AI vendor contract regulation addresses the obligations of AI developers, deployers, and third-party vendors throughout the AI supply chain. Emerging state laws are establishing requirements for contractual disclosures, model documentation, ongoing monitoring obligations, and liability allocation between AI vendors and their customers.
Key provisions include mandatory model cards and technical documentation, requirements to disclose training data sources, contractual obligations for bias testing and security audits, and indemnification frameworks for AI-caused harm. Legal practitioners should review vendor agreements for compliance with evolving state-specific requirements.
Artificial Intelligence Safety Measures Act
Illinois' SB 315, the Artificial Intelligence Safety Measures Act, regulates developers of frontier AI models (foundation models trained with more than 10^26 operations). All frontier developers must publish a transparency report when deploying a new or substantially modified model and report critical safety incidents within 72 hours. Large frontier developers (over $500 million revenue with affiliates) need a state disclosure statement from January 1, 2027, and from January 1, 2028 a published frontier AI framework and annual independent audits. Large developers face Attorney General penalties up to $1 million, then $3 million. Signed July 6, 2026 (P.A. 104-0538); effective January 1, 2027.
An act relating to data brokers and personal information
Vermont's H.211 (Act 138 of 2026) overhauls Vermont's data broker law, with higher fees and fines, checks before brokers disclose data, and a data broker breach-notice law. Its AI-relevant provision is in the annual registration under 9 V.S.A. § 2446: a data broker must state whether, in the past year, it shared consumers' data with or sold it to a developer of a generative AI ("GenAI") system or model, alongside disclosures about sales to foreign actors, governments and law enforcement. The act defines a GenAI system as an AI system that can generate synthetic text, images, video and audio. These provisions take effect January 1, 2027.
Establishes criteria for the use of automated employment decision tools; provides for enforcement for violations of such criteria.
New York's S 4394-A would add Labor Law Article 20-D (§§ 750-757) for automated employment decision tools, AI systems specifically developed, marketed or modified to be the controlling factor in a decision to hire, promote or terminate. Deployers may not use them in a way that violates Executive Law Article 15; deployers and developers must perform impact assessments within one year and annually, keep governance programs and give notice to individuals. The Attorney General enforces after notice and a 45-day cure period. Referred to Labor January 7, 2026.
Requires third party verification of compliance with transparency and safety requirements for developers of artificial intelligence models; requires publication of such compliance reports.
New York's S 10373 would require a large frontier developer to retain a third party verifier each year to report on its compliance with its frontier AI framework, including any noncompliance and whether its public statements on catastrophic risk conflict with the findings. The verifier must publish a summary within sixty days of completing the report. The Attorney General could seek civil penalties of up to $1 million for a first violation and up to $3 million for each later one. Referred to the Senate Internet and Technology Committee May 15, 2026; it has not passed either chamber.
Data brokers: data collection and deletion.
California's SB 361 expands what data brokers must report when registering with the California Privacy Protection Agency. Registrations must say whether the broker collects data such as account logins, government ID numbers, citizenship or immigration status, union membership, sexual orientation, gender identity or biometric data, and whether in the past year it shared or sold consumers' data to a developer of a generative AI system or model, a foreign actor, governments or law enforcement. Signed October 8, 2025 (Chapter 466); effective January 1, 2026.
Consumer Protection - High-Risk Artificial Intelligence - Developer and Deployer Requirements
Maryland's SB 936 (2025) would have added Commercial Law sections 14-47A-01 to 14-47A-08 requiring developers and deployers of high-risk AI systems used for consequential decisions to use reasonable care against algorithmic discrimination starting February 1, 2026, with impact assessments, consumer notices and appeals. The Attorney General would enforce, with fines up to $1,000 per violation ($1,000 to $10,000 if willful). A Senate Finance hearing was set for February 27, 2025; the bill went no further and died when the session ended.
Consumer Protection and Product Liability - Chatbots
Maryland's HB 1250 (2026, first reader text, cross-filed with SB 827) would have regulated operators and developers of generative AI chatbots made available to Maryland users: affirmative consent for training on input data, a ban on using chat logs for advertising, a 10-year cap on chat log retention, protections for users under 13, hourly not-human warnings, monthly safety testing, and product liability with possible strict liability. It had a House Economic Matters hearing set for March 3, 2026 and died when the 2026 session ended.
Relating To Artificial Intelligence.
Hawaii's SB 2967 (2026) would have added a part to HRS chapter 480 regulating businesses ('deployers') that use AI systems or automated decision tools with consumers. They would have to disclose AI interactions, give notice and explanation, correction, appeal and human review for AI-influenced consequential decisions, keep risk programs, do annual impact assessments and report incidents within 90 days. A violation would be an unfair or deceptive act. The Senate committee on LBT deferred it February 11, 2026; it died.
Relating To Artificial Intelligence.
Hawaii's HB 2500 (2026) would have added a chapter on algorithmic decision systems. Developers would have to give deployers risk disclosures; deployers would have to give notice before use and post-decision information (including the 20 most influential characteristics) when a system affects education, employment, finance, government services, health care, housing, insurance or legal services; generative AI would have to be disclosed to users. Developers and deployers would be jointly and severally liable for violations facilitated by the deployer. House committee ECD deferred it February 6, 2026; it died.
Relating To Artificial Intelligence.
Hawaii's HB 639 HD 1 (2025) would have required businesses and individuals in commercial transactions to clearly disclose before using an AI chatbot that could lead a reasonable person to think they are talking to a natural person, and chatbot developers to disclose their chatbot uses AI and can mimic human behavior. It would have allowed suits with the greater of $1,000 or treble damages and civil penalties up to $5,000,000. It passed House second reading February 5, 2025 and was referred to CPC, was carried over to 2026 on December 8, 2025 and was not enacted.
Acquisition and use of facial recognition technology by government entities prohibited.
Minnesota's HF 3661 would have barred state and local government entities, law enforcement agencies and officials from obtaining, retaining, accessing or using face surveillance systems or their information, or contracting with private entities to do so. Evidence from violations would have been inadmissible, and people could sue for damages of at least $1,000 or $100 per violation, whichever is greater, plus injunctions. Introduced February 23, 2026 and referred to Judiciary Finance and Civil Law and it never left committee.
Acquisition and use prohibition of facial recognition technology by government entities
Minnesota's SF 129 (93rd Legislature) would have barred state and local government entities, law enforcement agencies and officials from obtaining, retaining, accessing or using face surveillance systems or their information, or contracting with private entities to do so. People could have sued for damages of at least $1,000 or $100 per violation, whichever is greater, plus injunctions. Introduced January 11, 2023 and never left committee.
Eyewitness Identification
Not law: died in committee. Florida's HB 875, the House counterpart of SB 1202, would have amended s. 92.70, F.S., to set eyewitness identification procedures: a recorded description, independent lineup administrators, lineups with the suspect and at least five fillers, limits on show-ups and first-time in-court identifications, and audio and video recording. If facial recognition technology identified a suspect, a lineup could not be held without a basis independent of the technology. It died in the Criminal Justice Subcommittee on March 13, 2026.
Artificial Intelligence in Higher Education
Not law: died in committee. Florida's SB 1458 would have created the Artificial Intelligence in Higher Education Study Group to examine how AI affects academic integrity (including contract cheating), teaching, advising, grading, research, privacy, intellectual property and data security in the State University System and Florida College System. It would have had to report findings, recommendations and model policies to the Governor, Senate President and House Speaker by December 1, 2026, and the section would have expired December 31, 2026. It died in Education Postsecondary on March 13, 2026.
An act relating to creating oversight and safety standards for developers and deployers of inherently dangerous artificial intelligence systems
Vermont's H.341 (2025-2026 biennium) would have set oversight and safety standards for developers and deployers of inherently dangerous AI systems, meaning high-risk AI systems, dual-use foundational models and generative AI systems, used by non-small businesses doing business in Vermont. Duties included reasonable care, NIST-based testing and risk management, and Safety and Impact Assessments filed with an AI Division in the Agency of Digital Services. Harmed consumers could sue. It was referred to House Commerce on February 25, 2025 and died.
An act relating to liability standards for developers and deployers of artificial intelligence systems
Vermont's H.792 (2026) would have added 9 V.S.A. chapter 118 on liability for developers and deployers of AI. A developer would have been liable in a products liability action only if it failed to use reasonable care in design, warnings or express warranty, with a rebuttable presumption of non-defect for developers that test, mitigate, disclose risks and keep an AI data sheet. Deployers would have been treated as developers if they materially changed or misused a product. Violations would have been unfair and deceptive acts. Referred to committee January 28, 2026; died.
Providing consumer protections for artificial intelligence systems.
Washington's SB 6284 (1st substitute, 2026 session) would have required developers and deployers of high-risk AI systems used to make, or be a substantial factor in, consequential decisions on employment, housing, insurance, health care, education, lending, legal services and similar matters to guard against algorithmic discrimination. Deployer duties would start July 1, 2027, consumer notice July 1, 2026, and only the Attorney General could enforce. It cleared Senate Environment, Energy & Technology on February 3, 2026, was heard in Ways & Means on February 6, and died at adjournment on March 12.
Regulating high-risk artificial intelligence system development, deployment, and use.
Washington's SB 6120 (2026 session), the Senate companion to HB 2157, would have required developers and deployers of high-risk AI systems, those intended to make or be a substantial factor in consequential decisions such as employment, lending, housing, insurance, health care and education, to use reasonable care against algorithmic discrimination. It included developer documentation, deployer risk programs and impact assessments, consumer notices, and private lawsuits for injunctions. It had a first reading on January 14, 2026 and died at adjournment.
Protecting state and local government systems and data from foreign entities
West Virginia's SB 70 (2026 regular session) would have created the Data Protection Act (new W. Va. Code art. 5-34). State agency officials, employees and contractors would have had to block, on state-owned or state-leased internet-capable devices, social media platforms owned by entities in a foreign country of concern, and could not use applications, software or AI algorithms owned by entities located in such a country. Senate Government Organization reported it do pass on February 6, 2026 and sent it to Judiciary, where it died when the session ended March 14, 2026.
Protecting state and local government systems and data from foreign entities
West Virginia's SB 694 (2025 regular session) would have created the Data Protection Act (new W. Va. Code art. 5-32). State agency officials, employees and contractors would have had to block, on state-owned or state-leased internet-capable devices, social media platforms owned by entities in a foreign country of concern, and could not use applications, software or AI algorithms owned by entities located in such a country. It was reported do pass but first to Judiciary on March 11, 2025 and went no further.
A bill for an act relating to restrictions on the use of artificial intelligence, and creating a civil cause of action.
Iowa's HF 406 would require device companies and AI developers to disclose and get separate agreement before AI accesses private data on smart devices, let users uninstall preinstalled AI, and bar using AI to recreate a person's likeness without consent for commercial or deceptive uses. It creates a private right of action with punitive damages up to $250,000 per violation. A House subcommittee recommended passage March 5, 2025; it has not passed either chamber.
Biometric data and license plate readers-regulation.
Wyoming's HB 0181 (2026) would have barred governmental entities from using biometric data to identify or verify people, geolocation data to locate people or vehicles, and automatic license plate reader (ALPR) systems to identify vehicles, with narrow law enforcement exceptions (mostly warrant-based), a seven-day retention limit for data not tied to an investigation, and a civil action for damages or injunctive relief. Received for introduction February 11, 2026; the House did not consider it for introduction on February 13, 2026, so it died.
Use of fabricated media in elections.
Indiana's SB 7 (2024) would have barred disseminating 'fabricated media' made with generative AI, or contracting to do so, fewer than 90 days before an election to injure a candidate or influence the outcome, when the person knows or reasonably should know it is fabricated, the depicted person did not consent (for altered recordings and imitations of real people), and it lacks the disclaimer 'Elements of this media have been digitally altered or artificially generated.' A knowing and intentional violation would be a Class B misdemeanor, with enhancements. Referred to committee January 8, 2024; it did not pass.
Requires healthcare providers and healthcare facilities to inform patients of the use of artificial intelligence to memorialize patient visits.
Rhode Island S 2570 Substitute A (2026), enacted as Chapter 372, the Use of Artificial Intelligence by Healthcare Providers Notification Act, requires healthcare providers and facilities that use AI to document in-person or telehealth visits to notify patients of the use of AI for that sole purpose and to review the AI-generated documentation for accuracy after the visit. The act states no penalties. Enacted June 22, 2026; effective upon passage.
Public Safety Protections Artificial Intelligence
Not law. Colorado's HB 25-1212, as introduced, would have protected workers at developers that trained a foundation AI model costing at least $100 million in compute. Developers could not prevent or retaliate against workers who disclose information they have reasonable cause to believe shows a legal violation, a substantial public safety or security risk, or false or misleading statements about such risks, and would have had to notify workers and offer an anonymous internal disclosure process. Workers could sue for reinstatement, the greater of $10,000 or lost pay, and attorney fees. House Judiciary amended it; it never passed the House and its status is Lost.
Relating to the regulation and reporting on the use of artificial intelligence systems by certain business entities and state agencies; providing civil penalties.
Texas HB 1709 (2025), as introduced, the Texas Responsible Artificial Intelligence Governance Act, would have set duties for developers, distributors and deployers of high-risk AI systems that are a substantial factor in consequential decisions, with attorney general enforcement and civil penalties of $50,000 to $100,000 per uncured violation. It also would have banned certain uses, created a regulatory sandbox and an AI Council. It died when the regular session adjourned June 2, 2025.
Protection Against Foreign Adversarial Artificial Intelligence Act of 2025
This bill would bar federal contractors with an active federal contract from using DeepSeek, or any successor app or service from its developer High Flyer or entities High Flyer owns, to perform or support work on a federal contract. The Commerce Secretary, consulting the Defense Secretary, could waive the ban case by case for national security objectives or research. Commerce would also report to Congress within a year on national security threats from AI platforms tied to countries of concern, including censorship, propaganda, export-control circumvention and foreign access to U.S. users' data. Introduced May 7, 2025.
Relating to an automated artificial intelligence review of library material purchased by public schools; providing an administrative penalty.
Texas HB 4448 (2025), as introduced, would have required school districts and open-enrollment charter schools to have library material reviewed by a Texas Education Agency-approved third party using an automated AI review to rate it sexually explicit or sexually relevant. Explicit material could not be purchased, and relevant material would need parental consent. The agency could assess penalties up to $10,000 per library material acquired in violation. It did not pass both chambers and died June 2, 2025.
Relating to the artificial intelligence division within the Department of Information Resources.
Texas SB 1700 (2025), as introduced, would have had the Department of Information Resources establish an artificial intelligence division to help state agencies use generative AI on projects such as modernizing or replacing legacy systems. Projects could use department-developed AI or a vendor under a contract requiring the vendor's AI to complete at least 90 percent of the work, and the division would write cost analysis reports. No enrolled version exists, so it died June 2, 2025.
VET Artificial Intelligence Act Validation and Evaluation for Trustworthy (VET) Artificial Intelligence Act
The VET AI Act would direct NIST to develop, within a year and update at least every 2 years, voluntary technical guidelines for internal and independent third-party assurance of AI systems: testing, evaluating, verifying and validating them. The guidelines would address consumer privacy, assessing and reducing harms, dataset quality, documentation and disclosure, and governance, and recommend how often and how deeply developers and deployers should be assessed based on risk. Commerce would convene an advisory committee on assessor qualifications and study the capacity of the AI assurance sector. Introduced July 31, 2025.
Ban on employer use of automated decision systems.
Not law. HB 1421 would have barred Indiana employers with 11 or more workers, and state and local government employers, from relying solely on an automated decision system for hiring, firing, pay, scheduling or other job decisions. Using such a system's output would have required bias testing before use and independent testing every year, advance notice to workers and applicants, human review, plain-language documentation within 7 days, and a right to dispute and appeal to a person. Workers could opt out of algorithmic management. It was referred to committee on January 8, 2026 and got no further action before the 2026 session adjourned.
Creates a consumer bill of rights regarding artificial intelligence
Not law. HB 734 would have created a Louisiana AI bill of rights. Companion chatbot platforms would have needed a parent's consent for minors' accounts, with parental controls and self-harm alerts, AI disclosures and hourly break reminders for minors, and safeguards against material harmful to minors. Any bot would have had to show an hourly pop-up saying the user is not talking to a human. It also would have barred AI companies from selling personal data unless deidentified, banned commercial use of AI-generated likenesses without consent, and limited state AI contracts with entities tied to foreign countries of concern. It was withdrawn on March 30, 2026.
Use Of Artificial Intelligence Transparency
New Mexico's HB 184 (2024), 'Use of Artificial Intelligence Transparency', would have required each executive agency to submit an annual inventory of its AI systems by October 1, 2024 and each October 1 after, with the General Services Department (changed to the department of information technology by committee amendment) reporting and assessing the systems for accuracy and bias. Procurement contracts for covered AI products would have had to require vendor transparency, with a $500,000 appropriation and a July 1, 2024 effective date. It received Do Pass reports from both House committees but was then postponed indefinitely (undated) and died.
AN ACT to amend Tennessee Code Annotated, Title 29; Title 37 and Title 47, relative to artificial intelligence.
Tennessee Public Chapter 1082 directs the Tennessee Advisory Commission on Intergovernmental Relations (TACIR) to study how the state might regulate AI systems and generative AI chatbots. The study must cover federal law, other states' approaches, constitutional limits, costs to government, economic effects on businesses, developers, schools and consumers, and safeguards for minors and mental health, including suicide prevention, with any recommendations for legislation. Introduced as the Curbing Harmful AI Technology (CHAT) Act regulating companion chatbots, it was rewritten into this study. Signed May 22, 2026; effective immediately.
Artificial intelligence business; attorney general
Arizona's HB 4098 (2026) would have required an 'artificial intelligence business' using a frontier model from a large developer to assess each high-risk AI system for bias, child-safety, privacy and catastrophic risks, file a transparency report with the attorney general and post it publicly, and run quarterly audits. The attorney general could impose civil penalties of up to $50,000 per violation. It was held in House committees with no action and died when the 2026 session ended June 13, 2026.
Rental price fixing; algorithmic pricing
Arizona's HB 2490 (2026) would have barred a coordinator or a residential landlord from using an algorithmic device that uses nonpublic competitor data to perform a coordinating function in order to set or adjust rents, renewal terms or occupancy levels or to facilitate an agreement not to compete. Use in violation would, in specified circumstances, create a rebuttable presumption of a contract or conspiracy to restrain trade. It was held in House committees with no action and died when the 2026 session ended June 13, 2026.
A bill for an act relating to the requirements for chatbot deployers, including required protocols, limitations on data collection, and requirements for minors to interact with artificial intelligence companions and therapeutic chatbots, and providing civil penalties, punitive penalties, and civil…
Not law. HF 2204 would have required anyone offering a chatbot to the public in Iowa to keep protocols to detect, respond to and reduce harm to users, putting user safety first, and to collect only the data it needs. Deployers would have had to use age verification to keep minors from AI companions (chatbots that simulate a romantic or emotional bond), get permission before offering chatbots that impersonate real people, and meet strict conditions, including a licensed professional's recommendation and clinical trial evidence, before offering therapeutic chatbots to minors. It was referred to committee on January 29, 2026 and died when the 2026 session adjourned.
A bill for an act relating to the ownership of artificial intelligence output and trained artificial intelligence. (See HF 2691.)
Not law. Iowa House Study Bill 635 would have set default rules for owning AI output and trained AI. A user whose input makes an AI generate output would own that output, unless the AI's terms of use or a contract says otherwise. A person who trains an AI on lawfully acquired data would own the resulting AI unless they transferred those rights by contract. The House Economic Growth and Technology Committee approved it 18-1 and it was renumbered HF 2691 on February 23, 2026, but HF 2691 never got a floor vote before the 2026 session adjourned.
Autonomous Systems Amendments
Utah's SB 292 limits civil liability for automated driving systems (ADS). Noneconomic damages in actions over ADS-equipped vehicles are capped at $1,000,000 (not for wrongful death), with no punitive damages for level four or five ADS. People hurt by a driverless level four or five vehicle may sue its owner or dispatcher without proving negligence or defect, but recovery is capped at $100,000. Makers and developers of level four or five ADS are shielded from negligence claims and face product liability under stricter defect rules and a state-of-the-art defense. Signed March 23, 2026; effective May 6, 2026; the limits are repealed July 1, 2030.
Artificial intelligence; Responsible Deployment of AI Systems Act; AI Council; AI Regulatory Sandbox Program; Artificial Intelligence Workforce Development Program; effective date.
Oklahoma's HB 1916 (2025-26), as introduced, would have created the Responsible Deployment of AI Systems Act, covering public agencies and private entities that deploy AI systems affecting people in Oklahoma. Deployers would classify AI systems by risk (unacceptable, high, limited, minimal), assess them, and subject high-risk systems to oversight, notices and audits. It was referred to the Rules Committee on February 4, 2025 and died when the 2026 session ended May 14, 2026.
Mental health professionals: artificial intelligence.
Vetoed. SB 903, the Wellness and Oversight for Psychological Resources Act, would have limited AI in California psychotherapy to administrative and supplementary support. Recording or transcribing sessions, or AI triage, would have needed the patient's informed consent, and AI could not make therapeutic decisions, produce diagnoses or treatment plans, detect emotions or screen patients without a licensed professional's review. Companion chatbots could not be marketed as therapy. Governor Newsom vetoed it on September 30, 2026, calling it overly broad and saying it would restrict useful clinical tools and reach general-purpose AI.
Adds to existing law to establish provisions regarding unbiased artificial intelligence in state government purchasing.
Did not pass. H 687 would have let Idaho executive-branch agencies, including public colleges, buy or use a large language model only if it is 'truth-seeking' and 'ideologically neutral.' Agencies could not use models designed to alter facts or history to advance diversity, equity and inclusion (DEI) outcomes, restrict lawful content based on race or sex, embed DEI-based guardrails, or require users to affirm DEI concepts. Contracts would have given agencies access to system prompts, training directives and test results to check compliance. It passed the House 56-11 but died in the Senate State Affairs Committee.
Automated license plate recognition systems.
Vetoed. California's SB 274, the ALPR Data Accountability Act, would have tightened rules for automated license plate recognition (cameras plus computer algorithms that turn plates into searchable data). Public agencies could not have kept data not matching an authorized hot list past 60 days, police could have used it only to locate vehicles or people reasonably suspected of involvement in a public offense, every query would have needed a logged case file number (or AG task force name), and vendor contracts could not give default access to national ALPR databases. Vetoed by Governor Newsom October 1, 2025; veto sustained March 2, 2026.
Artificial intelligence models: large developers.
California's SB 53, the Transparency in Frontier Artificial Intelligence Act, covers developers of frontier models (foundation models trained with more than 10^26 operations). Large frontier developers (over $500 million in prior-year revenue with affiliates) must publish and follow a frontier AI framework for catastrophic risks. All frontier developers must publish transparency reports at deployment, report critical safety incidents to the Office of Emergency Services within 15 days, and not retaliate against whistleblowers. Large developers face penalties up to $1 million per violation. Signed September 29, 2025 (Chapter 138); effective January 1, 2026.
Law enforcement agencies: artificial intelligence.
California's SB 524 (Penal Code § 13663) requires every law enforcement agency to have a policy that official reports written fully or partly with AI name each AI program used, state "This report was written either fully or in part using artificial intelligence," and carry the preparer's signature verifying the facts. The AI first draft must be kept as long as the report, agencies must keep an audit trail, and vendors may not share or sell agency data except as allowed. Signed October 10, 2025 (Chapter 587); effective January 1, 2026.
California Cybersecurity Integration Center: artificial intelligence.
California's AB 979 amends Government Code § 8586.5 so the California Cybersecurity Integration Center, led by the Office of Emergency Services, must develop a California AI Cybersecurity Collaboration Playbook by January 1, 2027, informed by federal standards and the federal JCDC AI playbook. It must include mandatory mechanisms for state contractors and vendors providing AI services to share known threats and vulnerabilities, and may add voluntary ones for others. Shared threat information is confidential. Signed October 3, 2025 (Chapter 285); effective January 1, 2026.
Public contracts: automated decision systems: procurement standards.
Vetoed. California's SB 892 (2024) would have required the Department of Technology to adopt regulations setting a procurement standard for automated decision systems (ADS), with risk assessments, risk controls, incident monitoring, prohibited uses, equity and human-oversight reviews and data minimization. From January 1, 2027, state agencies could not have bought ADS until those rules existed, and contracts would have needed risk-assessment and notice-and-appeal clauses. Governor Newsom vetoed it September 20, 2024, saying it would disrupt existing work and create unbudgeted General Fund costs.
Regulate the use of pricing algorithms
Ohio's HB 665 (as introduced) would amend Ohio's antitrust law (R.C. Chapter 1331) to bar using or distributing a pricing algorithm, including one derived from machine learning or AI, that uses or is trained with nonpublic competitor data, and would presume an illegal agreement in certain cases where the same algorithm is distributed to or used by others in the same or a related market. Enterprises with $5 million or more in gross receipts would have to disclose algorithmic pricing to customers, employees and contractors. Introduced January 29, 2026 and referred February 4, 2026 to the House Technology and Innovation Committee; it has not passed either house.
Relates to the training and use of artificial intelligence frontier models; defines terms; establishes remedies for violations.
New York's RAISE Act (S 6953-B, Chapter 699 of 2025) as signed covered "large developers" spending over $100 million on compute, required safety protocols and set penalties up to $10 million, then $30 million. Chapter 96 of 2026 (signed March 27, 2026) repealed and replaced Article 44-B and set the effective date at January 1, 2027. From then, developers of frontier models (over 10^26 training operations) must publish transparency reports when deploying and report critical safety incidents to a Department of Financial Services office within 72 hours; those with over $500 million in revenue must also publish a frontier AI framework and file disclosure statements. Signed December 19, 2025.
ARTIFICIAL INTELLIGENCE SAFETY
Illinois's SB 3261, the Artificial Intelligence Public Safety and Child Protection Transparency Act, would require large frontier developers (models trained with over 10^26 operations; $500 million revenue) and large chatbot providers ($25 million revenue; 1,000,000+ monthly users, likely accessed by minors) to publish safety plans, and frontier developers and large chatbot providers to report safety incidents to the Attorney General. Civil penalties up to $1,000,000 (large developers) or $50,000 (chatbot providers) per violation. Introduced February 3, 2026; re-referred to Assignments May 22, 2026 under Rule 3-9(a); not passed. Would take effect January 1, 2027.
"GAI Accountability Act;" imposes civil penalties on generative artificial intelligence platforms engaging in harmful activity, including exploitation of children.
New Jersey's A 5090, the GAI Accountability Act, would make owners, operators and developers of generative AI platforms that do business in, are based in, or are accessible to residents of New Jersey civilly liable if they fail to prevent the platform from engaging in conduct that would be murder, assault, theft by deception or extortion, endangering the welfare of children, or creating child sexual abuse or exploitation material if done by a human. The penalty would be $20,000 per violation. Introduced May 14, 2026 and referred to the Assembly Science, Innovation and Technology Committee; it has not passed either house.
Safety - As introduced, enacts the "Artificial Intelligence Public Safety and Child Protection Transparency Act." - Amends TCA Title 4; Title 10, Chapter 7; Title 47; Title 58 and Title 68.
Tennessee's HB 1898 (114th General Assembly), the "Artificial Intelligence Public Safety and Child Protection Transparency Act," as introduced would have barred a frontier model developer or a large chatbot provider (1 million monthly users, $25 million revenue) from making materially false or misleading statements about catastrophic risk, and defined child safety incidents involving covered chatbots. The House passed it as amended, 94-0, on April 16, 2026, and the Senate received it April 20, 2026, but it did not pass the Senate before the session ended. Companion: SB 2171.
Relative to the contracting of digital replicas
Bill H74 establishes guidelines for the contracting of digital replicas in Massachusetts. Specific provisions are pending confirmation.
School Safety Firearm Detection Software Pilot Program; established.
Virginia's HB 1818 (2025 Regular Session) would have created a School Safety Firearm Detection Software Pilot Program under the Public School Security Equipment Grant Act of 2013, awarding grants for AI software that analyzes school security-camera video to detect firearms in two Title 1 schools in each congressional district. Left in House Appropriations on February 4, 2025; it failed.
Adopt the Artificial Intelligence Consumer Protection Act
Not law. Nebraska LB642, introduced by Senator Bostar, would have enacted the Artificial Intelligence Consumer Protection Act. Developers and deployers of high-risk AI systems that make consequential decisions without human review would have had to use reasonable care against algorithmic discrimination, with impact assessments, consumer notices and appeals, and Attorney General enforcement after a 90-day cure period. Indefinitely postponed April 17, 2026.
Regulating artificial intelligence training data.
Washington's HB 2503 (substitute, 2026 session) would have required developers of generative AI systems to post a high-level summary of their training datasets on their website on or before January 1, 2027 and before each later release or substantial modification made available to Washingtonians. It covered systems released on or after January 1, 2022, and treated violations as Consumer Protection Act violations. It was reported from House Technology, Economic Development, & Veterans on January 28, 2026, referred to Appropriations January 30 and died at adjournment.
AI Workforce PREPARE Act AI Workforce Projections, Research, and Evaluations to Promote AI Readiness and Employment Act
The federal S. 3339 (AI Workforce PREPARE Act) would have the Labor and Commerce departments gather data and forecasts on AI's effect on jobs, including an AI Workforce Research Hub, forecasts for at least 15 AI-sensitive occupations, AI questions in federal surveys and a voluntary program for AI developers and deployers to share adoption data. If AI was a substantial factor in a mass layoff, the WARN Act notice would have to say so, for notices issued from 1 year after enactment. Authorizations total $53,500,000 over FY2026-2030. Introduced December 3, 2025 and referred to the Senate HELP Committee; no further action.
ICE Out of Our Faces Act
The federal S. 3779 (ICE Out of Our Faces Act) would make it unlawful for any covered immigration officer (officers, employees, agents and contractors of ICE or CBP and officials deputized under INA section 287(g)) to acquire, possess, access or use in the United States any biometric surveillance system, including facial recognition, or information from one run by another entity. Data collected would have to be deleted within 30 days after enactment. Introduced February 4, 2026 and referred to the Senate Homeland Security and Governmental Affairs Committee; no further action.
PROCUREMENT-LOCAL GOV AI
Illinois's SB 2786 (104th General Assembly) would amend the Illinois Procurement Code to let the Department of Central Management Services enter a sole source contract with a specified contractor for a 6-month procurement modernization pilot. The pilot would run in no more than 7 municipalities of under 200,000 people to test AI applications. Referred to Assignments January 13, 2026.
ARTIFICIAL INTELLIGENCE SAFETY
Illinois's HB 3506 (104th General Assembly) would create the Artificial Intelligence Safety and Security Protocol Act. As introduced, developers would publish a safety and security protocol, publish risk assessment reports at least every 90 days, and obtain an annual third-party compliance audit, with civil penalties. House Committee Amendment No. 1 narrows this to 'large developers' and adds whistleblower protections. Re-referred to Rules April 11, 2025.
AI Safety Measures Act
Illinois's SB 3312 (104th General Assembly) would create the Artificial Intelligence Safety Measures Act. Large frontier developers would have to adopt and publish a frontier AI framework covering catastrophic risk management, transparency and cybersecurity, and report critical safety incidents to the Illinois Emergency Management Agency and Office of Homeland Security. Re-referred to Senate Assignments on May 22, 2026.
AI Product Liability Act
Illinois's SB 3502 (104th General Assembly) would create the Artificial Intelligence Design Requirements Act, setting rules for product liability actions against AI developers for defective design, inadequate instructions or warnings, and breach of express warranty. A deployer would be treated as a developer if it makes a material and substantial change or intentionally misuses the product contrary to the express warranty. Re-referred to Senate Assignments May 22, 2026.
Biometric Surveillance Act
Illinois's HB 5521 (104th General Assembly) would create the Illinois Biometric Surveillance Act. Law enforcement agencies could not obtain, retain, possess, access, request or use a biometric identification system, including through a third party or another government agency. It would give a private right of action and Attorney General enforcement. Re-referred to the House Rules Committee on March 27, 2026.
AI USE IN GOVT CONTRACTS
Illinois's HB 5228 (103rd General Assembly) would have added Section 50-41 to the Illinois Procurement Code. A vendor contracting for government services, grants, or leases or purchases of software or hardware would have to disclose whether AI technology is, has been, or will be used in fulfilling the contract or in the goods or services purchased. It was not passed before the 103rd General Assembly ended (Session Sine Die, January 7, 2025).
ALGORITHMIC IMPACT ASSESSMENTS
Illinois's HB 5322 (103rd General Assembly) would have created the Illinois Commercial Algorithmic Impact Assessments Act. By January 1, 2026, and annually after, deployers and developers of an automated decision tool would have to complete and document an impact assessment, and developers would have to give deployers documentation on intended uses and limitations. It was not passed before the 103rd General Assembly ended (Session Sine Die, January 7, 2025).
AUTONOMOUS VEH REQUIREMENTS
Illinois's SB 1471 (103rd General Assembly) would have amended the Illinois Vehicle Code to require manufacturers to file automation-level documentation with the Department of Transportation before selling or operating an autonomous vehicle, allow Level 2 vehicles to be sold and registered, and prohibit Level 3, 4 and 5 vehicles. It was not passed before the 103rd General Assembly ended (Session Sine Die, January 7, 2025).
Automated decision systems.
California's AB 1018 (2025-26 Regular Session) would have regulated automated decision systems (ADS) used to make consequential decisions. Developers of a covered ADS would have to give deployers instructions for use; deployers would have to disclose adverse outcomes to the affected person and allow an appeal. The Assembly passed it 50-16 on June 2, 2025; it was on the Senate floor, ordered to third reading August 30, 2026, and was not passed before the session ended.
Employment: artificial intelligence.
California's SB 366 (2025-26 Regular Session) would add Government Code section 12815.5 to require the Department of General Services to contract with the UCLA Labor Center for a study of how artificial intelligence affects worker well-being, job quality, job types, different populations and state revenues. The department would report to the Legislature on or before June 1, 2027, after which the section would be repealed. Held in Senate Appropriations May 23, 2025; not passed.
Social media platforms: artificial intelligence models.
California's AB 2169 (2025-26 Regular Session), the Digital Choice Act, would require a social media company, or a person that deploys an AI model (a deployer), to give a consumer a copy of their personal information, contextual data and social graph within five business days in a portable format where technically feasible. It would also require interoperability interfaces. Held under submission in Assembly Appropriations May 14, 2026; not passed.
Fostering Access, Innovation, and Responsibility in Artificial Intelligence Act; established.
Virginia's HB 713 (2026 Regular Session) would have created the FAIR AI Act, requiring developers of base AI models to disclose listed items in their terms of service and limiting defenses in harm actions. As introduced it would have taken effect July 1, 2027. It failed: left in House Appropriations Committee on February 18, 2026.
Virginia Human Rights Act; equal credit opportunities, Virginia Fair Housing Law, nondiscrimination.
Virginia's HB 999 (2026 Regular Session) would have made it an unlawful discriminatory practice to use an automated decision system in decisions under the Human Rights Act, equal credit law or Fair Housing Law that results in discrimination. The House General Laws substitute focused on credit. It failed: left in House Appropriations Committee on February 18, 2026.
Artificial Intelligence Training Data Transparency Act; transparency and disclosure requirements.
Virginia's HB 2250 (2025 Regular Session) would have amended the Consumer Data Protection Act and added an Artificial Intelligence Training Data Transparency Act (new Title 59.1 chapter, §§ 59.1-607 through 59.1-611) with requirements for generative AI developers. It would also have allowed third-party opt-out of data processing and required consent to process adolescents' data. Left in committee on February 4, 2025; it failed.
Artificial Intelligence Transparency Act; established.
Virginia's SB 1161 (2025 Regular Session) would have created the Artificial Intelligence Transparency Act, requiring developers of generative AI systems that produce audio, images, text or video to include a clear and conspicuous disclosure on AI-generated content and to prevent downstream use without it. Passed by indefinitely in committee on January 24, 2025; it failed.
AN ACT to amend Tennessee Code Annotated, Title 10; Title 24 and Title 38, relative to historical location data.
Tennessee's HB2608 (114th General Assembly), the "Protecting Everyone from Excessive Police Surveillance (PEEPS) Act," would have barred government officials, including government contractors, from accessing a database (including license plate, facial recognition, biometric or cellular location data) that reveals a person's or vehicle's location more than 24 hours earlier, except with a felony search warrant, consent, exigent circumstances or other listed cases. Companion: SB 2215. Not passed before the session ended in April 2026; last action: Taken off notice for cal in s/c Criminal Justice Subcommittee of Judiciary Committee (March 25, 2026).
Safety - As introduced, enacts the "Artificial Intelligence Public Safety and Child Protection Transparency Act." - Amends TCA Title 4; Title 10, Chapter 7; Title 47; Title 58 and Title 68.
Tennessee's SB 2171 (114th General Assembly), the "Artificial Intelligence Public Safety and Child Protection Transparency Act," as introduced would have barred a frontier model developer or a large chatbot provider (1 million monthly users, $25 million revenue) from making materially false or misleading statements about catastrophic risk, and defined child safety incidents involving covered chatbots. Companion HB 1898 passed the House. SB 2171 was not passed before the session ended in April 2026; last action: Re-refer to Senate Commerce & Labor Committee (April 15, 2026).
Declare A.I. systems nonsentient; prohibit legal personhood
Ohio's HB 469 would enact chapter 1357 declaring AI systems nonsentient for all purposes under state law and barring them from legal personhood, marriage, serving as corporate officers or directors, and owning property. Harm caused by an AI system would be the responsibility of the owner or user, and developers or manufacturers could be liable for design or instruction defects that proximately cause harm. Owners would have to maintain oversight, and owners or developers would have to report serious incidents. Introduced September 23, 2025; referred to committee October 1, 2025.
Creates regulations of artificially generated online content using artificial intelligence
Missouri's SB 1324 (Missouri Artificial Intelligence Transparency and Accountability Act) would require anyone creating AI-generated content for public consumption to label it "AI-generated", add a disclaimer and obtain consent for content depicting a real person (except parody or satire), and require developers and deployers to keep usage logs for seven years. The attorney general would enforce it with civil penalties. The Senate General Laws Committee voted do pass on March 25, 2026, but the bill died when the 2026 regular session ended in May 2026 without being truly agreed to and finally passed.
AGE-APPROPRIATE DESIGN CODE
Illinois' SB 50 is mainly a children's online privacy and design-code bill. As introduced, it would require covered entities (for-profit businesses over set revenue or data thresholds) to complete data protection impact assessments for services reasonably likely to be accessed by children, including whether algorithms and targeted advertising systems could harm children, and would bar profiling a child by default. Introduced January 13, 2025; re-referred to Assignments April 11, 2025 and still pending.
An Act amending Titles 18 (Crimes and Offenses) and 61 (Prisons and Parole) of the Pennsylvania Consolidated Statutes, in sexual offenses, further providing for the offense of unlawful dissemination of intimate image; in minors, further providing for the offense of sexual abuse of children and for the offense of transmission of sexually explicit images by minor; and making editorial changes to replace references to the term "child pornography" with references to the term "child sexual abuse material."
Pennsylvania's Act 125 of 2024 brings AI-generated sexual images into the Crimes Code. Disseminating an artificially generated sexual depiction of a real person with intent to harass, annoy or alarm is now unlawful dissemination of an intimate image, and the child sexual abuse material offenses (dissemination, and knowing possession or intentional viewing) now cover artificially generated child sexual abuse material. AI developers that report such material to NCMEC are exempt. The act also renames "child pornography" to "child sexual abuse material" throughout. It took effect 60 days after approval (Oct. 29, 2024).
Protecting kids from deepfakes and exploitative images.
Wyoming's AI deepfake and child-protection law (Chapter 91, Session Laws of 2026, effective July 1, 2026). It makes it a felony to knowingly distribute realistic AI-generated or digitally altered intimate images of an identifiable person without consent when it causes or is meant to cause harm, or to threaten to do so for gain (up to 10 years; 12 for a repeat offense). Using AI to create child sexual abuse material, or knowingly possessing AI-generated material, is sexual exploitation of a child. Building or distributing AI systems designed to produce such material or to promote self-harm is a felony, and using AI is no defense to any crime.
An Act relative to justice, equity and accountability in law enforcement in the Commonwealth
Massachusetts' 2020 police reform law (Chapter 253 of the Acts of 2020) regulates police use of facial recognition. Under new G.L. c.6 s.220, a law enforcement agency may perform or request a facial recognition search only through a written request to the Registry of Motor Vehicles, State Police or FBI, and only with a court order, except to identify a deceased person or in an emergency. Each search must be documented and reported quarterly to the Executive Office of Public Safety and Security. Section 220 took effect July 1, 2021; a special commission was set up to study government use of facial recognition.
Regarding The Ownership Of Model Training And Content Generated By A Generative Artificial Intelligence Tool.
Arkansas Act 927 of 2025 sets who owns what a generative AI tool produces. The person who provides the input owns the generated content, as long as it doesn't infringe existing copyrights or other intellectual property, and owns a model trained with the tool if the training data was lawfully acquired and ownership hasn't been transferred by contract. When an employee uses the tool within the scope of employment and under the employer's direction and control, the employer owns the result. Approved April 21, 2025; effective August 5, 2025.
Prohibits the use of a wage-fixing algorithm in combination with personal or behavioral data to set or recommend wages or compensation
A 9638 would ban 'surveillance wages' in New York: employers could not use a wage-fixing algorithm, or its output, together with a worker's personal or behavioral data (such as financial, purchasing, browsing, biometric or location data, or profiles drawn from them) to set or recommend pay, whether the employer or a third party collects the data. Tools that use only job requirements, performance (not customer reviews), qualifications, labor market conditions or local cost of living are exempt. The Attorney General, the Labor Department and harmed workers could sue for the greater of actual damages or $3,000 per violation, tripled if willful. Pending in the Assembly Labor Committee.
Establishes the artificial intelligence training data transparency act requiring developers of generative artificial intelligence models or services to post on the developer's website information regarding the data used by the developer to train the generative artificial intelligence model or…
New York's A 6578-B (the "artificial intelligence training data transparency act") would add General Business Law Art. 44-C, §§ 1430-1432. On or before January 1, 2027, and before each later release, a developer of a generative AI model or service (or substantial modification) released on or after January 1, 2022 and available to New Yorkers would have to post a high-level summary of its training datasets on its website. Would take effect immediately. Passed the Assembly and, on June 4, 2026, the Senate (substituted for S6955-A); the page shows no delivery to the Governor.
Requires certain disclosures by automobile insurers relating to the use of telematics systems in determining insurance rates and/or discounts.
New York's A 10364 would amend Insurance Law § 2313 and add § 2304-a so that insurers that offer or use telematics systems (technology that monitors, stores and transmits information such as vehicle location, driver behavior, engine performance and activity), and their third-party developers or vendors, would have to explain to the Superintendent how the factors in their model or algorithm relate to risk, publicly disclose scoring methodologies and let consumers request access to their data; vendors would have to also file their model or algorithm with the Superintendent. Referred to Insurance March 2, 2026; it has not passed either chamber.
Requires experts in professional fields to be consulted when developing and maintaining artificial intelligence technology for use in such fields.
New York's A 9219 would add General Business Law §§ 1710 to 1715. A developer of AI intended for a professional domain regulated under Title Eight of the Education Law would have to show that a licensed professional domain expert with three or more years of experience was directly and substantially involved in design, data and training, validation and ongoing risk assessment, and submit documentation to the Attorney General. Penalties up to $50,000 per violation. Would take effect one year after it becomes law. Referred to Science and Technology November 3, 2025 (and January 7, 2026); it has not passed either chamber.
Provides that health insurance plans would provide coverage the use of artificial intelligence technology for analysis of breast tissue diagnostic imaging.
Rhode Island H 8073 (2024), as introduced on March 15, 2024, would require individual and group health insurance contracts and plans delivered, issued or renewed in Rhode Island on or after January 1, 2025 to cover the use of AI technology for analysis of breast tissue diagnostic imaging, provided a physician qualified to read such imaging independently reviews and approves the imaging and the AI review. The same text is added in four insurance chapters. The text says it takes effect upon passage.
Generative artificial intelligence: training data transparency.
California's AB 2013 (Civil Code §§ 3110-3111) requires developers of generative AI systems or services made publicly available to Californians, free or paid, to post documentation of their training data on their websites: by January 1, 2026 for systems released since January 1, 2022, and before each later release or substantial modification. The documentation summarizes the datasets, including sources, size, data types, and whether they contain copyrighted material or personal information or were bought or licensed. Signed September 28, 2024 (Chapter 817); took effect January 1, 2025, with first postings due January 1, 2026.
California Consumer Privacy Act of 2018: artificial intelligence: training.
California's AB 2877 (2023-24 Regular Session) would amend the California Consumer Privacy Act to prohibit a developer, except if certain conditions are met, from using the personal information of a consumer under 16 to train an AI system or service unless the consumer or a parent or guardian affirmatively authorizes it, and then only after deidentifying and aggregating it. Passed the Assembly 73-0; held under submission in Senate Appropriations August 15, 2024; not passed.
Establishes understanding artificial intelligence responsibility act requiring developers of covered models to be strictly liable for certain injuries.
New York's A 8833, the "Understanding Artificial Intelligence Act," would add General Business Law §§ 1510 to 1512. Developers of "covered models" (trained with over 10^26 operations at a cost over $100 million) would be strictly liable, regardless of care exercised, for injuries to non-users caused by model conduct that would be negligence, an intentional tort or a crime if done by an adult human, unless the user or a modifying intermediary intended or reasonably anticipated it. Defamation is excepted. Would take effect immediately. Referred to Science and Technology June 9, 2025 (and January 7, 2026); it has not passed either chamber.
Relates to the development and use of certain artificial intelligence systems
New York's A 8884-A, the "New York AI act," would add Civil Rights Law §§ 105 to 115. Developers and deployers of high-risk AI used in consequential decisions (e.g. jobs, education, housing, health care, finance) would have to take reasonable care to prevent algorithmic discrimination, give notice and appeal with human review, get audits, report to the Department of Financial Services and keep risk programs; social scoring would be banned. AG civil penalties: up to $25,000 (developers) or $10,000 (deployers) per violation. Would take effect one year after becoming law (audits, two years). Amended June 1, 2026 and recommitted to Science and Technology; not passed by either chamber.
Enacts the "New York artificial intelligence transparency for journalism act"; requires developers of generative artificial intelligence systems or services to post certain information on the developer's website regarding video, audio, text and data from a covered publication used to train the…
New York's S 8331-A, the New York artificial intelligence transparency for journalism act, would add General Business Law Article 21-A (§§ 338 to 338-D). On or before January 1, 2027, and before each later release or substantial modification, AI developers would have to post the URLs, provenance, any removal of source identifiers or copyright notices, and collection timeframe for training data taken from a covered publication, and disclose their crawlers. A journalism provider could sue for injunctive relief and statutory damages up to $10,000 per violation. Referred to committee January 7, 2026.
Relating to the regulation and use of artificial intelligence systems and the management of data by governmental entities.
Texas's SB 1964 sets rules for AI used by state agencies and local governments. The Department of Information Resources (DIR) must adopt an AI code of ethics and minimum risk-management standards for "heightened scrutiny" AI (systems specifically intended to autonomously make, or be a controlling factor in, consequential decisions on access to government services), aligned with NIST's AI RMF 1.0, which agencies and local governments must adopt. State agencies and their vendors must assess such systems for risks of unlawful harm, agencies must give notice of public-facing AI, and vendors that do not cure violations can lose contracts. Signed June 20, 2025; effective September 1, 2025.
Prohibits the use of a wage-fixing algorithm in combination with personal or behavioral data to set or recommend wages or compensation; defines terms; establishes penalties for violations of such prohibition.
New York's S 9132 would add Labor Law § 194-c barring an employer from using a wage-fixing algorithm, or its output, combined with personal or behavioral data to set or recommend wages or compensation, whether the data is collected by the employer or a third party. The Attorney General or a harmed worker could sue for the greater of actual damages or $3,000 per violation, with treble damages for willful or egregious violations. Referred to the Labor Committee February 5, 2026; it has not passed either chamber.
Requires certain disclosures by automobile insurers relating to the use of telematics systems in determining insurance rates and/or discounts.
New York's S 5486 would add Insurance Law § 2304-a requiring insurers that use telematics systems, and third-party developers and vendors of them, to explain to the Superintendent how model or algorithm factors relate to risk, publicly disclose scoring methodologies, report discrimination testing and give consumers access to their collected data. Collected data could be used only for underwriting and rating. Referred to Insurance January 7, 2026; it has not passed either chamber.
Safe and Secure Innovation for Frontier Artificial Intelligence Models Act.
Vetoed. California's SB 1047 (2024) would have required developers of covered AI models (trained with more than 10^26 operations at a compute cost over $100 million) to adopt safety and security protocols and full-shutdown capability before training, assess and guard against critical harms before release, hire annual third-party auditors from 2026, and report AI safety incidents to the Attorney General within 72 hours. The Attorney General could have sued for penalties. Governor Newsom vetoed it September 29, 2024, and the Legislature did not override the veto.
Increase Transparency for Algorithmic Systems
Colorado's SB 25B-004, passed in the August 2025 special session, replaced every February 1, 2026 start date in the Colorado AI Act (SB 24-205, C.R.S. 6-1-1702 to 6-1-1704) with June 30, 2026. That moved developers' and deployers' reasonable-care, documentation, risk-program, impact-assessment, notice and reporting duties and the AI-interaction disclosure. It adds no new duties. Signed August 28, 2025 (Chapter 3, 2025 First Extraordinary Session); effective November 25, 2025. SB 26-189 repeals and reenacts Part 17 effective January 1, 2027.
Requires the registration of data brokers; imposes regulations upon data brokers; establishes a data deletion mechanism for consumers; imposes penalties upon data brokers for violations of the law.
New York's S 9088-A would add General Business Law Article 42-A (§§ 1150-1158) requiring data brokers to register with the Attorney General within 60 days with a $100 fee (or an amount the Attorney General sets) and disclose, among other things, data shared with AI developers. The Attorney General must build a one-request deletion mechanism within a year of the effective date, after which brokers must stop processing within five days and delete within 45 days. Penalties reach $500 per day or per request. Passed the Senate June 3, 2026 (51-10); referred to the Assembly Consumer Affairs and Protection Committee June 4, 2026.
Increasing transparency in artificial intelligence.
Washington's HB 1168 (substitute, 2025-26 biennium) would have required developers of generative AI systems released on or after January 1, 2022 and available to Washingtonians to post a high-level summary of their training data on their website by January 1, 2026 and before each later release. The Attorney General would have enforced it with a civil penalty of $5,000 per day and a 45-day cure notice. Its 1st substitute was recommended by House Technology in January 2025, was reintroduced January 12, 2026 and died at adjournment.
Artificial intelligence; disclosure of artificial intelligence-generated content required, enforcement provided
Alabama's SB 129 would require developers of generative AI systems that produce images, video or audiovisual content to include a clear, conspicuous and unavoidable disclosure that the content is AI-generated, plus metadata naming the tool and creation time, and to take reasonable steps to stop licensees and end users removing it. Violations would be unlawful trade practices with a private right of action. Referred to Senate Judiciary January 13, 2026; the bill died when the 2026 regular session ended without final passage.
Georgia Entertainment Artificial Intelligence Accountability and Performer Protection Act; enact
Georgia's HB 1603, the Georgia Entertainment Artificial Intelligence Accountability and Performer Protection Act, would add Article 38 to Title 10, Chapter 1. It would make an individual or production company liable in a civil action for publishing or distributing a digital replica of a performer without consent, or for distributing a product primarily designed to produce such replicas. Consent would need a written contract of no more than ten years while the performer is living. The bill reached House Second Readers on March 31, 2026 and died when the session ended.
Establishes the "AI Non-Sentience and Responsibility Act"
Missouri's HB 1769 (AI Non-Sentience and Responsibility Act), as introduced, would declare AI systems non-sentient for all purposes of state law, deny them legal personhood, marriage, corporate office and property ownership, and place responsibility for AI-caused harm on owners and users; developers and manufacturers could be held liable for design, construction or instruction defects. A House committee substitute (filed under HB 1746) was reported do pass on February 26, 2026, but the bill died when the 2026 regular session ended in May 2026 without being truly agreed to and finally passed.
Artificial intelligence, consumer protection
South Carolina's S 963 would enact the Consumer Protections in Interactions with Artificial Intelligence Systems Act (Chapter 31 of Title 37). Developers and deployers of high-risk AI systems used in consequential decisions would owe a duty of reasonable care against algorithmic discrimination, with impact assessments, consumer notices and appeal rights. The Attorney General would have exclusive enforcement. Introduced February 26, 2026 and referred to the Senate Banking and Insurance Committee; it has not passed either chamber.
AI Innovation Trust Fund
North Carolina's SB 735 would create an Artificial Intelligence Innovation Trust Fund, administered by the Secretary of Commerce, for grants to AI companies and AI entrepreneurship programs, with $750,000 appropriated for 2025-2026. It would also set safety duties for developers of covered AI models and computing cluster operators, enforced by the Attorney General. Filed March 25, 2025; re-referred to Appropriations/Base Budget March 26, 2025; it has not passed either chamber.
Technology; deployers; AI chatbots; minors; age verification systems; emergency situations; effective date.
Oklahoma's HB 4083 (2026), as introduced, would have required deployers of generative AI chatbots to keep human-like features and social AI companions away from minors (under 18) using reasonable age verification, with an exception for qualifying therapeutic chatbots. Per its title, it would also have required emergency-situation detection and Attorney General and private enforcement. It was referred to Rules February 3, 2026 and died when the session ended May 14, 2026.
Rural health care; Alabama Health Command established to designate an AI-assisted health platform in rural communities
Alabama's HB 280 would create the Alabama Health Command, an independent agency under a director appointed by the Governor, to designate an Alabama-headquartered business to develop a uniform virtual AI-assisted health platform for rural communities. The platform would give consumers health management services such as education, scheduling and navigation to rural providers, without diagnosis or treatment. Rural providers that contract to use it would be exempt from competitive bid laws. Referred to House Ways and Means General Fund on January 20, 2026; the bill died when the 2026 regular session ended without final passage.
Law enforcement: facial recognition and other biometric surveillance.
California's AB 1215 added Penal Code § 832.19, which barred law enforcement agencies and officers from installing, activating or using any biometric surveillance system, such as facial recognition, in connection with an officer camera (a body-worn camera or similar device) or its data, including by having another agency or a third party run it for them. Anyone could sue for equitable or declaratory relief. The section was repealed by its own terms on January 1, 2023, so the ban is no longer in effect. Signed October 8, 2019 (Chapter 579); effective January 1, 2020.
Artificial intelligence; nursing tasks; pilot
Arizona's HB 4080 (2026) would have established an artificial intelligence nursing innovation pilot program in the Department of Health Services to develop and test AI that performs nursing-adjacent tasks or workflows in a clinical setting. The department would select not more than five technology vendors recommended by an advisory committee. The bill was assigned to House Rules, held there, and died when the 2026 session ended June 13, 2026.
Various mental health and insurance matters.
Indiana's HB 1201 (2026) would have barred using an AI system to impersonate or substitute for a licensed mental health professional in interactions that must be performed by one (discipline under IC 25-1-9; a board could impose a civil penalty of up to $5,000 per violation). It also covered insurance: downcoding limits, mental health reimbursement parity with medical providers relative to Medicare, a 180-day audit and recoupment window, and out-of-network balance-billing limits. Referred to the Insurance Committee January 5, 2026; it was not passed before the 2026 session ended.
Artificial Intelligence Facial Recognition
Colorado's SB 22-113 sets rules for facial recognition used by state agencies, local governments and state colleges: a notice of intent and public accountability report before use, vendor bias disclosures, testing and meaningful human review for decisions with legal or similarly significant effects, training and records. Police need a warrant or another listed basis for ongoing surveillance, real-time identification or tracking. It barred schools from new facial recognition contracts until July 1, 2025; SB 25-143 (2025) removed that end date. Its task force became the AI Impact Task Force (HB 24-1468), ending September 1, 2027. Signed June 8, 2022 (Chapter 463); effective August 10, 2022.
Civil Actions - Product Liability - Artificial Intelligence Systems
Maryland's HB 712 (2026, first reader text) would have added Courts and Judicial Proceedings sections 3-2701 to 3-2706 letting people sue developers and deployers of high-impact or generative AI systems for harm from a dangerous or defective product (design defect, failure to warn, express warranty), with comparative fault, joint and several liability, and Attorney General enforcement. It had a House Judiciary hearing set for February 25, 2026 and died when the 2026 session ended.
Automated Decision-Making Technology
Colorado's SB 26-189 repeals and reenacts the 2024 AI Act as rules for automated decision-making technology (ADMT) that materially influences consequential decisions such as hiring, lending, housing and health care. Developers must document covered ADMT for deployers; deployers must give notice before use, explain adverse outcomes within 30 days and, on request, give correction steps and, where commercially reasonable, human review. Signed May 14, 2026 (Chapter 131); applies from January 1, 2027. A stipulated April 27, 2026 order in X. AI LLC v. Weiser bars AG enforcement of 2026 laws replacing SB 24-205 for violations through 14 days after a ruling on xAI's planned injunction motion.
An Act to Prohibit the Use of Artificial Intelligence in the Denial of Health Insurance Claims
Not law. Maine's LD 1301 would have set conditions, beginning January 1, 2026, on health insurance carriers and their contractors that use artificial intelligence in medical or utilization review decisions to approve, deny, delay or modify coverage. Despite its title, it did not ban AI. AI determinations would have had to rest on the enrollee's medical history and clinical circumstances and not supplant provider decision-making, and could not discriminate. Any denial, delay or modification based on medical necessity would have needed a clinical peer. The committee voted Ought Not To Pass on January 14, 2026; final disposition January 27, 2026.
An Act Concerning Broadband Internet, Gaming, Social Media, Online Services and Consumer Contracts
Public Act 25-113 overhauls the Connecticut Data Privacy Act's rules on automated decision-making. From July 1, 2026, consumers can opt out of profiling used for any automated decision with legal or similarly significant effects (housing, insurance, health care, employment, financial services and more), question the result and learn why the decision was made, and for housing decisions correct inaccurate data. Controllers that profile for such decisions must complete impact assessments (for processing created on or after Aug. 1, 2026), and privacy notices must state whether personal data is collected, used or sold to train large language models.
An Act To Increase Privacy and Security by Regulating the Use of Facial Surveillance Systems by Departments, Public Employees and Public Officials
Maine's 2021 facial surveillance law (25 MRSA §6001) generally prohibits government departments, public employees and officials from obtaining, using or contracting for facial surveillance systems, defined as automated or semi-automated processes that identify people from facial characteristics. Limited exceptions allow searches for serious crimes with probable cause, missing or deceased persons and BMV fraud, but requests must go through the BMV or State Police, which log them. A facial match alone cannot establish probable cause, and illegally obtained data must be deleted and is inadmissible.
An Act Concerning Artificial Intelligence, Automated Decision-making And Personal Data Privacy.
Connecticut's Public Act 23-16 governs AI in state government. The Department of Administrative Services (for all state agencies) and the Judicial Department must inventory the AI systems in use by December 31, 2023 and yearly after, and post them. OPM and the Judicial Branch set policies by February 1, 2024 for buying, using and assessing AI; from then, agencies may not deploy an AI system without an impact assessment showing it will not cause unlawful discrimination or disparate impact. It formed a working group on AI best practices and an AI bill of rights, and from October 1, 2023 state contracts must require compliance with the data privacy act. Signed June 7, 2023.
Public postsecondary education: generative artificial intelligence systems: procurement standards: training.
California's community colleges and CSU must, and the University of California is asked to, form a working group that by January 1, 2028 recommends procurement standards and user training for generative AI systems bought for education. Standards must require a documented risk assessment, safeguards against harmful output, no engagement-driven sycophancy, self-harm monitoring with human escalation, incident reporting, data-minimization and retention policies, and disclosure of training data sources. Until standards exist, each systemwide GenAI contract triggers a report to the Legislature within 60 days. Effective January 1, 2027.
Health care services: artificial intelligence.
California's AB 1979 sets rules for AI in clinical care. Health facilities such as hospitals, clinics, physician offices and group practices must take reasonable steps so licensed providers keep independent professional judgment whenever care is informed by a clinical decision support system, and may not use AI to independently perform licensed clinical work, or to direct unlicensed staff doing it. Businesses offering health care chatbots that consumers use to manage their health information or to diagnose, treat or manage a condition are treated as health care providers under the state's medical privacy law (CMIA). Signed September 30, 2026 (Chapter 854); effective January 1, 2027.
Employment: automated decision systems.
California's SB 947 limits how employers, including public employers and labor contractors, use automated decision systems (ADS) such as AI tools, starting July 1, 2027. Employers may not use an ADS to violate labor or civil-rights laws, infer a protected status, or predict and punish workers for exercising their rights, and may not rely solely on an ADS to discipline or fire. When they primarily rely on one, a human must corroborate the output, and the worker gets a written notice and can request a description of their data used. $500 per violation. Signed September 30, 2026 (Chapter 859).
Digital Content Authenticity and Transparency Act; established, civil penalty.
Virginia's SB 1417 (2025 Regular Session) would have created the Digital Content Authenticity and Transparency Act, requiring generative AI developers to apply provenance data to synthetic content and offer a public provenance tool and reader, with Attorney General enforcement and civil penalties. Passed by indefinitely in committee on January 24, 2025; it failed.
Relating to the security of state assets; amending ORS 276A.340, 276A.344, 276A.346 and 276A.348.
Oregon's HB 3936 (Chapter 396, Oregon Laws 2025) amends the state law that keeps products of covered vendors off state information technology assets (ORS 276A.340 to 276A.348). It adds a definition of artificial intelligence and makes any hardware, software or service that uses AI developed or owned by a covered vendor a covered product. Covered vendors include Ant Group, ByteDance, Huawei, Kaspersky, Tencent, ZTE and entities the State Chief Information Officer designates as national security threats. Covered products may not be installed on, downloaded to or used on state IT assets. Signed June 24, 2025; effective January 1, 2026.
Crimes & offenses, prohibits a person from creating a private image without consent.
Alabama's HB 161 (Act 2024-96) amends Section 13A-6-240 to create the crime of knowingly creating, recording or altering an intimate image of an individual without consent where the person had a reasonable expectation of privacy. A private image now includes a recording that a reasonable person would believe actually depicts an identifiable individual, even if any portion is artificially generated or depicts someone else. Violations are a Class A misdemeanor, and a subsequent offense is a Class C felony. Internet service providers, search engines, cloud providers and technology developers are not liable solely because their service was used. Effective October 1, 2024.
Establishes the "AI Nonsentience and Responsibility Act"
Not law. The AI Nonsentience and Responsibility Act (committee substitute for HBs 1746 & 1769) would have declared AI systems nonsentient under Missouri law: never persons, spouses, corporate officers or property owners, with AI-related assets attributed to a responsible human or organization. Liability for harm would rest with the deployer or user who directed the AI, and with developers for design defects or negligence; developers and deployers would have to maintain oversight following NIST-based risk standards and report serious harms. Two House committees approved it in March 2026, but it never got a floor vote before the May 15, 2026 deadline for passing bills.
FY27 BUDGET IMPLEMENTATION
Article 40 of the FY2027 Budget Implementation Act supports Senate Bill 315, the Artificial Intelligence Safety Measures Act. It lets the Illinois Emergency Management Agency and Office of Homeland Security adopt emergency rules for that Act (5 ILCS 100/5-45.71), creates the AI Safety Measures Fund for its fees and civil penalties (30 ILCS 105/5.1038, 6z-149), and amends Sections 18 and 25 of the Act so large frontier developer disclosure and annual fees are set by rule. Article 40 takes effect when the Act becomes law or on SB 315's effective date, whichever is later.
State Bar of California.
SB 253 is a State Bar omnibus bill. Its AI provision, in amended Business and Professions Code Section 6046.6, requires the Committee of Bar Examiners to provide notice if artificial intelligence is used in creating questions for the bar examination or in grading the bar examination. The bill also adds notice periods before changing the exam's question vendor or authorizing remote administration.
Artificial Intelligence Training for the Acquisition Workforce Act (AI Training Act)
The AI Training Act requires the Director of OMB, within one year and with GSA, to develop and provide an AI training program for federal employees in program management, procurement and contracting, logistics, cost estimating and related acquisition roles (sec. 2(b)). The training must cover how AI works, how it can benefit the government, its risks including discrimination and privacy risks, ways to mitigate those risks, and future trends. OMB must update the program at least every two years and track participation and feedback. The Department of Defense and NNSA are excluded, and the section sunsets 10 years after enactment.
Budget Act of 2025.
Section 239 of AB 102 rewrote Section 11.25 of the Budget Act of 2025. Departments under the Governor using state resources for generative AI projects must complete the state's GenAI risk assessment (SIMM 5305-F) and privacy assessments (SIMM 5310-C) and follow the project delivery lifecycle (SIMM 19H). For IT projects using generative AI, agencies must give project documentation to the Legislature regardless of funding source, and funding requests go through the annual budget. The administration had to report by March 1, 2026 on the state's first GenAI proofs of concept.
Workplace surveillance tools.
AB 1883 added Part 5.8 (commencing with Section 1580) to Division 2 of the Labor Code. With certain exceptions, it prohibits an employer, including public employers, from using a workplace surveillance tool that uses artificial intelligence to, among other things, collect neural data or recognize an individual's emotional state. The Labor Commissioner and public prosecutors may enforce it, with civil penalties of up to $500 per violation. Exemptions apply where use is reasonably necessary to comply with federal law or federal contracts for aircraft, national security, military, or space work.
AN ACT to amend Tennessee Code Annotated, Title 39, Chapter 14, Part 1 and Title 47, relative to the protection of personal rights.
The ELVIS Act renames Tennessee's Personal Rights Protection Act and adds a property right in a person's voice, defined to cover a sound readily identifiable as a particular person 'regardless of whether the sound contains the actual voice or a simulation of the voice.' It creates civil liability for publishing or distributing someone's voice or likeness without authorization, and for distributing an algorithm, software, tool or other technology whose primary purpose is producing a particular person's photograph, voice or likeness without authorization. Record labels with exclusive contracts may sue. First Amendment-type uses are exempt. Effective July 1, 2024.
Relating to Criminal Offenses -- Impersonation and Identity Fraud
Rhode Island's 2026 identity fraud amendment defines a forged digital likeness as a computer- or other electronic system-generated visual representation of an identifiable person, or an audio recording of their voice, made to closely resemble a genuine one, likely to deceive, and created and distributed without consent. Digital forgery, knowingly creating or distributing such a likeness as genuine to facilitate fraud, is now felony identity fraud under 11-49.1-3(a)(8). The act also covers impersonating an entity with intent to defraud. Constitutionally protected activity, law enforcement and providers or developers of the underlying technology are excepted. Effective on passage.
Relating to Criminal Offenses -- Impersonation and Identity Fraud
Rhode Island's 2026 identity fraud amendment defines a forged digital likeness as a computer- or other electronic system-generated visual representation of an identifiable person, or an audio recording of their voice, made to closely resemble a genuine one, likely to deceive, and created and distributed without consent. Digital forgery, knowingly creating or distributing such a likeness as genuine to facilitate fraud, is now felony identity fraud under 11-49.1-3(a)(8). The act also covers impersonating an entity with intent to defraud. Constitutionally protected activity, law enforcement and providers or developers of the underlying technology are excepted. Effective on passage.
Prohibits the use of biometric surveillance system or biometric surveillance information in places of public accommodation; prohibits entering into any agreement that authorizes any third party to use any biometric surveillance system or biometric surveillance information; provides penalties for…
New York's S 8004 would add Civil Rights Law § 40-h making it unlawful for an owner, franchisor, franchisee or other operator of a place or provider of public accommodation to use any biometric surveillance system or its information, or let a third party do so on its behalf. Collecting biometric information would require written notice, a stated purpose and term, and a written release. Violators and those who aid or incite them would owe the aggrieved person at least the greater of $1,000 or actual damages per violation, plus attorneys' fees. Referred to Investigations and Government Operations January 7, 2026; it has not passed either chamber.
Enacts the "New York artificial intelligence consumer protection act", in relation to preventing the use of artificial intelligence algorithms to discriminate against protected classes.
New York's S 1962, the New York artificial intelligence consumer protection act, would add General Business Law Article 45-A (sections 1550 to 1556). From January 1, 2027, developers and deployers of high-risk AI decision systems that make or substantially factor in consequential decisions (education, employment, lending, government services, health care, housing, insurance, legal services) would have to use reasonable care against algorithmic discrimination, with impact assessments, notices and appeals. The Attorney General would have exclusive enforcement. Referred to Internet and Technology January 7, 2026; it has not passed either chamber.
Sunset Public Utilities Commission
Colorado HB26-1326 continues the Public Utilities Commission to 2033 and changes many utility and carrier rules. Its AI-relevant provision is Section 23: a transportation network company (TNC) must run periodic checks using facial recognition software, or equally or more effective technology approved by the commission, to prevent driver impersonation, under commission rules. TNCs that mainly serve schools or government and meet at least 90% of the school-contract safety rules are exempt. Impersonating a TNC driver becomes a class 2 misdemeanor, or a class 6 felony during a felony. Signed May 29, 2026.
Contracts against public policy: personal or professional services: digital replicas.
AB 2602 added Labor Code Section 927. A provision in an agreement for personal or professional services is unenforceable as to new performances, fixed on or after January 1, 2025, by a digital replica of the individual if it allows the replica to be used in place of work the individual would otherwise have performed, lacks a reasonably specific description of the intended uses, and the individual was not represented by legal counsel or a labor union in negotiating it. A digital replica is a computer-generated, highly realistic electronic representation readily identifiable as the individual's voice or visual likeness.
Generally revise laws related to privacy and facial recognition technology
Montana's SB 397 (Chapter 781 of 2023), the Facial Recognition for Government Use Act, bars state and local agencies, law enforcement, public employees and officials from using continuous facial surveillance and, with exceptions, from obtaining or using facial recognition technology or contracting vendors for it. The Department of Justice and local police may use it in criminal investigations under restrictions, including a warrant requirement, must tell defendants before trial, and must report use annually. Agencies may use facial verification only under a written use and privacy policy, with notice, vendor retention limits and human review training. People harmed may sue.
To amend the law concerning autonomous vehicles
Arkansas's HB 1562 (Act 619 of 2021) updates the state's autonomous vehicle law. Autonomous and fully autonomous vehicles operate under State Highway Commission pilot programs, which must show the vehicles obey traffic laws, including at railroad crossings unless exempted, reach a minimal risk condition if the automated driving system fails, meet federal safety standards, and that a remote operator can meet crash duties. On-demand driverless capable vehicle networks may carry passengers or goods. Human and remote operators need valid driver's licenses, local governments may not add AV requirements or taxes, and the original maker of a vehicle a third party converts into an AV is not liable.
Adopt the Ensuring Transparency in Prior Authorization Act and provide for insurance and medicaid coverage of biomarker testing
Nebraska's LB 77 (2025) adopts the Ensuring Transparency in Prior Authorization Act. Its AI section says an artificial intelligence-based algorithm may not be the sole basis for a utilization review agent's decision to deny, delay or modify health care services based on medical necessity. Agents must disclose to the Department of Insurance, to every network provider, to every enrollee and on their public website whether AI-based algorithms are or will be used in utilization review. The department may audit an agent's automated utilization management system at any time, including through a third party. The section is operative January 1, 2026.
Technology Transparency
South Carolina's H 3401, 'Technology Transparency', would add Chapter 31 to Title 37. It would bar government entities from working with social media platforms on content moderation, give consumers rights to opt out of profiling with significant effects, require search engines to publish plain-language ranking parameters, and require data protection assessments. Introduced January 14, 2025 and referred to the House Judiciary Committee; it has not passed either chamber.
A bill for an act relating to the ownership of artificial intelligence output and trained artificial intelligence. (Formerly HSB 635.)
Iowa's HF 2691 (formerly HSB 635) would create Code chapter 554J making the user whose input prompts an AI the owner of the resulting output, unless the AI's terms of use or a contract says otherwise, and making a person who lawfully trains an AI the owner of it unless rights were transferred by contract. On the House calendar since February 23, 2026; it has not passed either chamber.
A bill for an act relating to artificial intelligence, including the use of artificial intelligence to create materials related to elections and protections in interactions with artificial intelligence systems, and making penalties applicable.
Iowa's HSB 294 would require a disclosure on AI-generated election material that advocates for or against a candidate or ballot issue, and would create Code chapter 554I requiring developers and deployers of high-risk AI systems to use reasonable care against algorithmic discrimination, with attorney general enforcement. The House committee voted 18-3 for passage on March 6, 2025; it has not passed either chamber.
Promoting economic development with emerging artificial intelligence models and safety
Massachusetts S2630 would create an AI Innovation Trust Fund and the Transparency in Frontier Artificial Intelligence Act (G.L. Chapter 93M). Large frontier developers (over $500,000,000 revenue, models trained with over 10^26 operations) would have to publish safety frameworks, and critical safety incidents would be reported to the Attorney General within 15 days. Reported favorably and referred to Senate Ways and Means October 16, 2025; it has not passed either chamber.
A bill for an act relating to chatbots, including deployer requirements and interactions with minors. (Formerly HSB 647.)
Iowa's HF 2715 (formerly HSB 647) would require deployers of AI companions, public-facing chatbots and therapeutic chatbots to keep harm-response and self-harm protocols, disclose at the start and every three hours that the user is talking to AI, and take extra steps for minors. The attorney general could seek civil penalties up to $2,500 per violation. On the House calendar since February 24, 2026; it has not passed either chamber.
SCH CD-STUDENT BIOMETRIC INFO
Illinois's SB 1239 would amend the School Code to bar school districts from buying, acquiring, using or contracting for biometric systems, including facial recognition software, on students. Districts holding student biometric information would have to destroy it within 30 days after the Act takes effect. Filed January 24, 2025; re-referred to Assignments April 11, 2025; it has not passed either house.
Prohibits the use of biometric surveillance system or biometric surveillance information in places of public accommodation; prohibits entering into any agreement that authorizes any third party to use any biometric surveillance system or biometric surveillance information; provides penalties for…
New York's A 6211 (same as S 8004) would add Civil Rights Law § 40-h, making it unlawful for an owner, manager, employee or other agent of a place or provider of public accommodation to use a biometric surveillance system or biometric surveillance information, or to let a third party do so on its behalf. It would also require written notice and consent before collecting biometric information. Referred to the Assembly Governmental Operations Committee in February 2025 and again January 7, 2026; it has not passed either chamber.
Psychotherapy Artificial Intelligence Restrictions
Colorado's HB 26-1195 limits how licensed mental health professionals and others lawfully providing psychotherapy use AI. They may use it for administrative and supplementary support (e.g. scheduling, billing) if they stay responsible for reviewing its outputs, but may not let AI engage in therapeutic communication with clients without their synchronous, real-time participation or generate therapeutic recommendations or treatment plans without their approval. AI recording or transcription of sessions needs advance written notice and consent. No one may present AI as psychotherapy, therapist-equivalent or therapist-confidential. Signed June 3, 2026 (Chapter 358); effective August 12, 2026.
ICE Out of Our Faces Act
The federal H.R. 7363 (ICE Out of Our Faces Act) would make it unlawful for any covered immigration officer (officers, employees, agents and contractors of ICE or CBP and officials deputized under INA section 287(g)) to acquire, possess, access or use in the United States any biometric surveillance system, including facial recognition, or information from one run by another entity. Data collected would have to be deleted within 30 days after enactment. Introduced February 4, 2026 and referred to the House Judiciary and Homeland Security committees (and the Border Security and Enforcement Subcommittee); no further action.
Establishes public-private partnerships to develop artificial intelligence job training.
New Jersey's S2942 would let the Commissioner of Labor and Workforce Development contract with private entities in public-private partnerships to develop AI training, providing retraining for displaced workers and advancing the workforce's AI skills. The private entity would be exempt from procurement and contracting requirements and from prevailing wage requirements.
Artificial Intelligence Transparency Act; established.
Virginia's HB 2554 (2025 Regular Session) would have created the Artificial Intelligence Transparency Act, requiring developers of generative AI systems that produce audio, images, text or video to include a clear and conspicuous disclosure on AI-generated content and to prevent downstream use without it. Left in committee on February 4, 2025; it failed.
In culpability, providing for liability for deployment of artificial intelligence system.
Pennsylvania's HB 1533 (2025-26) would add 18 Pa.C.S. 306.1, making a person who deploys an AI system to perform an automated or autonomous function subject to criminal or civil liability, or both, for any negative outcome from the deployment. Claims that the AI acted autonomously or was supplied by a third party would not avoid liability. It was referred to the House Judiciary Committee on May 30, 2025.
Relating To Artificial Intelligence.
Hawaii's HB 2591 (2026) would have required the State's Chief Data Officer to turn the open data portal into a hub with an AI chatbot and data visualizations on statewide shared data sets, and to set up a system to evaluate AI governance tools and collect agency reports of AI use cases and vendors. It would have appropriated $2,000,000 for FY 2026-2027. It was referred to ECD and FIN on February 2, 2026 and was not enacted.
Protecting consumers in interactions with artificial intelligence systems
Massachusetts's H 97 would add Chapter 93M requiring developers and deployers of high-risk AI systems (those making or substantially influencing decisions on education, employment, finance, government services, health care, housing, insurance or legal services) to use reasonable care against algorithmic discrimination, with documentation, risk programs, impact assessments and consumer notices, and requiring disclosure when consumers interact with AI. Reported favorably and referred to House Ways and Means December 24, 2025; it has not passed either house.
Enacts the New York Artificial Intelligence Civil Rights Act establishing protections for individual rights with respect to computational algorithms; establishes protections against the use of algorithms involved in consequential decisions, such as those that impact people's rights, civil…
New York's A 9654 (the New York Artificial Intelligence Civil Rights Act) would bar developers and deployers from using covered algorithms in consequential actions (such as employment, housing, credit, health care, insurance, education, criminal justice and government services) in ways that discriminate or have a disparate impact on protected characteristics. It would require independent audits where harm is plausible. Referred to the Assembly Science and Technology Committee January 21, 2026; it has not passed either house.
Video Surveillance
South Carolina's H 4675 would create the Community Data Protection and Responsible Surveillance Act. State and local law enforcement could not use surveillance systems (automated license plate readers) that store data on third-party servers or use AI to identify or track vehicles by appearance. Data would be kept at most 21 days and searched only with a warrant. Referred to the House Judiciary Committee January 13, 2026; it has not passed either house.
Trade: business regulation; requirements and safety standards for developers of certain artificial intelligence models; provide for. Creates new act.
Michigan's HB 4668 (as introduced) would create the Artificial Intelligence Safety and Security Transparency Act. Large developers of foundation models (compute costing at least $5 million for one model and $100 million over 12 months) would have to publish a safety and security protocol for critical risks, publish transparency reports at least every 90 days, and get an annual third-party audit, with whistleblower protection. The attorney general could seek fines up to $1,000,000 per violation. Re-referred to the House Communications and Technology Committee March 19, 2026; it has not passed either house.
Relating To Artificial Intelligence.
Hawaii's HB 1676 HD 1 (2026) would have created an AI in Education Task Force within the University of Hawaii to develop model statewide guidance, data privacy and vendor transparency standards and other recommendations on AI in education. It passed the House, but the Senate EDU and LBT committees deferred it March 23, 2026, and it was not enacted.
Relating To Correctional Institutions.
Hawaii's SB 2860 (2024) would have required the Department of Corrections and Rehabilitation to study the feasibility of using artificial intelligence technology to improve safety for staff and inmates in correctional institutions, report findings and recommendations before the 2026 session, and appropriated a blank amount for fiscal year 2024-2025. It was referred to PSM and WAM on January 24, 2024 and died when the 2024 session ended.
Artificial Intelligence
Not law: died in subcommittee. Florida's HB 1395 (2026) would have created an "Artificial Intelligence Bill of Rights" (new part IX of ch. 501): parental consent and controls for minors on companion chatbot platforms, an hourly not-human pop-up for bots, a ban on selling users' personal information unless deidentified, and consent for commercial use of generative-AI likenesses. It would also have barred government AI contracts with foreign-country-of-concern entities. It died on March 13, 2026.
An Act to prohibit the use of a deepfake to influence an election and to provide a penalty therefor.
South Dakota's 2025 SB 164 targets election deepfakes. A deepfake is an image, audio or video created or manipulated with AI or other digital technology so realistic that a reasonable person would believe it shows a real person's speech or conduct that did not happen. Disseminating one, or contracting to, with intent to injure a candidate within 90 days of an election, without the disclosure "This (image/video/audio) has been manipulated or generated by artificial intelligence," is a Class 1 misdemeanor. The AG, candidates and depicted people can sue. The act states no effective date.
Digital Content Authenticity and Transparency Act; established, civil penalty.
Virginia's HB 2121 (2025 Regular Session) would have created the Digital Content Authenticity and Transparency Act, requiring generative AI developers to apply provenance data to synthetic content and offer a public provenance tool and reader, with Attorney General enforcement and civil penalties. Left in committee on February 4, 2025; it failed.
License artificial intelligence risk mitigation organizations
Ohio's HB 628 would enact chapter 3755 letting the Attorney General license independent verification organizations that assess whether AI models and applications meet standards for preventing personal injury and property damage. An applicant would file a plan with its risk-mitigation metrics, requirements for developers and deployers, and independence safeguards, and could be licensed only if independent of the AI industry. An AI safety advisory council would be set up in the Attorney General's office. Referred to committee February 4, 2026.
AI SAFETY MEASURES ACT
Illinois's HB 4799 (104th General Assembly) would create the Transparency in Frontier Artificial Intelligence Act. Large frontier AI developers would have to adopt and publish a frontier AI framework covering catastrophic risk management, transparency and cybersecurity, and report critical safety incidents to the Attorney General, with civil penalties for noncompliance. It would also create a consortium to develop ILCompute, a public cloud computing resource. Referred to Rules February 6, 2026.
AI DATA PRIVACY ACT
Illinois's SB 3180 (104th General Assembly) would create the Artificial Intelligence Data Privacy Act. Beginning January 1, 2027, a deployer would have to either (1) not let its AI train on a user's covered information and retain the training data indefinitely without first informing the user in writing and getting express written consent, or (2) set its AI by default not to train on that information unless the user is notified and affirmatively consents. The bill has private right of action provisions, and a violation would be an unlawful practice under the Consumer Fraud Act. Last action: re-referred to Assignments May 22, 2026.
AGE-APPROPRIATE DESIGN CODE
Illinois' SB 3241 is mainly a children's online privacy and design-code bill. As introduced, it would require covered entities (for-profit businesses over set revenue or data thresholds) to complete data protection impact assessments for services reasonably likely to be accessed by children, including whether algorithms and targeted advertising systems could harm children, and would bar profiling a child by default. Introduced February 2, 2026; re-referred to Assignments May 22, 2026.
Health care services: artificial intelligence.
Vetoed. AB 2575 would have barred California employers from retaliating against workers providing direct patient care based solely on their override of, or reliance on, a clinical decision support system (AI that aids decisions on timing of care, diagnosis or treatment), with enforcement by the Labor Commissioner. In lawsuits over harm from such a system, its developer or deployer could not have argued that a clinician's failure to override it cut off liability. Governor Newsom vetoed it on September 30, 2026, saying its anti-retaliation test set a higher bar than other protections and would make the Labor Commissioner judge the medical standard of care.
Extend Prohibition on School Facial Recognition
Colorado's SB 25-143 keeps the SB 22-113 ban on schools signing facial recognition contracts by deleting its July 1, 2025 repeal date. Contracts in effect April 18, 2025 stay allowed. New exceptions cover vendor tools used with board-approved curricula, which need opt-in consent, and safety uses: an articulable and significant threat, a missing student, or a person ordered to stay off school property. Safety systems may identify only the people involved and only while such a situation is occurring. Biometric identifiers may be kept no longer than 18 months, and aggrieved parties may seek an injunction. Signed and effective April 18, 2025 (Chapter 86).
Schools; creating the Oklahoma Responsible Technology in Schools Act; requiring development of guidance for use of artificial intelligence and emerging technologies. Effective date. Emergency.
Oklahoma's Responsible Technology in Schools Act sets rules for AI in public schools from July 1, 2026. Classroom AI must be educator-directed, with a person reviewing AI outputs before use; AI may not be the main basis for grading, discipline, placement or other high-stakes decisions; and tools must suit students' ages and follow student-privacy law such as FERPA. Districts must give parents a yearly written list of AI tools, vendors and student data shared, and let them opt students out of student-facing AI without penalty. Each district board must adopt an AI policy before the 2027-28 school year.
An Act To Amend Title 15 Of The Delaware Code Relating To Deep Fakes In Elections.
Delaware's HB 316 (enacted as House Substitute 1, 84 Del. Laws c. 487) makes it a crime to distribute, or contract to distribute, a deep fake of a candidate or party within 90 days before an election without the depicted person's consent, if the person knows or should know it is a deep fake. Media carrying "This (image/video/audio) has been altered or artificially generated." is exempt, as are qualifying news coverage, satire and parody. Violations are class B misdemeanors, or class A with intent to cause violence or within 5 years of a prior conviction; depicted candidates may sue in the Court of Chancery. Signed and effective October 9, 2024.
AN ACT to amend Tennessee Code Annotated, Section 2-7-112 and Title 55, Chapter 50, relative to licenses.
Tennessee's HB 1316 (Public Chapter 297) renames the electronic driver license system the digital driver license system and limits its data use. A vendor providing the license app may not capture or retain biometric identifiers (retina or iris scans, fingerprints, voiceprints, hand or face geometry) except a photograph used solely to compare with the license photo on file, and neither the vendor nor the Department of Safety may collect geolocation data. Data from using a digital license may be kept no more than three days and not sold. Digital licenses cannot be used as voter ID. Signed April 24, 2025 (Public Chapter 297); effective on signing.
Revises provisions relating to transportation network companies. (BDR 58-935)
Nevada's SB 288 lets a transportation network company (TNC) contract with monitored autonomous vehicle providers, who own and operate autonomous vehicles with an employed monitor physically present at all times, to give rides through the TNC's app largely on the same terms as drivers. Providers are liable in tort like drivers and must carry at least $1,500,000 of TNC insurance while operating; the TNC must hold a Transportation Authority permit and inspect the vehicles. Local governments generally may not tax or charge fees on these providers or rides. Approved June 10, 2021 (Chapter 550); effective on approval.
AI USE IN GOVT CONTRACTS
Illinois's HB 5099 (103rd General Assembly) would have added Section 50-41 to the Illinois Procurement Code. A vendor contracting for government services, grants, or leases or purchases of software or hardware would have to disclose whether AI technology is, has been, or will be used in fulfilling the contract or in the goods or services purchased. It was not passed before the 103rd General Assembly ended (Session Sine Die, January 7, 2025).
AUTOMATED DECISION TOOLS
Illinois's HB 5116 (103rd General Assembly) would have created the Automated Decision Tools Act. On or before January 1, 2026, and annually after, a deployer of an automated decision tool would have to perform an impact assessment, notify people subject to a consequential decision, and keep a governance program to manage algorithmic discrimination risk. The Attorney General could sue. Died at Session Sine Die on January 7, 2025.
artificial intelligence; state agencies; rules
Vetoed. Arizona's HB 2592 (2026) would have added A.R.S. § 18-105, requiring the Department of Administration director to have each state budget unit identify AI uses that reduce administrative burdens, eliminate regulations that unnecessarily restrict AI innovation, streamline AI procurement and set up enterprise AI governance. Agencies could not have adopted rules specifically regulating AI systems or computational resources without an express legislative delegation to address a specific harm and a least-restrictive-means showing. The director would have reported yearly by December 1. Vetoed June 19, 2026.
TRAIN Act Transparency and Responsibility for Artificial Intelligence Networks Act
The federal H.R. 7209 (TRAIN Act, Transparency and Responsibility for Artificial Intelligence Networks Act) would let copyright owners ask a federal court clerk for a subpoena requiring a generative AI model developer to disclose copies of, or records identifying, the owner's works used in training. The developer shall expeditiously disclose, and failure to comply creates a rebuttable presumption that it copied the work. Introduced January 22, 2026 and referred to the House Judiciary Committee; no further action.
Cartwright Act: violations.
California's AB 325 amends the Cartwright Act, the state antitrust law. It is unlawful to use or distribute a common pricing algorithm (any methodology, including software, used by two or more persons that uses competitor data to recommend, align, stabilize, set or otherwise influence a price or commercial term) as part of a contract, combination or conspiracy to restrain trade, or while coercing another person to adopt a price or term it recommends. A Cartwright Act complaint need only plausibly allege an agreement, without excluding independent action. Signed October 6, 2025 (Chapter 338); effective January 1, 2026.
APA-SURVEY
Illinois' HB 1937 (Rep. Jed Davis) is a regulatory-reduction bill that mentions AI only as a permitted tool. As introduced, it would require the Auditor General to survey the Illinois Administrative Code for mandates and restrictions on the private sector and local governments and report within 2 years of the effective date, and would require State agencies to cut those mandates. The Auditor General, contractors, and agencies could use AI to do the counting. Introduced February 4, 2025; in Rules Committee.
Regulates use of automated employment decision tools in employment decisions to minimize discrimination in employment.
New Jersey's A2726 would regulate automated employment decision tools. A tool could not be sold, developed, deployed, used or offered in New Jersey unless it had a bias audit in the past year; employers would have to notify candidates at least 10 days before use and post audit summaries. Civil penalties would be up to $1,500 for a developer's first violation and up to $500 per violation for employers. Pre-filed for introduction in the 2026 session.
READ AI Models Act Resources for Evaluating and Documenting AI Models
H.R. 6461, the READ AI Models Act, as introduced would direct NIST, subject to appropriations, to start a pilot program creating a modular template and technical guidelines for documenting AI models and their data. Introduced December 4, 2025 and referred to the House Science, Space, and Technology Committee, which ordered it reported in the nature of a substitute (amended) on June 25, 2026 (35-0); this page describes the introduced text. It has not passed either house.
China AI Power Report Act
H.R. 6275, the China AI Power Report Act, as introduced would require the Secretary of Commerce to report to the House Foreign Affairs and Senate Banking committees on China's advanced AI capabilities and AI supply chains: 180 days after enactment and annually for 3 years after. Introduced November 21, 2025 and referred to House Foreign Affairs, which ordered it reported with amendments on January 21, 2026 (47-0); this page describes the introduced text. It has not passed either house.
AI Whistleblower Protection Act
H.R. 3460, the AI Whistleblower Protection Act, would bar employers from retaliating against employees and independent contractors, including former ones, who report AI security vulnerabilities or AI violations to regulators, Congress or supervisors. Remedies would include reinstatement and double back pay. Introduced May 15, 2025 and referred to the House Education and Workforce Committee; it has not passed either house.
Mississippi Consumer Privacy Protection Act; create.
Mississippi's HB 1051 (2026) would have created the Mississippi Consumer Privacy Protection Act for businesses with over $25 million in revenue that handle personal information of 175,000+ consumers (or 25,000+ with over half of revenue from selling data). Consumers could opt out of profiling used for decisions with legal or similarly significant effects. It was referred to House Judiciary A on January 16, 2026 and died in committee on February 3, 2026.
Generative artificial intelligence: training data: copyrighted materials.
California's AB 412 (2025-26 Regular Session) would add Civil Code Title 15.3 requiring a developer of a generative AI model to provide a website mechanism for rights owners to request information on use of their covered materials. Within 30 days of a request, subject to exceptions, the developer would assess whether the materials were used and give the owner a list. Passed the Assembly 45-16; held under submission in Senate Appropriations August 13, 2026; not passed.
An Act Concerning Artificial Intelligence.
Connecticut's SB 2, as passed by the Senate (File 603 as amended by Senate Amendments A and B, as described in the OLR bill analysis), would require anyone doing business in the state to tell consumers when they interact with an AI system, and deployers of high-risk AI systems used in consequential decisions to give notices, explain adverse decisions and allow correction and appeal, beginning October 1, 2026, with attorney general enforcement. It would also create AI studies, an AI Academy and a synthetic intimate image crime. Passed the Senate May 14, 2025; tabled on the House calendar May 16, 2025; it did not pass the House.
Artificial intelligence; regulate use in health coverage decisions
Alabama's HB 515 (2025, as introduced) would have limited how health insurers use AI, algorithms or other software in utilization review. Medical necessity determinations would always have been made by a licensed physician or other competent health care professional. Insurers would have had to disclose AI use to enrollees and contracting providers, periodically review outcomes, and face civil suits for compensatory or punitive damages. Introduced April 3, 2025 and referred to the House Committee on Insurance; it died in committee when the 2025 session ended.
Artificial Intelligence Chatbots and Minors Act; established, prohibited practices, penalties.
Virginia's HB 758 (2026) would have created the Artificial Intelligence Chatbots and Minors Act (Code §§ 59.1-614 to 59.1-616). Deployers that operate or distribute a chatbot in Virginia would have had to keep "human-like features" away from minors, use reasonable age verification, and keep social AI companion chatbots unavailable to minors. A violation would have been a prohibited practice under the Virginia Consumer Protection Act. The bill died: a House subcommittee recommended laying it on the table (7-3) on February 4, 2026, and it was left in committee February 18, 2026.
RISE Act of 2025 Responsible Innovation and Safe Expertise Act of 2025
The RISE Act would shield AI developers from civil liability for errors made by their AI products when licensed or certified professionals use them to serve clients, if the developer publishes a model card and its model specification (including system prompts) before deployment and gives professionals clear documentation of known limitations, failure modes and appropriate uses. The shield would not cover recklessness or willful misconduct, would be lost if disclosures are not updated within 30 days of a new version or newly found failure mode, and would preempt covered state-law claims except those for fraud, knowing misrepresentation or non-professional use. Introduced June 12, 2025.
PROTECT IMAGE-VOICE-LOOKS
Illinois's HB 5594 (103rd General Assembly) would have created the NO FAKES Act, giving each individual (and after death their heirs) a descendible, licensable property right to authorize use of their image, voice or visual likeness in a digital replica, enforceable by civil action with the greater of $5,000 per violation or actual damages. It was not passed before the 103rd General Assembly ended (Session Sine Die, January 7, 2025).
DIGITAL PROTECT-USE OF REPLICA
Illinois' Public Act 104-0282 (HB 3178) narrows Section 10 of the Digital Voice and Likeness Protection Act, which makes unenforceable a services-contract provision letting a digital replica of a person's voice or likeness replace work they would have done in person, if it lacks a reasonably specific description of intended uses and the person had neither a lawyer who negotiated the replica license nor a union contract covering replicas. The rule now applies only to new replica performances fixed on or after January 1, 2026, and not when uses fit the contract and the recording's fundamental character. Approved August 15, 2025; effective January 1, 2026.
Prohibits the collecting of information of historical or contemporaneous prices, supply levels, or lease or rental contract termination and renewal dates of residential dwelling units from two or more rental property owners for purposes of analyzing or processing of such information using an…
New York's S 1573 would add Real Property Law § 222-a barring owners of four or more residential units from paying for a coordinator's services (software or analytics that collects data from two or more owners and recommends rents, renewal terms or occupancy levels). Coordinators could not facilitate agreements among owners not to compete. The Attorney General could sue for an injunction and monetary penalties; arbitration clauses would be unenforceable. Referred to Judiciary January 7, 2026; it has not passed either chamber.
Artificial intelligence safety and disclosure requirements established, and civil remedies provided.
Minnesota's HF 4532, the Responsible Artificial Intelligence Safety and Education (RAISE) Act, would require developers (anyone who has trained at least one AI model) to adopt, publish and send to the attorney general a safety and security protocol before deploying a model, report safety incidents within 72 hours, and not deploy a model that creates an unreasonable risk of critical harm. Introduced and referred to Commerce Finance and Policy March 23, 2026; it died when the 2026 session adjourned.
Generative Artificial Intelligence - Training Data Transparency
Maryland's HB 823 (2025) would have required developers of generative AI systems released on or after January 1, 2022 for public use in Maryland to publish documentation on their website describing the training data, on or before January 1, 2026 and before each release or substantial modification (new State Finance and Procurement section 3.5-807). A House Economic Matters hearing was set for February 18, 2025; the bill went no further and died when the session ended.
Artificial intelligence and cybersecurity.
Indiana's SB 150 (Public Law 108 of 2024) creates a 15-member legislative AI task force (IC 2-5-53.7) that studies AI used, developed or considered by state agencies, assesses its benefits, risks and effects on residents' rights, privacy, employment and economic welfare, and reports recommendations by October 31 each year. From July 1, 2025, state agencies may submit AI inventories and public entities may adopt technology and cybersecurity policies; entities connecting to state technology infrastructure after July 1, 2026 (public entities after July 1, 2027) must meet cybersecurity rules. Signed March 13, 2024; task force effective July 1, 2024; the AI chapters expire December 31, 2027.
$CMS-AI PROCUREMENT
Illinois's SB 2780 (104th General Assembly) would appropriate $250,000, or so much as may be necessary, from the General Revenue Fund to the Department of Central Management Services for a grant to Amp AI, doing business as Nozma, to conduct a procurement modernization and artificial intelligence pilot program. Its Section 99 sets an effective date of July 1, 2026. Last action: referred to Assignments July 2, 2026 under Senate Rule 3-9(b).
AI Model Safety
Illinois's SB 3444 (104th General Assembly) would create the Artificial Intelligence Safety Act. A frontier AI model developer would not be liable for critical harms it did not intentionally or recklessly cause, if it publishes a safety and security protocol and transparency report on its website. Re-referred to Senate Assignments on May 22, 2026.
AN ACT RELATING TO INSURANCE -- THE TRANSPARENCY AND ACCOUNTABILITY IN ARTIFICIAL INTELLIGENCE USE BY HEALTH INSURERS TO MANAGE COVERAGE AND CLAIMS ACT
Rhode Island's proposed Transparency and Accountability in AI Use by Health Insurers to Manage Coverage and Claims Act. Health insurers, and contractors acting for them, would have to disclose to the health insurance commissioner and DBR how they use AI in claims and coverage decisions (models, role, training data, performance metrics, governance) and keep records of AI-driven decisions for five years. Any clinical denial in which AI was a substantial factor would need review and approval by a provider with the same license as the ordering provider, or it would be invalid. Regulators would report yearly. The Senate passed a substitute on June 9, 2026.
Worker data: prohibitions: artificial intelligence.
California's AB 2027 (2025-26 Regular Session) would add Labor Code provisions barring an employer from using a worker's personal information to train an artificial intelligence system to replicate, automate, or replace the worker's job, or from selling or providing that information to a third party for that purpose. Vendors serving employers would face parallel limits and contract terms. Held under submission in Assembly Appropriations on May 14, 2026; not passed before the session ended.
An Act Concerning Online Safety
Public Act 26-15 is Connecticut's main AI statute. AI companion operators must disclose that users are talking to AI, run suicide and self-harm protocols and protect minors (from Jan. 1, 2027). Developers and deployers of automated employment-related decision technology must give notices to workers and applicants, enforced by the Attorney General, and AI use is no defense to discrimination claims (Oct. 1, 2026). It also adds frontier-developer whistleblower protections, provenance duties for large generative AI providers, AI subscription disclosures, a statutory AI definition, the CT AI Academy, an AI working group and state-agency AI inventory and assessment rules.
An Act Concerning Consumer Privacy And Protection.
Connecticut's Public Act 26-64 (SB 4) targets data-driven pricing and surveillance. Businesses that use an automated price setting device fed by personal data (other than to set a discount) and advertise the price online must show "THIS PRICE WAS INCREASED BY A PRICE SETTING DEVICE USING YOUR PERSONAL DATA" or similar. Retailers and delivery apps may not use surveillance pricing. Data privacy act controllers using facial recognition on premises for security must match only against their own database and post entrance signs. It also requires data brokers to register, bans selling precise geolocation data, and adds genetic-testing consent rules. Signed May 27, 2026; effective October 1, 2026.
Requires healthcare providers and healthcare facilities to inform patients of the use of artificial intelligence to memorialize patient visits.
Rhode Island's H 7538 Sub A adds Chapter 23-106 to the General Laws. Healthcare providers and healthcare facilities that use AI to document in-person or telehealth visits must notify patients of the use of AI for that sole purpose and review the AI-generated documentation for accuracy after the visit. The Senate passed Sub A and the House concurred June 11, 2026; signed June 22, 2026 (Chapter 199); effective upon passage (June 22, 2026).
Artificial Intelligence Civil Rights Act of 2025
The federal S. 3308 (Artificial Intelligence Civil Rights Act of 2025) would bar developers and deployers from offering or using a covered algorithm in a way that causes or contributes to disparate impact or otherwise discriminates based on a protected characteristic in consequential actions such as employment, education, housing, health care, credit, insurance and government benefits. It would require independent-auditor evaluations and annual assessments, public disclosures, human alternatives and appeals, with enforcement by the FTC, State attorneys general and private suits. Introduced December 2, 2025 and referred to the Senate Commerce Committee; no further action.
PROACTIV Artificial Intelligence Data Act of 2025 Preventing Recurring Online Abuse of Children Through Intentional Vetting of Artificial Intelligence Data Act of 2025
The federal S. 2381 (PROACTIV Artificial Intelligence Data Act of 2025) would require the NIST Director, within 1 year after enactment, to develop and publish a voluntary framework for AI developers and data collectors to detect, remove and regularly report child pornography in AI training datasets built with automated crawlers or scrapers. Developers and data collectors acting in accordance with it would be shielded from lawsuits, with exceptions for intentional misconduct, malice, recklessness and gross negligence. Introduced July 22, 2025 and referred to the Senate Commerce Committee; no further action.
Artificial intelligence; AI devices in health care; qualified end-user; deployer; quality assurance program; State Department of Health; effective date.
Oklahoma's HB 1915, as introduced, would require AI devices used in health care that are medical devices under federal law to be deployed under FDA rules and used only by a qualified end-user (a licensed physician able to perform the task without the device). Hospitals, practices and other deployers would have to run a quality assurance program, an AI governance group and a device inventory, with penalties set by the State Department of Health. Referred to the House Rules committee February 4, 2025; the bill died when the 2026 legislative session ended on May 14, 2026 without passing.
Requires the registration of data brokers; imposes regulations upon data brokers; establishes a data deletion mechanism for consumers; imposes penalties upon data brokers for violations of the law.
New York's A 9642-A would add General Business Law Article 42-A (§§ 1150-1158). Data brokers would have to register with the Attorney General within 60 days after meeting the definition and disclose, among other things, whether they have "shared or sold consumers' data to a developer of an artificial intelligence system or model in the past five years." The Attorney General would set up a free data deletion mechanism, and brokers would have to process and delete requests within 45 days of receipt, with penalties of $500 per day for failing to register or delete. Introduced January 21, 2026; amended and recommitted to Consumer Affairs and Protection June 1, 2026; not passed.
Basic Allowance for Housing Calculation Improvement Act of 2023
The federal H.R. 5230 (Basic Allowance for Housing Calculation Improvement Act of 2023) would have required the Secretary of Defense, by September 30, 2024, to seek an agreement with a nationally recognized single-family housing data entity to calculate monthly basic allowance for housing rates for at least 15 military housing areas using machine learning and AI algorithms. Introduced August 18, 2023 and referred to the House Armed Services Committee; it died when the 118th Congress ended on January 3, 2025.
Enacts the "New York artificial intelligence transparency for journalism act"; requires developers of generative artificial intelligence systems or services to post certain information on the developer's website regarding video, audio, text and data from a covered publication used to train the…
New York's A 8595-B, the "New York artificial intelligence transparency for journalism act," would add General Business Law §§ 338 to 338-D. By January 1, 2027, generative AI developers serving New Yorkers would have to post the URLs crawled, a description of covered-publication content used, whether copyright notices were removed and the collection timeframe, and disclose crawler details. A journalism provider could sue for compliance and statutory damages of up to $10,000 per violation. Would take effect immediately. Amended June 9, 2025 and referred to Codes (again January 7, 2026); it has not passed either chamber.
Prohibits the use of any automated or algorithm-driven process by which the price charged for an essential good or service is adjusted on a real-time basis substantially in reference to any non-cost-based factor.
New York's A 9152 would add General Business Law § 396-rrr prohibiting sellers of essential goods and services, including platforms, from using dynamic pricing: an automated or algorithm-driven process adjusting price in real time "substantially in reference to any non-cost-based factor." Exemptions include auctions, bona fide contracts, financial and insurance products and emergencies. Only the Attorney General could sue, for civil penalties up to $25,000 per violation or three times gross receipts. Would take effect on the ninetieth day after it becomes law. Referred to Consumer Affairs and Protection October 17, 2025 (and January 7, 2026); it has not passed either chamber.
Transportation: other; definition of automated driving systems and automated vehicle roadway; modify and expand.
Michigan's Public Act 179 of 2022 amends the Vehicle Code (MCL 257.2b, 257.642, 257.665 and new 257.665c-665e and 257.666a). It redefines automated driving systems, lets the Department of Transportation designate automated vehicle roadways and lanes, charge user fees and contract with roadway system providers, and makes unauthorized use of those lanes a civil infraction enforceable with system data. It also revises testing rules for automated vehicles, treats an engaged automated driving system as the driver, and allows truck platoons. Effective July 25, 2022.
Artificial Intelligence Risk Evaluation Act of 2025
U.S. Congress's S. 2938, the Artificial Intelligence Risk Evaluation Act of 2025 (119th Congress), would require the Secretary of Energy to establish an Advanced Artificial Intelligence Evaluation Program. Developers of advanced AI systems (trained with more than 10^26 operations) would have to participate and give the Secretary requested materials, and could not deploy such a system in interstate or foreign commerce otherwise, with fines of at least $1,000,000 per day. It was referred to Senate Commerce on September 29, 2025; Homeland Security and Governmental Affairs held hearings September 30, 2026. It is pending in committee.
LIFE with AI Act Learning Innovation and Family Empowerment with AI Act
The federal S. 3063 (LIFE with AI Act) would condition federal education funds on student-privacy rules: a simpler directory-information opt-out form, a bar on using student photos to train facial recognition without parental consent, and public ed-tech contracts with vendor privacy certifications. It would also create a "Golden Seal of Excellence in Student Data Privacy", a Privacy Technical Assistance Center, and teacher resources and research priority for AI in education. Introduced October 28, 2025 and referred to the Senate HELP Committee; no further action.
AI LEAD Act Aligning Incentives for Leadership, Excellence, and Advancement in Development Act
The federal S. 2937 (AI LEAD Act) would make AI developers liable for harm if they fail to use reasonable care in design or warnings, breach an express warranty, or sell a defective and unreasonably dangerous product (strict liability for the last). Deployers would be treated as developers if they substantially modify or intentionally misuse a system. It would make contract terms that waive rights or unreasonably limit liability unenforceable, create a federal cause of action, set a 4-year limitations period, and require foreign developers to designate a U.S. agent. Introduced September 29, 2025 and referred to the Senate Judiciary Committee; no further action.
Autonomous Veh Requirements
Illinois's HB 2053 (103rd General Assembly) would have amended the Illinois Vehicle Code to require manufacturers to submit automation-level documentation and a filing fee to the Department of Transportation before selling or operating autonomous vehicles, and to prohibit sale or operation of Level 3, 4 or 5 vehicles. It stayed in the House and died at Session Sine Die on January 7, 2025.
AN ACT relating to the promotion of family well-being and making an appropriation therefor.
Kentucky's HB 734, the omnibus ALPHA Act on family well-being, included a provision that would bar the Cabinet for Health and Family Services from relying exclusively on automated, AI-based or algorithmic software to identify fraud in public assistance programs and from denying, discontinuing or reducing benefits without staff review of the documentation. Introduced February 26, 2024; sent to the House Appropriations & Revenue Committee March 5, 2024. It died when the 2024 session ended without passing.
A bill to require the Secretary of Defense to carry out a pilot program on using artificial intelligence-enabled software to optimize the workflow and operations of depots, shipyards, and other manufacturing facilities run by the Department of Defense, and for other purposes.
The federal S. 4758 would have required the Secretary of Defense to start, within 60 days after enactment, a pilot program on AI-enabled software to optimize workflow and operations at DoD depots, shipyards and manufacturing facilities and in contract administration, spending or obligating not less than $35,000,000. Introduced July 24, 2024 and referred to the Senate Armed Services Committee; it died when the 118th Congress ended on January 3, 2025.
Advanced Artificial Intelligence Security Readiness Act of 2025
This bill would direct the NSA's Artificial Intelligence Security Center to develop and share security guidance for protecting the most advanced AI from theft or sabotage by foreign threat actors. The guidance would identify AI-specific vulnerabilities and supply-chain weak points and cover protecting model weights, insider threats and personnel vetting, network access controls and counterintelligence. NSA would consult AI developers, researchers, national labs and agencies such as NIST's CAISI, report progress to the intelligence committees within 180 days and deliver a final report within a year, including a public version. Introduced November 19, 2025.
AN ACT relating to the promotion of family well-being and making an appropriation therefor.
Kentucky's SB 34, the omnibus ALPHA Act on family well-being, included a provision that would bar the Cabinet for Health and Family Services from relying exclusively on automated, AI-based or algorithmic software to identify fraud in public assistance programs and from denying, discontinuing or reducing benefits without staff review of the documentation. Introduced January 2, 2024; sent to the Senate Appropriations & Revenue Committee January 5, 2024. It died when the 2024 session ended without passing.
Right to Compute Act
South Carolina's H 4657, the Right to Compute Act, would add Chapter 35 to Title 1. A deployer of AI that controls critical infrastructure in whole or part would have to develop a reasonable risk management policy, and government restrictions on private use of computing resources would have to be demonstrably necessary and narrowly tailored to a compelling interest. Introduced January 13, 2026 and referred to the House Labor, Commerce and Industry Committee; it has not passed either chamber.
Establishes public-private partnerships to develop artificial intelligence job training.
New Jersey's A5033 would let the Commissioner of Labor and Workforce Development contract with a private entity that takes on full financial and administrative responsibility for developing AI job training, including retraining for displaced workers and building AI skills in the State workforce. Each agreement would create an advisory council reporting annually to the Governor and Legislature. The entity would be exempt from procurement and certain prevailing wage requirements. Introduced November 14, 2024. A bill of the Legislature's 2024-2025 session, which ended January 13, 2026.
Health care plans; to regulate the use of artificial intelligence in determinations of coverage
Alabama's SB 63 (Act 2026-589) limits how health benefit plan providers, including insurers, HMOs and utilization review contractors, use AI in prior authorization. AI-assisted medical necessity determinations must rest on the enrollee's medical history, clinical circumstances presented by the requesting provider and other information in the record, and any denial, delay or modification must be made by a licensed physician or other competent health care professional. Providers must certify their AI annually to the Department of Insurance, disclose its use and review its outcomes. Fines up to $5,000 for repeat violations. Signed April 16, 2026; effective October 1, 2026.
Relating to public safety; and declaring an emergency.
Oregon's 2026 public safety act (Chapter 77, in effect since it was signed on March 31, 2026) sets statewide rules for police use of automated license plate recognition (ALPR): cameras combined with computer algorithms that read plates and vehicle traits. Police may use ALPR only for listed purposes, must delete data not tied to a case or investigation within 30 days, log every search, publish their policies and their vendors' monthly audits, and may share data with non-Oregon agencies only for a specific law enforcement purpose. Vendors may not use, share or sell the data. The act also changes pretrial release and two state grant programs.
Establishes public-private partnerships to develop artificial intelligence job training.
New Jersey's S3984 would let the Commissioner of Labor and Workforce Development contract with a private entity that takes on full financial and administrative responsibility for developing AI job training, including retraining for displaced workers and building AI skills in the State workforce. Each agreement would create an advisory council reporting annually to the Governor and Legislature. The private entity would be exempt from the Department's procurement rules and certain prevailing wage requirements. Introduced December 19, 2024. A bill of the Legislature's 2024-2025 session, which ended January 13, 2026.
Relating To Artificial Intelligence.
Hawaii's HB 2597 (H.D. 1, S.D. 1) would have required the State's chief data officer to turn the open data portal into a comprehensive Hawaii data hub with an AI chatbot developed in phases, and to build a system to evaluate and select AI governance tools for state agencies and publish agency AI use cases and vendors. It passed the House March 5, 2026, but the Senate never passed it; it died when the session adjourned May 8, 2026.
AN ACT to amend Tennessee Code Annotated, Title 10; Title 24 and Title 38, relative to historical location data.
Tennessee's SB2215 (114th General Assembly), the "Protecting Everyone from Excessive Police Surveillance (PEEPS) Act," would have barred government officials, including government contractors, from accessing a database (including license plate, facial recognition, biometric or cellular location data) that reveals a person's or vehicle's location more than 24 hours earlier, except with a felony search warrant, consent, exigent circumstances or other listed cases. Companion: HB 2608. Not passed before the session ended in April 2026; last action: Assigned to General Subcommittee of Senate Judiciary Committee (March 23, 2026).
Colorado Artificial Intelligence Act
Colorado's SB 24-205 (the Colorado AI Act) covers high-risk AI that makes, or is a substantial factor in making, consequential decisions such as hiring, lending, housing, insurance and health care. Developers and deployers must use reasonable care against algorithmic discrimination; deployers need risk programs, impact assessments and notices. Signed May 17, 2024 (Chapter 198). Duties run from June 30, 2026 (SB 25B-004) until SB 26-189 replaces Part 17 on January 1, 2027. Under a stipulated April 27, 2026 order in X. AI LLC v. Weiser (D. Colo.), the Attorney General may not start enforcement over violations through 14 days after a ruling on xAI's planned preliminary-injunction motion.
Adds to existing law to establish provisions regarding generative artificial intelligence in public education.
Idaho's S 1227 (2026 Session Laws Chapter 71) adds Chapter 70, Generative Artificial Intelligence in Education, to Title 33. The State Department of Education must develop a statewide generative AI framework for K-12 schools, subject to State Board approval, that prioritizes human oversight, transparency, safety and data security and ensures no generative AI replaces a human teacher. Every school district and public charter school must adopt a generative AI policy aligned with it. Vendors of AI tools bought by schools must disclose whether products use machine learning, predictive analytics or generative AI. Signed March 19, 2026; effective July 1, 2026.
Concerning the use of facial recognition services.
Washington's Chapter 257, Laws of 2020 (ESSB 6280) governs state and local government use of facial recognition services (chapter 43.386 RCW). Before use, an agency must give notice to its legislative authority and publish an accountability report after public comment and community meetings. Decisions with legal or similarly significant effects require meaningful human review; services must be tested in operational conditions and vendors must allow independent accuracy and bias testing. Ongoing surveillance, real-time identification and persistent tracking need a warrant, exigent circumstances or a court order. The governor vetoed section 10 (a task force). Effective July 1, 2021.
Relates to transparency and safety requirements for developers of artificial intelligence models
New York's S 8828 (Chapter 96 of 2026) is the chapter amendment to the RAISE Act (Chapter 699 of 2025). It repealed and replaced General Business Law Article 44-B and set the effective date at January 1, 2027. Developers of frontier models (over 10^26 training operations) must publish transparency reports when deploying and report critical safety incidents to a Department of Financial Services office within 72 hours. Those with over $500 million in revenue must also publish and follow a frontier AI framework, report internal-use risk assessments, file disclosure statements and pay assessments, and face Attorney General penalties up to $1 million, then $3 million. Signed March 27, 2026.
AI Whistleblower Protection Act
The federal S. 1792 (AI Whistleblower Protection Act) would bar employers from retaliating against employees and independent contractors, including former ones, who report an AI security vulnerability or an AI violation. Victims could file with the Secretary of Labor or sue in district court, and could recover reinstatement and 2 times back pay. Introduced May 15, 2025 and referred to the Senate HELP Committee; no further action.
ARTIFICIAL INTELLIGENCE SAFETY
Illinois's HB 4705, the Artificial Intelligence Public Safety and Child Protection Transparency Act (as introduced), would require large frontier developers (revenue of at least $500,000,000) and large chatbot providers (revenue of at least $25,000,000, covered chatbots with 1,000,000+ monthly users) to publish a public safety and child protection plan and report safety incidents to the Attorney General within 15 days. Civil penalties up to $1,000,000 or $50,000 per violation. Introduced January 29, 2026; re-referred to Rules March 27, 2026; not passed.
Human Control of AI Act
Illinois's HB 4980 (104th General Assembly) would create the Meaningful Human Control of Artificial Intelligence Act. Public employers and their contractors could not use or procure automated decision-making systems for specified functions without meaningful and continuing human review, and would have to run impact assessments at least every 2 years. It passed House committee as amended; re-referred to Rules April 17, 2026.
Adopt the Transparency in Artificial Intelligence Risk Management Act, create a fund, and change provisions relating to records which may be withheld from the public
Not law. Nebraska LB1083, introduced by Senator Storer, would have enacted the Transparency in Artificial Intelligence Risk Management Act. Large frontier developers (frontier models trained with more than 10^26 operations; revenue of $500 million or more) and large chatbot providers (revenue of $25 million or more) would have had to publish safety and child protection plans; frontier developers would have reported critical safety incidents and large chatbot providers child safety incidents to the Attorney General, with penalties up to $1,000,000 or $50,000 per violation. Placed on General File March 24, 2026; indefinitely postponed April 17, 2026.
AN ACT CONCERNING AUTOMATED DECISION SYSTEMS PROTECTIONS FOR EMPLOYEES.
Connecticut's SB 435 (2026) would have set rules for employers that use automated employment-related decision processes. Deployers would have had to give applicants and employees notices, a statement of reasons for adverse decisions with a chance to correct data and appeal to human review, and an annual independent bias audit; violations of sections 3 to 8 would have been unfair trade practices enforced solely by the Attorney General; aggrieved workers could also have sued. It also covered state-agency AI use. After a Judiciary Committee favorable report, it was tabled for the Senate calendar April 20, 2026 and never voted on; it died when the session adjourned May 6, 2026.
An act relating to regulating developers and deployers of certain automated decision systems
Vermont's H.340 (2025-2026 biennium) would have regulated developers and deployers of automated decision systems used for consequential decisions in areas such as education, employment, housing, health care, financial services and government services. It would have made algorithmic discrimination unlawful, required independent audits and reports to the Attorney General, notices, explanations and human-review appeals for consumers, and a risk management program. It was referred to House Commerce on February 25, 2025 and died when the biennium ended.
AUTOMATED DECISION TOOLS
Illinois's SB 2203 (104th General Assembly) would create the Preventing Algorithmic Discrimination Act. On or before January 1, 2027, and annually after, a deployer of an automated decision tool would have to perform an impact assessment, notify people subject to consequential decisions, and keep a governance program. Re-referred to Assignments on April 11, 2025.
Establishes criteria for the use of automated employment decision tools; provides for enforcement for violations of such criteria.
New York's S 5641-A (2023-24 session, Sen. Comrie) would have added Labor Law article 20-D on automated employment decision tools (AI that is the controlling factor in a decision to hire, promote or terminate). Deployers and developers would have had to perform annual impact assessments and keep an AI governance program, and deployers to notify affected individuals; the Attorney General could investigate and would give 45 days' notice to cure. Referred to Labor March 10, 2023 and amended and recommitted to Labor January 8, 2024; it died when the session ended.
Establishes contract requirements for contracts involving the creation and use of digital replicas.
New York's S 7676-B adds General Obligations Law § 5-302. A clause in a personal or professional services agreement is void as to new performances by digital replication if it lets a digital replica of the person's voice or likeness replace work they would have done in person, lacks a reasonably specific description of the intended use, and the person was not represented by counsel who negotiated the replica license (the text also refers to terms stated clearly and conspicuously in a signed writing) or by a union whose bargaining agreement expressly addresses digital replicas. Signed December 13, 2024 (Chapter 581); effective January 1, 2025, for contracts made or modified from then on.
Consumer Protection - Workgroup on Artificial Intelligence Implementation
Maryland's HB 956 creates the Workgroup on Artificial Intelligence Implementation: legislators, the Attorney General, the Maryland Technology Development Corporation CEO and appointed industry, academic, labor, civil rights, privacy, consumer and cybersecurity representatives. It monitors and makes recommendations on AI, including regulating AI used in decisions that significantly impact people's livelihood and life opportunities, developer and deployer obligations, consumer rights and disclosures, Attorney General enforcement and AI in government benefit decisions, and reports yearly from July 1, 2026. Approved April 22, 2025 (Chapter 105); effective July 1, 2025; ends June 30, 2029.
Establishes the position of chief artificial intelligence officer and such person's functions, powers and duties; including, but not limited to, developing statewide artificial intelligence policies and governance, coordinating the activities of any and all state departments, boards, commissions…
New York's S 9104 (2023-2024) would have created the position of chief artificial intelligence officer, appointed by the governor with Senate advice and consent, and an office that would develop statewide AI policy and a risk management plan, coordinate agency AI procurement, audit agency AI use and report annually to legislative leaders; an advisory committee would be created. Passed the Senate June 4, 2024 (61-0) and went to the Assembly Governmental Operations Committee, where it died when the 2023-2024 session ended.
INFORMATION TECHNOLOGY: Creates the Protecting Louisiana's Infrastructure from Artificial Intelligence Risk Act. (1/1/27)
Louisiana's SB 474, the Protecting Louisiana's Infrastructure from Artificial Intelligence Risk Act, would have required developers of frontier AI models (trained with more than 10^26 operations) to publish transparency reports and report critical safety incidents, and would have required large frontier developers (over $500 million annual revenue) to publish a safety framework, obtain audits and certify compliance. The Attorney General could seek up to $1,000,000 per first violation. It passed no chamber: it was returned to the Senate calendar subject to call on April 21, 2026 and died.
TO CREATE THE CRIMINAL OFFENSE OF UNLAWFUL CREATION OR DISTRIBUTION OF DEEPFAKE VISUAL MATERIAL; AND TO ESTABLISH A CAUSE OF ACTION FOR UNLAWFUL CREATION OF DEEPFAKE VISUAL MATERIAL.
Arkansas Act 827 of 2025 makes it a crime to knowingly create or distribute, without consent, realistic deepfake images or video showing an identifiable person nude or engaged in sexual conduct: a Class A misdemeanor for a first offense and a Class D felony after that. The Attorney General may sue providers or developers of prompt-based image generation tools used to make such material if they lacked reasonable safeguards, and injured people may sue the tool provider or whoever caused the deepfake, recovering damages and attorney's fees. Approved April 17, 2025; effective August 5, 2025.
AUTONOMOUS VEH REQUIREMENTS
Illinois's HB 3044 (104th General Assembly) would amend the Illinois Vehicle Code to require manufacturers to file automation documentation and a fee with IDOT before selling or operating an autonomous vehicle. Level 2 vehicles could be sold and registered, Level 3, 4 and 5 vehicles could not be sold or operated, and violations would carry penalties. Re-referred to Rules March 21, 2025.
Artificial Intelligence Transparency Amendments
Utah's HB 286 (2026), Artificial Intelligence Transparency Amendments (first substitute), would have enacted the AI Transparency Act: a large frontier AI developer would have to write, implement and publish a public safety plan for catastrophic risks; per the bill's highlighted provisions, developers would also publish child protection plans and risk assessment summaries and report safety incidents to the Office of Artificial Intelligence Policy, with civil penalties and whistleblower protections. It never passed the House; the enacting clause was struck and the bill filed on March 6, 2026.
Regulating high-risk artificial intelligence system development, deployment, and use.
Washington's HB 2157 (Substitute House Bill, 2026 session) would have required developers and deployers of high-risk AI systems, those specifically intended to make, or be a substantial factor in making, consequential decisions such as employment, lending, housing, insurance, health care and education, to use reasonable care against algorithmic discrimination, with developer documentation, deployer risk programs and impact assessments, consumer notices, and private lawsuits. It died when the session adjourned March 12, 2026, after the House Rules "X" file on February 19.
Creating the Right to Compute Act and requiring a risk management policy for critical infrastructure facilities controlled by an artificial intelligence system
Montana's SB 212 (Chapter 150, 2025), the Right to Compute Act, requires government actions that restrict the private ownership or use of computational resources for lawful purposes to be limited to those demonstrably necessary and narrowly tailored to fulfill a compelling government interest. When critical infrastructure facilities are controlled in whole or in part by a critical AI system, the deployer must develop a reasonable risk management policy that considers the NIST AI Risk Management Framework, an ISO/IEC AI standard or another recognized framework. The act requires no shutdown capability. Signed and effective April 16, 2025.
Commerce and Trade; private entities that employ certain AI systems to guard against discrimination caused by such systems; provide
Georgia's SB 167 would add a new Chapter 16 to Title 10 regulating automated decision systems used for consequential decisions (education, employment, essential government services, financial or lending services, healthcare, housing, insurance and legal services). Developers could not make available a system that results in algorithmic discrimination and would have to provide information to the Attorney General. According to its title, deployers would also have duties, and the Attorney General would enforce. The bill was read and referred on February 13, 2025 and died when the session ended.
CHATBOT RESPONSE LIABILITY ACT
Illinois's SB 3368 (104th General Assembly) would create the Chatbot Response Liability Act. A chatbot proprietor could not disclaim liability when its chatbot gives materially misleading, incorrect, contradictory or harmful information resulting in financial loss, other demonstrable harm or bodily harm to the user or a third party, would have to give clear notice that users are talking to AI, and would face companion chatbot rules including parental consent for minors. Re-referred to Assignments May 22, 2026.
AI PRODUCT LIABILITY ACT
Illinois's SB 3590 would create the Artificial Intelligence Product Liability Act. In product liability actions over high-impact or generative AI systems, a developer would be liable only if the plaintiff establishes the elements listed in Sec. 15: failure to use reasonable care in design, in instructions or warnings, and in an express warranty, causing harm. Deployers would be treated as developers if they materially change the product or intentionally misuse it. Filed February 5, 2026; re-referred to Assignments May 22, 2026; it has not passed either house.
3-1-1 Systems - Expansion Program and Oversight Board - Establishment
Maryland's Chapter 434 of 2026 creates the Maryland 3-1-1 Oversight Board in the Maryland Information Network and a 3-1-1 Program that uses AI chatbots and voicebots, drawing on agency-approved sources, to answer residents' non-emergency questions and route calls in pilot counties. Chatbots must start by June 30, 2027, with multilingual support and escalation to live agents; vendors track accuracy from user feedback, and agencies must correct inaccurate source pages. Voicebots, due by December 1, 2027, can transfer calls to 9-1-1, 2-1-1 and 9-8-8, and the program goes statewide by July 1, 2028. Effective July 1, 2026.
Requires an office within the department of financial services to establish minimum standards for large frontier developers' frontier AI frameworks to prevent unreasonable levels of catastrophic risk.
New York's S 10456 would add General Business Law section 1430. The Office (which the sponsor memo identifies as the Office of Digital Innovation, Governance, Integrity & Trust, DIGIT, in the Department of Financial Services) would have to adopt regulations by July 1, 2028 requiring large frontier developers' frontier AI frameworks to meet minimum standards to prevent unreasonable levels of catastrophic risk. It must consult academia, the Empire AI Research Institute, the Attorney General, civil society and frontier developers, and review the rules annually. Referred to Internet and Technology May 15, 2026; it has not passed either chamber.
State contracts: report: modern foundation models and associated artificial intelligence systems.
California's AB 2653 (2025-26 Regular Session) would add Public Contract Code Chapter 6.5 requiring the Department of Industrial Relations, in consultation with the Department of Technology, to convene a nine-member Foundation Model Labor and Procurement Working Group. It would assess labor practices behind modern foundation models and recommend whether and how the state should include labor standards in procurement, reporting by December 31, 2027. Held in Assembly Appropriations May 14, 2026; not passed.
An Act to Regulate and Prevent Children's Access to Artificial Intelligence Chatbots with Human-like Features and Social Artificial Intelligence Companions
Not law. Maine's LD 2162 would have regulated AI chatbots and social AI companions offered to minors in Maine. As amended by committee amendment C-A, which both chambers adopted, deployers would have had to keep chatbots' human-like features and social AI companions away from minors starting February 15, 2027, and maintain systems to detect, respond to, report and mitigate situations where a minor indicates an intent to harm themselves or others. The Attorney General could seek civil penalties up to $2,500 per violation ($7,500 if intentional), and minors could sue. The bill died on adjournment April 29, 2026.
Artificial Intelligence Bill of Rights
Not law: passed the Senate but died in the House. Florida's SB 2-D (2026 special session D) would have created an "Artificial Intelligence Bill of Rights" (new part IX of ch. 501, F.S.): parental consent and parental controls for minors on companion chatbot platforms, an hourly pop-up telling users a bot is not human, limits on selling AI users' personal data, an AI-image consent rule for commercial use of name, image or likeness, rules for AI in schools and a ban on state contracts with AI vendors tied to foreign countries of concern. The Senate passed it 37-1 on April 28, 2026; it died in the House Information Technology Budget & Policy Subcommittee on April 29, 2026.
Enacts into law major components of legislation necessary to implement the state transportation, economic development and environmental conservation budget for the 2025-2026 state fiscal year; relates to the waterfront commission act; makes amendments to change "applicant" to "licensee or…
New York's 2025-26 budget bill (Chapter 58 of 2025) includes two AI laws. Part U requires operators of AI companions (AI that simulates a sustained human-like relationship) to make reasonable efforts to detect and address suicidal ideation or self-harm and refer users to crisis services such as 988, and to tell users at the start of an interaction and every three hours that they are not talking to a human; the Attorney General can seek up to $15,000 a day (in effect since November 5, 2025). Part X requires businesses using personalized algorithmic pricing to show 'THIS PRICE WAS SET BY AN ALGORITHM USING YOUR PERSONAL DATA' (since July 8, 2025).
Providing consumer protections for artificial intelligence systems.
Washington's HB 2667 (2026 session), the House companion to SB 6284, would have required deployers of high-risk AI systems used for consequential decisions on education, employment, lending, health care, housing, insurance, legal services and similar matters to guard against algorithmic discrimination. Deployer duties would start July 1, 2027 and consumer notice July 1, 2026; only the Attorney General could enforce. It had a first reading on January 26, 2026, never got a hearing and died at adjournment on March 12.
Enacts the "New York artificial intelligence consumer protection act", in relation to preventing the use of artificial intelligence algorithms to discriminate against protected classes.
New York's A 768, the "New York artificial intelligence consumer protection act," would add General Business Law Article 45-A. Beginning January 1, 2027, developers and deployers of high-risk AI decision systems used in consequential decisions (education, employment, lending, government services, health care, housing, insurance, legal services) would have to use reasonable care against algorithmic discrimination, with documentation, impact assessments, consumer notices and appeal rights. Only the Attorney General would enforce it. Referred to Consumer Affairs and Protection January 7, 2026; it has not passed either chamber.
Artificial Intelligence Bill of Rights
Not law: passed the Senate but died in the House when the session ended. Florida's CS/SB 482 (2026), the "Artificial Intelligence Bill of Rights," would have required parental consent and controls for minors on companion chatbot platforms, an hourly not-human notice from bot operators, deidentified data for any sale of user data by AI companies, consent for generative-AI likenesses, and rules for AI tools in schools. The Senate passed it 35-2 on March 4, 2026; it died in House Messages on March 13, 2026.
Health care services: artificial intelligence.
California's SB 503 targets bias in clinical AI. Developers and deployers (health facilities, clinics and medical practices) of clinical decision support systems, AI that aids decisions on timing of care, diagnosis or treatment, must make reasonable efforts to find systems with known or foreseeable risk of biased impacts based on protected characteristics. Developers must mitigate those risks and give deployers a statement of uses and risks plus documentation on training data, bias testing and monitoring; deployers must monitor the systems and take reasonable steps to mitigate bias. Signed September 30, 2026 (Chapter 857); effective January 1, 2027.
Consumer Protection - Artificial Intelligence - Behavioral Health Care Prohibitions
Maryland's HB 883 (2026, third reader text) would have barred developers of AI offered to Maryland consumers from representing that the AI is a behavioral health care provider or can provide behavioral health care, and from offering AI specifically programmed or designed to provide a service that would be behavioral health care if a provider delivered it. A violation would be an unfair, abusive or deceptive trade practice under the Maryland Consumer Protection Act. It passed the House 110-23 and was referred to Senate Finance, with a hearing set for April 1, 2026, but no further action is recorded and it died when the 2026 session ended.
Relating to the artificial intelligence division within the Department of Information Resources.
Texas's HB 2818 requires the Department of Information Resources (DIR) to establish an artificial intelligence division. The division must help state agencies and other entities that use DIR's services implement generative AI for projects to modernize or replace legacy systems and other projects DIR finds appropriate, using DIR's own generative AI or contracting with a vendor, whose generative AI must then complete a majority of the project work. For each completed project, the division must prepare a cost analysis report on the time, money and resources saved compared with traditional systems. Signed June 20, 2025; effective September 1, 2025.
TRAIN Act Transparency and Responsibility for Artificial Intelligence Networks Act
The federal S. 2455 (TRAIN Act) would add 17 U.S.C. 514, letting a copyright owner ask a federal district court clerk to issue a subpoena to the developer of a generative AI model for copies of, or records identifying, the owner's works used to train it, on a sworn declaration of good-faith belief. The developer "shall expeditiously" disclose; failure creates a rebuttable presumption that it copied the work. Bad-faith requests can be sanctioned. Introduced July 24, 2025 and referred to the Senate Judiciary Committee; no further action.
Artificial intelligence; establishing certain rights; prohibiting certain actions by certain entities; requiring certain actions by certain entities. Effective date.
Oklahoma's SB 2085 (2026), as introduced, would, per the official bill summary, have barred the state from accepting bids from or renewing contracts with AI technology providers that do not attest they are not foreign-owned or foreign-adversary controlled, required AI companies to de-identify user data before selling it, restricted commercial use of a person's generative-AI likeness without consent, and set parental-consent rules for companion chatbots and minors. It was referred to a Senate committee February 3, 2026 and died when the session ended May 14, 2026.
Prohibits public contracts with entities owned or controlled by foreign adversaries for the provision of artificial intelligence technology (OR NO IMPACT See Note)
Louisiana's HB1184 would have barred public bodies from executing, entering into or extending, starting July 1, 2027, contracts that procure artificial intelligence technology, software or products unless the vendor signs an affidavit that it is not owned or controlled by, organized in, or based in China, Russia, Iran, North Korea or Cuba. It would have covered higher education, school materials, the legislature, public bid contracts and state procurement. It was referred to House Appropriations April 1, 2026 and died.
Artificial intelligence safety and disclosure requirements establishment (RAISE Act)
Not law. Minnesota's SF 4509, the Responsible Artificial Intelligence Safety and Education (RAISE) Act, would have added Minn. Stat. 325M.40 to 325M.42. AI model developers would have had to adopt, publish in redacted form and send to the attorney general a safety and security protocol, not deploy a model creating an unreasonable risk of critical harm, and report safety incidents within 72 hours. Civil penalties would reach $10,000,000, then $30,000,000.
Fostering Access, Innovation, and Responsibility in Artificial Intelligence Act; established.
Virginia's SB 365 (2026 Regular Session) would create the FAIR AI Act. A developer of a base AI model would have to disclose in its terms of service the model's name, developer, incorporation location, release date and other listed items; the disclosure would not be a defense to liability. Continued to 2027 in committee on February 4, 2026.
Promoting economic development with emerging artificial intelligence models and safety
Massachusetts' S 37 would create an Artificial Intelligence Innovation Trust Fund for grants to AI developers and research, and a new Chapter 93M on frontier AI models. Developers of covered models (trained with more than 10^26 operations costing over $100 million) would need safety protocols, annual third-party reviews and 72-hour incident reports to the attorney general. The committee reported a new draft, S 2630, instead of S 37 on October 16, 2025; S 37 itself did not advance.
State government; require state agencies to provide a notice to employees when using artificial intelligence in personnel matters
Georgia's HB 1351 would add Code section 50-1-15 requiring a governmental agency that uses AI, or contracts with a third party to use it, in hiring to state in the job description that AI may be used to evaluate applications. If AI is used to evaluate an employee's performance in a way that leads to termination, the agency would have to provide a disclaimer documenting all decision pathways, including human review. The bill reached House Second Readers on February 19, 2026 and died when the session ended.
Regulates the development and use of certain artificial intelligence systems to prevent algorithmic discrimination; requires independent audits of high risk AI systems; provides for enforcement by the attorney general as well as a private right of action.
New York's S 1169-B would regulate high-risk AI systems used in consequential decisions on employment, education, housing, health, finance and legal services. Developers and deployers would have to take reasonable care against algorithmic discrimination, commission independent audits, file reports and keep a risk management program; social scoring AI would be banned. The Senate passed it June 3, 2026 and delivered it to the Assembly; it has not passed the Assembly.
To ensure accountability and transparency in artificial intelligence systems
Massachusetts H94 would add G.L. Chapter 93M requiring developers and deployers of high-risk AI systems used in consequential decisions (education, employment, lending, housing, health care, insurance, legal and government services) to guard against algorithmic discrimination, with Attorney General enforcement. On December 24, 2025 it accompanied H97, which was reported favorably and referred to House Ways and Means.
Youth AI Privacy Act
The federal S. 4199 (Youth AI Privacy Act), as introduced, would require AI chatbot deployers that know a user is a minor to disclose that the user is talking to an AI, bar profiling, advertising and training on minors' data, and have the FTC write rules against compulsive-use features. The Commerce Committee ordered it reported with a substitute August 5, 2026; the substitute text is not yet published, and the bill has not passed either chamber.
Artificial Intelligence Civil Rights Act of 2025
The AI Civil Rights Act would bar companies from developing or using AI-driven 'covered algorithms' in decisions about jobs, education, housing, utilities, health care, credit, insurance, criminal justice, elections, government benefits or public accommodations in a way that causes a disparate impact or otherwise discriminates based on a protected characteristic. Where harm is plausible, an independent auditor must evaluate the algorithm before deployment, and deployers must assess impacts every year, with summaries made public. The FTC would set rules for human alternatives and appeals. Enforced by the FTC, state attorneys general and private lawsuits. Introduced December 2, 2025.
Acquisition and use of facial recognition technology by government entities prohibited.
Minnesota's HF 3146 would have barred state and local government entities, law enforcement agencies and officials from obtaining, retaining, accessing or using face surveillance systems or their information, or contracting with private entities to do so. Evidence from violations would have been inadmissible, and people could sue for damages of at least $1,000 or $100 per violation, whichever is greater, plus injunctions. Introduced April 7, 2025 and referred to Public Safety Finance and Policy and it never left committee.
Artificial intelligence; age verification systems required for chatbots, safeguard protocols required, therapy chatbot requirements established, private right of action and enforcement provided for
Alabama's HB 324, as introduced, would require AI chatbot deployers to verify the age of every user, keep chatbots with human-like features away from minors (under 19) or offer minors a version without them, adopt protocols for users who express intent to harm themselves or others, and limit the data they collect and store. It would allow licensed psychiatrists to prescribe qualifying therapeutic chatbots to minors, with a private right of action and Attorney General enforcement. Referred to House Judiciary January 22, 2026; the bill died when the 2026 regular session ended without final passage.
A bill for an act relating to the ownership of artificial intelligence output and trained artificial intelligence. (Formerly SSB 3013.)
Iowa's SF 2199 (formerly SSB 3013) would create Code chapter 554J making the user who provides input the owner of an AI's output (if it does not infringe a third party's copyrights or other IP), a lawful trainer the owner of the trained AI, and the employer the owner when the use is within the scope of employment. On the Senate calendar since February 4, 2026; it has not passed either chamber.
Consumer Protection and Product Liability - Chatbots
Maryland's SB 827 (2026, first reader text, cross-filed with HB 1250) would have regulated operators and developers of generative AI chatbots made available to Maryland users: affirmative consent for training on input data, a ban on using chat logs for advertising, a 10-year cap on chat log retention, protections for users under 13, hourly not-human warnings, monthly safety testing, and product liability with possible strict liability. It had a Senate Finance hearing set for March 12, 2026 and died when the 2026 session ended.
Rural health care; Alabama Health Command established to designate an AI-assisted health platform in rural communities
Alabama's SB 97 would create the Alabama Health Command, an independent agency under a director appointed by the Governor, to designate an Alabama-headquartered business to develop a uniform virtual AI-assisted health platform for rural communities. The platform would give consumers health management services such as education, scheduling and navigation to rural providers, without diagnosis or treatment. Rural providers that contract to use it would be exempt from competitive bid laws. Referred to Senate Healthcare on January 13, 2026; the bill died when the 2026 regular session ended without final passage.
Human services: medical services; use of artificial intelligence tools to make decisions regarding claims; prohibit. Amends 1939 PA 280 (MCL 400.1 - 400.119b) by adding sec. 107b.
Michigan's HB 4537 would add section 107b to the social welfare act (1939 PA 280) providing that the department or a contracted health plan shall not deny, modify, or delay a claim under the medical assistance program based on a review using artificial intelligence. Introduced June 3, 2025; re-referred to the House Committee on Communications and Technology March 19, 2026; it has not passed either chamber.
Artificial Intelligence Bill of Rights
Florida's SB 2-D (2026 special session D), the Artificial Intelligence Bill of Rights, would have required companion chatbot platforms to get parental consent before a minor holds an account, required bots to tell users hourly that they are not talking to a human, barred AI companies from selling users' personal information unless deidentified, restricted AI tools in schools, and required AI vendors to government to attest they are not owned, controlled or based in a foreign country of concern. It passed the Senate 37-1 on April 28, 2026, was referred in the House to the Information Technology Budget & Policy Subcommittee, and died there on April 29, 2026. It did not become law.
Prohibits advertising generative artificial intelligence as able to practice regulated profession or occupation.
New Jersey's S4088 would bar developers and deployers of generative AI in the State from advertising or representing to the public that the AI is able to practice a profession or occupation regulated under Title 45, by the Judicial Branch or by the Administrative Office of the Courts. A violation would be an unlawful practice under the consumer fraud act. Introduced May 4, 2026.
Enact Alyssa's Law
Ohio's HB 106 (Alyssa's Law) would appropriate $25,000,000 for fiscal year 2026 (Ohio School Safety Center line item) for the Department of Public Safety to distribute pilot grants to school districts, community schools, STEM schools and chartered nonpublic schools to buy a panic alert system or contract for artificial intelligence firearm detection software. The Department would report on the pilot by December 1, 2027. Introduced February 18, 2025; referred to the House Finance Committee February 26, 2025.
Expressing the sense of the House of Representatives that the Centers for Medicare & Medicaid Services should halt the pilot program and should not jeopardize seniors' access to critical health care by utilizing artificial intelligence to determine Medicare coverage.
The federal H.Res. 694 is a simple House resolution that would express the sense of the House that the Centers for Medicare & Medicaid Services "should not utilize artificial intelligence to determine whether patients' procedures will be covered by Medicare." It recites CMS's June 27, 2025 announcement of a pilot using for-profit contractors and "enhanced technologies" such as AI. It would not change the law or bind CMS. Introduced September 10, 2025 and referred to the House Ways and Means and Energy and Commerce committees; no further action.
State-by-State Regulation of AI Vendor Contracts
Artificial intelligence regulation is advancing at the state level. This page lists the 279 published bills we track on AI Vendor Contracts. State attorneys general, privacy regulators, and legislatures are developing a patchwork of laws that impose different obligations on businesses deploying AI systems related to this topic. Compliance teams and legal counsel must track both enacted laws and the pipeline of pending bills that could shift requirements at any time.
Obligations differ from bill to bill. Depending on the law, they can include consumer disclosure obligations, prohibition on specific high-risk uses, mandatory algorithmic impact assessments, bias audits, rights to explanation, and human override requirements. Penalties for non-compliance vary by state — use our Penalty Tracker to review enforcement provisions. For upcoming effective dates, see the Deadlines page.
To understand how AI Vendor Contracts laws intersect with specific industries, browse our Healthcare, Employment, Insurance, and Financial Services industry trackers. Compare how different state laws approach this topic using our Bill Comparator.