One decision, fifty regimes.

Why the mosaic is a different problem from the single clock

We wrote separately about the EU AI Act's August 2026 high-risk deadline, and the shape of that problem is clean: one framework, output-based scope, a fixed date, a known list of obligations. A team can read the Act, classify its pipelines against Annex III, and build to a single target. The American situation is not a bigger version of that. It is a categorically different one. There is no Annex III to read, because there is no single Act. There is Colorado's regime, and Texas's, and California's, and a dozen more in various stages of enactment, and they do not agree on who is regulated, what triggers the obligation, what the obligation is, or when it starts.

This matters for a specific and often-missed reason: the exposure does not follow the vendor's address, and it does not follow the customer's address either. It follows the person the automated decision is about. A document AI pipeline that screens a job application, scores a loan file or reviews a benefits claim inherits the regime of the state where that applicant, borrower or claimant lives — and a single enterprise customer serving all fifty states exports the same decision into all fifty regimes at once. This is the distinction that separates the mosaic from two adjacent problems people conflate it with. It is not the EU AI Act (one regime, one clock). And it is not sovereign AI or data residency, which is about where the bytes are processed. The mosaic is about operating the same automated decision under N state regimes simultaneously, because the customer — and the impact of the decision — crosses state lines.

Data residency asks where the data lives. The mosaic asks whose law governs the decision — and answers "all of them, at once, differently."

What the states actually enacted

The details differ enough that a single compliance posture cannot cover them, and close enough that the same underlying evidence — an inventory, a classification, an impact assessment, an audit trail — is what each one wants in its own format. A few representative regimes make the fragmentation concrete.

Colorado passed the first comprehensive US state AI law aimed squarely at consequential decisions. It puts a duty of reasonable care on deployers of high-risk AI systems to protect consumers from algorithmic discrimination, and layers on impact assessments, consumer notice and disclosure to the state attorney general. Its enforcement date is a live example of why the calendar itself is a risk: originally set for early 2026, it was pushed to June 30, 2026 in a special session. A team that built to the first date and stopped watching would have mis-scheduled its own readiness.

Texas took a different path. Its Responsible AI Governance Act narrowed over its drafting to focus on intentional harms and government use rather than a broad private-sector discrimination regime — but it carries the detail that matters most for vendors: an affirmative defense for organizations that adhere to a recognized risk-management framework such as the NIST AI RMF, and that operate red-teaming and internal review. That single design choice converts a recognized framework from a nice-to-have into a legal shield.

California, Illinois and New York each added their own layers — transparency and training-data disclosure rules, amendments treating AI in employment decisions under civil-rights law, and sector-specific requirements — with their own definitions and their own effective dates. The common thread is not a common text. It is that a vendor operating nationally now faces a matrix of obligations that share a spirit and diverge in every operational particular.

The last row is the one teams keep betting on. Through the first half of 2026 there was a genuine federal effort to preempt the state patchwork — to declare one national standard and pause the state laws. It did not become law. Planning as though it will is the same mistake as reading a proposed EU delay as a reprieve: a preemption that has not been enacted is not a plan, and the state deadlines that already exist do not wait for Washington to agree.

Classify by use and by jurisdiction, not by technology

The single most expensive framing error is to ask "is our technology regulated?" It is the wrong axis twice over. As with the EU Act, these regimes classify the use, not the model — the same extraction is unremarkable reading an invoice and consequential when its output feeds a hiring or lending decision. But the mosaic adds a second axis the single-clock problem does not have: jurisdiction of impact. A pipeline is not simply "high-risk" or "not." It is high-risk-in-Colorado for the applicant in Denver, governed-differently in Texas for the applicant in Austin, and subject to a third set of disclosures for the applicant in California — all from the same code path, on the same day.

That means the unit of compliance is not the system. It is the tuple of use context × jurisdiction of the affected person. A vendor that tags each pipeline with its use case but not the states its output reaches can answer "what does this system do" and still cannot answer "which regimes apply to it" — which is the only question that matters when a state attorney general asks.

The framework that survives more than one regulator

The good news buried in the fragmentation is that the states, for all their divergence, are asking for the same underlying evidence in different wrappers. Build the evidence once, mapped to many regimes, and the mosaic becomes a reporting problem rather than N separate compliance programs. The teams that do this share a small number of habits.

An inventory classified by use and by jurisdiction

You cannot govern what you have not listed, and here the list needs a second column. Every AI system in production, each row tagged with its use context, the states whose residents its output can affect, and the developer-or-deployer role the company holds under each regime that reaches it. This is the artifact that converts "which states apply?" from a research project into a query — and it is the same inventory the audit-evidence post argued is the foundation of any governance program.

A recognized framework as a reusable affirmative defense

Texas made explicit what is implicit everywhere: adherence to a recognized framework such as the NIST AI RMF is not paperwork, it is legal cover. Adopt one framework, operate its controls for real — risk mapping, red-teaming, documented review — and the same posture answers Colorado's duty of care, Texas's affirmative defense, and the diligence questions of states that have not yet legislated. The alternative — a bespoke response per state — does not scale and does not hold up.

Per-jurisdiction architecture instead of one policy for all

A single global policy that says "we use AI responsibly" satisfies no specific regulator. What survives is architecture that can apply a different rule where a different rule applies: route the affected person's jurisdiction into the pipeline, attach the disclosures that state requires, run the impact assessment that state demands, and record which rule fired. The policy is the same everywhere; the enforcement is per-jurisdiction, because the law is.

An impact-assessment and transparency trail, recorded as it happens

Colorado wants impact assessments and consumer notice. Others want disclosure and bias review. The common requirement is a trail that shows the assessment was done, the notice was given, and the decision can be reconstructed — recorded as the pipeline runs, not assembled from memory when an AG letter arrives. This is the same per-decision audit trail a non-deterministic system needs anyway; the state laws just make it non-optional.

A calendar watch, because the deadlines move

Colorado's slip from early 2026 to June is not an exception; it is the pattern. Effective dates get pushed, scopes get amended, new states enact between your planning cycle and your audit. The framework has to include someone whose job is to watch the state calendar and re-tag the inventory when a regime changes — the cheapest control in the list, and the one most often skipped.

Four ways the mosaic catches vendors out

None of these failure modes is exotic. Each has a defensive pattern that costs far less applied early than discovered under an enforcement letter.

Assuming EU compliance covers the US

A team does the hard work of EU AI Act readiness and reasons that the harder regime must subsume the easier ones. It does not. The Colorado duty of care, the Texas defense conditions and the California disclosure rules are not subsets of the Act — they have their own definitions, triggers and dates. The fix is to treat US state law as a separate mapping, sharing evidence with the EU work but never assumed to be covered by it.

Ignoring that the customer exports the decision into a regulated state

"We only sell software; our customer decides" is the delegation that fails first. When the customer's use of the output determines a consequential outcome for a resident of a regulated state, the obligation attaches to that decision, and the vendor whose pipeline produced the field is in the evidence chain whether or not the contract says so. The fix is to map, per customer and per tenant, which states the output can reach — the same runtime map the inventory needs.

Treating it as a legal problem without instrumenting the pipeline

Compliance gets handed to counsel, who produce a policy and a questionnaire answer — while the pipeline emits none of the per-jurisdiction evidence the policy promises. When a specific state asks for the impact assessment tied to a specific decision, the gap between the document and the runtime is the whole finding. The fix is to treat the obligations as engineering requirements: the jurisdiction tag, the routed disclosure, the recorded assessment ship as features.

Waiting for the federal law that unifies everything

The most comfortable error: the patchwork is obviously untenable, so surely Congress will preempt it, so we wait. The preemption debate produced no single law, the states kept legislating, and the teams that waited entered the enforcement window with nothing built. The fix is to plan against the enacted state deadlines and treat any future federal standard as consolidation relief, not as the reason to defer the work.

The trade-off, stated honestly

There is a real cost to building for the mosaic, and it deserves naming rather than a wave. A per-jurisdiction inventory, a routed-disclosure architecture, impact assessments recorded at runtime and a framework operated for real is engineering and process work that competes with roadmap features a customer can see this quarter. A vendor whose exposure turns out to be concentrated in two states will have built machinery for fifty. Some of that effort is insurance against regimes that have not fully arrived. That is the honest downside.

The other side of the trade is exclusion and penalty. A vendor that cannot show control per jurisdiction is not merely at risk of a state fine — it is disqualified at the procurement filter of any enterprise buyer that operates nationally, because that buyer inherits the vendor's gap in every state it serves. The cost of building the mosaic-ready posture is a known quantity, paid in engineering weeks and one recognized framework operated properly. The cost of a generic "we follow best practices" answer is the regulated, multi-state accounts — finance, insurance, healthcare, public sector — where document AI is worth the most, walking to the vendor who can produce the evidence. For anyone selling across state lines, the trade favours building once, as architecture, over answering N times, as fire drills.

What we ship at Cogneris

Cogneris was built as an audit-instrumented platform, not as an extraction engine with a compliance layer bolted on afterward — and the choices in the architecture are the ones the mosaic happens to reward:

• Use × jurisdiction tagging — every tenant pipeline carries both its use-case classification and the jurisdictions its output can reach, so "which state regimes apply to this decision?" is a field, not an investigation.
• Framework-mapped controls — the risk mapping, review and logging map to a recognized framework once and answer many state regimes, rather than a bespoke response per jurisdiction.
• Per-jurisdiction enforcement in routing — the affected person's jurisdiction routes into the pipeline, the required disclosures and assessments attach where that state demands them, and the platform records which rule fired.
• Impact-assessment and decision trail at runtime — the assessment, the notice and the per-decision record are emitted as the pipeline runs, so a state inquiry is answered from the log, not reconstructed under a deadline.
• An inventory that answers scope in a query — the same register the audit-evidence post describes, extended with the jurisdiction column the mosaic requires.

Where we deliberately stop

An honest list of what we do not absorb on the customer's behalf, because absorbing it would be wrong or impossible.

Which state regimes apply to a given deployment. Whether a specific use in a specific state crosses that state's threshold is a determination for the customer's counsel against the customer's context. We make it cheap to defend by holding the evidence and the jurisdiction map; we do not issue the verdict.

The legal reading of conflicting or moving requirements. The regimes named here have their own definitions, their own effective dates, and a history of amendment under political pressure. Everything in this post is operational, not legal, and our summaries are a working understanding, not advice. The customer's counsel owns the reading the customer relies on.

The decision itself. The state laws exist because automated decisions have consequences for real people. We instrument the decision so it can be governed, disclosed and reconstructed; we do not make it, and we design so a person can understand, intervene in and override it where the law — and good sense — require.

Closing thought

The United States did not give AI vendors a law. It gave them a mosaic, and a mosaic is not something you comply with once — it is a property the pipeline either has or does not have: the ability to show, per jurisdiction, that a specific automated decision was classified, assessed, disclosed and logged under the regime that governs the person it affected. The teams that will pass build that property as architecture on the product clock — an inventory tagged by use and jurisdiction, one framework operated for real, enforcement routed per state, and a decision trail recorded as it happens. The teams that will struggle keep waiting for the federal law that unifies everything, and discover under a state attorney general's schedule they do not control that the preparation was engineering all along. There is no single American clock. There are fifty, they do not agree, and the only durable answer is a pipeline built to be classified — which is the pipeline Cogneris was built around.

If you are working out which state AI regimes your document AI pipeline touches — and the conversation with internal audit starts the same week — see our data-protection page for the control posture we ship, or talk to our team and we will map your use cases against the jurisdictions your output reaches, before the enforcement letter, not after.