated court order paused enforcement. On 14 May 2026, Governor Polis signed SB 26-189, repealing the original framework and re-enacting a narrower one.

What SB 26-189 actually requires

The new law applies to covered ADMT: technology that processes personal data and produces outputs such as predictions, scores, rankings or classifications that materially influence a consequential decision. A consequential decision concerns access, eligibility, selection or compensation in seven domains: education, employment, residential real estate, financial or lending services, insurance, health care and essential government services. Incidental or clerical uses don't count, and neither do basic tools such as spreadsheets, calculators or chat tools not meant for consequential decisions.

The law also allocates liability. A developer is liable only when the deployer used the tool for its intended purpose, and contract clauses that indemnify a party for its own violations are void. Enforcement sits solely with the Colorado Attorney General under the Colorado Consumer Protection Act, with a 60-day cure period that doesn't apply to knowing or repeated violations and expires on 1 January 2030. The Attorney General must adopt implementing rules, and a formal rulemaking hearing was scheduled for 26 October 2026.

Texas TRAIGA: prohibitions, defences and a sandbox

TRAIGA also began as a much broader bill. The original 2024 draft, HB 1709, would have imposed Colorado-style duties on high-risk AI. The version signed by Governor Abbott on 22 June 2025, HB 149, was rewritten around a narrower principle: punish harmful intent, not the use of AI as such. It applies to anyone who develops or deploys AI in Texas, offers AI products or services used by Texans, or advertises AI in the state.

The prohibited practices

• Developing or deploying AI with the intent to manipulate people into self-harm, harming others or criminal activity
• Developing or deploying AI with the intent to unlawfully discriminate against a protected class. Disparate impact alone is not enough to show intent.
• Developing or deploying AI with the sole intent of infringing someone's constitutional rights
• Producing or distributing child sexual abuse material or unlawful sexually explicit deepfakes, or AI that imitates a child in sexual conversations
• Government social scoring, and government use of AI to identify people from biometric data without consent where that infringes their rights

Disclosure duties, but mainly for the public sector and health care

Government agencies must tell consumers when they are interacting with an AI system, clearly and without dark patterns. Health care providers must disclose AI use in a patient's treatment. For most private businesses, TRAIGA adds no notice, assessment or documentation duty. The obligation is not to cross the prohibited lines.

Built-in protections for business

• Affirmative defences for violations discovered through red-teaming, adversarial testing or the company's own review, and for substantial compliance with the NIST AI Risk Management Framework or another recognised standard
• A regulatory sandbox, run by the Department of Information Resources, letting approved participants test AI for up to 36 months without punitive action for waived laws, in exchange for quarterly reports
• A seven-member Texas AI Council that advises on policy and the sandbox but cannot issue binding rules
• Preemption of local ordinances on AI, so Texas cities cannot add their own AI rules

Enforcement is reserved to the Texas Attorney General, who must give written notice and a 60-day cure period before suing. The Attorney General was also required to publish an online complaint mechanism. Civil penalties are among the highest of any state AI law.

TRAIGA penalties range from $10,000–$12,000 (curable), $80,000–$200,000 (uncurable) and $2,000–$40,000 per day (continuing). Licensing agencies may add sanctions of up to $100,000 on the Attorney General's recommendation. Colorado figures reflect the Colorado Consumer Protection Act's general per-violation cap.

If you are mapping these state laws against your own AI programme, I share practical breakdowns of US state AI laws, the EU AI Act and ISO 42001 regularly on LinkedIn. You're welcome to connect with me there and tell me which state is causing your team the most questions.

Colorado vs Texas: side by side

Why these are "opposite models", and why they're converging

The philosophical gap is real. Colorado assumes harm can happen without anyone intending it, so it gives individuals procedural rights whenever an algorithm shapes a life-changing decision. Texas assumes most AI use is beneficial, so it intervenes only where someone intends a clearly defined harm, and it actively protects room to experiment through its sandbox and affirmative defences.

In practice, though, Colorado's 2026 rewrite moved it significantly towards Texas. Both laws now have no impact assessment mandate, Attorney General-only enforcement, 60-day cure periods and no private right of action. The remaining differences are consumer-facing transparency and adverse-decision rights, which Colorado keeps and Texas largely leaves out.

The federal factor: preemption pressure, but no preemption

On 11 December 2025, President Trump signed Executive Order 14365, which set a policy of a national AI framework and directed the Attorney General to create an AI Litigation Task Force to challenge state AI laws. The order singled out Colorado's AI law as an example, saying its algorithmic discrimination ban could force AI models to produce false results. The Department of Justice set up the task force on 9 January 2026.

The Colorado litigation shows the order's practical reach. xAI sued Colorado's Attorney General on 9 April 2026, and the United States intervened. The stipulated order of 27 April 2026 bars enforcement of SB 24-205 or "2026 replacement legislation" until 14 days after the court rules on a planned preliminary-injunction motion, due 28 days after final implementing rules are adopted. That wording could reach SB 26-189, so Colorado enforcement may start later than 1 January 2027.

How the two laws unfolded

• 17 May 2024

  Colorado SB 24-205 signed, with duties from 1 February 2026.

• 22 Jun 2025

  Texas TRAIGA (HB 149) signed into law.

• 28 Aug 2025

  Colorado special session delays SB 24-205 to 30 June 2026.

• 11 Dec 2025

  Executive Order 14365 names Colorado's AI law and orders a DOJ litigation task force.

• 1 Jan 2026

  Texas TRAIGA takes effect.

• 9 Jan 2026

  DOJ establishes the AI Litigation Task Force.

• 9 Apr 2026

  xAI sues to block Colorado's AI law; the United States later intervenes.

• 27 Apr 2026

  Stipulated court order pauses Colorado enforcement.

• 14 May 2026

  Colorado SB 26-189 signed, repealing and replacing SB 24-205.

• 1 Sep 2026

  Deadline for the Texas Attorney General's online TRAIGA complaint mechanism.

• 26 Oct 2026

  Colorado Attorney General's formal rulemaking hearing on SB 26-189 rules.

• 1 Jan 2027

  Colorado SB 26-189 applies; implementing rules due.

• 1 Jan 2030

  Colorado's 60-day cure right expires.

Which model wins for your business?

A 6-step plan to comply with both

1. Inventory AI by decision and intent

   List every AI system touching Colorado or Texas residents. Flag those that materially influence decisions in Colorado's seven domains, and those that could be misused for any TRAIGA-prohibited purpose.

2. Adopt the NIST AI RMF as your backbone

   Substantial compliance supports TRAIGA's affirmative defence and gives you the documentation Colorado deployers will ask for. ISO/IEC 42001 can serve the same role.

3. Build developer documentation once

   Write one standard pack covering intended uses, limitations, training data categories and human review instructions. It meets Colorado's developer duty and helps you defend intent in Texas.

4. Design consumer-facing notices and rights

   Prepare Colorado pre-use notices, 30-day adverse-decision explanations, data correction routes and human review processes. Add Texas health care and government disclosures where they apply.

5. Red-team for prohibited uses

   Test generative and conversational products against TRAIGA's prohibited categories, especially manipulation, sexual content and impersonation. Keep the records, because they support the affirmative defence.

6. Track rules, courts and Washington

   Watch the Colorado Attorney General's final rules, the xAI litigation, Texas complaint and enforcement activity, and any federal preemption bill. Review your programme each quarter.

Common mistakes to avoid

• Building Colorado impact assessments for a law that no longer requires them
• Assuming TRAIGA doesn't apply because you're not a Texas company
• Treating TRAIGA's intent standard as a free pass, without documented testing
• Assuming the federal executive order has already overridden state law
• Relying on indemnity clauses that Colorado now voids for a party's own violations

A prompt to map your obligations in both states

Paste in your company details to get a first-draft compliance map. Your counsel should review it before you act on it.

You are a US AI regulatory specialist familiar with Colorado
SB 26-189 (Automated Decision-Making Technology) and Texas HB 149
(TRAIGA).

Our organisation:
[developer, deployer or both; AI systems and what they do;
whether they influence decisions on employment, education,
housing, lending, insurance, health care or government services;
whether we serve Colorado and/or Texas residents; whether we are
a government entity, health care provider or contractor;
frameworks we follow (NIST AI RMF, ISO 42001)]

Produce:
1. Which of our AI systems are likely covered ADMT under
   SB 26-189, with reasons.
2. Which systems carry a risk under TRAIGA's prohibited
   practices, and the safeguards to document.
3. A table of obligations by state: notice, explanation,
   correction, human review, documentation, records, disclosure.
4. How to use NIST AI RMF or ISO 42001 evidence for TRAIGA's
   affirmative defence and Colorado's documentation duties.
5. Deadlines and pending events (Colorado rules, xAI litigation,
   federal preemption) that could change the plan.
6. A 90-day action plan.

Use only what I provide and mark uncertain points UNKNOWN.

Colorado asks how a decision about you was made. Texas asks whether anyone meant to harm you. The best US compliance programmes will be ready to answer both. — Kumail Mehdi

Frequently asked questions

Navigating AI compliance across Colorado, Texas and other states? Let's connect on LinkedIn. I'm always happy to compare notes on the US state AI patchwork.

Sources

• Colorado General Assembly — SB 26-189
• Seyfarth — Colorado enacts artificial intelligence replacement law
• Finnegan — Overview of the new SB 26-189 framework
• Consumer Finance Monitor — Unpacking SB 26-189
• DCI — What SB 26-189 means for employers (rulemaking timeline)
• Texas Legislature — HB 149 (TRAIGA)
• Baker Botts — Texas enacts Responsible AI Governance Act
• Ropes & Gray — Navigating TRAIGA
• Latham & Watkins — Texas signs Responsible AI Governance Act
• Vorp Labs — Texas TRAIGA penalties and deadlines
• Secure Privacy — Executive Order 14365 and state law preemption
• AI Laws by State — DOJ task force and the xAI v. Colorado order
• CASRAI — Federal AI preemption fight: where it stands