Little tech braces for impact of state AI law patchwork

While the Trump administration's AI Action Plan has provided some clarity about AI policy at the federal level, a growing number of proposed and adopted regulations at the state level are raising concerns for smaller technology companies.

According to the most recent information from the National Conference of State Legislatures (NCSL), roughly 1,370 bills had been introduced at the state level year to date through July 10. The bills cover all 50 states, Puerto Rico, the Virgin Islands and Washington, DC. Many expand existing protections against the unauthorized sharing of intimate images or the possession of child sexual abuse material to include computer-generated imagery, including images made by AI. Others cover specific industries' use of AI, including in healthcare, insurance, real estate or the government itself.

All told, the NCSL said 38 states had adopted or enacted about 100 measures during the most recent legislative year.

While larger AI companies such as OpenAI LLC have the financial and legal resources to invest in compliance, given the proliferation and variety of these laws, experts warn that smaller tech companies will have the hardest time keeping up.

"What I'm hearing from CEOs at Midwestern tech companies is that it's really challenging to understand how to innovate when there is kind of a lack of clarity around what will happen," Kara Lowe, CEO of the KC Tech Council, said in an interview with S&P Global Market Intelligence. "It's just a noisy space."

State of play

Looking at the different state laws that have passed, Colorado, California, New York and Texas have enacted the most laws directly aimed at AI, particularly for automated decision-making that could result in discrimination.

"Colorado's AI law prohibits the use of AI tools that make consumer-facing significant decisions if those decisions have a discriminatory impact," said MJ Wilson-Bilik, a technology, privacy and insurance regulatory law partner at Eversheds-Sutherland, referring to the Colorado AI Act, which takes effect in June 2026. Colorado's AI law, which has been likened by tech policy scholars to the EU AI Act, imposes $20,000 in fines per violation of the law. It exempts businesses with fewer than 50 employees from risk assessment requirements.

"If every state and the District of Columbia were to enact similar laws, small businesses could face mountains of fees for potential missteps," wrote Morgan Stevens, privacy fellowship manager at The App Association, a global trade organization for small and medium-sized tech companies. "Even if some states pursue more permissive, innovation-friendly laws, the cumulative effect of 50 different frameworks would still demand extensive compliance efforts."

The Colorado AI Act was originally set to take effect in February 2026, but state lawmakers delayed the effective date in late August amid concerns about the law. Supporters of the bill, including Consumer Reports, the Colorado AFL-CIO, the Center for Democracy and Technology, ACLU Colorado and Towards Justice, argue that the bill is needed to protect consumers.

"Companies increasingly use hidden algorithms to determine who gets hired, who qualifies for loans, who receives medical care and who gets access to many other key parts of our lives and livelihoods," the groups said in a statement. "Workers and consumers often have no recourse when algorithms reject them using incorrect, biased, or illegally obtained information."

Texas has passed a similar AI law, the Texas Responsible Artificial Intelligence Governance Act, which takes effect Jan. 1, 2026. "Texas' recent law also prohibits discrimination but specifically requires discriminatory intent, and the law includes a provision that disparate impact is not sufficient to prove discriminatory intent," Wilson-Bilik said.

AI laws by industry

Both Colorado and Texas also have laws that target the insurance industry. A 2021 Colorado law prohibits insurance providers from using algorithms or predictive models that discriminate based on a number of protected classes, such as race or sex. A Texas law that became effective Sept. 1, by contrast, prevents a utilization review agent at an insurance provider from using an automated decision system or AI-based algorithms to make an adverse determination — essentially a determination that healthcare services provided or proposed to be provided to a patient are not medically necessary or appropriate and therefore will not be covered. California has a similar bill.

In healthcare, several states, including Utah and Nevada, have laws outlining how AI can or cannot be used in mental health services, including disclosure requirements.

South Carolina, meanwhile, has a Real Estate AI Responsibility Law that became effective in 2024, which makes any licensed real estate professional responsible for any work produced with AI.

Meanwhile, New York's RAISE Act would make it more difficult for startups to build their AI products by creating audit and transparency requirements for foundation models, according to policy experts at the entrepreneur-focused advocacy group Engine.

"A patchwork of state AI laws threatens to impose heavy costs on small businesses, slow innovation, and weaken US competitiveness," wrote Stevens from The App Association. "While the full economic impact remains uncertain, early evidence points to a high risk of significant disruption, particularly for small businesses that lack the resources to navigate 50 different compliance regimes."

A path toward a federal statute

While it will take time to fully understand or measure the broader economic impact of AI regulation at the state level, smaller tech companies are feeling an economic impact now, said Lowe of the KC Tech Council.

As an example, she pointed to Garmin Ltd., the fitness wearable-tech maker, which has a facility in the Kansas City metro area. Garmin has an entire compliance team devoted to data privacy or issues related to AI, Lowe said.

But because not all companies can devote such resources to compliance, an ideal balance of consumer protection with room to innovate based on risks and specific context is highly sought after, Lowe added.

"From the perspective of the vast majority of tech companies in the country, it's really hard to play by a federal or by a state patchwork of regulatory standards," Lowe said.

Others note that there is a real risk in making it harder for smaller companies to compete in the AI arena, given that AI is one area where smaller companies are successfully challenging Big Tech. Silicon Valley startup Perplexity AI Inc. aims to establish itself as a viable alternative to Google LLC by changing the way internet search results are delivered. The company, which completed a round of funding in May at an $18 billion valuation, offered in August to buy Google's Chrome browser for $34.5 billion.

Other smaller AI companies that have made significant contributions to the field include German language translation company DeepL SE; Anthropic PBC, maker of popular large language model Claude; and SoundHound AI Inc., which specializes in voice technology for applications like smart assistants.

"There's different companies that are winning the AI race than the ones that won the prior technology races," said Cobun Zweifel-Keegan, managing director at IAPP. "Even though we see Microsoft Corp., Alphabet Inc., and Meta Platforms Inc. up at the top of the list, there's also new companies and new entrants."