Resources / State AI Law Trackers / Financial Services
State AI Law TrackersFinancial ServicesCredit Unions and Lenders
State AI Law Tracker for Credit Unions
The state AI and privacy laws most likely to affect credit unions, what each one requires, their status, and when each takes effect.
The short answer
Most state AI laws affecting credit unions fall into three groups: rules on automated decisions in lending and other consequential decisions, such as Colorado’s; rules on AI in hiring, such as Illinois’s and New York City’s; and disclosure rules for AI interactions, such as Utah’s. Many state privacy laws exempt GLBA-covered institutions or data, but AI laws often have narrower exemptions, so each must be checked for credit unions with members or employees in that state.
Status at a glance
Colorado
Automated decisions
Effective soonJan. 1, 2027
California
Automated decision rules under the CCPA
Effective soonJan. 1, 2027
Illinois
AI in employment decisions
In effectJan. 1, 2026
Texas
Responsible AI Governance Act
In effectJan. 1, 2026
Utah
AI interaction disclosures
In effect2024, amended 2025
New York City
Bias audits for hiring tools
In effect2023
What each law means for credit unions
| Jurisdiction | Law | What it covers | What credit unions should do |
|---|---|---|---|
| Colorado | SB 26-189 | Automated decision-making technology in consequential decisions, including lending | Prepare disclosures and post-decision explanations for Colorado members. |
| California | CCPA automated decision-making regulations | Notices, opt-outs, and access rights for certain automated decisions | Confirm which data falls outside your GLBA exemption, such as marketing and employee data. |
| Illinois | Amendments to the Illinois Human Rights Act | Discrimination and notice when AI is used in employment decisions | Review AI hiring and HR tools and give the required notice to Illinois employees and applicants. |
| Texas | Texas Responsible AI Governance Act | Prohibited AI practices and government AI use | Confirm no AI use falls into a prohibited category. |
| Utah | Utah Artificial Intelligence Policy Act | Disclosure that a consumer is interacting with generative AI in certain situations | Disclose chatbot use to Utah members, especially when asked. |
| New York City | Local Law 144 | Independent bias audits and notices for automated hiring tools | Audit any automated hiring tool used for New York City positions. |
Upcoming dates
- Jan. 1, 2026
Illinois and Texas
Illinois employment AI rules and the Texas Responsible AI Governance Act take effect.
- Jan. 1, 2027
Colorado and California
Colorado’s automated decision rules and California’s automated decision requirements take effect.
- Ongoing
New legislation
Several states consider new AI bills each session. We update this tracker as laws pass.
Frequently asked questions
Do GLBA exemptions cover state AI laws?
Not always. Many state privacy laws exempt GLBA-covered institutions or data, but AI-specific laws often have narrower exemptions or none, and employee data is usually outside GLBA entirely.
Which laws apply to a credit union with members in many states?
Generally, the laws of the states where your members or employees are located, not just where you’re headquartered. Start with the states where you have the most members and staff.
More Guides for Credit Unions and Lenders
- AI Regulation Map for Credit Unions
- AI Use Policy Guide for Credit Unions
- AI Risk Register for Credit Unions
- AI Vendor Assessment Checklist for Credit Unions
- AI Governance Blueprint for Credit Unions
- AI Training Guide for Credit Unions
- AI Impact Assessment Example for Credit Unions
- AI Incident Response Playbook for Credit Unions
- AI Board Oversight Guide for Credit Unions
- Privacy Program Guide for Credit Unions
- AI Contract Clause Library for Credit Unions
- AI Use Case Catalog for Credit Unions
- Data Protection Assessment Template for Credit Unions
- AI Tabletop Exercise Scenario for Credit Unions
Sources
- Colorado SB 26-189 (2026)
- California Consumer Privacy Act regulations on automated decision-making technology
- Illinois Human Rights Act, as amended by HB 3773
- Texas Responsible AI Governance Act, HB 149 (2025)
- Utah Artificial Intelligence Policy Act, as amended
- New York City Local Law 144 of 2021
How this guide is built
Built from primary sources: statutes, regulations, standards, and agency guidance. Our team reviews each industry’s legal summary every quarter and updates guides when requirements change.
Cite this guide
Cogent Assurance. (2026). State AI Law Tracker for Credit Unions. Cogent Assurance Resource Center. https://cogentassurance.com/resources/state-ai-law-tracker-credit-unions
Report an issue
See something out of date or incorrect? Tell us and we’ll review it.
Report an issue with this guideThis guide is general information for planning purposes. Laws and guidance change, so confirm current requirements before acting. It is not legal advice. For legal advice about your organization, consult a licensed attorney.
Services that help
AI Governance Readiness Assessment
A gap analysis of your AI governance against the NIST AI RMF, with a prioritized plan for what to fix first.
AI Bias Audit for Hiring Tools
An independent bias audit of AI tools used in hiring and promotion, including audits required in New York City.
AI Governance Essentials
Monthly AI governance support from our team: tool reviews, policy updates, and register upkeep.
Talk through your AI and privacy questions
Tell us what you're working on, and we'll reply within one business day.