In the absence of comprehensive federal legislation, US states have been legislating, and the results differ in ways that matter more for compliance cost than the headline summaries suggest.
What triggers the obligation
The most consequential drafting choice is the trigger. A statute that prohibits developing or deploying a system with the intent to discriminate captures a narrow set of conduct and requires proof of a mental state. One that reaches systems producing discriminatory effects regardless of intent captures a far wider set and requires testing to detect.
These are different laws with similar summaries. An organisation reading a one-page overview of several state statutes will not see the difference, and it determines whether the compliance work is a policy exercise or a testing programme.
Who enforces, and whether individuals can sue
Enforcement reserved to a state attorney general, with a cure period before penalties, produces a manageable and predictable exposure. A private right of action produces a different world, in which any affected individual may bring a claim and class actions follow.
For most organisations this single provision affects expected cost more than any substantive requirement in the statute, and it is worth checking first when assessing a new state law.
Safe harbours and what they do to voluntary frameworks
Several state statutes provide that documented alignment with a recognised risk management framework — the NIST AI RMF is the usual reference — constitutes evidence of reasonable care, or provides an affirmative defence.
This changes the status of framework adoption. A voluntary framework that carries a statutory consequence is no longer purely a good-practice matter; it is a legal one, and the documentation supporting alignment needs to be capable of surviving examination rather than merely existing. Organisations that adopted a framework informally may find that the evidence they hold does not support the claim they would want to make.
The union problem
An organisation operating in many states does not comply with each statute separately. It builds one programme that satisfies the strictest requirement it faces on each dimension, because maintaining state-specific behaviour in a national product is usually more expensive than meeting the ceiling everywhere.
The practical consequence is that the most demanding state provision on any given point becomes the internal standard nationally, and tracking which state currently holds that position on each dimension is the actual compliance task.