While federal AI legislation stalls, states are moving forward. Here's what you need to know.
California (CCPA/CPRA)
- Automated decision-making disclosure requirements
- Consumer rights regarding profiling
- Risk assessments for high-risk processing
Virginia (VCDPA)
- Opt-out rights for profiling
- Assessments required for certain processing
- Effective for AI-based decisions
Colorado (CPA)
- Profiling opt-out requirements
- High-risk processing assessments
- Controller obligations for AI
Other States to Watch
- Connecticut, Utah, Texas, and others have passed or proposed AI-relevant provisions
- Requirements vary significantly by state
- Compliance requires state-by-state analysis
Practical Approach
Map your AI systems to applicable state requirements. Implement the most restrictive requirements as baseline. Monitor for new state laws. Document compliance efforts.
State AI regulation will only increase. Build a flexible compliance program now.
Michael oversees compliance strategy at ZeroShare, helping organizations navigate the complex regulatory landscape around AI. He previously led compliance programs at Fortune 500 financial services firms and holds CISA, CISM, and CRISC certifications.
Stop AI Data Leaks Before They Start
Deploy ZeroShare Gateway in your infrastructure. Free for up to 5 users. No code changes required.
This article reflects research and analysis by the ZeroShare editorial team. Statistics and regulatory information are sourced from publicly available reports and should be verified for your specific use case. For details about our content and editorial practices, see our Terms of Service.