State AI Laws That Apply to RIAs: What to Track

State AI laws reach an advisory firm in two main places: where software materially influences a decision about a person, such as taking on a client or hiring, and where a client talks to generative AI. Several of them treat drafting and summarizing that an advisor reviews before deciding differently from tools that score or decide.

This is a tracking list, current as of November 1, 2026, built from statute text and official state pages. It is not legal advice. Colorado replaced its AI law in May 2026 and states kept adopting the insurance bulletin through the year, so check each official source before relying on a date.

Quick reference

Colorado: SB 26-189, automated decision-making technology

Colorado's first AI law, SB 24-205, set its main duties to apply "On and after February 1, 2026." SB 25B-004, signed August 28, 2025, moved that to June 30, 2026. SB 26-189, signed May 14, 2026, then repealed and reenacted the law. Its final text says "this act takes effect January 1, 2027," apart from a few sections that took effect on passage, and that it "applies to consequential decisions made on or after January 1, 2027."

It covers automated decision-making technology "used to materially influence a consequential decision" about a consumer's access to, eligibility for, selection for or compensation for a covered domain, or about "a differentiated price, cost sharing, compensation, or other material terms" likely to materially limit that access. Covered domains include "a financial or lending service," employment, insurance, housing, education, health care and government services. "Consumer" includes an employee and a job applicant who is a Colorado resident.

The deployer gives clear and conspicuous notice before that use. After an adverse outcome it has thirty days to describe the decision and the technology's role in plain language, explain how to get more information, and set out the consumer's rights. The attorney general must adopt rules on those disclosures by January 1, 2027.

The exclusions matter most for an advisory firm. Out of scope are "advertising, marketing, differentiated product recommendations, search, or content moderation," routine scheduling and workflow management, anti-money laundering and fraud prevention, and technology used "to summarize, organize, or present information for human review" that does not produce "a score, ranking, recommendation, classification, prediction, or other inference that materially influences an outcome or a decision."

Where an RIA could be in scope:

• A model that scores prospects and decides, or materially shapes, who is offered an advisory relationship.
• A tool that sets a client's fee, account minimum or other material terms.
• A screening tool that ranks job applicants who are Colorado residents.

Meeting summaries and drafts an advisor reads before deciding fit the summarizing exclusion more closely.

Utah: disclosing generative AI

Utah Code 13-77-103, effective 5/7/2025, sets two duties. A supplier using generative AI in a consumer transaction must disclose that the person is interacting with generative AI "and not a human" when the person makes "a clear and unambiguous request" to know.

A person providing services in a "regulated occupation" must "prominently disclose" generative AI in a "high-risk artificial intelligence interaction," which includes collecting financial data and personalized advice relied on for significant personal decisions, including "financial advice or services." The disclosure comes verbally at the start of a spoken interaction and in writing before a written one. A safe harbor covers AI that discloses this itself, at the outset and throughout.

A regulated occupation is one regulated by the Department of Commerce that requires a license or state certification. Whether that reaches a Utah-licensed investment adviser representative is a question for counsel. The statute defines generative AI as a system "designed to simulate human conversation with a consumer," so ask of each tool whether the client converses with it. A client-facing chatbot or AI voice line is the clearest case.

California: CCPA regulations on automated decisionmaking technology

The California Privacy Protection Agency's regulations were approved by the Office of Administrative Law on September 22, 2025 and took effect January 1, 2026. Section 7200 reads: "A business that uses ADMT for a significant decision prior to January 1, 2027, must be in compliance with the requirements of this Article no later than January 1, 2027."

ADMT is "any technology that processes personal information and uses computation to replace human decisionmaking or substantially replace human decisionmaking." Substantially replacing means deciding on the output without human involvement, and human involvement requires a reviewer who knows how to interpret the output, reviews it with other relevant information, and has authority to change the decision.

Significant decisions cover financial or lending services, housing, education, employment and healthcare. The regulation defines financial or lending services as "the extension of credit or a loan, transmitting or exchanging funds, the provision of deposit or checking accounts, check cashing, or installment payment plans," a list that does not mention investment advice. Employment covers hiring, work allocation and pay, promotion, demotion, suspension and termination. Advertising is excluded.

For a firm subject to the CCPA, hiring and pay are the exposure. A business in scope gives a pre-use notice, an opt-out with listed exceptions, and access.

Texas: the Responsible Artificial Intelligence Governance Act

HB 149 states: "This Act takes effect January 1, 2026." Its consumer disclosure section, 552.051, applies to governmental agencies and health care services. The provisions that reach any person are intent-based, such as the ban on deploying AI "with the intent to unlawfully discriminate against a protected class in violation of state or federal law." The act adds that "a disparate impact is not sufficient by itself to demonstrate an intent to discriminate."

New York City: Local Law 144 for hiring tools

Local Law 144 prohibits employers and employment agencies from using an automated employment decision tool unless it has had a bias audit within one year of its use, information about the audit is publicly available, and notices have gone to employees or job candidates. Enforcement began July 5, 2023. Before switching on a feature that scores or ranks candidates, ask the vendor for its bias audit summary. The hiring workflow is in AI for advisor recruiting and retention.

Insurance: the NAIC model bulletin

NAIC members adopted the Model Bulletin on the Use of Artificial Intelligence Systems by Insurers on December 4, 2023. The NAIC calls it "not a model law or regulation" and expects "a written AIS Program" from insurers. It applies in a state once that state's insurance regulator adopts it.

The NAIC's adoption map, with status as of October 8, 2026, lists Alaska, Arkansas, Connecticut, Delaware, the District of Columbia, Hawaii, Illinois, Iowa, Kentucky, Maryland, Massachusetts, Michigan, Mississippi, Nebraska, Nevada, New Hampshire, New Jersey, North Carolina, North Dakota, Oklahoma, Pennsylvania, Puerto Rico, Rhode Island, South Carolina, Vermont, Virginia, Washington, West Virginia and Wisconsin.

The bulletins are addressed to insurers. An advisor who also holds an insurance license can ask each carrier whether its rules cover AI tools that producers use in quotes or applications.

NASAA and state securities regulators

NASAA's Investment Adviser Section has published compliance guidance on AI, which says "it is not intended as legal advice." It says AI-driven marketing, client communications and investment recommendations "should be reviewed by a compliance officer for accuracy before being disseminated," and that advisers "must maintain documentation of the review of any AI-generated content for examination purposes."

A tracking routine for the firm

1. Keep an inventory of AI tools and their uses. The RIA compliance page has inventory language.
2. Mark each use as drafting for a person who decides, or as scoring or deciding about a client, prospect or applicant.
3. For each scoring use, record where the affected people live, who reviews the output, and whether that person can change the decision. Colorado's exclusion and California's definition both turn on those facts.
4. Put January 1, 2027 on the compliance calendar, and recheck each official source here at the annual compliance review.