AI rule changes small businesses should know: November 2026
Every month I read through what changed in AI rules and pull out what a small business owner would want to know about. This is a description of the news, not legal advice. Whether a rule applies to your business is a question for your attorney. Everything below was checked on October 17, 2026, with the source linked.
Already in effect
Connecticut: AI subscription disclosures (since October 1, 2026). Connecticut's SB 5 requires large consumer AI providers, the ones with more than one million monthly users, to give written notice of key subscription terms, such as usage limits, and to get the customer's acceptance before charging or renewing. Its employment section takes effect a year later, on October 1, 2027. (Covington, Inside Privacy)
Illinois: notice when AI influences employment decisions (since January 1, 2026). Illinois amended its Human Rights Act to cover AI that influences hiring, promotion, discipline and similar decisions. Draft rules from the Illinois Department of Human Rights describe what the notice would contain: the tool's name, what it is used for, and a contact. The rules are still in draft. (Hinshaw & Culbertson)
EU: chatbot and AI content transparency (since August 2, 2026). Article 50 of the EU AI Act asks for chatbots to tell people they are talking to AI and for deepfakes to be disclosed. It matters if you serve customers in the EU. (Goodwin)
Passed and waiting on a governor
Pennsylvania: AI in advertising (SB 806). The House passed it on October 7, 2026, after the Senate passed it in June. It would require a clear disclosure when an ad uses AI-generated or heavily AI-modified content in a way that could mislead people about a product. Text-only content, parody and obvious fiction are excluded. As of October 9, the governor had not acted. If signed, it takes effect 60 days later. (AI Policy Desk)
New York: several AI bills on the governor's desk. Among them are a notice that generative AI output may be inaccurate (A 3411) and provenance data for synthetic content (S 6954). The governor has until December 31 to act. (Transparency Coalition, October 16 update)
Coming January 1, 2027
Colorado: the rewritten AI law. Colorado replaced its 2024 AI Act with SB 26-189, which takes effect January 1, 2027. It leans toward disclosure and recordkeeping, with three years of records and a 60-day window to fix a violation before enforcement. (Reinhart)
California: automated decision rules under the CCPA. Businesses covered by the CCPA that use automated decisionmaking technology for significant decisions about people, such as lending, housing, employment or healthcare, have a January 1, 2027 compliance date for notice, opt-out and access requirements. (Sourcepoint)
The federal picture
There is still no federal AI statute. Executive Order 14365, signed December 11, 2025, directed the Justice Department to challenge state AI laws. The clearest case so far is Colorado: the United States joined xAI's lawsuit against the 2024 Colorado law in April 2026, before Colorado replaced that law in May. State laws keep passing in the meantime. (AI Laws by State)
What I would do this month
None of these rules needs a big project to start with. Most of them ask the same first question: which AI tools do you use, and what do they touch? If you can answer that in writing, you are ready for whatever your attorney tells you applies.
- List your AI tools and the client data that goes into them. The free AI tool list takes about 10 minutes.
- Note which tools touch hiring, staff decisions, ads or customer chat. Those are the areas this month's rules focus on.
- Keep the list dated. Colorado's new law asks for three years of records. A dated list is easier to keep than to rebuild.
If you want the list to become a register, a usage policy and a staff card, the AI Use Register Kit is $49. All the rule summaries live on the AI rule changes page, each with its last-checked date.