AI compliance plan
Your AI compliance plan.
17 duties from 4 enacted laws in 1 state. Each one says who it falls on, when it starts and where in the law it comes from. The next start date is July 1, 2027.
The plan at a glance
Pro turns this plan into a spreadsheet for audit files and a calendar of every start date. The plan on this page stays open to everyone.
Already in effect 6 duties
These duties are in force today.
| Starts | Law | Who | What it requires | How often | Source |
|---|---|---|---|---|---|
| January 1, 2026 | Nebraska Age-Appropriate Online Design Code Act (LB 504): recommendation system and profiling provisions | Covered online service | Give each covered minor an accessible, easy-to-use tool to control personalized recommendation systems by opting in to a chronological feed or blocking categories of recommended content.Applies when: A user the service knows to be a minor. The tool must default to the option giving the highest protection available for the minor's safety. | Ongoing | LB 504 § 4(1)(d), (3) |
| January 1, 2026 | Nebraska Age-Appropriate Online Design Code Act (LB 504): recommendation system and profiling provisions | Covered online service | Do not profile a covered minor unless profiling is necessary to provide a service the minor requested, and only for the aspects the minor is actively and knowingly engaged with.Applies when: Any automated processing of personal data to evaluate, analyze or predict aspects of a covered minor. | Ongoing | LB 504 § 5(7); § 2(15) |
| January 1, 2026 | Nebraska Age-Appropriate Online Design Code Act (LB 504): recommendation system and profiling provisions | Covered online service | Set the Section 5 protections, including the profiling limit, by default to the option giving the highest protection available for the covered minor's safety.Applies when: A user the service knows to be a minor. | Ongoing | LB 504 § 5(8) |
| January 1, 2026 | Nebraska Age-Appropriate Online Design Code Act (LB 504): recommendation system and profiling provisions | Covered online service | Designate one or more officers responsible for compliance with the act.Applies when: Any covered online service. | Ongoing | LB 504 § 9(2) |
| January 1, 2026 | Nebraska Ensuring Transparency in Prior Authorization Act, AI section (LB 77) | Utilization review agent | Do not make an artificial intelligence-based algorithm the sole basis of a decision to deny, delay or modify health care services based, in whole or in part, on medical necessity.Applies when: Any utilization review decision based in whole or in part on medical necessity. | Ongoing | LB 77 § 12(1) |
| January 1, 2026 | Nebraska Ensuring Transparency in Prior Authorization Act, AI section (LB 77) | Utilization review agent | Disclose to the Department of Insurance, each network health care provider, each enrollee and on its public website if AI-based algorithms are used or will be used in utilization review.Applies when: The agent uses or will use artificial intelligence-based algorithms in its utilization review process. No deadline or frequency is stated. | Ongoing | LB 77 § 12(2) |
Starting later 8 duties
Dates further out, in order.
| Starts | Law | Who | What it requires | How often | Source |
|---|---|---|---|---|---|
| July 1, 2027 | Nebraska Conversational Artificial Intelligence Safety Act (LB 525, §§ 12-18) | Operator | Clearly and conspicuously disclose to each minor account holder that they are interacting with AI, by a persistent visible disclaimer or at session start and at least every three hours.Applies when: A minor account holder uses the conversational AI service. | Ongoing | LB 525 § 14(1) |
| July 1, 2027 | Nebraska Conversational Artificial Intelligence Safety Act (LB 525, §§ 12-18) | Operator | Do not give minor account holders points or similar rewards at unpredictable intervals with the intent to increase engagement.Applies when: A minor account holder uses the conversational AI service. | Ongoing | LB 525 § 14(2) |
| July 1, 2027 | Nebraska Conversational Artificial Intelligence Safety Act (LB 525, §§ 12-18) | Operator | Take reasonable measures to prevent the service from producing visual depictions of sexually explicit conduct, urging sexually explicit conduct, or sexually objectifying the account holder, for minors.Applies when: A minor account holder uses the conversational AI service. | Ongoing | LB 525 § 14(3) |
| July 1, 2027 | Nebraska Conversational Artificial Intelligence Safety Act (LB 525, §§ 12-18) | Operator | Take reasonable measures to prevent statements that would lead a reasonable person to believe they are talking to a human, including claims of sentience, emotional dependence or romantic role-play.Applies when: A minor account holder uses the conversational AI service. | Ongoing | LB 525 § 14(4) |
| July 1, 2027 | Nebraska Conversational Artificial Intelligence Safety Act (LB 525, §§ 12-18) | Operator | Offer privacy and account-setting tools to minor account holders, to parents or guardians of those under thirteen, and related tools to parents of older minors as appropriate.Applies when: A minor account holder uses the conversational AI service. | Ongoing | LB 525 § 14(5) |
| July 1, 2027 | Nebraska Conversational Artificial Intelligence Safety Act (LB 525, §§ 12-18) | Operator | Clearly and conspicuously disclose that the service is AI where a reasonable person interacting with it would be misled into believing they are talking to a human.Applies when: Any user, not only minors. | Ongoing | LB 525 § 15 |
| July 1, 2027 | Nebraska Conversational Artificial Intelligence Safety Act (LB 525, §§ 12-18) | Operator | Adopt a protocol for responding to user prompts about suicidal ideation or self-harm, including reasonable efforts to refer the user to crisis services.Applies when: The operator makes a conversational AI service available to the public. | Ongoing | LB 525 § 16 |
| July 1, 2027 | Nebraska Conversational Artificial Intelligence Safety Act (LB 525, §§ 12-18) | Operator | Do not knowingly and intentionally cause or program the service to state explicitly that it is designed to provide professional mental or behavioral health care.Applies when: The operator makes a conversational AI service available to the public. | Ongoing | LB 525 § 17 |
Triggered by an event 3 duties
These apply when something happens, such as a request, an incident or a decision about a person. Each row says what triggers it.
| Starts | Law | Who | What it requires | How often | Source |
|---|---|---|---|---|---|
| When triggered | Nebraska Child Sexual Abuse Material Prevention Act: computer-generated and AI material (LB 383) | Person | Do not knowingly make, create or generate child sexual abuse material, including computer-generated or AI-made material, in any way.Applies when: Computer-generated depictions count when they meet the definition, including obscene depictions of a computer-generated person who appears to be a child. The act states no effective date (see open questions). | Ongoing | Neb. Rev. Stat. 28-1805(1); 28-1802(2)-(4) |
| When triggered | Nebraska Child Sexual Abuse Material Prevention Act: computer-generated and AI material (LB 383) | Person | Do not knowingly sell, distribute, advertise, publish, trade or otherwise provide child sexual abuse material, including computer-generated material, or possess it intending to do so.Applies when: Any distribution or possession with intent to distribute. The act states no effective date (see open questions). | Ongoing | Neb. Rev. Stat. 28-1805(2); 28-1804(1) |
| When triggered | Nebraska Child Sexual Abuse Material Prevention Act: computer-generated and AI material (LB 383) | Person | Do not knowingly possess or receive child sexual abuse material, including computer-generated material.Applies when: Any possession or receipt; persons under 19 are covered when acting knowingly and intentionally. The act states no effective date (see open questions). | Ongoing | Neb. Rev. Stat. 28-1803(1)-(2) |
Law by law
Who each law covers, who enforces it, the penalties, whether people can sue and what the text leaves open. Open a law to see it; every line cites its section.
Nebraska Age-Appropriate Online Design Code Act (LB 504): recommendation system and profiling provisions
4 duties · checked November 14, 2026
LB 504, 109th Legislature, First Session (2025), approved May 30, 2025; Age-Appropriate Online Design Code Act (LB 504 §§ 1-9). Official text · Full law page
Who it covers
- Covered online service. A legal entity that owns, operates, controls or provides an online service and meets all five tests: it does business in the state, determines the purposes and means of processing personal data, and meets the revenue, data-volume and revenue-share thresholds. Threshold: All of: annual gross revenue above $25,000,000 (adjusted for inflation in odd-numbered years); buys, receives, sells or shares the personal data of 50,000 or more consumers, households or devices a year; and earns at least 50% of annual revenue from selling or sharing consumers' personal data. LB 504 § 2(5)(a)
Enforcement
- Enforcer: Nebraska Attorney General, the only enforcer the act names. A violation is also a deceptive trade practice under the Uniform Deceptive Trade Practices Act, with civil penalties governed only by this act.
- Penalty: Up to $50,000 for each violation, any violation of the act by a covered online service, beginning July 1, 2026. LB 504 § 9(3)
- Can people sue? The law does not say LB 504 § 9 (silent)
- Time to fix before enforcement: The law does not say
Exemptions
- An online service with actual knowledge that fewer than 2% of its users are minors. LB 504 § 2(5)(c)
- Federal, state, tribal and local government entities in the ordinary course of their operations. LB 504 § 3(1)(a)
- Personal data governed by Title V of the Gramm-Leach-Bliley Act, HITECH or HIPAA regulations, where the service must comply with them. LB 504 § 3(1)(b)
- Information collected in a clinical trial under federal human subject protection requirements. LB 504 § 3(1)(c)
- Not online services: telecommunications services, broadband internet access services, and the sale, delivery or use of a physical device. LB 504 § 2(9)
What the text leaves open
- The coverage test is conjunctive as read: a service must meet the revenue, data-volume and 50% revenue-share thresholds together.
- The act is silent on a private right of action. Whether the Uniform Deceptive Trade Practices Act, which was not read, gives private parties a claim for the same conduct was not checked.
- Section 9(3) sets the penalty without naming who recovers it; section 9(1) names only the Attorney General.
- Codified section numbers in the Nebraska Revised Statutes were not confirmed, and any amendment in the 2026 session was not checked.
- Court challenges to this law were not checked in this run.
Nebraska Child Sexual Abuse Material Prevention Act: computer-generated and AI material (LB 383)
3 duties · checked November 15, 2026
Laws 2025, LB 383, approved May 20, 2025; secs. 1-6 now Neb. Rev. Stat. 28-1801 to 28-1806 (formerly 28-1463.01 to 28-1463.06 and 28-813.01). Official text · Full law page
Who it covers
- Person. Any person who makes, generates, distributes, possesses or receives child sexual abuse material, including computer-generated material; penalties differ for those under 19. Neb. Rev. Stat. 28-1803, 28-1804, 28-1805
Enforcement
- Enforcer: Criminal prosecution; the sections read do not name the prosecuting office. A web search on November 15, 2026 found no court challenge to these provisions.
- Penalty: Class ID felony: 3 to 50 years in prison, making or distributing, by a person 19 or older. Neb. Rev. Stat. 28-1805(8); 28-105(1)
- Penalty: Class III felony: up to 4 years in prison and 2 years of post-release supervision, a fine up to $25,000, or both, making or distributing, by a person under 19. Neb. Rev. Stat. 28-1805(7); 28-105(1)
- Penalty: Class IC felony: 5 to 50 years in prison, making, distributing or possessing after a prior conviction for a covered offense. Neb. Rev. Stat. 28-1803(5); 28-1804(2)(c); 28-1805(9); 28-105(1)
- Penalty: Class IIA felony: up to 20 years in prison, possession or receipt by a person 19 or older. Neb. Rev. Stat. 28-1803(1); 28-105(1)
- Penalty: Class I misdemeanor: up to 1 year in jail, a $1,000 fine, or both (Class IV felony for a later conviction), possession or receipt by a person under 19. Neb. Rev. Stat. 28-1803(2)(b); 28-106(1)
- Penalty: Class II felony (1 to 50 years in prison) for an offender 19 or older; Class IIIA felony (up to 3 years in prison and 18 months of post-release supervision, a fine up to $10,000, or both) if under 19, possession with intent to distribute. Neb. Rev. Stat. 28-1804(2)(a)-(b), as amended by LB 383 sec. 4; 28-105(1)
- Can people sue? The law does not say Neb. Rev. Stat. 28-1803 to 28-1805 (criminal offenses only)
- Time to fix before enforcement: None
Exemptions
- Narrow affirmative defenses for defendants under 19 where a child 15 or older (or within four years of the defendant's age, if under 18) voluntarily made and sent the image, it shows only that child, and was not shared or coerced. Neb. Rev. Stat. 28-1803(3)-(4); 28-1805(5)-(6) (defense applies only to 28-1805(1))
What the text leaves open
- The act has no emergency clause and states no effective date for sections 1-25; Nebraska acts without one take effect three calendar months after adjournment, but no official page stating that date for LB 383 was read, so no effective date is given for the duties.
- The Parental Rights in Social Media Act in LB 383 (secs. 26-30, operative July 1, 2026) is not covered. News reports say a federal court partly enjoined it in NetChoice v. Hilgers in 2026; that ruling was not read.
Nebraska Conversational Artificial Intelligence Safety Act (LB 525, §§ 12-18)
8 duties · checked November 12, 2026
LB 525, One Hundred Ninth Legislature, Second Session (2026), approved April 14, 2026; sections 12 to 18 are the Conversational Artificial Intelligence Safety Act; sections 1 to 10 are the Agricultural Data Privacy Act. Official text · Full law page
Who it covers
- Operator. A person who makes a conversational AI service available to the public; app stores and search engines are not operators solely for providing access. LB 525 § 13(6)
Enforcement
- Enforcer: Nebraska Attorney General, who may sue an operator on behalf of the state or of an aggrieved person.
- Penalty: At least $1,000 per violation, up to $500,000 per operator, civil penalties in an attorney general action; the court may also award actual damages, equitable or declaratory relief, and costs and attorney's fees. LB 525 § 18(2)(b)
- Can people sue? No LB 525 § 18(3)
- Time to fix before enforcement: The law does not say
Exemptions
- Applications mainly designed and marketed for developers or researchers, or for business commercial use. LB 525 § 13(2)(b)(i), (iv)
- A feature inside another application that is not itself a conversational AI service, and tools designed to produce output on a narrow, discrete topic. LB 525 § 13(2)(b)(ii), (iii)
- Voice command interfaces and voice-activated assistants for consumer electronic devices. LB 525 § 13(2)(b)(v)
- Tools a business uses solely for internal purposes, or solely for customer service or information about its products, services or customer accounts. LB 525 § 13(2)(b)(vi), (vii)
- The act creates no liability for an AI model developer for a violation by a system that a third-party operator developed to provide a conversational AI service. LB 525 § 18(4)
What the text leaves open
- The act imposes no age-verification duty; a minor is someone the operator actually knows, or is reasonably certain, is under eighteen.
- Section 18(4) refers to the 'Conversational Artificial Intelligence Act', not the act's full short title.
- The $500,000 figure is written as a cap per operator; the text does not say whether it applies per action or in total.
- The Agricultural Data Privacy Act (sections 1 to 10) is not itemized in this file; its 45-day cure provision in section 9 does not apply to the conversational AI act.
Nebraska Ensuring Transparency in Prior Authorization Act, AI section (LB 77)
2 duties · checked November 12, 2026
Laws 2025, LB 77, §§ 1 to 13 (Ensuring Transparency in Prior Authorization Act); artificial intelligence provision at § 12. Official text · Full law page
Who it covers
- Utilization review agent. A utilization review agent, with the same meaning as in Neb. Rev. Stat. § 44-5418. That section was not opened. LB 77 § 2(18); § 12
Enforcement
- Enforcer: Nebraska Department of Insurance, which may at any time audit a utilization review agent's automated utilization management system and may contract with a third party to do so. The act names no other enforcement step. A web search on November 12, 2026 found no report of a court order blocking this law; court dockets were not searched.
- Penalty: the law does not set an amount.
- Can people sue? The law does not say LB 77 §§ 1 to 13 (no provision on private lawsuits)
- Time to fix before enforcement: The law does not say
What the text leaves open
- The act does not define artificial intelligence-based algorithm or automated utilization management system.
- The act sets no penalty, cure period or private right to sue for the AI section; whether the Department of Insurance can use penalties in other insurance statutes was not checked.
- The disclosure duty has no stated deadline, format or frequency.
- Who counts as a utilization review agent depends on Neb. Rev. Stat. § 44-5418, which was not opened. The act's definition of health carrier excludes a managed care agent (§ 2(12)), but section 12 places its duties on utilization review agents.
- The act does not say whether it applies to the medical assistance program; Medicaid is mentioned only in the biomarker testing sections.
- Codified section numbers and any 2026 amendment were not confirmed.
How the plan is built
Each law in the plan was read from its official text, on the legislature’s or state’s own website. 265 of the 326 have also been read a second time to confirm every date, threshold, penalty and enforcer; the rest have had one full read, and each shows the date it was last checked. Each duty is written in plain English in 30 words or fewer and carries the section it comes from, with a link.
Where a law is silent, the plan says so. It does not borrow a penalty from another statute or guess at a deadline. A law that is repealed or replaced on a known date shows that end date, and its duties leave the plan once the date passes. The date each law was last checked appears with it.
The plan is built fresh from these records every time the page loads, so it changes as soon as a law is added or re-checked. To report an error, use the corrections page. For how we find laws and decide what counts as an AI law, see our methodology. If you are not sure which laws touch your business at all, start with Am I Affected?
Common questions
What does an AI compliance plan cover?
Each duty an enacted state AI law places on a business or other regulated party: who it applies to, what it requires, when it starts, how often it recurs, who enforces it, the penalties and whether people can sue. The builder covers 1,235 duties in 326 enacted laws across 50 states, and every duty links to the section of law it comes from.
Where does the information come from?
From the official text of each law: the enrolled bill, session law or codified statute, opened on the legislature's or state's own website. 265 of the 326 laws have also been read a second time to confirm every date, threshold, penalty and enforcer, and the date each law was last checked is shown with it. Where a law is silent on a point, such as a penalty amount, the plan says the law does not say rather than filling the gap. Law firm summaries and news reports are never used as sources.
Does the plan include every AI law in a state?
Not yet. It includes the enacted laws we have mapped duty by duty. When you choose a state, its other enacted AI laws are listed separately with links, so nothing is left out of view. New laws are added as they are read. When a law is repealed or replaced on a set date, its duties show that end date and leave the plan once it passes.
How do I know which duties apply to my company?
Start with the 'who it covers' entry for each law: many apply only above a size or revenue threshold, only to developers or only to deployers, or only in one industry. The plan quotes those conditions from the text. Whether your company meets them depends on facts only you and your counsel know.
Is this legal advice?
No. It is information drawn from official legal texts, organized so you can see what each law requires. Use it to brief your team and your lawyers, not in place of them.
What does Pro add?
The same plan as a CSV file for spreadsheets and audit files, and as a calendar file (.ics) with every dated duty as an event that links back to the law. Both are built from the states and uses you pick. The plan on this page, and printing it, are open to everyone.