AI Compliance Documents — State AI Compliance Templates
California CCPA ADMT
California's new ADMT regulations require documented risk assessments starting January 1, 2026 and consumer-facing opt-out and notice requirements by January 1, 2027. If the CCPA applies to your business and you use automated systems to make decisions about consumers, this package covers both deadlines.
How It Works
Three steps from zero to fully documented.
Choose Your Regulation
Select the state regulation you need to comply with. Answer a short questionnaire about your company and AI systems. Takes about 10 minutes.
Pay Once
One-time purchase, no subscription. Secure checkout via Stripe. Your answers generate customized documents — never stored or shared.
Download Your PDFs
Your complete compliance package downloads instantly. Post, distribute, and file. You're done.
How We Build Our Templates
Every document starts with the actual enacted law — not summaries, not AI-generated overviews.
Read the enacted statute
Every template starts with the actual law text from .gov sources
Verify every citation
Section numbers, penalty amounts, effective dates — all checked against primary sources
Flag what's pending
If implementing rules haven't been published yet, we say so explicitly
Templates, not legal opinions
We document what the law requires. Your attorney verifies it applies to you.
“I built this because I needed it myself. I'm a small business owner using AI, and I couldn't find compliance documentation I could actually afford. So I built it — using the same approach I used building HIPAA compliance software for one of the country's most respected hospital systems.”
Cameron, Founder · Read our story
What happens if you don't comply?
AI regulations aren't suggestions. They're law, with real enforcement teeth and penalties up to $200,000 per violation.
Employee & Consumer Complaints
In most states, employees and consumers can file complaints with the Attorney General or a state agency. If a complaint leads to an investigation, the first thing the state asks for is your documentation. Having it ready is your strongest first response.
State Enforcement
Attorney General offices enforce these laws. Penalties range from $5,000 per violation (Connecticut) to $70,000 per violation (Illinois). Several states assess penalties per violation and per person affected — so for automated systems that process many people, the numbers add up quickly.
The Cost of Starting from Scratch
Hiring a law firm to build a compliance package from scratch typically runs $5,000 to $25,000. Our templates give you a professional, statute-based starting point for $49–$997 — and your attorney can review and finalize them in a fraction of the time.
Compliance Document Library
State-specific and universal AI compliance packages. Each includes customized documentation, instant download.
These Laws Are In Effect Now — Penalties Are Live
Last updated March 15, 2026
Illinois HB3773
Illinois
In effect since January 1, 2026
$70,000 per violation
California CCPA ADMT
California
In effect since January 1, 2026
$7,500 per intentional violation
Colorado SB 24-205
Colorado
Effective June 30, 2026
Up to $20,000 per violation ($50,000 for age 60+)
Healthcare AI
Federal
Effective Available now (COPPA deadline April 22, 2026)
$2.1M per HIPAA violation category
Not sure where to start?
Using AI in hiring?
If you have employees in Illinois, NYC, or Colorado and use automated tools in hiring decisions:
Collecting consumer data?
If you use customer data for targeting, profiling, or automated decisions:
Don't know what you have?
Start by inventorying your AI systems before worrying about which laws apply:
NYC Local Law 144
NYC Admin. Code § 20-870 et seq.
If you hire in New York City and use any automated tool to screen or evaluate candidates, you need an annual bias audit and public summary o...
Texas TDPSA
Tex. Bus. & Com. Code Ch. 541
The Texas Data Privacy and Security Act requires data protection assessments for targeted advertising, data sales, and profiling. If your bu...
Delaware PDPA
Del. Code tit. 6, ch. 12D, §§ 12D-101 through 12D-111
Delaware has the lowest applicability threshold of any state privacy law — just 35,000 consumers. If your business has any meaningful presen...
Multi-State Profiling Bundle
VA, CT, CO, OR, TX, MT, DE, MN, MD, IN + more
If you operate across multiple states and use customer data for profiling, targeting, or automated decisions, you probably need assessments ...
Employer AI Disclosure Kit
IL HB3773 + NYC LL144 + CO SB24-205
If you hire in Illinois, New York City, and Colorado, you need AI disclosure documents for all three. This bundle covers all three jurisdict...
Virginia CDPA
Va. Code §§ 59.1-575 through 59.1-584
If your business processes personal data from Virginia consumers and uses it for targeted ads, profiling, or automated decisions, the VCDPA ...
Connecticut CTDPA
Conn. Gen. Stat. §§ 42-515 through 42-525
Connecticut's privacy law has been in effect since 2023 and requires data protection assessments for profiling, targeted advertising, and se...
Oregon CPA
ORS §§ 646A.570–646A.589
Oregon's Consumer Privacy Act requires data protection assessments for profiling that presents risk of harm to consumers. If your business p...
Minnesota MCDPA
Minn. Stat. Ch. 325M (§§ 325M.10–325M.21)
Minnesota's privacy law includes specific AI provisions — including algorithmic governance documentation requirements — that go beyond most ...
Illinois HB3773
775 ILCS 5/2-102(L)
If you're an Illinois employer using any software that helps screen, rank, or evaluate job candidates, this law applies to you. HB3773 (775 ...
California CCPA ADMT
Cal. Civ. Code § 1798.100 et seq.
California's new ADMT regulations require documented risk assessments starting January 1, 2026 and consumer-facing opt-out and notice requir...
Colorado SB 24-205
C.R.S. § 6-1-1701 et seq.
Colorado's AI law takes effect June 30, 2026 and requires businesses using AI in consequential decisions — hiring, lending, insurance, housi...
EU AI Act
Regulation (EU) 2024/1689
The EU AI Act is the world's first comprehensive AI regulation. If you develop or deploy high-risk AI systems that touch EU markets, you nee...
EEOC AI Hiring
Title VII, ADA, ADEA + EEOC AI Guidance
Even without a new federal AI law, the EEOC enforces existing anti-discrimination law when AI is involved in hiring. If your AI tools produc...
NIST AI RMF
NIST AI 100-1
The NIST AI Risk Management Framework is voluntary, but it's referenced in multiple state laws as a compliance benchmark — and Colorado's la...
AI Use Policy
NIST AI RMF + EEOC Guidance
An internal policy that tells your employees what they can and can't do with AI tools at work. Covers approved uses, prohibited uses, data h...
Vendor Due Diligence
NIST AI RMF MAP Function
Before you buy or renew an AI tool, you should know whether it can discriminate, what data it uses, and whether the vendor can provide the d...
Bias Audit Template
NYC LL144 + EEOC + NIST AI RMF
A structured template for documenting whether your AI tools produce discriminatory outcomes. Required annually for NYC employers under Local...
AI Incident Response
NIST AI RMF + CA TFAIA + EU AI Act
What do you do if your AI system makes a bad decision, produces discriminatory outcomes, or fails? This is a documented plan for how your or...
Manager Training Kit
Framework: NIST AI RMF + EEOC AI Guidance + State Employment Laws
When your managers need to explain to their teams that the company uses AI and what that means, these are the materials they need. Talking p...
Annual Review Checklist
Framework: Multi-State AI Compliance Annual Review Best Practices
Laws change. Your AI tools change. Your compliance documents need to keep up. This is a structured annual review checklist that walks you th...
Board AI Summary
Framework: NIST AI RMF Govern Function + SEC AI Governance Guidance
When your board or CEO asks 'where do we stand on AI compliance?' — this is the document you hand them. A one-page status report, a presenta...
Consumer Notice Kit
Framework: Multi-State AI Consumer Disclosure Requirements (CO, CA, MN, TX)
Multiple states require you to tell consumers when AI is involved in decisions about them. This kit gives you the notices in every format — ...
Data Mapping Inventory
Framework: Multi-State Privacy Data Mapping Requirements (CA, CO, VA, CT, MN, TX, DE)
Before you can write a data protection assessment, you need to know what personal data you collect, where it goes, and who you share it with...
Consumer Rights Kit
Framework: Multi-State Consumer Rights Requirements (CA, CO, VA, CT, MN, TX, DE)
When a consumer asks to see their data, correct it, or delete it — you need a process for handling that request within the timeline the law ...
Healthcare AI
HIPAA + FDA AI/ML + COPPA
If you're a healthcare organization using AI — whether for clinical decisions, patient intake, diagnostics, or administration — you're navig...
Financial Services AI
FINRA + SEC + CFPB Guidance
Financial services firms using AI face overlapping requirements from FINRA, the SEC, and the CFPB. This package covers AI supervision docume...
AI Governance
NIST AI RMF Govern Function + CO SB24-205 Risk Management
The organizational framework that ties everything else together — who in your company is responsible for AI decisions, how new AI tools get ...
AI Registry
NIST AI RMF MAP Function + Deployer Inventory Requirements
You can't comply with any AI law if you don't know what AI you're using. This is step zero — a structured inventory of every AI system in yo...
Transparency Report
EU AI Act Art. 13 + Voluntary Best Practice
A template for publicly disclosing what AI systems your organization uses and what safeguards are in place. Required by the EU AI Act and Co...
Whistleblower Policy
CA SB 53 (2025–2026 Session) + Best Practice
An internal policy that protects employees who report concerns about your AI systems. Required for frontier AI developers under California S...
Customer AI AUP
FTC Act § 5 + EU AI Act Art. 13 + Best Practice
If your customers use AI features in your product or service, this policy tells them what they can and can't do with it. Covers permitted us...
Indiana ICDPA
IC 24-15 (Indiana Consumer Data Protection Act)
Indiana's Consumer Data Protection Act follows the same general framework as Virginia and Connecticut — data protection assessments for prof...
Montana MCDPA
MCA §§ 30-14-2801 through 30-14-2820
Montana's privacy law has some of the lowest applicability thresholds in the country. If your business processes personal data from Montana ...
Kentucky KCDPA
KRS Chapter 367 (Kentucky Consumer Data Protection Act, HB 15)
Kentucky's Consumer Data Protection Act requires data protection assessments for profiling and targeted advertising. If you have Kentucky cu...
New Jersey NJDPA
NJDPA (S332/A1971, signed January 16, 2024)
New Jersey's Data Protection Act requires documented data protection assessments for profiling, targeted advertising, and sensitive data. If...
IL Notice & Response Kit
775 ILCS 5/2-102(L)
When Illinois employees receive your AI notice and have questions — or when you need to log each time AI is used in an employment decision —...
IL Zip Code Proxy Audit
775 ILCS 5/2-102(L)
Illinois HB3773 specifically prohibits using zip codes as a proxy for protected classes. This workbook walks you through auditing your AI hi...
CO Appeal & Correction Kit
C.R.S. § 6-1-1701 et seq.
When a Colorado consumer receives an adverse AI decision and wants to appeal — or needs to correct their data — you need a documented proces...
CO AG Reporting Kit
C.R.S. § 6-1-1701 et seq.
If you discover your high-risk AI system has caused algorithmic discrimination, Colorado law gives you 90 days to report it to the Attorney ...
CO Dev-Deploy Exchange Kit
C.R.S. § 6-1-1701 et seq.
Colorado's law requires AI developers to provide specific documentation to deployers — including model cards, dataset cards, and impact asse...
CA ADMT Notice & Opt-Out Kit
Cal. Civ. Code § 1798.100 et seq.
California's ADMT regulations require a specific Pre-Use Notice before automated decisionmaking is applied to consumers, plus a documented o...
CA ADMT Access Kit
Cal. Civ. Code § 1798.100 et seq.
When California consumers exercise their right to know how ADMT was used in decisions about them, you need to explain the logic, key paramet...
CA Cyber Audit Kit
Cal. Civ. Code § 1798.100 et seq.
California's CCPA regulations require annual cybersecurity audits covering 17 specific areas, plus risk assessments analyzing specific harm ...
NYC Bias Audit Management Kit
NYC Admin. Code § 20-870 et seq.
NYC Local Law 144 requires an annual independent bias audit and public posting of results. This kit gives you the auditor RFP template, resu...
NYC Candidate Notice Kit
NYC Admin. Code § 20-870 et seq.
NYC requires 10 business days advance notice before using an AEDT on candidates, plus information about an alternative selection process, an...
VA Consumer Rights Kit
Va. Code §§ 59.1-575 through 59.1-584
Virginia's CDPA gives consumers 5 distinct rights with a 45-day response window and a formal appeal process. When someone exercises a right,...
VA Profiling Assessment Workbook
Va. Code §§ 59.1-575 through 59.1-584
Virginia requires data protection assessments specifically structured around statutory weighing factors — benefits vs. risks, de-identified ...
VA Controller-Processor Kit
Va. Code §§ 59.1-575 through 59.1-584
Virginia's CDPA requires specific contractual terms between controllers and processors — confidentiality, data return/deletion, compliance d...
EU FRIA Kit
Regulation (EU) 2024/1689
Article 27 of the EU AI Act requires deployers of certain high-risk AI systems to complete a Fundamental Rights Impact Assessment before fir...
EU Post-Market Kit
Regulation (EU) 2024/1689
After deploying a high-risk AI system in the EU, you must monitor its operation and report serious incidents within 15 days. This kit covers...
EU Human Oversight Kit
Regulation (EU) 2024/1689
The EU AI Act requires designated human oversight with documented competence and authority, plus worker notification before deployment. This...
EU Registration & Transparency Kit
Regulation (EU) 2024/1689
Public authority deployers must register in the EU AI database, and all deployers must make transparency disclosures — including specific re...
Frequently Asked Questions
Everything you need to know before getting started.
How do I know if any of this applies to my business?
What if I don't know whether my tools use AI?
I have no idea where to start.
What AI regulations do you cover?
Is this legal advice?
How are the documents generated?
What if the law changes?
Do I need this if I already have outside counsel?
Are all sales final?
Don't wait for a complaint
AI regulations are in effect now. Get your compliance documents today for a fraction of what a law firm charges.
Browse ProductsNot sure which package? info@aicompliancedocuments.com