The compliance stack problem is real. A US company with employees in Illinois, customers in New York City, operations in Texas, users in Colorado, and software deployed to EU customers now has to contend with at least eight distinct AI regulatory frameworks. Texas TRAIGA, Colorado SB 189, Illinois AI employment law, NYC Local Law 144, New Jersey's proposed AI legislation, Minnesota, Connecticut SB 5, California, plus the EU AI Act, GDPR's AI provisions, and the UK's emerging AI framework.
The instinct is to treat each as a separate compliance track. That instinct leads to twelve parallel spreadsheets, duplicated documentation, and teams that cannot keep up with updates to any single law because they are managing all of them simultaneously.
There is a better approach. Most of these laws share a common structure. Build compliance once against that common structure. Add jurisdiction-specific requirements on top. Maintain one calendar, not twelve.
TL;DR: NIST AI RMF documentation satisfies most US state safe harbors. ISO 42001 or EU AI Act documentation covers EU requirements. The two overlap enough that one core documentation set handles both, with jurisdiction-specific additions (disclosures, audit reports, notice language) layered on top. Build the core once. Add the local extras per jurisdiction. Maintain one calendar, not twelve.
The compliance stack problem
The US has no federal AI law. Instead, states have acted, and the result is a patchwork where similar obligations are worded differently, apply to different thresholds, and carry different enforcement mechanisms.
Texas TRAIGA (Responsible AI Governance Act, HB 149) prohibits a defined set of intentional AI misuses rather than imposing Colorado-style impact assessments, and offers an affirmative-defense safe harbor for organizations that substantially comply with NIST AI RMF. Effective January 1, 2026.
Colorado SB 189 covers automated decision technology used in consequential decisions affecting Colorado residents (employment, credit, housing, education, healthcare, insurance). It requires consumer notice and explanation rights and provides a safe harbor for documented risk management; the mandatory impact assessments from the original SB 205 were dropped. Effective January 1, 2027.
Illinois has layered AI employment requirements: the Artificial Intelligence Video Interview Act (since 2020) requires disclosure before AI interview analysis; amendments extending to broader AI employment use were effective in 2024.
NYC Local Law 144 requires annual independent bias audits for automated employment decision tools used on NYC-based job candidates or employees, plus public posting and candidate notice. In force since July 2023, with annual audit renewal required.
Connecticut SB 5 creates obligations for developers and deployers of high-risk AI systems, including impact assessments and governance documentation. Effective October 1, 2026.
EU AI Act applies to providers and deployers of AI systems used in the EU. High-risk systems require conformity assessments, technical documentation, and registration. General Purpose AI models have separate obligations. High-risk obligations fully enforceable from August 2, 2026.
GDPR continues to apply to AI systems that process personal data of EU individuals. Automated decision-making provisions under Article 22 are relevant to any AI system that makes decisions solely by automated means with significant effects on individuals.
The core insight: one documentation set covers most of it
Most AI laws share the same underlying structure because they were all designed to address the same policy problem: consequential AI decisions affecting individuals need oversight, documentation, and accountability.
The core documentation set that satisfies this shared structure has four components:
AI inventory with risk classification. A registry of all AI systems you develop or deploy, classified by risk tier under both NIST AI RMF (minimal, low, medium, high) and EU AI Act (minimal, limited, high-risk, GPAI). This single document is the foundation of compliance across all jurisdictions.
Impact assessments for high and medium-risk systems. A documented assessment of each system's purpose, the data it uses, how it was tested, what risks were identified, what mitigations were applied, and what residual risks remain. NIST AI RMF MAP function documentation, EU AI Act Article 9 risk management documentation, and state-law "algorithmic impact assessment" requirements are all satisfied by the same underlying document if properly structured.
Governance policy. A written AI governance policy covering who is responsible for AI oversight, how systems are approved for deployment, what incidents must be reported and to whom, and how vendor AI is managed. EU AI Act requires governance at the senior leadership level. US state laws require governance programs that are "reasonable." One policy can satisfy both if it addresses all the required elements.
Human review documentation. For systems that make or inform consequential individual decisions, documentation of the human review process: who reviews AI outputs, what authority the reviewer has to override the AI, how long reviews take, and what the review log looks like. This satisfies EU AI Act Article 14 (human oversight), NIST AI RMF GOVERN function elements, and state-law human review requirements.
Risk classification alignment across jurisdictions
The triggering concept across most AI laws is "high-risk AI that makes or informs consequential decisions affecting individuals." The terminology varies but the concept is consistent.
EU AI Act Annex III lists specific application categories (employment, credit, education, healthcare, migration, law enforcement, critical infrastructure, benefits). US state laws typically define high-risk AI as systems that make or contribute to "consequential decisions" about individuals in areas including employment, credit, housing, education, healthcare, and insurance.
A system classified as high-risk under EU AI Act Annex III will almost certainly be high-risk under Colorado SB 189, Texas TRAIGA, and Connecticut SB 5. A single risk classification decision, documented once and applied consistently, covers the question across all relevant jurisdictions.
The practical workflow is to classify each system once using the most detailed taxonomy available (EU AI Act Annex III categories work well because they are specific), and then map that classification to the applicable jurisdictions and their corresponding obligations.
The jurisdiction matrix: what is shared and what is local
This matrix covers the most common AI laws. For each, it shows what is satisfied by the core documentation set and what local addition is required.
| Jurisdiction | Satisfied by core set | Local addition required |
|---|---|---|
| Texas TRAIGA | NIST AI RMF conformance satisfies safe harbor entirely | None beyond NIST conformance |
| Colorado SB 189 | Impact assessment, governance policy, human review docs | Consumer notice language for Colorado residents |
| Illinois AI employment | Governance policy, impact assessment | Pre-use employee/applicant disclosure, 10-day data access right |
| NYC Local Law 144 | Impact assessment, governance policy | Annual independent bias audit, public posting, candidate notice |
| Connecticut SB 5 | Impact assessment, governance policy, human review | Developer/deployer notice to consumers before deployment |
| EU AI Act (high-risk) | Technical documentation, conformity assessment, governance | EU database registration, EU authorized representative if required |
| GDPR Article 22 | Data processing documentation | Specific Article 22 notice if fully automated decision-making applies |
| UK AI framework | Governance policy, impact assessment | Sector-specific regulator notification (varies) |
What you need once vs. what you need per jurisdiction
Build once and maintain:
- AI inventory with risk classification
- Impact assessment template and completed assessments for each high/medium-risk system
- AI governance policy approved at the appropriate organizational level
- Human review process documentation for consequential-decision systems
- Vendor AI questionnaire and vendor risk records
- Incident response procedures for AI failures
- Testing and red-team records for high-risk systems
Build per jurisdiction:
- Specific disclosure language for Illinois employee and applicant notices
- NYC bias audit engagement with an independent auditor (annual)
- NYC candidate notice and public posting on company website
- Colorado consumer notice language
- Connecticut pre-deployment consumer notice
- EU AI Act database registration for high-risk systems
- EU authorized representative appointment if the company has no EU establishment
- GDPR Article 22 notice if applicable
The ratio is roughly four to six documents built once versus two to three actions per relevant jurisdiction. For a company operating in three US states and the EU, the total is manageable: one core set plus eight to twelve jurisdiction-specific additions.
Managing the regulatory calendar across jurisdictions
The biggest operational challenge of multi-jurisdiction compliance is not documentation. It is keeping track of deadlines across a regulatory landscape that is still changing.
The 2026 calendar for AI compliance has five key dates:
January 1, 2027: Colorado SB 189 effective date for AI in consequential employment and consumer decisions.
February 2, 2025 (past, but ongoing): EU AI Act prohibited practices under Article 5 became enforceable. If you have not audited for prohibited practices, this audit is overdue.
August 2, 2026: EU AI Act becomes broadly applicable, with GPAI penalties activating and Article 50 transparency rules taking effect. Note that the high-risk Annex III obligations (technical documentation, conformity assessments, registration) were delayed to around December 2027 by the provisional May 2026 omnibus agreement.
October 1, 2026: Connecticut SB 5 effective date.
Annual (NYC LL144): Bias audit for automated employment decision tools must be renewed annually. If your last audit was more than twelve months ago, it is due.
Maintain a single compliance calendar that covers all applicable jurisdictions. Assign ownership to one person for each deadline. Review the calendar quarterly at a minimum, and after any major new legislation is signed.
For SaaS companies: customer-facing compliance
SaaS companies face a dual obligation. As providers they have their own compliance requirements. As vendors they are part of each customer's compliance chain: customers who deploy your software need documentation from you to complete their own assessments. Specifically they need:
- A technical summary of how the AI component works (level of detail depends on risk tier)
- Bias testing results or a summary of your testing methodology
- A description of data processed and retention policies
- Disclosure language they can include in their own notices
Make these part of onboarding for enterprise customers subject to EU AI Act or state AI law obligations. Review customer contracts after each major regulatory update: pre-2025 agreements may contain AI representations that are now either too broad or too narrow.
The bottom line
Multi-state and multi-jurisdiction AI compliance in 2026 is genuinely complex, but it is not twelve parallel problems. It is one problem, which is building a solid governance program against the NIST AI RMF and EU AI Act frameworks, plus a manageable set of local additions for each jurisdiction where you operate.
The companies that are struggling are those that have started compliance work jurisdiction by jurisdiction rather than building the common foundation first. If you are in that position, the correction is to step back, build the AI inventory and impact assessment set across all systems, and then audit each jurisdiction against that foundation to identify gaps. The gaps are almost always smaller than expected.
Related reading
- One documentation set for EU AI Act, NIST AI RMF, and Texas TRAIGA
- Texas TRAIGA safe harbor NIST AI RMF checklist
- Colorado SB 189 employer guide
- Colorado AI Act SB 26-189: employer compliance guide 2027
- Illinois AI employment disclosure law 2026
- NYC Local Law 144 AI bias audit employer guide
- Connecticut SB 5 AI October 2026 employer checklist
- EU AI Act August 2026 compliance checklist
- AI regulation deadline calendar 2026
- Canada AIDA AI Data Act 2026
- California SB 1047 what happened 2026
- Utah AI Policy Act compliance 2026
- Maryland AI algorithmic pricing law 2026
- State chatbot disclosure laws 2026 SaaS compliance
- New Jersey AI employment law 2026 employer guide
- UK AI regulation 2026 post-Brexit what applies
- Minnesota AI legislation 2026 employer compliance guide
- Tennessee ELVIS Act AI voice and likeness compliance
