There is no single federal AI law — there's a fast-moving patchwork of state rules and federal enforcement, and most owners assume none of it reaches a business their size. That assumption is the exposure. The law that already exists has no headcount threshold, your larger clients push their obligations into your contracts, and the comprehensive state laws are arriving on hard dates in 2026. This check tells you, in about three minutes, where your shop stands.
Built by Cibi Creative · Systems-First AI Advisory · cibicreative.com
Using AI doesn't suspend the rules you already operate under. The FTC enforces against unsubstantiated "AI-powered" claims, with civil penalties up to $53,088 per violation (2026). Federal anti-discrimination law reaches AI-assisted hiring and lending. Sector privacy laws — HIPAA, GLBA, FCRA — apply based on the data you hold, not your headcount.
Your larger, regulated, or government counterparties are covered — and the fastest way for them to prove it is to require evidence from you: AI governance attestations, tool inventories, and data-handling reps inside contracts and vendor questionnaires. You inherit obligations you never legislated.
Illinois (HB 3773) and California's privacy regulations took effect Jan 1, 2026. Colorado's high-risk AI obligations take effect June 30, 2026. California's automated-decision rules phase in through 2027. Texas's law took effect Jan 1, 2026 (narrowed, mostly governing public-sector use). A December 2025 federal executive order directs review of state AI laws and may redraw the map again. Betting on which rule survives is not a strategy. Documented governance you can defend is.
This is a readiness self-check, not a legal or compliance determination. It surfaces where a small business's AI governance is likely exposed under the emerging U.S. patchwork — including the Colorado AI Act (SB 24-205, effective June 30, 2026, currently under active revision), Illinois HB 3773 (effective Jan 1, 2026), California's CPPA/CCPA regulations (effective Jan 1, 2026, with automated-decision obligations from Jan 1, 2027), and Texas's Responsible AI Governance Act (HB 149, effective Jan 1, 2026) — alongside federal enforcement of existing law (FTC Act §5; federal anti-discrimination and sector privacy laws) and contractual flow-down from larger or regulated counterparties. Thresholds and exemptions vary by law and may change. Some small employers are exempt from parts of these laws — for example, Colorado exempts employers under 50 that do not train AI on their own data — which narrows one channel but does not touch the others. This tool does not certify compliance, constitute legal advice, or substitute for review by qualified compliance and legal counsel. Cibi Creative is a vendor-neutral advisory practice and earns no tool commissions.