How does state AI law reach older adults?
State AI law reaches older adults without naming them. No state has written an act aimed at older people; they are covered through categories like consequential decisions about health care and housing. Colorado’s act is the furthest along, and it was repealed and reenacted in 2026 with duties starting in 2027.
Search for state protections for older adults and artificial intelligence. You will find bills, hearings and press releases.
You will not find a state law written for them. Not one.
That is not a scandal. It is a design choice, and understanding it changes what you go looking for.
Contents
Why is state law where AI regulation is actually happening?#
Because the states moved and Congress did not.
Artificial Intelligence (AI) landed on every statehouse desk at once, and on one desk in Washington that has to agree with itself before it moves. The statehouses moved first.
That produces a map rather than a rule. Your position depends on your address.
It also means advice travels badly. A woman on the phone to her sister describes what she was entitled to. You cannot ask for it. Neither of them suspects a thing, because the company and the software were identical on both sides of the line.
Think of it like a prescription that is over the counter in one country and needs a doctor in the next. Same box. Same pills. The rule attached to it changed at a line on a map.
So the first move with any claim about AI rights is to ask which state it came from. The second is to ask when it starts.
Both questions take a minute. Skipping them can cost a day, at the worst possible time, on an afternoon when somebody is already worried about a parent.
The habit is worth building before you need it. Write the state and the start date at the top of any note you keep. Everything else in this subject sits on those two facts.
Which rights those two facts unlock, and which have actually started, is the frame this page sits inside. Start there.
What happened to the Colorado AI Act?#
It was passed, postponed, and then replaced. Most coverage stopped after the second step.
Colorado enacted an act about artificial intelligence in 2024. Its start date was later pushed back, and that postponement is the version most summaries describe.
Then the legislature went further. The 2026 act states plainly what it does to its predecessor. It repeals and reenacts those provisions with new requirements regarding the use of automated decision-making technology in consequential decisions.
Repeals and reenacts. Not delays.
So the 2024 version is not a law sitting in a waiting room. It is gone, and something else stands in its place. Anything you read about it describes a rule that no longer exists.
That distinction decides whether a summary is useful or misleading. A page describing Colorado as having postponed its act until the middle of 2026 was written before the replacement. Its account of the duties is not the account of the duties that will actually arrive.
Read the date on the commentary before you read the commentary. It is the cheapest check available and almost nobody does it.
This is not a criticism of the people who wrote those summaries. They were accurate on the day they were published, and a legislature moved underneath them afterwards.
It is a warning about how this subject ages. A page about an AI law can be eighteen months old and still read as though it were written this morning. Nothing announces the shift.
What does Colorado SB 26-189 require, and when?#
New duties, on three different parties, from 1 January 2027. None of it reaches you today.
Nothing in it binds anybody today. That is the single most important sentence on this page and it is the one most likely to be lost.
From that date, a developer of a covered system used to materially influence a consequential decision must give a deployer technical documentation. The act names what that documentation covers: intended uses, categories of training data, known limitations, and instructions for appropriate use and human review.
A deployer takes on a different duty, owed to the person rather than to the supplier.
Consumers gain rights of their own. The right to request their personal data. The right to correct personal data that is factually incorrect. The right to request meaningful human review and reconsideration after a decision that went against them.
The attorney general must write clarifying rules by that same date, which is a sign the legislature knew the text alone would not be workable.
All of that is next year. Say so out loud whenever you repeat it.
There is a reason to learn it now anyway. A duty arriving in January is a duty somebody is already building for, and the questions you can usefully ask change before the date does.
Ask now. Ask what they are preparing.
A plan or a provider that has thought about this will have an answer, and one that has not will tell you something else about how the year is going to go. Neither response is a legal right. Both are information.
Diary the date. Then ask again.
The rules an attorney general writes can arrive after the act, and they carry the working detail. Nobody sends them to you, so a note in a diary is the only reliable way to catch them.
Set a reminder. Twice a year is enough.
The people who get the most out of a new rule are not always the ones who read it first. They are the ones who asked early and wrote down the answer they were given.
Then they came back on the day it started, with the note still in hand. That is the whole advantage, and anybody can have it.
Do any state AI laws actually mention older adults?#
No, and this section replaces a question I could not answer honestly.
The row for this page originally asked what California changed in 2026. I could confirm a California measure exists and could not open its operative text from the state’s own site, which returns a page shell with no law in it. So I am not going to describe requirements I have not read.
The better question, and the one this page is actually about, has a clear answer. No state has written an artificial intelligence act aimed at older people as a group.
They are reached through categories instead. The category doing most of the work is the consequential decision, meaning a decision about health care, housing, insurance, employment or credit.
Older adults meet many of those decisions. So a general rule lands on them heavily without naming them once.
Think of it like rain falling on a garden. Nothing was aimed at any particular plant. Some things get watered anyway, and some do not.
That has a consequence worth carrying. A protection you were never named in can be narrowed by an argument that has nothing to do with you.
Say a legislature decides the rules are too heavy on small employers. The fix is written about employers. It lands on every older person whose decision runs through one of those systems, and nobody in that debate was thinking about them.
There is an upside to the same design. A rule written broadly reaches situations nobody anticipated, including yours. Being unnamed cuts in both directions.
So watch the categories rather than the headlines. The word consequential does more for you than the word senior.
What does a state AI law typically cover?#
Three parties.
- The developer, who builds it.
- The deployer, who uses it on you.
- The consumer, who gets a right.
The developer duties are the heaviest and the least visible. Paper about training data and known limitations goes to a business, not to a person. You will never see it.
The deployer duties are where a person first appears in the text. Something must be told to somebody. That somebody is you.
The consumer rights are the thinnest layer. They are also the only one you can use yourself. Ask for the data. Correct it. Ask a human to look again.
Like a building code, most of the weight sits with the architect and the builder, and the person in the room gets a smoke alarm and a phone number to call. That is not a failure of the code. It is where each duty can actually be enforced.
Most of the weight sits upstream here too. It is the same reason distribution decides whose values win in the models themselves. Whoever ships the default sets it for everybody downstream. Defaults travel.
Knowing which layer your question belongs to saves a day. A complaint about training data is not a complaint your clinic can answer, and the person at that desk will not know how to say so.
Match the question to the party. Developer for how it was built. Deployer for how it was used on you. Yourself for the record it holds.
How do state AI laws and federal rules interact?#
They sit in layers rather than competing.
Federal health privacy law governs who may hold and share medical information. It does that whether or not software was involved, and it turns on the identity of the holder.
A state AI act governs something else. How an automated system may be used to reach a decision about you, and what you must be told afterwards.
One is about custody. The other is about conduct.
A single bad afternoon can involve both. A denial produced by a system, sitting in a record held by a plan, raises a privacy question and a decision question at once, and they have different answers and different offices.
Reading one to settle a question belonging to the other is a reliable way to reach a confident wrong answer.
A route is only as good as the door that actually opens. That is the local case of weak links deciding an outcome. Find the weak one.
So sort the question before you chase it. Is this about who has my information, or about how the decision was made. Then take it to the right layer.
There is one more layer worth naming, because it looks like the first door and for this question it is the wrong one. The state attorney general.
Attorneys general enforce these acts. They do not adjudicate your particular denial. A complaint to that office is a signal about a pattern rather than a route to a reversal, and it is worth sending for exactly that reason.
So send it. Just do not wait on it.
The reversal, if one is coming, comes from the appeal route inside the plan or the programme. Those run on their own clocks and they do not pause while a regulator reads your letter.
Both things can be true at once. Your complaint may help the next person and do nothing for you. That is not a reason to skip it. It is a reason not to substitute it for the appeal.
A family with a denial letter and twenty minutes can do that sorting before anybody picks up a phone. It is the cheapest thing in this whole subject. It is also the step nearly everyone skips.