For a US small business (under about 50 people) the 2026 state AI laws impose far less than the headlines imply: California's SB 53 applies only to frontier model developers (above ~10^26 training operations or >$500M revenue) and not to AI users, Colorado's comprehensive law was repealed, narrowed, and delayed to 1 January 2027 by SB 26-189 (signed 14 May 2026), Texas's Responsible AI Governance Act (effective 1 January 2026) is intent-based rather than paperwork-based, and no federal AI law is in force, so the proportionate response is a short list — know which states you actually touch, confirm you are a deployer not a frontier developer, adopt basic disclosure hygiene, and never deploy AI to deceive or discriminate — rather than an enterprise-scale compliance programme.

Anchored on: California SB 53 frontier-developer thresholds (Brookings; CA Legislative Information), Colorado SB 26-189 repeal-and-reenactment signed 14 May 2026 delaying to 1 January 2027 and removing the duty of care / risk-management / impact-assessment obligations (Crowell & Moring), Texas Responsible AI Governance Act effective 1 January 2026, broad in reach but intent-based and AG-enforced with a cure period (Norton Rose Fulbright), and the absence of an in-force federal AI law given the non-binding 20 March 2026 White House framework and the non-enactment of the proposed state-law moratorium (Holland & Knight; King & Spalding). Operator-register advisory sized for a sub-50-person deployer; the claim is the mostly-exempt reading plus the four-item short list, not legal advice and not a claim that no small business ever has an obligation (a business serving Texas residents is within TRAIGA's intent-based prohibition; an EU-facing business is separately within the EU AI Act, which did not retreat). The original Colorado law's smaller-employer carve-outs are referenced as additional relief, not as the load-bearing point. VERIFIED 2026-06-02 via Brookings (SB 53 frontier-only thresholds), Crowell & Moring (Colorado SB 26-189 scope + 1 Jan 2027 date), Norton Rose Fulbright (TRAIGA broad reach + intent-based + 1 Jan 2026 effective), and Holland & Knight / King & Spalding (no in-force federal floor). 45-day review cadence (17 Jul 2026), set to track the moving US state picture. Trigger conditions: (1) Congress enacts a federal AI law, changing the no-federal-floor point; (2) Colorado's reenacted law is amended again before 1 January 2027; (3) a state passes a comprehensive small-business AI obligation on the original Colorado model, lengthening the short list; (4) Texas AG enforcement that clarifies the intent-based prohibition for deployers. Sibling: the enterprise version AM-197 (/us-ai-regulation-federal-state-standoff/). Related: the EU small-business deployer duties OPS-080 (/operators/eu-ai-act-small-business-deployer-duties/, the regime that did not retreat) and the AI client-deliverable contract clauses piece (/operators/ai-client-deliverable-contract-clauses/).