Rules
Texas and Colorado AI Laws: What They Mean for Algorithm Audits
Texas and Colorado both regulate AI, but neither requires a formal audit of a social feed ranking system. Here is what each statute covers and where platform ranking sits.
What to take away
- Texas HB 149 (the Texas Responsible Artificial Intelligence Governance Act) took effect on January 1, 2026. It bans specific uses of AI, but it does not require an algorithmic impact assessment or an audit.
- Colorado repealed and reenacted its 2024 AI law through SB26-189, signed on May 14, 2026. Most of the new duties start on January 1, 2027, and the text contains no impact assessment or audit requirement.
- Colorado's definition of a "consequential decision" lists advertising, marketing, differentiated product recommendations, search and content moderation as exclusions, so ordinary feed ranking falls outside it.
- Both laws are enforced by the state attorney general, with a 60-day window to cure a violation in most cases.
- A platform ranking system can still be examined under these laws if it is used for hiring, lending, housing or a similar decision, or if a Texas investigator asks about it.
Why people ask about audits under these two laws
Colorado's first statute, SB24-205, was widely described as the first comprehensive US state AI law, and the word "audit" then spread to coverage of every state bill. Teams that work on social media ranking and recommendation started asking whether they now owe regulators a documented review of their feed models.
The short answer from the enacted text is no. The texts are narrow, and Colorado changed its law in 2026, so older explainers describing impact assessments are out of date. For the federal side, see how FTC algorithm claims rules shape social media marketing and the piece on San Francisco and Washington algorithm regulation.
What Texas HB 149 requires
HB 149 adds a new subtitle to the Texas Business & Commerce Code. It applies to developers and deployers of AI systems and defines an "artificial intelligence system" broadly: a machine-based system that infers from its inputs how to generate outputs such as content, decisions, predictions or recommendations. A feed ranking model could fit that wording, so scope is not the limiting factor. The limiting factor is what the law forbids.
The prohibited practices in the enrolled text are specific:
- Developing or deploying an AI system that intentionally aims to incite or encourage self-harm, harm to another person or criminal activity.
- Developing or deploying an AI system with the sole intent to infringe a person's rights under the US Constitution.
- Developing or deploying an AI system with the intent to unlawfully discriminate against a protected class. The statute says a disparate impact is not sufficient by itself to show intent.
- Government-only rules on social scoring and on identifying people through biometric data.
There is also a disclosure duty, but it applies to governmental agencies that offer an AI system meant to interact with consumers, and to health care providers using AI in a service or treatment. A private social platform is not covered by that duty.
The structure matters for audits. The statute is intent-based. It does not instruct a company to measure outcomes, test for bias on a schedule or file an assessment. Nothing in the text creates a general audit mandate for ranking systems.
How the attorney general can still look inside a system
Texas gives the attorney general exclusive enforcement authority and no private right of action. The attorney general must keep an online complaint mechanism. If a complaint alleges a violation, the attorney general may issue a civil investigative demand and ask for a high-level description of the system's purpose and deployment context, the type of training data, input categories, outputs, performance metrics, known limitations and post-deployment monitoring and user safeguards.
That request is the nearest thing in the statute to an audit trail. A company is not required to produce such a file in advance, but a team that keeps one will answer a demand faster.
Penalties and defenses in Texas
Before suing, the attorney general must send written notice of the specific provisions allegedly violated. The company then has 60 days to cure and to provide a written statement with supporting documentation and internal policy changes. If a violation is not cured, the civil penalty is:
Violation type / Civil penalty
- Curable (or breach of a cure statement)
- $10,000 to $12,000 per violation
- Uncurable
- $80,000 to $200,000 per violation
- Continuing violation
- $2,000 to $40,000 per day
The statute presumes a person used reasonable care. A defendant cannot be held liable if another party misuses the system in a prohibited way, or if the defendant finds a violation through feedback, adversarial or red-team testing, state agency guidelines, or an internal review where it substantially complies with the latest NIST generative AI risk management profile or another recognised framework. The attorney general also may not seek a civil penalty over a system that has not been deployed.
Testing and framework alignment are therefore rewarded as a defense, not required as a duty. That is the closest Texas comes to encouraging audits.
What Colorado now requires after SB26-189
Colorado's original law, SB24-205, was delayed once to June 30, 2026 by a special-session bill signed on August 28, 2025. The 2026 session then passed SB26-189, "Automated Decision-Making Technology," which repeals and reenacts the earlier consumer protections. The governor signed it on May 14, 2026.
The new law centres on "automated decision-making technology" that materially influences a "consequential decision." A consequential decision concerns access to, eligibility for or compensation for one of seven covered domains: education, employment, residential real estate, financial or lending services, insurance, health care services, and essential government services and public benefits.
The text also excludes several categories from "consequential decision," including advertising, marketing, differentiated product recommendations, search and content moderation, as well as cybersecurity, spam filtering and fraud prevention tools. A social feed, a recommendation row or a search result is therefore outside the law's reach as such.
Duties that apply to covered systems
For a covered system, the law requires:
- Developers to give deployers documentation and to keep compliance records for at least three years.
- Deployers to give clear and conspicuous notice before using the technology in a consequential decision, and, within 30 days after an adverse decision, a plain-language description of the decision and the system's role.
- Consumer rights to access and correct personal data used and to ask for human review after an adverse outcome.
The attorney general must adopt rules on post-adverse-outcome disclosures by January 1, 2027. Most provisions take effect on January 1, 2027 and apply to consequential decisions made on or after that date.
Searching the enacted text for "impact," "bias," "testing" and "audit" returns nothing. The 2024 law's impact assessment and risk management concepts did not carry into the replacement.
Enforcement runs through the Colorado Consumer Protection Act, with exclusive attorney general authority and no new private right of action. Before enforcement, the attorney general issues a notice of violation where a cure is possible, and the company has 60 days to cure. No cure period is required if the violation was knowing or repeated.
Where platform ranking systems actually sit
Putting the two statutes together gives a practical map.
| Use of a ranking or scoring model | Texas HB 149 | Colorado SB26-189 |
|---|---|---|
| Ordering a public feed or recommending videos | In scope as an AI system, but only prohibited uses matter | Excluded (recommendations, search, content moderation) |
| Ranking job applicants on a recruiting platform | Intent-to-discriminate rule applies | Covered if it materially influences an employment decision |
| Scoring creators for a lending or insurance product | Intent-to-discriminate rule applies, with financial and insurance carve-outs | Covered domain |
The pattern is consistent: the laws follow the decision, not the algorithm. A platform whose model orders posts has little exposure under either statute. A platform that lets an automated score shape who gets a job, a loan or housing has real exposure in Colorado from 2027, and an intent-based exposure in Texas today.
These laws do not create public logs of feed changes or a way for creators to demand an explanation of reach. For that, see how feed algorithms work and the ranking signals explainer.
