Data Report · RedactSure Research
Chris Sowa · Founder, RedactSure
Published
Last updated
How Many AI Laws Require Human Review of AI Decisions?
Of the 45 AI laws enacted in California, Colorado, Illinois and New York in 2025 and 2026, 4 require a person to review the AI's decision, and 3 of those are Colorado's. Nationwide in 2025, 9 of more than 1,100 state AI bills required human review and 1 became law. Only 1 enacted law mentions AI agents.
Four. That is how many of the 45 artificial intelligence laws enacted in California, Colorado, Illinois and New York in 2025 and 2026 require a person to review or approve a decision the AI makes, by RedactSure's read of every AI bill on the four legislatures' own sites. Three of the four are Colorado's. Across all state legislatures in 2025, 9 of more than 1,100 AI bills required human review of AI decisions and 1 became law. The laws that did pass mostly require disclosure: telling people that AI is being used. The decision about who checks the AI's work is still being made inside each organization, not in statute.
Key findings
- Of 45 AI laws enacted in California, Colorado, Illinois and New York in 2025 and 2026, 4 require a person to review or approve an AI decision: 3 in Colorado and 1 in Illinois. California enacted 25 AI laws and 0 require human review (California Legislature, 2026; Colorado General Assembly, 2026; Illinois General Assembly, 2026; New York State Assembly, 2026).
- Across all state legislatures in 2025, 9 of 1,143 AI bills tracked by the National Conference of State Legislatures required human review or oversight of AI decisions, and 1 was enacted, Virginia HB 1642 on criminal justice risk assessments (National Conference of State Legislatures, 2025).
- Of the 45 enacted laws in the four states, 1 mentions AI agents, California SB 1159, which excludes autonomous agents from the definition of a person in public records law. Nationwide in 2025, 2 of 1,143 bills addressed AI software agents and neither was enacted (National Conference of State Legislatures, 2025; California Legislature, 2026).
- Disclosure is what passes: 14 of California's 25 enacted AI laws require telling people that AI is in use, against 0 that require a person to review its decisions (California Legislature, 2026).
- Federal regulators are only starting to name agents: 7 Federal Register documents mentioned AI agents or agentic AI in 2026 through October 27, and 6 in 2025, against 0 in 2023 and 2024. 270 documents mentioned artificial intelligence in 2026 (Office of the Federal Register, 2026).
How do the four states compare?
| State, 2025 to 2026 | AI bills introduced | Enacted | Vetoed | Enacted laws requiring human review | Enacted laws addressing AI agents |
|---|---|---|---|---|---|
| California | 58 | 25 | 6 | 0 | 1 |
| Colorado | 15 | 5 | 2 | 3 | 0 |
| Illinois | 96 | 9 | 0 | 1 | 0 |
| New York | 89 | 6 | 0 | 0 | 0 |
| Four states | 258 | 45 | 8 | 4 | 1 |
Counts are as of October 28, 2026. Illinois and New York list House or Assembly and Senate versions of the same bill separately; each measure is counted once. New York has 1 bill with the governor and 4 that passed both chambers but were not delivered, so its figures can still move. Colorado's 2025 count includes four special-session bills.
Colorado is the exception. Its three human-review laws are HB26-1139, which requires a person to review AI denials of health coverage; HB26-1195, which restricts AI in psychotherapy; and SB26-189, on automated decision-making technology. Illinois's one is SB 2909, on AI in teacher evaluations. California's six human-review bills either stalled in committee or, in one case, SB 903 on AI and mental health professionals, were vetoed.
What did the 2025 bills across all states require?
| Measure, NCSL 2025 table | Bills | Enacted |
|---|---|---|
| All AI bills | 1,143 | at least 100 |
| Government use of AI | 250 | 52 |
| Education | 165 | 27 |
| Health care | 152 | 20 |
| Disclosure that AI is in use | 76 | 8 |
| Impact or risk assessment | 16 | 2 |
| Human review or oversight of AI decisions | 9 | 1 |
| AI software agents | 2 | 0 |
The National Conference of State Legislatures tracked 1,143 AI bills in 2025 from all 50 states, the District of Columbia, Puerto Rico and the Virgin Islands. NCSL's table marks 183 as enacted or adopted, but that figure includes 52 resolutions and 27 appropriations bills; NCSL's own summary says around 100 measures became law, and 104 substantive bills in the table did, so this page says at least 100. The government, education and health rows are NCSL's own categories, and a bill can carry more than one. The last four rows come from reading every NCSL summary that matched a keyword set and keeping only the bills that fit. NCSL has no category for insurance or for automated decisions.
What did California pass in 2026?
California's two-year session ended in August 2026 and the governor's deadline to act was September 30, so every 2026 AI bill now has a final outcome. In 2026 the governor signed 17 AI bills and vetoed 3, on top of 8 signed and 3 vetoed in 2025.
| California, 2025 to 2026 session | Introduced | Enacted |
|---|---|---|
| All AI bills | 58 | 25 |
| Require disclosure that AI is in use | 27 | 14 |
| Government use of AI | 19 | 6 |
| Automated decisions about people | 15 | 4 |
| Limit the personal data AI may use | 10 | 4 |
| Require human review of AI decisions | 6 | 0 |
| Address AI agents | 2 | 1 |
The four data-protection laws are SB 574 on attorneys and generative AI, AB 1159 on student personal information, AB 1979 on AI in health care services and AB 1883 on workplace surveillance tools. The one human-review bill that reached the governor, SB 903 on AI and mental health professionals, was vetoed.
What do the numbers mean for risk and compliance leaders?
The laws that pass tell people AI is in use. They mostly do not say who checks what the AI decides, and almost none of them mentions agents, the software that reads a screen and takes an action on its own. An organization waiting for statute to define the human review step will wait a while longer; Colorado's health-coverage law is the closest model, and it covers one decision in one industry.
That leaves the control where it already sits, inside the workflow: which decisions the AI may make on its own, which ones a named person approves, and what record shows who approved what. The disclosure laws make one more thing true. Once an organization has to tell people that AI is in use, it also has to be able to show what the AI saw and did.
Methodology and limitations
Four sources were read on October 28, 2026. The National Conference of State Legislatures' Artificial Intelligence 2025 Legislation page, whose header says updated July 10, 2025, was parsed into one row per bill, 1,143 rows, with NCSL's status, categories and summary; keyword sets for agents, disclosure, human review and impact assessments were matched against titles and summaries and every match was read. California's official bill archive for the 2025 to 2026 session (5,065 bills) was searched for artificial intelligence, automated decision and generative AI in titles and Legislative Counsel's Digests, giving 62 matches, 3 passing mentions removed. Colorado (leg.colorado.gov), Illinois (ilga.gov) and New York (nyassembly.gov) were searched for the same terms plus algorithmic; 78, 118 and 289 candidate bills were read on their own pages. The Federal Register API was queried for "artificial intelligence," "AI agent," "AI agents" and "agentic" by calendar year, and the 13 agent documents from 2025 and 2026 were read in full.
Every bill was coded from its title and official summary for government use, education, health, automated decisions, AI agents, human review, disclosure and data protection. "Human review" means the bill requires a person to review, approve or be able to override an AI output or action. "Enacted" means signed, chaptered or became law on the legislature's own site; resolutions are not counted as laws. One coder read each bill, so the code counts are minimums. Keyword searches miss bills that use other terms. NCSL's 2025 table is a snapshot and NCSL had not published a 2026 page as of October 28, 2026. Illinois holds a fall veto session and New York's governor acts on passed bills through the end of the year, so those outcomes can change. The Federal Register counts are by quoted phrase and 2026 is partial.
Frequently asked questions
How many states require a human to review AI decisions?
Very few, and only for specific decisions. Of the AI laws enacted in California, Colorado, Illinois and New York in 2025 and 2026, four require human review, three of them in Colorado: AI denials of health coverage, AI in psychotherapy and automated decision-making technology. Illinois requires it for AI in teacher evaluations. Across all states in 2025, one of nine human-review bills became law, Virginia's on criminal justice risk assessments.
Do any state laws regulate AI agents?
Almost none yet. Of 1,143 state AI bills in 2025, two addressed AI software agents and neither passed. In the four states reviewed, one enacted law mentions agents, California SB 1159, and only to exclude autonomous agents from the definition of a person in public records law. Federal agencies published 13 Federal Register documents mentioning AI agents in 2025 and 2026, against none in the two years before.
What AI laws did California pass in 2026?
Seventeen were signed in 2026 and three vetoed, making 25 signed and 6 vetoed across the 2025 to 2026 session. Fourteen of the 25 require disclosure that AI is in use, four limit the personal data AI may use, and none requires human review of an AI decision.
How RedactSure Puts the Human Review Step in the Workflow
Four of 45 laws require a person to review the AI's decision. RedactSure makes it the default for every consequential action, whether or not a statute asks.
The environment that enforces this is built by RedactSure, an AI agent controls, governance and data protection company.
Before: an agent working a claims queue reads the member ID and the diagnosis on the screen and issues the denial on its own. Inside the governed environment: render-layer tokenization shows the agent MEMBER_001 in place of the identifiers, the work still gets done, and a named person approves the denial under Supervised Delegation. Every screen the agent saw, every action and every approval lands in the AI Control Record, which is also what a disclosure law asks an organization to be able to show.
RedactSure is deploying now with enterprise and government customers.
Everyone else controls where data can go. RedactSure controls what the AI can see.
See it on your own workflow
If a law in your state names a decision a person must review, that step can be in place before the AI starts. Bring one decision workflow and see, with test values, what the agent reads and who approves each step. Book a demo