California now regulates how lawyers use generative AI, Colorado rewrote its AI Act, and Congress has not preempted any of it.
If you practice in California, January 1, 2027 is the date to circle: SB 574, signed September 30, 2026, makes California the first state to write rules for lawyers’ use of generative AI into statute, including a duty to personally verify every citation. Colorado, the state everyone watched for two years, replaced its AI Act before it ever took effect, and laws in Texas and Illinois have applied since January 2026. As of October 23, 2026, Congress has not passed anything that overrides them.
What Does California’s SB 574 Ask of Lawyers?
Under SB 574, signed by Governor Gavin Newsom, new Business and Professions Code section 6068.1 says an attorney “shall not delegate the practice of law to generative artificial intelligence.” An attorney who uses generative AI may not enter confidential, personal identifying or other nonpublic information into a system unless access to that information is restricted to the attorney and people the attorney authorizes under confidentiality obligations. The attorney must take reasonable steps to verify outputs, including case and statutory citations, and to correct hallucinated output. The section also requires disclosure of generative AI use to the court for documents submitted to the court.
The law also amends Code of Civil Procedure section 128.7 so that no filing may contain a citation the responsible attorney has not personally verified. It sets parallel limits for arbitrators, who may not delegate decision-making to AI tools, Bloomberg Law reported. Reuters reported that no other state has a law aimed at lawyers’ and arbitrators’ use of the technology, and that some attorneys say the measure partly duplicates existing rules. When the bill passed the state Senate in January, its author, Senator Tom Umberg, gave Reuters his reasoning:
“As A.I. becomes more common in the legal system, we need clear guardrails to protect clients’ confidentiality and ensure that real people, not algorithms, are making legal decisions.”
If you buy legal tech, read the access-restriction line twice. It makes vendor data handling terms a compliance question for California-licensed lawyers as well as an IT one.
What Replaced Colorado’s AI Act?
Colorado’s original AI Act, SB 24-205, was due to take effect June 30, 2026. Instead, the legislature passed SB 26-189, signed May 14, which repeals and replaces it. According to a Jones Walker analysis, the new law’s main requirements apply to consequential decisions made on or after January 1, 2027, and it drops the duty of reasonable care, the risk management program and the annual impact assessment. It covers automated decision-making technology that “materially influences” a consequential decision, such as employment. Deployers must give notice, explain an adverse outcome within 30 days, offer data correction and human review, and keep records for three years. Tools used solely to summarize, organize, translate, draft or route information for human review are carved out, which matters for the drafting tools common in legal work. The attorney general has exclusive enforcement authority, and there is no new private right of action.
The attorney general’s office scheduled a rulemaking hearing for October 26, 2026 on rules for the new law and a companion chatbot law. In xAI’s federal suit against the attorney general, which the Justice Department joined on April 24 alleging an Equal Protection violation, an April 27 order bars the state from starting enforcement until 14 days after the court rules on a preliminary injunction motion. Jones Walker reports xAI must file that motion within 28 days after the rules are final, so the date Colorado adopts final rules starts that clock.
Which Other State AI Laws Already Touch Firms and Legal Departments?
The Texas Responsible Artificial Intelligence Governance Act took effect January 1, 2026, the Texas attorney general’s office says. Its prohibitions include developing or deploying AI intended to incite self-harm or crime and government social scoring. The enrolled text gives the attorney general exclusive enforcement, rules out a private right of action, and allows 60 days to cure after notice.
Illinois Public Act 103-0804, also effective January 1, 2026, amends the Human Rights Act. It makes it a civil rights violation for an employer to use AI that has the effect of discriminating on the basis of protected classes in hiring, promotion, discipline and other employment decisions, or to use zip codes as a proxy for protected classes, and employers must give notice when they use AI for those purposes. Law firms and legal departments are employers too.
More dates for the calendar: Utah’s Artificial Intelligence Policy Act is scheduled for repeal on July 1, 2027; its disclosure chapter defines a high-risk AI interaction to include generative AI that provides legal advice or services, aimed at consumer-facing tools. New York’s RAISE Act, finalized by a chapter amendment Governor Kathy Hochul signed March 27, takes effect January 1, 2027 for large frontier model developers, Wiley reports. Connecticut’s Public Act 26-15 took effect in stages starting October 1, 2026, with its automated employment decision rules applying to systems deployed on or after October 1, 2027. And California businesses that use automated decisionmaking technology for significant decisions must meet the privacy agency’s ADMT requirements beginning January 1, 2027.
Is Federal Preemption Coming?
Not yet. Executive Order 14365, signed December 11, 2025, directed the attorney general to form a task force to challenge state AI laws. The Justice Department created it on January 9, with the “sole responsibility” of challenging state laws it finds inconsistent with federal policy; the Colorado intervention is the only task force action we could confirm. In Congress, a bipartisan House discussion draft of the Great American AI Act would preempt state laws specifically regulating AI model development for three years, while expressly leaving alone laws of general applicability and laws regulating AI use or deployment. On September 29, Roll Call reported that Speaker Mike Johnson did not commit to AI legislation, while Senate Commerce Chairman Ted Cruz said federal standards “must also address the burgeoning patchwork of state laws.”
For lawyers, that House draft’s line matters most: as written, it would leave rules on how lawyers use AI, like California’s, in place.
FAQ
Which state first wrote lawyer AI rules into statute?
California, when Governor Gavin Newsom signed SB 574 on September 30, 2026.
Did Colorado’s AI Act take effect?
No. Colorado replaced SB 24-205 with SB 26-189 before its June 30, 2026 start, and the attorney general scheduled a rulemaking hearing for October 26, 2026.
When did the Texas AI law take effect?
January 1, 2026, the Texas attorney general’s office says.
Has federal law preempted state AI laws?
No, not as of October 23, 2026.
*Updated Oct 23 to refresh the story and add an FAQ.*
In this story
See every round in the Funding Tracker