Which AI laws actually apply to you?

Why the answer depends on the decision, not the model

Almost every framework here classifies by consequence. The EU AI Act's Annex III does not list model architectures; it lists employment, creditworthiness, essential services, education access, insurance pricing and biometric identification. The Colorado AI Act turns on whether the system is a substantial factor in a consequential decision. Title VII does not mention algorithms at all — it reaches any selection procedure with an adverse impact. The result is that two companies running the identical model can sit in different tiers, and that swapping vendors changes almost nothing.

The other thing the frameworks share is that using someone else's system does not move the duty upstream. Article 26 gives deployers their own obligations, Local Law 144 lands on the employer, and an FCRA adverse-action notice has to name the specific principal reasons rather than the vendor.

Common questions

Which laws does this checker cover?

The EU AI Act (prohibited practices, Annex III high-risk duties, deployer duties, Article 50 transparency and the Article 4 AI literacy requirement), the Colorado AI Act, NYC Local Law 144, Illinois HB 3773 and BIPA, Texas TRAIGA, the Utah AI Policy Act, California's CCPA automated decision-making rules and AB 2013, plus the federal frameworks that reach AI without naming it: Title VII and the ADA for hiring, the FCRA for algorithmic scoring, the Fair Housing Act for tenant screening, the NAIC model bulletin for insurers, COPPA for children's products and FERPA for education records.

Does the EU AI Act apply if we are not in the EU?

It can. The Act reaches providers placing a system on the EU market regardless of where they are established, and it reaches providers and deployers outside the EU where the output of the system is used in the EU. Answer the jurisdiction question by where the affected people are, not by where you are incorporated.

What changed on 2 August 2026?

The bulk of the EU AI Act's Chapter III obligations for Annex III high-risk systems became applicable, alongside the Article 50 transparency duties for systems that interact with people or generate synthetic content. The prohibitions in Article 5 and the AI literacy duty in Article 4 had already been in force since 2 February 2025, and the general-purpose AI model obligations since 2 August 2025.

We bought the AI tool from a vendor — is this our problem?

Yes, in most of these frameworks. The EU AI Act gives deployers their own obligations under Article 26, including human oversight, log retention and telling affected people. NYC Local Law 144 applies to the employer using the tool, not the company that built it. Under Title VII the employer is liable for a discriminatory selection procedure whether or not it wrote the code. Vendor contracts move cost, not liability.

Is a bias audit the same thing as an impact assessment?

No. NYC Local Law 144 requires an independent bias audit computing selection and impact ratios by sex and race/ethnicity, published as a summary on your site. The Colorado AI Act requires an impact assessment — an internal document covering the purpose, known risks, data used, post-deployment monitoring and safeguards — refreshed annually and after substantial modification. An organisation hiring in both places needs both.

Does this replace legal advice?

No. This is a reading of published statutory and regulatory text, mapped to the description you gave. It is a starting checklist and a reading list, not an opinion on your facts, and it does not create a lawyer-client relationship.

Why does an accessibility company publish an AI compliance checker?

Because the same person owns both calendars. The compliance lead who is tracking the EU AI Act's August 2026 date is usually the one who also owes a European Accessibility Act statement that has been required since June 2025, and who is fielding ADA website demand letters in the US. If your result names the EU, the checker points you at both.