AI compliance plan
Your AI compliance plan.
31 duties from 7 enacted laws in 1 state. Each one says who it falls on, when it starts and where in the law it comes from. The next start date is January 1, 2027.
The plan at a glance
31duties from 7 laws
6start in the next 90 days; the next on January 1, 2027
3laws let people sue over a violation
1law gives a set number of days to fix a violation before enforcement
Download CSV and calendar with Pro
Open as a checklist
Pro turns this plan into a spreadsheet for audit files and a calendar of every start date. The plan on this page stays open to everyone.
Already in effect 15 duties
These duties are in force today.
| Starts | Law | Who | What it requires | How often | Source |
|---|---|---|---|---|---|
| July 1, 2019 | Vermont Automated Vehicle Testing Act (Act 60 of 2019, S.149) | Automated vehicle tester | Do not test an automated vehicle on public highways until the Traffic Committee approves a permit application defining the test scope and operational design domain.Applies when: Before any public-road testing, and again before changing the design domain or permit conditions. | Once | 23 V.S.A. § 4203(a), (e) |
| July 1, 2019 | Vermont Automated Vehicle Testing Act (Act 60 of 2019, S.149) | Automated vehicle tester | Register each test vehicle and keep liability insurance, self-insurance or a surety bond of at least $5 million.Applies when: While testing under a permit. | Ongoing | 23 V.S.A. § 4203(h)(2)(A)-(B) |
| July 1, 2019 | Vermont Automated Vehicle Testing Act (Act 60 of 2019, S.149) | Automated vehicle tester | Keep a zero-tolerance drug and alcohol policy, run background checks on all operators, and follow NHTSA testing standards or hold exemptions.Applies when: While testing under a permit. | Ongoing | 23 V.S.A. § 4203(h)(2)(C)-(D), (h)(3)(A) |
| July 1, 2019 | Vermont Automated Vehicle Testing Act (Act 60 of 2019, S.149) | Operator | Sit in the driver's seat, monitor the vehicle and be able to take immediate manual control during testing.Applies when: Every test drive on a public highway. | Ongoing | 23 V.S.A. § 4203(h)(1) |
| July 1, 2019 | Vermont Automated Vehicle Testing Act (Act 60 of 2019, S.149) | Automated vehicle tester | Report annually to the Traffic Committee on safety, traffic operations, roadway interaction and public comments until testing ends.Applies when: Each year testing continues. | Every year | 23 V.S.A. § 4203(g) |
| July 1, 2019 | Vermont Automated Vehicle Testing Act (Act 60 of 2019, S.149) | Automated vehicle tester | Make test vehicles clearly identifiable to the public and capable of complying with traffic and motor vehicle laws.Applies when: Every test vehicle. | Ongoing | 23 V.S.A. § 4203(l), (n) |
| July 1, 2019 | Vermont Automated Vehicle Testing Act (Act 60 of 2019, S.149) | Operator | Do not operate or be in actual physical control of a test vehicle with a blood alcohol concentration of 0.02 or more.Applies when: Every test drive. | Ongoing | 23 V.S.A. § 4203(m) |
| June 6, 2024 | Vermont digitally altered intimate images law (Act 161, H.878) | Person | Do not knowingly disclose a nude or sexual image of an identifiable person, including a digitally altered one, without consent, intending to harm, harass, intimidate, threaten or coerce.Applies when: The disclosure would cause a reasonable person harm. Consent to making the image is not consent to disclose it. | Ongoing | 13 V.S.A. § 2606(b)(1) |
| June 6, 2024 | Vermont digitally altered intimate images law (Act 161, H.878) | Website, online service or app operator | Do not solicit or accept a fee or other consideration to remove or stop posting such an image when the person depicted asks.Applies when: The operator's site, service or app contains an image covered by the section. | Each time it happens | 13 V.S.A. § 2606(c) |
| March 5, 2026 | Vermont synthetic media in elections law (Act 75, S.23) | Person | Within 90 days before a Vermont election, do not publish or distribute known deceptive and fraudulent synthetic media without the statutory disclosure that it was digitally manipulated or generated.Applies when: The media appears realistic to a reasonable person and depicts a candidate or someone giving voters materially false information. Exemptions in § 2032(b) apply.Blocked in court for Henry L. Poitras (Planet Hank), only for his June 7, 2026 video. A federal preliminary injunction bars the Attorney General from enforcing a civil investigative demand or taking further Act 75 action against Poitras over that video; the court did not rule on the law itself. Poitras v. Clark, No. 2:26-cv-00234-wks (D. Vt.), Sep 4, 2026 | Each time it happens | 17 V.S.A. § 2032(a) |
| March 5, 2026 | Vermont synthetic media in elections law (Act 75, S.23) | Person | For images and video, show the disclosure as text readable by the average viewer, accessible to people with disabilities where possible, and, for video, for the full duration.Applies when: Visual synthetic media covered by § 2032(a). | Each time it happens | 17 V.S.A. § 2032(a)(1) |
| March 5, 2026 | Vermont synthetic media in elections law (Act 75, S.23) | Person | For audio-only media, speak the disclosure clearly at the beginning and end, and at least every two minutes if the audio runs longer.Applies when: Audio synthetic media covered by § 2032(a). | Each time it happens | 17 V.S.A. § 2032(a)(2) |
| June 17, 2026 | Vermont AI in mental health services law (Act 156, H.816) | Corporation or entity | Do not provide, advertise or otherwise offer mental health services to the public, including through AI, unless provided by a mental health professional or within an approved study.Applies when: Any offer of mental health services to the public. The study exception covers approved institutional review board or privacy board studies under 45 C.F.R. § 164.512(i)(1)(i)(A) and (B). | Ongoing | 18 V.S.A. § 7115(b) |
| June 17, 2026 | Vermont AI in mental health services law (Act 156, H.816) | Mental health professional | Do not engage in the prohibited use of artificial intelligence under 18 V.S.A. § 7115; doing so is unprofessional conduct.Applies when: Added to the unprofessional conduct lists in 3 V.S.A. § 129a(a) (licensees generally) and 26 V.S.A. § 1354(a) (a licensing board's list). | Ongoing | 3 V.S.A. § 129a(a)(30); 26 V.S.A. § 1354(a)(3) (Act 156, Secs. 2, 4) |
| June 17, 2026 | Vermont AI in mental health services law (Act 156, H.816) | Mental health professional | When using AI tools, stay within scope of practice, use tools that comply with HIPAA, and review and approve any mental health services.Applies when: A mental health professional relies on the allowance for professional AI use. Covered FDA products must be prescribed or recommended by a mental health professional. | Ongoing | 18 V.S.A. § 7115(d) |
Starting in the next 90 days 6 duties
Time to prepare is short for these.
| Starts | Law | Who | What it requires | How often | Source |
|---|---|---|---|---|---|
| January 1, 2027 | Vermont Age-Appropriate Design Code Act (S.69, Act 63 of 2025): algorithm provisions | Covered business | Prominently and clearly state on your website or app the purpose of each algorithmic recommendation system you use.Applies when: The covered business uses one or more algorithmic recommendation systems. | Ongoing | 9 V.S.A. § 2449e(2) |
| January 1, 2027 | Vermont Age-Appropriate Design Code Act (S.69, Act 63 of 2025): algorithm provisions | Covered business | Disclose each input your algorithmic recommendation system uses and how each is measured, uses covered minors' personal data, influences recommendations, and is weighed against other inputs.Applies when: The covered business uses one or more algorithmic recommendation systems. | Ongoing | 9 V.S.A. § 2449e(3)(A)-(D) |
| January 1, 2027 | Vermont Age-Appropriate Design Code Act (S.69, Act 63 of 2025): algorithm provisions | Covered business | Do not use a covered minor's personal data to select, recommend or prioritize media for them, except their express requests, user-selected privacy or accessibility settings, or search queries.Applies when: Allowed requests are for a specific account, feed or user, a category of media, or more or less similar media. A search query may be used only to answer that search. | Ongoing | 9 V.S.A. § 2449f(a)(4)(A)-(C) |
| January 1, 2027 | Vermont data broker law update with GenAI disclosure (Act 138, H.211) | Data broker | Register with the Secretary of State within 30 days after becoming a data broker and annually by July 1, paying a $900 fee and filing a $20,000 surety bond.Applies when: Any business meeting the data broker definition. | Every year | 9 V.S.A. § 2446(a)(1)-(3) |
| January 1, 2027 | Vermont data broker law update with GenAI disclosure (Act 138, H.211) | Data broker | In the registration, state whether in the past year it shared or sold brokered personal information to a developer of a GenAI system or model.Applies when: Part of the sensitive-data and data-sharing disclosures each registration must contain. | Every year | 9 V.S.A. § 2446(a)(4)(E)(ii)(V) |
| January 1, 2027 | Vermont data broker law update with GenAI disclosure (Act 138, H.211) | Data broker | In the registration, give opt-out details, a deletion and opt-out page URL, minors' data practices if known, sensitive data collected, and copies of the bond and privacy policy.Applies when: Each registration, alongside the GenAI disclosure. | Every year | 9 V.S.A. § 2446(a)(4) |
Starting later 7 duties
Dates further out, in order.
| Starts | Law | Who | What it requires | How often | Source |
|---|---|---|---|---|---|
| January 1, 2028 | Vermont consumer data privacy act (Act 145 of 2026, S.71): profiling and automated decision provisions | Controller | Let a consumer opt out of the processing of personal data for profiling in furtherance of any automated decision that produces a legal or similarly significant effect.Applies when: A consumer asks. Opt-out requests need not be authenticated but may be denied, with notice, if believed fraudulent. | Ongoing | 9 V.S.A. § 2415d(a)(5)(C), (c)(4) |
| January 1, 2028 | Vermont consumer data privacy act (Act 145 of 2026, S.71): profiling and automated decision provisions | Controller | On request, confirm whether the consumer's personal data is profiled for a decision that produces a legal or similarly significant effect.Applies when: A consumer uses the right to confirm processing and access personal data. | Ongoing | 9 V.S.A. § 2415d(a)(1) |
| January 1, 2028 | Vermont consumer data privacy act (Act 145 of 2026, S.71): profiling and automated decision provisions | Controller | If feasible, let the consumer question the result, learn the reason for the decision, review the personal data used and, for housing decisions, correct data and obtain reevaluation.Applies when: The controller engages in profiling in furtherance of an automated decision that produces a legal or similarly significant effect. | Ongoing | 9 V.S.A. § 2415d(a)(6) |
| January 1, 2028 | Vermont consumer data privacy act (Act 145 of 2026, S.71): profiling and automated decision provisions | Controller | Conduct and document a data protection assessment for processing that presents a heightened risk of harm, including profiling with the listed foreseeable risks.Applies when: Profiling presents a reasonably foreseeable risk of unfair or deceptive treatment, unlawful disparate impact, financial, physical or reputational injury, intrusion upon seclusion or other substantial injury. Applies to processing created or generated after January 1, 2028. | Ongoing | 9 V.S.A. § 2415g(a)(3), (e)(3) |
| January 1, 2028 | Vermont consumer data privacy act (Act 145 of 2026, S.71): profiling and automated decision provisions | Controller | Conduct an impact assessment covering purpose and use cases, risks and mitigation, input data and outputs, customization data, performance metrics and limits, transparency measures, and post-deployment monitoring.Applies when: The controller engages in profiling for decisions that produce a legal or similarly significant effect. Elements are required to the extent reasonably known or available. | Ongoing | 9 V.S.A. § 2415g(c) |
| January 1, 2028 | Vermont consumer data privacy act (Act 145 of 2026, S.71): profiling and automated decision provisions | Controller | State in the privacy notice whether it collects, uses or sells personal data for the purpose of training large language models.Applies when: The controller provides the privacy notice required by the subchapter. | Ongoing | 9 V.S.A. § 2415e(c)(1)(H) |
| January 1, 2028 | Vermont consumer data privacy act (Act 145 of 2026, S.71): profiling and automated decision provisions | Processor | Give the controller the information it needs to conduct and document data protection assessments and impact assessments.Applies when: Processing personal data on a controller's behalf. | Ongoing | 9 V.S.A. § 2415f(a) |
Triggered by an event 3 duties
These apply when something happens, such as a request, an incident or a decision about a person. Each row says what triggers it.
| Starts | Law | Who | What it requires | How often | Source |
|---|---|---|---|---|---|
| When triggered | Vermont Automated Vehicle Testing Act (Act 60 of 2019, S.149) | Automated vehicle tester and operator | Report any crash involving personal injury or property damage to the Agency of Transportation and the law enforcement agency within 72 hours.Applies when: A crash involving a test vehicle. | Each time it happens | 23 V.S.A. § 4203(h)(3)(B) |
| When triggered | Vermont consumer data privacy act (Act 145 of 2026, S.71): profiling and automated decision provisions | Controller | Respond to a consumer rights request within 45 days, with one 45-day extension on notice, and answer any appeal in writing within 60 days.Applies when: A consumer makes a request or appeals a refusal. If an appeal is denied, the controller must give a way to contact the Attorney General. | Each time it happens | 9 V.S.A. § 2415d(c)(1), (c)(2), (d) |
| When triggered | Vermont consumer data privacy act (Act 145 of 2026, S.71): profiling and automated decision provisions | Controller | Disclose relevant data protection and impact assessments to the Attorney General when required.Applies when: The Attorney General requires disclosure. Assessments are confidential and exempt from the Public Records Act. | Each time it happens | 9 V.S.A. § 2415g(d) |
Law by law
Who each law covers, who enforces it, the penalties, whether people can sue and what the text leaves open. Open a law to see it; every line cites its section.
Vermont AI in mental health services law (Act 156, H.816)
3 duties · checked November 12, 2026
2026 Acts and Resolves No. 156 (H.816), signed June 17, 2026; adds 18 V.S.A. § 7115; amends 3 V.S.A. § 129a(a), 26 V.S.A. § 1354(a) and 3 V.S.A. § 5023(b)(1). Official text · Full law page
Who it covers
- Corporation or entity. A corporation or entity that provides, advertises or otherwise offers mental health services to the public, including through artificial intelligence. The ban is not written to apply to individuals. 18 V.S.A. § 7115(b)
- Mental health professional. An individual licensed, certified or rostered to provide mental health services, including physicians, advanced practice registered nurses specializing in psychiatric mental health, psychologists, peer support providers, social workers, alcohol and drug abuse counselors, clinical mental health counselors, marriage and family therapists, psychoanalysts, applied behavior analysts, nonlicensed or noncertified psychotherapists, and any other professional who provides mental health services. 18 V.S.A. § 7115(a)(2)
Enforcement
- Enforcer: Vermont Attorney General, with the same authority as under the Consumer Protection Act, because a violation by a corporation or entity is deemed a violation of that Act. Private parties have the same rights and remedies as under that Act. Licensing authorities may treat prohibited AI use by a mental health professional as unprofessional conduct. No court order blocking the act was looked for in this review.
- Penalty: Up to $10,000 for each unfair or deceptive act or practice, a violation of 18 V.S.A. § 7115 by a corporation or entity, as a Consumer Protection Act violation in an action by the Attorney General; the court may also order an injunction, restitution and the State's costs. 18 V.S.A. § 7115(c)(1); 9 V.S.A. § 2458(b)
- Penalty: Damages or the consideration paid, reasonable attorney's fees, and exemplary damages up to three times the consideration given, a consumer's private action under the Consumer Protection Act. 18 V.S.A. § 7115(c)(1); 9 V.S.A. § 2461(b)
- Can people sue? Yes 18 V.S.A. § 7115(c)(1) (same rights and remedies as under 9 V.S.A. chapter 63, subchapter 1)
- Time to fix before enforcement: The law does not say
Exemptions
- Mental health services that are part of an approved institutional review board or privacy board study under 45 C.F.R. § 164.512(i)(1)(i)(A) and (B). 18 V.S.A. § 7115(b)(2)
- A mental health professional acting within scope of practice who uses HIPAA-compliant AI tools and reviews and approves any mental health services, including FDA-authorized, cleared or approved software-based medical products prescribed or recommended by a mental health professional. 18 V.S.A. § 7115(d)
What the text leaves open
- The ban in § 7115(b) names a corporation or entity; whether an unlicensed individual offering mental health services is covered is not stated in this section.
- The catch-all for any other professional who provides mental health services is not tied to a license in the text; how far it reaches is not stated.
- Subsection (d) is written as a permission with conditions rather than a stand-alone duty; the act leaves further rules for professional AI use to the Advisory Council report due January 15, 2027.
- Disciplinary sanctions for unprofessional conduct are set elsewhere in Titles 3 and 26, which were not opened.
- Whether any lawsuit challenges the act was not checked.
Vermont Age-Appropriate Design Code Act (S.69, Act 63 of 2025): algorithm provisions
3 duties · checked November 15, 2026
S.69, Act No. 63 of 2025 (2025-2026 Session); 9 V.S.A. chapter 62, subchapter 6, §§ 2449a-2449j. Official text · Full law page
Who it covers
- Covered business. A business entity or affiliate that conducts business in Vermont, earns a majority of its annual revenue from online services, has online products reasonably likely to be accessed by a minor, collects consumers' personal data, and decides the purposes and means of processing it. Threshold: Majority of annual revenue from online services; a service is 'reasonably likely to be accessed' if directed to children under COPPA or its audience is at least two percent minors aged 2 through 17 (routinely, by internal research, or as the business knew or should have known). 9 V.S.A. § 2449a(10), (26)
Enforcement
- Enforcer: Vermont Attorney General. A violation of the subchapter or its rules is an unfair and deceptive act in commerce under 9 V.S.A. § 2453, and the Attorney General has its chapter 63 powers to make rules, investigate, sue and accept assurances of discontinuance. No court order blocking the law was found.
- Penalty: A civil penalty of not more than $10,000 for each unfair or deceptive act or practice in commerce, violations treated as unfair and deceptive acts under 9 V.S.A. § 2453, in an action under 9 V.S.A. § 2458. 9 V.S.A. § 2449h(a); 9 V.S.A. § 2458(b)(1)
- Can people sue? The law does not say 9 V.S.A. § 2449h (no private action in the subchapter)
- Time to fix before enforcement: None
Exemptions
- Federal, state, tribal or local government entities in the ordinary course of their operation. 9 V.S.A. § 2449b(1)
- HIPAA protected health information held by covered entities or business associates; information used only for listed public health activities; information used in listed human subjects research. 9 V.S.A. § 2449b(2)-(4)
- Entities whose primary purpose is journalism, with a majority journalist workforce; financial institutions subject to Title V of the Gramm-Leach-Bliley Act. 9 V.S.A. § 2449b(5), (6)
- The subchapter does not impose liability inconsistent with 47 U.S.C. § 230 and does not stop a covered minor from deliberately searching for or specifically requesting media. 9 V.S.A. § 2449i
What the text leaves open
- The act creates no private right of action, but 9 V.S.A. § 2461(b) lets a consumer harmed by false or fraudulent representations sue under the Consumer Protection Act; whether it reaches violations of this subchapter was not resolved.
- Whether the Attorney General has adopted the required rules, including age assurance methods that decide who is a covered minor, was not confirmed from an official page.
- The definition of algorithmic recommendation system refers to a business's website, while § 2449e requires disclosure on its website or mobile application; how this applies to app-only feeds is unclear.
- A web search found no lawsuit challenging this law as of November 15, 2026.
Vermont Automated Vehicle Testing Act (Act 60 of 2019, S.149)
8 duties · checked November 15, 2026
2019 Acts and Resolves No. 60 (S.149), Secs. 16-18, signed June 14, 2019; adds 23 V.S.A. chapter 41, §§ 4201-4203, and amends 19 V.S.A. § 1(24). Official text · Full law page
Who it covers
- Automated vehicle tester. A person who tests automated vehicles on Vermont public highways. 23 V.S.A. §§ 4202, 4203
- Operator. A person employed by or under contract with the tester, trained by the tester, at least 21 and licensed for the vehicle class, able to take immediate control. Threshold: Operator must be at least 21 years old. 23 V.S.A. § 4202(10)
Enforcement
- Enforcer: The Traffic Committee approves, suspends or revokes permits after a hearing; law enforcement officers may void a permit for a trip. No lawsuit challenging the law was found in this review.
- Penalty: Traffic violation, penalty up to $1,000, operating or testing in violation of a permit suspension or revocation. 23 V.S.A. § 4203(k)
- Penalty: Permit suspension or revocation; trip permit voided, violating a permit condition or unsafe continued testing. 23 V.S.A. § 4203(i)-(j)
- Can people sue? The law does not say 23 V.S.A. chapter 41
- Time to fix before enforcement: The law does not say
Exemptions
- Class 2, 3 and 4 town highways may be used for testing only where the municipality has preapproved testing; a municipality may revoke preapproval by written notice. 23 V.S.A. § 4203(c)
What the text leaves open
- The operator definition allows manual or remote control, but § 4203(h)(1) requires the operator to sit in the driver's seat; how remote operation fits is not stated.
- Whether the Agency of Transportation adopted rules or published the testing guide was not checked.
Vermont consumer data privacy act (Act 145 of 2026, S.71): profiling and automated decision provisions
9 duties · checked November 14, 2026
Act 145 of 2026 (S.71), An act relating to consumer data privacy and online surveillance, signed June 16, 2026; adds 9 V.S.A. §§ 2415a-2415k. Official text · Full law page
Who it covers
- Controller. A person that conducts business in Vermont or targets Vermont residents and met one of three data-volume tests in the preceding calendar year. Threshold: Controlled or processed personal data of 35,000 or more consumers (not counting data used only to complete a payment), or sensitive data of 3,000 or more consumers, or offered for sale personal data of 3,000 or more consumers. 9 V.S.A. § 2415b(a)
- Processor. Defined at 9 V.S.A. § 2415a(b)(38). A processor must help the controller with consumer requests, security and breach duties and assessments. 9 V.S.A. § 2415a(b)(38); § 2415f(a)
Enforcement
- Enforcer: Vermont Attorney General. A violation is deemed a violation of the Vermont Consumer Protection Act, and the Attorney General has that chapter's enforcement authority. The Attorney General must also publish and update compliance guidance.
- Penalty: Up to $10,000 for each unfair or deceptive act or practice, a violation of the subchapter, deemed a Consumer Protection Act violation, in an action by the Attorney General or an authorized State's Attorney; the court may also order injunctions, restitution and reimbursement of the State's costs. 9 V.S.A. § 2458(b)(1); 9 V.S.A. § 2415j(a)
- Can people sue? No 9 V.S.A. § 2415j(a); Act 145, Sec. 2(a)
- Time to fix before enforcement: 60 days (June 30, 2029; applies from January 1, 2028, and only where a cure is possible)
Exemptions
- Government entities in the ordinary course of their operations. 9 V.S.A. § 2415c(a)(1)
- HIPAA covered entities that are not hybrid entities, health care components of hybrid entities, business associates, and protected health information. 9 V.S.A. § 2415c(a)(2), (a)(18)
- State or federally chartered banks and credit unions, and data subject to Title V of the Gramm-Leach-Bliley Act. 9 V.S.A. § 2415c(a)(13), (a)(14)
- Persons regulated under Vermont insurance law (8 V.S.A. part 3), other than those running only a self-insurance program. 9 V.S.A. § 2415c(a)(16)
- Activity regulated by the Fair Credit Reporting Act, FERPA data, and data collected and used within a person's role as a job applicant, employee, agent or contractor. 9 V.S.A. § 2415c(a)(11), (a)(12)(B), (a)(24)(A)
- Nonprofits and small businesses have no general exemption; only specific nonprofit activities are exempt, and the data-volume tests are the only general limit. 9 V.S.A. § 2415b(a); § 2415c(a)
What the text leaves open
- The act does not use the terms artificial intelligence or algorithm. Its automated-decision rules work through the definition of profiling.
- The rights to question a profiling result, learn the reason and review the data apply only if feasible; the text does not say who decides feasibility.
- The act gives the Attorney General a guidance duty (9 V.S.A. § 2415j(c)) but no express rulemaking power.
- Sec. 2(a) says the General Assembly may revisit a private right of action if the Attorney General does not receive more resources.
- The definition of processor was cited but its wording was not extracted. The Vermont Age-Appropriate Design Code, which the act cross-references for covered minors, is a separate law and is not covered here.
- Whether the 2027 legislative session changes the act before it takes effect could not be known on the date of this file.
Vermont data broker law update with GenAI disclosure (Act 138, H.211)
3 duties · checked November 15, 2026
2026 Acts and Resolves No. 138 (H.211), signed June 16, 2026; amends 9 V.S.A. chapter 62 (including §§ 2430, 2431, 2436 and 2446) and adds 9 V.S.A. § 2444a. Official text · Full law page
Who it covers
- Data broker. A business, or unit of a business, that knowingly collects and sells or licenses to third parties the brokered personal information of a consumer with whom it has no direct relationship. 9 V.S.A. § 2430(6)
Enforcement
- Enforcer: Vermont Attorney General, who may sue in the Civil Division to collect penalties and seek injunctions; a violation of § 2446 is also an unfair and deceptive act under 9 V.S.A. § 2453. No lawsuit challenging the act was found in this review.
- Penalty: $200 per day, plus unpaid fees and the State's reasonable costs, operating as a data broker in Vermont without registering. 9 V.S.A. § 2446(b); Act 138 Act Summary
- Penalty: $1,000 per day, failing to supply all required registration information, after a 30-day window to amend. 9 V.S.A. § 2446(b); Act 138 Act Summary
- Penalty: $25,000 civil penalty, plus $1,000 per day, filing materially incorrect registration information; the daily fine runs after 30 days without correction. 9 V.S.A. § 2446(b); Act 138 Act Summary
- Can people sue? The law does not say 9 V.S.A. § 2446(c)-(d) (enforcement by the Attorney General)
- Time to fix before enforcement: The law does not say
Exemptions
- Not data brokers: developers or maintainers of third-party e-commerce or application platforms, 411 directory assistance providers, providers of publicly available business or professional information, and real-time health or safety alert services using publicly available information. 9 V.S.A. § 2430(6)(C)
What the text leaves open
- The penalty subsection in the extracted act text shows both the old $50-per-day penalty and the new amounts; the new amounts in this file match the official Act Summary.
- The 30-day windows to amend or correct a registration work like a correction period before daily fines; whether they count as a cure period is not stated.
- Whether a consumer can sue under 9 V.S.A. § 2461 for a § 2446 violation is not stated in the act.
- The act does not say what a data broker must do beyond disclosing GenAI-developer sales; it does not limit those sales.
Vermont digitally altered intimate images law (Act 161, H.878)
2 duties · checked November 15, 2026
2024 Acts and Resolves No. 161 (H.878), Sec. 45, signed June 6, 2024; amends 13 V.S.A. § 2606. Official text · Full law page
Who it covers
- Person. Any person who discloses a nude or sexual visual image of an identifiable person, including an image created or altered by digitization. 13 V.S.A. § 2606(a)(5)-(6), (b)
- Website, online service or app operator. A person who maintains a website, online service, online application or mobile app that contains such an image. 13 V.S.A. § 2606(c)
Enforcement
- Enforcer: Criminal prosecution by the State; the section does not name a prosecuting office. A person depicted may also sue. No lawsuit challenging the law was found in this review.
- Penalty: Up to 2 years in prison, a fine up to $2,000, or both, knowing nonconsensual disclosure with intent to harm, harass, intimidate, threaten or coerce. 13 V.S.A. § 2606(b)(1)
- Penalty: Up to 5 years in prison, a fine up to $10,000, or both, the same disclosure made with intent to disclose the image for financial profit. 13 V.S.A. § 2606(b)(2)
- Penalty: Equitable relief, including a temporary restraining order or injunction, and other relief available at law, a civil action by the person depicted against a defendant who knowingly disclosed the image without consent and caused harm. 13 V.S.A. § 2606(e)
- Can people sue? Yes 13 V.S.A. § 2606(e)(1)-(2); current codified (e)(4) lets the action be brought at any time, reaching violations on or after July 1, 2015
- Time to fix before enforcement: The law does not say
Exemptions
- Images of voluntary nudity or sexual conduct in public or commercial settings or where there is no reasonable expectation of privacy. 13 V.S.A. § 2606(d)(1)
- Disclosures in the public interest, such as reporting unlawful conduct, law enforcement, legal proceedings and medical treatment, and disclosures of matters of public concern. 13 V.S.A. § 2606(d)(2)-(3)
- Interactive computer services, information services and telecommunications services, for content solely provided by another person. 13 V.S.A. § 2606(d)(4)
What the text leaves open
- The penalty for an operator who charges a removal fee under § 2606(c) is not separately stated in the text read.
- The civil action does not state a damages amount.
- What 2025 Acts No. 89 (Adj. Sess.) changed in § 2606 was not determined; the current codified text includes (e)(3) on trauma diagnoses and (e)(4) on timing.
- The codified section was read through a paraphrasing tool; the intent list in (b)(1) here follows the act as enacted.
Vermont synthetic media in elections law (Act 75, S.23)
3 duties · checked November 15, 2026
2026 Acts and Resolves No. 75 (S.23), signed March 5, 2026; adds 17 V.S.A. §§ 2031-2033 and 2041-2042. Official text · Full law page
Who it covers
- Person. Any person who publishes, communicates or distributes deceptive and fraudulent synthetic media within 90 days before a Vermont election, knowing it is such media. 17 V.S.A. § 2032(a)
Enforcement
- Enforcer: Vermont Attorney General or a State's Attorney, who may bring any appropriate action or injunction and run civil investigations. A depicted candidate may seek an injunction. A federal court has barred enforcement against one creator, Henry L. Poitras, over one video only (Poitras v. Clark, D. Vt., Sept. 4, 2026); the law otherwise remains enforceable.
- Penalty: Fine up to $1,000, a knowing and intentional violation. 17 V.S.A. § 2033(a)
- Penalty: Fine up to $5,000, a knowing and intentional violation committed with intent to cause violence or bodily harm. 17 V.S.A. § 2033(a)(1)
- Penalty: Fine up to $10,000, a violation within five years after one or more prior violations. 17 V.S.A. § 2033(a)(2)
- Penalty: Fine up to $15,000, a violation with both intent to cause violence or bodily harm and a prior violation within five years. 17 V.S.A. § 2033(a)(3)
- Penalty: Fine up to $5,000, hiding, destroying, altering or falsifying documents or information to avoid a civil investigative demand. 17 V.S.A. § 2042(b)(2)
- Can people sue? Yes 17 V.S.A. § 2033(b) (a misrepresented candidate may seek injunctive or other equitable relief; no damages stated)
- Time to fix before enforcement: The law does not say
Exemptions
- Radio and TV broadcasters, cable and satellite operators, and websites, streaming platforms or apps airing the media in bona fide news coverage that acknowledges doubts about authenticity, when paid to air it, or when federal law requires airing candidate ads. 17 V.S.A. § 2032(b)(1)
- Websites and regularly published periodicals of general circulation that clearly state the media does not accurately represent the person's speech or conduct. 17 V.S.A. § 2032(b)(2)
- Satire or parody. 17 V.S.A. § 2032(b)(3)
- Telecommunications and information service providers and interactive computer services, for content provided by another person. 17 V.S.A. § 2032(b)(4)-(5)
What the text leaves open
- The act does not define candidate, election or public question for this subchapter.
- The September 4, 2026 order is preliminary and as-applied; the plaintiff's broader challenge to the law was not decided, and whether the State appealed was not found.
- The court said the criminal-prosecution warning in § 2042(a)(3) is likely severable; how the fines in § 2033 are imposed (civil or criminal) is not stated in the text read.
Other enacted laws to check
These 4 enacted AI laws are in the states you chose, but they are not yet mapped duty by duty, so they are not in the plan above. Each page has a summary and the official source.
- Vermont H0814: An act relating to neurological rights and the use of artificial intelligence technology in health and human… (effective May 18, 2026)
- Vermont H195: An act relating to use of facial recognition technology by law enforcement in cases involving sexual… (effective May 4, 2021)
- Vermont H410: An act relating to the use and oversight of artificial intelligence in State government (effective July 1, 2022)
- Vermont S0124: An act relating to governmental structures protecting the public health, safety, and welfare (effective October 1, 2020)
Information, not legal advice. This plan summarizes what the official texts of the laws listed say. It does not decide whether a law applies to your organization; that turns on facts such as your size, your role as a developer or deployer, and how you use AI. Laws change, and courts and regulators can read them differently. Check the official text linked with each duty and talk to a qualified lawyer before acting. Using this page does not create an attorney-client relationship. See our terms of service.
How the plan is built
Each law in the plan was read from its official text, on the legislature’s or state’s own website. 265 of the 326 have also been read a second time to confirm every date, threshold, penalty and enforcer; the rest have had one full read, and each shows the date it was last checked. Each duty is written in plain English in 30 words or fewer and carries the section it comes from, with a link.
Where a law is silent, the plan says so. It does not borrow a penalty from another statute or guess at a deadline. A law that is repealed or replaced on a known date shows that end date, and its duties leave the plan once the date passes. The date each law was last checked appears with it.
The plan is built fresh from these records every time the page loads, so it changes as soon as a law is added or re-checked. To report an error, use the corrections page. For how we find laws and decide what counts as an AI law, see our methodology. If you are not sure which laws touch your business at all, start with Am I Affected?
Common questions
What does an AI compliance plan cover?
Each duty an enacted state AI law places on a business or other regulated party: who it applies to, what it requires, when it starts, how often it recurs, who enforces it, the penalties and whether people can sue. The builder covers 1,235 duties in 326 enacted laws across 50 states, and every duty links to the section of law it comes from.
Where does the information come from?
From the official text of each law: the enrolled bill, session law or codified statute, opened on the legislature's or state's own website. 265 of the 326 laws have also been read a second time to confirm every date, threshold, penalty and enforcer, and the date each law was last checked is shown with it. Where a law is silent on a point, such as a penalty amount, the plan says the law does not say rather than filling the gap. Law firm summaries and news reports are never used as sources.
Does the plan include every AI law in a state?
Not yet. It includes the enacted laws we have mapped duty by duty. When you choose a state, its other enacted AI laws are listed separately with links, so nothing is left out of view. New laws are added as they are read. When a law is repealed or replaced on a set date, its duties show that end date and leave the plan once it passes.
How do I know which duties apply to my company?
Start with the 'who it covers' entry for each law: many apply only above a size or revenue threshold, only to developers or only to deployers, or only in one industry. The plan quotes those conditions from the text. Whether your company meets them depends on facts only you and your counsel know.
Is this legal advice?
No. It is information drawn from official legal texts, organized so you can see what each law requires. Use it to brief your team and your lawyers, not in place of them.
What does Pro add?
The same plan as a CSV file for spreadsheets and audit files, and as a calendar file (.ics) with every dated duty as an event that links back to the law. Both are built from the states and uses you pick. The plan on this page, and printing it, are open to everyone.