The United States has federal AI law, and the effort to impose a regulatory framework on AI is contested and far from settling. What has emerged instead is a patchwork of state statutes that look, at first, like they solve different problems.
California regulates the provenance of AI-generated content. Colorado and Texas regulate consequential AI decisions. Utah regulates disclosure in consumer interactions. Read them together and the divergence is on the surface. Underneath, they ask for the same thing.
Different laws, one requirement
California’s AI Transparency Act, which came into effect on August 2, 2026, requires large generative AI providers to offer a tool that reads embedded provenance data and reports whether content was created or altered by AI.
After January 1, 2027, it bars large platforms from stripping that data. Colorado’s AI Act requires deployers of high-risk systems to maintain impact assessments and documentation of how a system reaches consequential decisions about employment, lending, housing, or healthcare.
Texas’s Responsible Artificial Intelligence Governance Act, effective January 1, 2026, layers disclosure and recordkeeping obligations onto high-risk uses. Utah requires affirmative disclosure when a person is interacting with generative AI in a regulated service. The approaches all mandate that you must be able to establish where a piece of content, or a decision, came from.
The audit trail is the through-line
Strip away the sector-specific language and each statute is asking for an audit trail.
A content provenance record, an impact assessment, a decision log, a disclosure: each is a mechanism for answering the same question after the fact.
How did this output come to exist, and can you reconstruct the path back to its source? A law that lets a regulator trace an AI-generated image to its origin and a law that lets a regulator trace an adverse lending decision to its inputs both make traceability the test of compliance.
This principle already governs compliance decisions
Compliance and risk teams have lived with this problem longer than the current AI regulatory debates have existed.
A sanctions screen, a beneficial ownership determination, and a forced-labor finding are each only as defensible as their source.
When a regulator, an auditor, or a court asks how you reached a conclusion, “the model flagged it” is not a sufficient answer. The state laws now write that instinct into statute, across every sector they touch and regardless of which one governs a given decision.
Provenance is the product
This is one of the core principles Sayari is built on. The Commercial World Model resolves 12B+ primary-source records from 250+ jurisdictions.
Every entity, ownership link, and risk signal traces back to the government registry, trade record, or filing it came from. Each output is sourced, scored, and explainable, and it shows its work. That architecture was a deliberate response to the same failure the states are now addressing in law.
Generic AI produces fluent answers with no way to check them. In economic security and commercial risk, where decisions are mission-critical, an answer you cannot trace is a liability, not an efficiency.
The takeaway
The state AI law map will stay fragmented, and the federal debate over AI regulation could last for years. But the through-line and message from regulators is consistent.
Whether a law governs synthetic media or a lending model, it resolves to a single requirement: information and decisions without provenance cannot be trusted or legally defended.
Build to that standard to ensure you are compliant. The question every AI-assisted decision has to answer is the same: where did this come from, and can you prove it?
What teams should do now
Any AI-assisted decision in a regulated context should be reconstructable on demand. 3 practices help establish that capability.
- Anchor key decisions to primary sources: Each input should resolve to a government registry, a filing, or a trade record, not an unattributed model output.
- Capture and retain the full decision path: Log the model, the data used and timestamp decisions. Store the evidence for the required retention period.
- Prove you can reconstruct the decision on demand: Pull a past commercial decision and rebuild it end to end. If you cannot, the audit trail has a gap, and the gap is a liability.
FREQUENTLY ASKED QUESTIONS