An executive I advise recently asked her general counsel a reasonable question: “If our AI screening tool gets something wrong, what is our exposure?” The answer she got was honest and useless at the same time. “It depends on which state, which rules are finalized by then, and how a case that hasn’t been decided yet comes out.”
That is the current state of AI regulation. Not a void, a construction zone. The road exists but it is unfinished, and you are driving on it every day. There are no painted lines telling you where your lane divides, no speed limit signs, no signs telling you what’s coming, and no guardrails showing you where the edge is. And the one thing I can tell you with certainty is this: you cannot wait for the road to be finished before you drive on it. Your organization is already on it.
So let me walk the road with you. I’ll cover what is painted, posted, and missing. Then I’ll tell you what I think you should do about it. Because you can speed on an unfinished road with no posted speed limits and somehow still get a speeding ticket.
One note before we start. I am not an attorney, and nobody can keep track of all of this in real time. What follows is based on my experience as of the date of this post. Treat it as a map of the construction zone, not legal advice, and check with your counsel before you act on any of it.
No lines: the EU painted them, then moved the opening date. The EU AI Act remains the only comprehensive attempt to draw lanes on the road with risk tiers, prohibited uses, obligations for high-risk systems, transparency rules, and duties for general-purpose model providers. If you operate in Europe or sell into it, it is the reference point whether you like it or not. But in July 2026 the Digital Omnibus amended the Act and pushed the high-risk obligations (the Annex III categories: employment, credit, education, biometrics) from August 2026 to December 2027. Systems embedded in regulated products moved to August 2028. The stated reason was candid: the harmonized technical standards weren’t ready, and several member states hadn’t stood up their enforcement authorities.
Read that carefully. The most mature AI regulatory regime on the planet delayed its own centerpiece because the infrastructure to comply with it didn’t exist yet. The lines are painted. The road is closed for another sixteen months. And the parts that are NOT delayed (transparency obligations, general-purpose AI model requirements, the AI Office’s enforcement powers) are already in force. Lines on one lane, warning cones on the others.
Outside the EU, the designs don’t match. South Korea passed a comprehensive AI Basic Act. Japan chose a promotion-first law with no penalties. The UK has no AI statute at all and regulates through sector bodies. China requires labeling of generated content. Singapore published an agentic AI governance framework I’ve written about separately. Four roads, four engineering standards, none of them interoperable. A multinational is not complying with “AI regulation.” It is complying with five incompatible drawings of the same road. Sound like privacy regulation part 2?
No signs: the US states are posting them one at a time, and repainting the lines as they go. Here is where the construction zone gets interesting, because the signs are being written while you’re driving past them.
Colorado passed the first comprehensive US state AI law in 2024. It never took effect. In May 2026 the legislature repealed and re-enacted it as a narrower automated decision-making technology law paired with a chatbot safety act. The Attorney General filed draft rules in August, revised them in October, and holds the rulemaking hearing on October 26 with everything scheduled to take effect January 1, 2027. If you make consequential decisions about Colorado residents, you have roughly two months between final rules and live obligations.
California took a different lane entirely. Its AI Transparency Act has been operative since August 2026, and on September 30 the governor signed SB 1000, which removed the one-million-user threshold. Every publicly accessible generative AI system is now covered, not just the large ones. California is regulating disclosure and provenance, not decisions. That’s a different sign for a different stretch of road.
Texas and Illinois both switched on statutes this past January. Texas’s TRAIGA is intent-based and narrow, aimed mostly at government deployers, and it carries something I want you to notice: a safe harbor for organizations that follow the NIST AI Risk Management Framework. (I wrote about the NIST portfolio two weeks ago. This is why.) Illinois amended its Human Rights Act so that discriminatory AI use in employment is a civil rights violation, with notice required when AI touches a hiring decision.
Then there’s the US federal government, which is not painting lines so much as arguing about who holds the brush. A December 2025 executive order created a Justice Department task force to challenge state AI laws in court. The task force’s first act was to intervene in xAI’s lawsuit against Colorado’s original statute. A federal court stayed enforcement. Then Colorado rewrote the law underneath the lawsuit. Meanwhile, the congressional preemption bill has stalled since June. An executive order cannot preempt state law; only Congress or the courts can. So as of today, every state law I just named is in force or on schedule, and the federal position is a lawsuit, not a standard.
The table below summarizes the inventory I keep for clients: six jurisdictions, six effective dates, three regulatory philosophies, and not one of them nested inside another. “Comply with the strictest one” is a strategy that works when rules stack. These rules don’t stack. They cross.
| Jurisdiction | Instrument | Status (as of Oct 17, 2026) | What it touches | Road gap |
|---|---|---|---|---|
| EU | AI Act, as amended by Digital Omnibus (Reg. 2026/1744) | In force July 27, 2026. Annex III high-risk duties move to Dec 2, 2027; Annex I to Aug 2, 2028. Art. 50 transparency, GPAI duties, and AI Office enforcement stay on the Aug 2, 2026 schedule. | Risk tiers, high-risk duties, transparency, GPAI | Lines painted; road closed 16 months for lack of standards and enforcers |
| Colorado | SB 26-189 (ADMT Act) + HB 26-1263 (Chatbot Safety Act); rules 4 CCR 904-6 | Original 2024 AI Act repealed and re-enacted May 2026. Draft rules filed Aug 11, revised Oct 6; hearing and comments close Oct 26. Effective Jan 1, 2027. AG-only enforcement, no private right of action. | Consequential decisions (employment, credit, housing); chatbots and minors | Signs written in real time; still litigated |
| California | SB 942 (AI Transparency Act) as amended by SB 1000 and AB 2713; SB 53; AB 2013 | SB 942 operative Aug 2, 2026. SB 1000 signed Sept 30, 2026, effective immediately; removes the 1M-user threshold. SB 53 and AB 2013 in effect since Jan 1, 2026. | Provenance and disclosure for generative AI; frontier model transparency | Lines painted for one lane (disclosure), not for decisions |
| Texas | TRAIGA (HB 149) | Effective Jan 1, 2026. Intent-based prohibitions; mostly government deployers; NIST AI RMF safe harbor. | Narrow prohibited uses | A sign that says “no bad intent,” and little else |
| Illinois | HB 3773 (amends Human Rights Act) | Effective Jan 1, 2026. Discriminatory AI use in employment is a civil rights violation; notice required when AI is used in hiring. | Employment AI | Painted line on one road only |
| US federal | EO 14365; DOJ AI Litigation Task Force | EO signed Dec 11, 2025; task force stood up Jan 2026; intervened in xAI v. Weiser Apr 2026. No preemption by EO alone; congressional preemption bill stalled since June. | All state AI law, in theory | Arguing over who holds the brush while nobody paints |
No guardrails: the courts haven’t found the edge of the road yet. This is the part people get wrong. They assume there’s a body of AI case law somewhere that defines a standard of care. There isn’t. Not yet. Here is what exists.
Mobley v. Workday is the case every CHRO and CISO should know. A federal court in California has repeatedly refused to let Workday out of a class action alleging its AI screening tools discriminate by age, race, and disability. The court’s early framing was that an AI tool screening candidates on an employer’s behalf can be treated as the employer’s agent, which means neither the vendor nor the deployer is insulated. In June 2026 the court let California state-law claims proceed even for applicants outside California. But understand what that is: a series of procedural rulings. No judgment on whether discrimination occurred. The case is in discovery, and discovery was still being argued this month.
Garcia v. Character Technologies opened a door and then closed it. In 2025 a federal judge allowed product liability claims against a chatbot developer to proceed, the first ruling of its kind. In January 2026 the case settled. No precedent on the merits. The door is open; nobody has walked through it.
xAI v. Weiser is the constitutional fight over whether states can regulate at all, and it’s now aimed at a statute that no longer exists in its original form.
The only clean, decided ruling I can point to is a Canadian small-claims tribunal, Moffatt v. Air Canada (2024), which held the airline responsible for a bereavement policy its chatbot invented. Modest damages. Enormous principle: the chatbot’s words are your words.
That’s the guardrail inventory (Figure 2). One small tribunal ruling and three large unresolved cases. When the first merits judgment lands, and it will, the court will ask what reasonable organizations were already doing. That standard is being set right now, by you, whether you intend it or not.
Honorable mentions. A few items I left out of the walkthrough because their status is unsettled or I couldn’t verify them to my standard: New York’s RAISE Act for frontier developers (effective date reported inconsistently), the precise procedural status of the Colorado litigation after the repeal-and-reenact, and the 2026 industry surveys on AI governance maturity. If any of these touch your operations, check them directly rather than taking my summary.
Final Thoughts
The absence of finished regulation is not a reason to wait. You can still get a speeding ticket on a road with no posted limits. It’s the reason to build your own guardrails now, because the first court to rule will measure you against what the reasonable organization was doing in the construction zone.
1. Map your consequential decisions, not your AI systems. Every jurisdiction above regulates by what the decision does to a person, not by what the technology is. Try this: list the decisions where AI materially influences hiring, credit, housing, or access to services, and mark which jurisdictions’ residents each one touches.
2. Treat vendors as agents, because the courts might. The Mobley framing means “it’s the vendor’s tool” is not a defense you can count on. Try this: for each AI vendor in a consequential decision, confirm in writing who tests for bias, who sees the results, and who holds the data.
3. Anchor to NIST AI RMF now. It’s a safe harbor in Texas, a reference in Colorado’s drafts, and the closest thing to a common engineering standard the US has. Try this: run a one-page gap assessment of your program against the Govern function alone.
4. Stop treating the EU delay as a pause. Transparency and general-purpose model duties are live today. Try this: confirm that every customer-facing AI interaction discloses that it’s AI.
5. Document what reasonable looks like, dated. When the standard of care gets decided, your contemporaneous records are your defense. Try this: write a dated memo of your current AI governance posture and the regulations you’re tracking. Refresh it quarterly.
So here is my question for you. If a court ruled tomorrow on what a reasonable organization should have been doing with AI in 2026, would your records show you were driving carefully, or just driving?