A MITRE ATT&CK-style view of US state AI regulation: regulatory domains across the top, individual state laws as cells underneath. A law that touches more than one domain — like Connecticut's CART Act — appears in every column it actually applies to, the same way one technique can map to several tactics.
This tracker runs on the same regulatory-monitoring engine behind our GRC & Continuous Compliance retainer — built once, kept current, applied to your footprint.
| Law | Jurisdiction | Domains | Status | Effective | Enforcer | Private right of action |
|---|
Companion piece: the full plain-English write-up this matrix is built from covers Colorado, Texas, Illinois, California and Connecticut in narrative detail, plus why this isn't a temporary gap before federal rules arrive. Sources for every entry are cited in its detail panel. If any of this touches your stack, our AI Regulatory & Compliance Advisory service turns this tracker into an ongoing program for your footprint — or start with a free AI risk assessment.
Assess. Measure. Fortify.
Managed security for the AI era — assessed, assembled, and fortified.
Developed by HACKTRONIAN