State & Local AI Policy: California’s Suspense-File Reckoning — 30 Bills, 85 Laws in 27 States, and 100 Local Data-Center Pauses
With federal preemption stalled, the states are where AI law is actually being written — and this week they wrote a lot of it.
California reached its suspense-file reckoning on August 13, the closing day of this window, with Assembly and Senate Appropriations Committees voting on roughly 30 AI bills that had crossed over to their secondary chamber. The list spans nearly every regulatory theme in circulation: training-data documentation, customer-service chatbots, AI in health care, provenance and digital signatures, a state AI Standards and Safety Commission, worker protections and displacement notice, companion chatbots in toys. AB 2656 is the sleeper item for the public-sector market — a 45-day advance-notice requirement to recognized employee organizations before a state or local public employer deploys GenAI into represented work, which would materially change deployment timelines on every California SLED engagement.
Behind California sits the number that defines the operating environment: 85 new AI laws enacted across 27 states in 2026, with seven legislatures still in session. Two states have already set the ceiling. Illinois moved the model from disclosure to external verification — S.B. 315 requires annual independent third-party audits of frontier model safety practices, with 72-hour critical-incident reporting and penalties up to $3 million per violation. Colorado’s Chatbot Safety Act, effective January 1, 2027, went the other direction: narrow, use-case-specific, minor-focused, and succeeding precisely where broad algorithmic-discrimination regulation has stalled. Together they show contractors what to build — not one horizontal AI policy, but a matrix of use cases against jurisdictions.
New York holds the largest single block of pending state AI law in the country, with Governor Hochul’s deadline running to December 31: training-data transparency, synthetic-content provenance, kids chatbot safety, a surveillance-pricing ban, and the Responsible Data Center Development Act’s one-year moratorium on hyperscale permitting above 20 MW.
That last item connects to the section’s fastest-moving story. Brookings reported on August 11 that at least 15 states have weighed data-center pauses and at least 100 localities have already approved their own. But the ratepayer track is outrunning the moratorium track: New Jersey’s Fair Share Act, Oklahoma’s large-load tariffs, and Virginia’s first-of-its-kind $0.011/kWh energy consumption tax — a direct cost input for anyone operating in the National Capital Region. Meanwhile, local AI deployment continues to outpace local governance, with emergency-call triage and law-enforcement use raising a delegation-of-authority question most jurisdictions have not answered in writing.
The through-line: 85 laws across 27 states is the compliance surface, and no national framework covers it. The quiet August recess is the work window — build the matrix before the September wave.
1. ★ California Reached Its Suspense-File Reckoning on Roughly 30 AI Bills — August 13
The story. The marquee in-window state event. California’s Assembly and Senate Appropriations Committees scheduled their suspense-file votes to begin Thursday, August 13 — the closing day of this coverage window — on roughly 30 remaining AI bills that had crossed over to their secondary chamber. The preceding week consisted of final public-comment hearings.
The bills in play span nearly every AI regulatory theme in circulation: AB 412 (documentation of copyrighted training material and a rights-holder inquiry mechanism), AB 1609 (customer-service chatbots), AB 1979 and AB 2575 (AI in health care), AB 2656 (45-day notice to employee organizations before state and local public employers deploy GenAI within represented job classifications), AB 2713 and SB 1000 (provenance data and digital signatures embedded in or attached to content), AB 2392 (procurement standards and training before CSU/CCC provide GenAI to students and staff), AB 2545 (an EDD assessment of AI’s labor-force impact), SB 813 (a California AI Standards and Safety Commission), SB 947 and SB 951 (worker protections and 90-day technological-displacement notice), SB 903 (AI transcription in mental-health therapy), SB 867 (companion chatbots in toys), and SB 1159 (clarifying that AI systems are not “persons” under the Public Records Act and open-meeting laws).
Why it matters to contractors and agencies.
- AB 2656 is the sleeper item for the public-sector market. A 45-day advance-notice requirement to recognized employee organizations before a state or local public employer deploys GenAI into represented work would materially change deployment timelines on every California SLED engagement. Implementation schedules in current proposals and contracts may need to be rebuilt.
- AB 2392 would put procurement standards and training in front of GenAI deployment across the CSU and community college systems — directly relevant to anyone selling into California higher education.
- AB 2713 / SB 1000 push provenance from “available” to “embedded, attached, or otherwise associated,” which is a materially stricter technical requirement and aligns California with the EU’s Article 50 direction.
- SB 1159 is small but clarifying: AI systems cannot be treated as members of the public for records and open-meeting purposes.
California remains the de facto national standard-setter. Contractors should treat the August 13 outcomes as a preview of 2027 requirements in a dozen other states.
Source: Transparency Coalition — AI Legislative Update, August 7, 2026
2. The 2026 Baseline: 85 New AI Laws in 27 States, With Seven Legislatures Still in Session
The story. As of the August 7 legislative update, 85 new AI-related laws had been enacted across 27 states in 2026, per the Transparency Coalition’s mid-year report. Seven states remained in session and continued to move AI bills: California, Michigan, Pennsylvania, Massachusetts, Ohio, New Jersey, and North Carolina. Michigan lawmakers returned during the second week of August; Pennsylvania returns September 9 (House) and September 28 (Senate). The week itself was described as the quietest of 2026, with most legislatures on summer break.
Why it matters to contractors and agencies. Two planning implications. First, the quiet period is the work window. With federal preemption stalled and most legislatures in recess, this is the moment to build a state-by-state compliance matrix before the September wave. Second, the enacted-law count is the number that matters for exposure: 85 laws across 27 states is a compliance surface that no single national framework currently covers. For contractors selling to SLED customers, or to commercial clients operating across states, this is a durable service line — and a durable cost.
Source: Transparency Coalition — AI Legislative Update, August 7, 2026
3. Illinois Set the New High-Water Mark: Independent Third-Party Audits of Frontier Models
The story. (Enacted July 6; the compliance implications are now being worked.) Governor J.B. Pritzker signed the Artificial Intelligence Safety Measures Act (S.B. 315), the first state law requiring annual independent third-party audits of frontier AI models’ safety practices. It targets developers with over $500 million in annual revenue building models above a specified compute threshold. Requirements include published safety frameworks with annual updates, pre-deployment transparency reports, reporting of critical safety incidents within 72 hours, whistleblower protections, and disclosure statements. The Illinois Attorney General has exclusive enforcement authority, with civil penalties up to $3 million per violation and no private right of action.
Why it matters to contractors and agencies. Illinois moved the state model from disclosure to external verification — the same direction the federal framework declined to take publicly. Three consequences: an independent AI audit market is now being created by statute, and it will need auditors, methodologies, and evidence standards; the 72-hour critical-incident reporting clock is a concrete operational requirement that federal contractors should benchmark against, since federal incident-reporting expectations are tightening in the same direction; and agencies evaluating frontier models now have a citable third-party audit artifact to request in source selection.
Source: Mintz — AI: The Washington Report, August 2026 edition
4. Colorado’s Chatbot Safety Act Signaled the Shift to Use-Case-Specific Regulation
The story. (Signed July 1; effective January 1, 2027.) Governor Jared Polis signed H.B. 26-1263, the Chatbot Safety Act — the first state law regulating AI chatbots specifically to protect minors. All users must be regularly told they are interacting with AI; operators must adopt protocols for users expressing suicidal ideation or self-harm, including crisis-service referrals; and services may not indicate they provide professional mental or physical health care, financial planning, or accounting services. For users under 18, additional requirements prohibit generating statements that encourage emotional dependency, prohibit engagement gamification, prohibit sexually explicit content, and require parental account controls.
Meanwhile, enforcement of the broader Colorado AI Act remains suspended amid litigation and federal intervention, though its risk-management and automated-decision requirements continue to influence other states.
Why it matters to contractors and agencies. Colorado is the clearest evidence that broad algorithmic-discrimination regulation has stalled while narrow, use-case-specific regulation is succeeding. That changes how to build a compliance program: not one horizontal AI policy, but a matrix of use cases (chatbots, minors, health, employment, insurance, pricing, education, elections) against jurisdictions. For agencies deploying public-facing conversational AI — benefits navigation, 311, licensing, constituent services — the Colorado requirements are a reasonable design baseline even outside Colorado, particularly the crisis-referral protocol and the prohibition on implying professional care.
Source: Mintz — AI: The Washington Report, August 2026 edition
5. New York’s 2026 AI Package Sits on the Governor’s Desk Until December 31
The story. New York’s legislature closed its 2026 session on June 1 having passed a substantial AI package now awaiting Governor Hochul’s signature, with a deadline of December 31. The bills include S 9051 (kids chatbot safety, with a private right of action), A 6578 (the Artificial Intelligence Training Data Transparency Act, requiring developers to publish a high-level summary of training datasets), S 6954 (provenance data on synthetic content), S 8451 (the FAIR News Act, transparency for AI-generated news media content), A 9349 (a ban on surveillance pricing), A 3411 (a warning label on generative AI outputs), and A 11560, the Responsible Data Center Development Act — a statewide one-year moratorium on permitting hyperscale data centers with peak load above 20 megawatts.
Why it matters to contractors and agencies. This is the largest single block of pending state AI law in the country, and it will resolve in a four-and-a-half-month window. The training-data transparency act and the provenance requirements would apply to model developers regardless of where they are headquartered, given New York’s market size. The data-center moratorium is the item with the most direct GovCon consequence: a 20 MW threshold captures essentially every AI-scale facility, and a one-year permitting pause in New York would push siting demand toward other states — with Virginia, Ohio, Texas, and the Southeast absorbing it. Firms with data-center construction, power, cooling, or siting practices should be modeling that redistribution now.
Source: Transparency Coalition — AI Legislative Update, August 7, 2026
6. Data-Center Backlash Became a Governance Problem, Not Just a Political One
The story. On August 11 — in window — Brookings published an analysis arguing that data-center moratoriums are not a substitute for oversight. The scale it documents is the notable part: at least 15 states have weighed pauses on data-center development, and at least 100 localities have already approved their own. The piece follows nationwide protests against AI data-center expansion and argues that while moratoriums buy communities time to negotiate community-benefit agreements, they are not a complete solution.
The ratepayer-protection track has moved faster than the moratorium track. New Jersey enacted a Data Center Fair Share Act on July 7 requiring 50 MW-plus facilities to commit to paying at least 85% of projected power costs for a decade. Virginia ended a budget standoff on June 30 by retaining its data-center sales tax exemption while adding a first-of-its-kind $0.011/kWh energy consumption tax capped at $600 million per year. Oklahoma enacted a Data Center Customer Ratepayer Protection Act requiring large-load tariffs.
Why it matters to contractors and agencies. For firms in the National Capital Region especially, the Virginia energy-consumption tax is a direct cost input that should already be in pricing models. More broadly, the shift from “should we allow this” to “who pays for the grid upgrade” is the mature form of this debate, and it favors contractors who can bring credible power, cooling, water, and community-benefit analysis to a siting conversation — not just construction capability. Agencies planning AI compute capacity should assume utility interconnection, not construction, is the binding constraint, and should engage state utility commissions early.
Sources: Brookings — data center moratoriums are not a substitute for oversight · New York Governor’s Office — statewide hyperscale moratorium
7. Local Government AI Deployment Outpaced Local Governance
The story. State and local adoption of AI in high-consequence public-safety workflows continued to draw scrutiny, with New Orleans attracting particular attention for using AI in emergency-call triage — intended to help prioritize calls when human operators are occupied. Critics raised concerns about speech recognition accuracy, contextual understanding, bias, and failure modes during life-threatening situations. Related concerns persist around facial recognition and automated license-plate readers, and some police departments have begun limiting generative AI in official reports over worries that fabricated details or unclear authorship could contaminate evidence and undermine prosecutions.
Why it matters to contractors and agencies. The governing question is not whether AI can participate in a 911 or investigative workflow — it is whether AI can delay, reprioritize, or dispose of a call or a lead without immediate human review. That is a delegation-of-authority question, and most local governments have not answered it in writing.
The practical prerequisite almost no jurisdiction has completed is an AI inventory: agencies cannot govern systems they do not know their departments, contractors, and embedded software products are already using. For contractors, AI inventory, use-case classification, and delegation-policy development is a well-defined, fast-to-deliver SLED service offering with an obvious trigger event. For law-enforcement customers specifically, an auditable chain of custody — source data, model version, prompts, outputs, edits, and the identity of the person who accepted the result — is becoming an evidentiary necessity, not a best practice.