ALABAMA

H172, enacted May 16, 2024, prohibits a person from distributing or entering into an agreement to distribute materially deceptive media. “Materially deceptive media” is “any image, audio, or video” that (1) “depicts an individual engaging in speech or conduct in which the depicted individual did not in fact engage,” (2) “a reasonable viewer or listener would incorrectly believe that the depicted individual engaged in the speech or conduct depicted,” and (3) AI created the media. AI includes any “artificial system or generative artificial intelligence system that performs tasks under varying and unpredictable circumstances without significant human oversight or that can learn from experience and improve performance when exposed to data sets.” A violation occurs if the person knows the media falsely represents someone, the distribution occurs within 90 days before an election, and the person intends to distribute this and cause a particular result. The creator, sponsor, or purchaser must have a disclaimer informing viewers the media has been manipulated. A violation results in criminal penalties.

Attorney General, depicted person, a candidate for office, and an entity that represents the interests of voters, may all seek injunctive relief.

Effective date: October 1, 2024.

Enacted

ALABAMA

SB 63, introduced January 13, 2026 and enacted April 17, 2026, prohibits Alabama health insurers from using AI exclusively in coverage decisions.  The law mandates that all denials or reductions in coverage must be reviewed by a qualified healthcare professional.  If AI is used in some capacity, the health insurer must disclose to enrollees when AI is used in determinations.  There is no private right of action, as only the Department of Insurance has authority to discipline violations.

The law is effective on October 1, 2026.

Enacted

ALABAMA

HB 291, introduced January 20, 2026, criminalizes distributing materially deceptive media created by AI.  The bill would allow the Attorney General or the depicted individuals to seek permanent injunctive relief.  This bill would apply to any person who prepares, creates, or causes the creation or dissemination of AI-generated media, excluding from the bill: broadcasters, cable providers, digital newspapers, online services, Internet service providers, streaming platforms, or technology developers used in the generation of media by AI.

Failed

ALABAMA

HB 324, introduced January 22, 2026, requires AI chatbot providers to impose a “reasonable” age verification process to protect minors, create an alternative non-humanlike version for minors when feasible, have the AI chatbot detect and mitigate emergency or self-harm situations, limit data collection by the chatbot, and allow certain therapy chatbots to be prescribed by psychiatrists for minors.  The bill would create a private right of action, allowing minors or their parents to seek injunctive relief and damages.  The bill also authorizes Attorney General enforcement with civil penalties and injunctive relief.

Failed

ALABAMA

HB 325, introduced January 22, 2026, mandates that any person using AI chatbots in commercial transactions must disclose to consumers from the start and during the interaction that the consumer is interacting with a computer, not a human.  Failure to disclose is deemed an “unfair” and “deceptive” trade practice.  This bill would create a private right of action for consumers, who can sue for injunctive relief and statutory damages up to $1,000 per violation with class action damages capped at $10 million.  The bill also authorized Attorney General enforcement with civil penalties of up to $5 million and other appropriate remedies.

Failed

ALABAMA

HB 327, introduced January 22, 2026, prohibits the use of AI to create a highly realistic, computer-generated digital replica of an individual’s voice or visual likeness for commercial purposes without the written consent of the right holder. Exceptions apply for news broadcasting, commentary, criticism, satire, parody, and First Amendment-protected expression, but none of these exceptions cover AI-generated replicas used to depict sexually explicit conduct. Eligible plaintiffs may seek injunctive relief, actual damages, and punitive damages for knowing violations, with attorney’s fees awarded to the prevailing party.

Failed

ALABAMA

Introduced on April 3, 2025, HB516 provides that the use of a computer to interact with a consumer as part of a commercial transaction in a manner that would deceive the consumer into reasonably believing that the consumer is interacting with a human is an unlawful, deceptive trade practice.

If enacted, the bill would become effective on October 1, 2025.

Failed

ALABAMA

Introduced on February 13, 2025, HB283 authorizes greater  consumer control of their personal data. The act allows consumers to: confirm whether a controller is processing any of the consumer’s personal data, correct any inaccuracies in the consumer’s personal data, direct a controller to delete the consumer’s personal data, obtain a copy of the consumer’s personal data, and opt out of the processing of the consumer’s data for sale or targeted advertising. It regulates the manner in which a controller can process data and requires the controller that possesses data to publicly commit to processing the data in a deidentified manner only. The controller shall document a data protection assessment for any activities that present a risk of harm to consumers, for example: sale of personal data, profiling, sale of data for targeted advertising, etc. There is no private right of action.

If enacted, the bill would become effective on July 1, 2026.

Failed

ALABAMA

SB 129, introduced January 13, 2026, requires AI-developers in Alabama to provide “clear, conspicuous, and unavoidable disclosures” when AI-generated images or videos are produced.  The disclosures must be visible or audible, understandable by a reasonable person, and permanently embedded in the contents or its metadata.  The disclosures must remain intact when content is shared or used by third parties.  AI-developers and third-party licensees must implement procedures to stop disclosures from being removed.  There is a private right action and enforcement actions by the Attorney General, with a 30-day cure period before enforcement begins.  A violation is an “unlawful trade practice.”   

Failed

ALASKA

HB 251, introduced January 20, 2026, amends the definition of “person” in Alaska criminal-law statutes to add entities that have the moral right of self-determination, which explicitly includes artificial intelligence.

Failed

ALASKA

Introduced February 2, 2024, H306 (Senate version S117) would require a disclosure if a person knows or reasonable should know the communication has a deepfake depicting a candidate or political party in a way intended to injure reputation or deceive a voter. The disclosure must state the communication has been manipulated or generated by AI. This disclosure must be easily heard or readable based on the type of media. “Deepfake” includes “an image, audio recording, or video recording of an individual’s appearance, conduct, or spoken words that has been created or manipulated with machine learning, natural language processing, or another computational processing technique of similar or greater complexity in a manner to create a realistic but false image, audio, or video” that (1) “appears to a reasonable person to depict a real individual saying or doing something that did not actually occur” or (2) “provides a fundamentally different understanding or impression of an individual’s appearance, conduct, or spoken words than the understanding a reasonable person would have from an unaltered, original version of the media.”

Failed

ALASKA

Introduced February 20, 2024, H352 would revise the definition of “person” in a civil action to not include AI. This bill would have taken effect July 1, 2024.

Failed

ALASKA

Introduced February 20, 2024, H358 would have provided for a defamation action on the use of synthetic media. More specifically, a person cannot knowingly use synthetic media in an electioneering communication with an intent to impact the election. Otherwise, the harmed individual may recover damages against the person who created the communication or retained services of another to do so, the person who disseminated the communication, or the person who removed the disclosure statement. “Synthetic media” is an “image, audio recording, or video recording of an individual’s appearance, speech, or conduct that is manipulated by artificial intelligence in a manner that creates a realistic but false image, audio recording, or video recording and produces” a certain depiction. The depiction is one a “reasonable person would believe is of a real individual in appearance, speech, or conduct but did not actually occur in reality;” and is “a materially different understanding or impression that a reasonable person would have from the unaltered, original version.”

Failed

ALASKA

Introduced on January 1, 2025, SB33 prohibits a person from using synthetic media in an electioneering communication with the intent to influence an election. The bill provides a private right of action, but allows a defense to such action by including the disclosure statement explicitly spelled out in the bill.  It provides that an individual who is harmed by such communication may bring an action in the superior court to recover damages, reasonable attorney fees, and costs from (1) the person who created the communication or retained the services of another to create the communication; (2) a person who disseminates the communication knowing that the communication includes synthetic media; or (3) person who removes a disclosure statement described in (d) of this section from an election communication with (a) the intention to influence (b) the purpose of the disclosure statement; and provides that the synthetic media constitutes satire

The bill also categorizes defamation claims for involving synthetic media claims as a claim for  defamation per se. The bill is effective upon passage.

Failed

ALASKA

Introduced on January 22, 2025, SB2 is an act governing the disclosure of election-related deepfakes. If a communication is related to a candidate or proposition, it must contain a label (specific text of label in bill) or, if the content is in audio format, a spoken warning. This bill contains a private right of action for any candidate or proposition group about whom a deepfake is made. This bill is effective upon passage.

Failed

ALASKA

S117, introduced January 16, 2024, would have prohibited a person from making or retaining services to make an election-related communication the person “knows or reasonably should know includes a deepfake relating to a candidate or proposition without including” a specified disclosure stating AI has manipulated or generated the content. The disclosure placement and readability are based on the type of media. “Deepfake” constitutes an “image, audio recording, or video of an individual’s appearance, conduct, or spoken words that has been created or manipulated with machine learning, natural language processing, or another computational processing technique in a manner to create a realistic but false image, audio, or video” that a reasonable person would understand to depict a real individual.

Failed

ALASKA

SB 64, introduced January 24, 2025, is an election-reform bill that includes rules for AI-generated political content.  The bill would regulate unlawful interference in elections, including the use of synthetic media generated by AI in electioneering communications used to influence voters.  The bill would ban AI-based content that manipulates a person’s likeness to mislead voters.  If any AI-generated election content is distributed, the bill would require clear disclosures that the media is synthetic.  The bill has a private right of action, allowing individuals to sue for defamation and seek damages.  Enforcement actions by the Division of Elections is also allowed. 

Failed

ARIZONA

Enacted May 12, 2025, HB2175 outlines amendments to Arizona Revised Statutes concerning healthcare insurance. Specifically, it mandates that medical directors at healthcare insurance companies must personally review all denials of claims and prior authorizations that are based on medical necessity. Furthermore, these medical directors are required to exercise independent medical judgment during these reviews, rather than relying solely on external recommendations. This new regulation is set to become effective on June 30, 2026.

Enacted

ARIZONA

HB 2311, introduced January 15, 2026 and passed by both houses by June 13, 2026, mandates that operators of conversational AI services clearly disclose to minors that they are interacting with AI, while also prohibiting the generation of AI-content involving sexual conduct or objectification and misrepresentations that the service is human, not AI.  It further mandates that operators provide minors with appropriate privacy and account-management tools, including enhanced protections for users under 13 and parental controls for users age 13 and older.  In addition, AI services must respond appropriately to prompts indicating suicidal thoughts by directing users to crisis resources and the AI tools cannot claim to offer professional mental-health care.  Violations of the law may result in civil penalties of up to $500,000 per operator, enforceable solely by the Attorney General, with no private right of action available.

On June 19, 2026, the bill was vetoed by the governor.

Failed

ARIZONA

HB 2410, introduced January 20, 2026, amends Arizona Revised Statutes to add a new chapter on artificial intelligence, specifically adding communications with an AI system as “privileged communications” in legal matters.  Privilege is granted if the communication would have been protected had it been made to a human professional.  The purpose of this bill is to allow individuals to share sensitive information to AI tools without fear of disclosure. 

Failed

ARIZONA

HB 2490, introduced January 20, 2026, prohibits landlords from using algorithmic devices, including AI, to process nonpublic competitor data and configurate rental prices, lease renewal terms, or occupancy levels.  The bill would impose a rebuttable presumption that the landlord is engaging in noncompetitive activity if the landlord knowingly uses such data in a market where competitors are present.  The bill would apply to landlords with five or more rental units and coordinators who sell or license algorithmic device outputs.  The bill, therefore, would exclude small landlords with four or fewer units, government-sponsored housing, public housing, educational dormitories, and transient lodging.  The Attorney General has enforcement capabilities.

Failed

ARIZONA

HB 2737, the Arizona ChatBot Protection Act introduced January 20, 2026, imposes restrictions on chatbot providers.  The bill mandates that providers obtain affirmative consent before processing personal data or chat logs and prohibits chatbots from falsely implying endorsement by licensed professionals or misrepresenting user data confidentiality of user information.  The bill requires providers to clearly disclose that users are interacting with a chatbot, conduct monthly risk assessments, and maintain data security measures.  Users must also have the right to access their chat logs.  Under this bill, providers are held liable for injuries caused by their products, and violations may be enforced through both a private right of action–allowing individuals to seek civil penalties, injunctive relief, and damages up to $5,000 per violation–and through enforcement by the Attorney General.

Failed

ARIZONA

HB 4098, introduced February 11, 2026, would apply to businesses that create, sell, or provide access to AI systems that interact with the public and operate using a frontier-level model. Before deploying or selling any high-risk AI system (meaning one that could impact health care, employment, public safety, education, or children, or that risks discrimination or significant privacy violations), businesses must conduct a comprehensive risk assessment, implement bias mitigation measures, and submit a transparency report to the Attorney General, which must also be posted publicly on their website. Businesses would need Attorney General certification before entering the market and must conduct quarterly audits to identify and correct discriminatory or harmful outputs. If the system is accessible to children, parental controls and content filtering are required. The Attorney General can impose civil penalties up to $5,000 for failure to comply.

Failed

ARIZONA

SB 1786, introduced February 5, 2026, would require providers that operate generative AI systems with over one million monthly users that are publicly accessible in the state of Arizona to embed provenance data (digital record of origin and modification history) into any AI generated or materially altered video, image, or audio content before it is shared with users. The provenance data must be made difficult to remove or tamper with, and providers must not include personally identifiable information unless the user affirmatively opts to include it. The bill would not apply to text generated through real time conversational interactions, minor edits like cropping or color adjustments, or platforms primarily selling goods and services online.

Failed

ARIZONA

SB 1815, introduced February 9, 2026, creates a consumer data privacy framework. It would allow consumers to have the right to access, correct, delete, and opt out of targeted advertising, sales, and profiling as a result of AI. The bill would require “controllers,” or businesses and organizations that use AI systems, to provide clear privacy notices to consumers of how their data is being used, to respond to consumer requests within 45 days, and conduct data protection assessments. The law would have prohibited controllers from selling a consumer’s sensitive data without consent. This bill could be enforced by the Attorney General or through consumer appeals, and would have civil penalties.

Failed

ARIZONA

HB 2133, introduced January 12, 2026 and passed by both houses by June 11, 2026, imposes privacy protections.  The bill prohibits the unlawful disclosure of images, including AI-generated synthetic images, that depict nudity or specific sexual activities without consent and without the depicted person’s reasonable expectation of privacy.  Commercial entities must verify informed consent and maintain records for seven years.

As of June 12, 2026, the bill has been transmitted to the Governor for signature.

Proposed (Awaiting Governor’s Signature)

ARKANSAS

HB1876, introduced April 2, 2025, and enacted April 21, 2025, establishes ownership rules for content and trained models generated with AI tools. The person who provides the input or directive to a generative AI tool owns the resulting generated content, and the person who provides data to train a generative AI model owns the resulting trained model, provided the training data is lawfully acquired and ownership has not been contractually transferred. Where an employee is directed by their employer to use a generative AI tool to generate content or conduct model training within the scope of their employment, the resulting content and model belong to the employer as a work-made-for-hire equivalent. In all cases, no ownership rights are granted over content that infringes pre-existing copyrights or other intellectual property rights.

Enacted

CALIFORNIA

AB 316, introduced on January 24, 2025 and enacted October 13, 2025, would prohibit defendants who develop, modify, or use artificial intelligence from claiming that the AI autonomously caused harm as a legal defense in civil actions. The bill defines AI as systems capable of generating outputs that influence environments based on input data. It aims to ensure accountability by preventing developers or users of AI from shifting liability to the technology itself.

Enacted

CALIFORNIA

AB 853, introduced on February 19, 2025 and enacted on October 13, 2025, expands the California AI Transparency Act and delays its operation until August 2, 2026. It requires developers of generative AI systems with over one million monthly users to provide a free AI detection tool that identifies whether content was created or altered by their system. The bill also mandates that, beginning January 1, 2027, large online platforms detect whether any provenance data that is compliant is embedded into or attached to content distributed on the large online platform. Additionally, beginning January 1, 2028 it requires capture device manufacturers to offer users the option to embed provenance disclosures in recorded content. It prohibits platforms from hosting generative AI systems that omit permanent disclosures and bans tools designed to remove such disclosures. There is no private right of action. Penalties include a $5,000 fine per violation.

Enacted

CALIFORNIA

Assembly Bill 325 (AB 325), signed into law on October 6, 2025, significantly amends California’s Cartwright Act (antitrust laws) by making two major changes. First, the law modifies the required standard for pleading antitrust violations, requiring that a complaint contain factual allegations demonstrating that the existence of a contract, combination, or conspiracy to restrain trade is plausible, and explicitly stating that the complaint is not required to allege facts tending to exclude the possibility of independent action. Second, AB 325 introduces new prohibitions related to the use of pricing technologies. Specifically, it is now unlawful for a person to use or distribute a common pricing algorithm as part of a contract, combination, or conspiracy to restrain trade. Furthermore, it is unlawful to use or distribute a common pricing algorithm if the person coerces another person to adopt a price or commercial term recommended by that algorithm for similar products or services within the state. A “common pricing algorithm” is defined as any methodology (including software) used by two or more persons that relies on competitor data to recommend, set, or otherwise influence a price or commercial term.

Enacted

CALIFORNIA

Effective January 1, 2025, California’s AB 3030 regulates the use of generative artificial intelligence (“genAI”) in health care provision. The law requires health facilities, clinics, doctor’s offices, and group practices to disclose when they have used genAI to communicate clinical information about health status to patients. In these circumstances, the law requires both: 1) a disclaimer that the communication was created with genAI, and 2) clear instructions about how the patient can contact a human instead.

There are two exceptions to the disclosure requirements: AI-generated communications read and reviewed by a licensed or certified healthcare provider, and administrative tasks like appointment scheduling, even if AI-assisted.

The law does not include a private right of action.

Enacted

CALIFORNIA

Enacted on October 10, 2025, AB 723 requires real estate brokers and salespersons who use digitally altered images in advertisements or promotional materials for property sales to include a clear disclosure. If the material is posted online, they must also provide the original, unaltered image alongside the altered one. These requirements aim to ensure transparency for prospective buyers. Because violations of the Real Estate Law are crimes, this bill creates a state-mandated local program, and reimbursement procedures apply under the California Constitution.

Enacted

CALIFORNIA

Enacted on October 11, 2025, AB 489 extends existing laws against misleading health care titles to AI systems, requiring disclaimers for AI-generated patient communications and prohibiting AI from using terms that imply licensed professional care. Existing law regulates licensed health care professionals and makes it illegal for unlicensed individuals to use titles or terms implying they are authorized to practice. It also requires health facilities and clinics using generative AI for patient communications to include a disclaimer and provide instructions for contacting a human provider, with violations overseen by the appropriate medical boards. This bill extends those rules to developers and deployers of AI or generative AI, prohibiting the use of terms or phrases that falsely suggest advice or care is coming from a licensed professional. Each violation is treated as a separate offense and falls under the jurisdiction of the relevant health care boards.

Enacted

CALIFORNIA

Enacted on September 17, 2024, AB1836, prohibits commercial use of digital replicas of deceased performers in films, TV shows, video games, audiobooks, sound recordings, etc., without first obtaining the consent of those performers’ estates. 

Enacted

CALIFORNIA

Enacted on September 17, 2024, AB2355 requires that electoral advertisements using AI-generated or substantially altered content feature a disclosure that the material has been altered.   The law will be enforced by the Fair Political Practices Commission. 

Enacted

CALIFORNIA

Enacted on September 17, 2024, AB2602, provides that “a provision in an agreement between an individual and any other person for the performance of personal or professional services is unenforceable only as it relates to a new performance, fixed on or after January 1, 2025, by a digital replica of the individual of the voice or likeness of an individual in lieu of the work of the individual.” 

Enacted

CALIFORNIA

Enacted on September 17, 2024, AB2839 expands the timeframe in which a committee or other entity is prohibited from knowingly distributing an advertisement or other election material containing deceptive AI-generated or manipulated content. 

Enacted

CALIFORNIA

Enacted on September 19, 2024, SB942, the California AI Transparency Act applies to businesses providing a generative AI system with over 1M monthly visitors during a 12-month period that is publicly accessibly within the state’s geographic boundaries. The law requires in-scope businesses to create an AI detection tool that allows a user to query the business about the which content was created by a generative AI system.  Additionally, the law requires these businesses to include in any AI-generated content a visible disclosure that has “clear and conspicuous” as well as appropriate notice based on the content’s medium stating AI has created the content. This disclosure must be understandable to a reasonable person, not avoidable, and consistent with the communication itself.  The law goes into effect on January 1, 2026.

Enacted

CALIFORNIA

Enacted on September 28, 2024, AB 1008 updates the definition of “personal information” as defined in the California Consumer Privacy Act to clarify that “personal information” can exist in various formats, including artificial intelligence (AI) systems that are capable of outputting personal information.

Enacted

CALIFORNIA

Enacted on September 28, 2024, AB2013, requires, on or before January 1, 2026, a developer of an artificial intelligence system or service made available to Californians for use, regardless of whether the terms of that use include compensation, to post on the developer’s internet website documentation regarding the data used to train the artificial intelligence system or service.

The law applies to AI developers, which is defined broadly to mean any person, government agency, or entity that either develops an AI system or service or “substantially modifies it,” which means creating “a new version, new release, or other update to a generative artificial intelligence system or service that materially changes its functionality or performance, including the results of retraining or fine tuning.” The law applies to generative AI released on or after January 1, 2022, and developers must comply with its provisions by January 1, 2026.

Enacted

CALIFORNIA

Enacted on September 28, 2024, AB2885 defines artificial intelligence as “an engineered or machine-based system that varies in its level of autonomy and that can, for explicit or implicit objective, infer from the input it receives how to generate outputs that can influence physical or virtual environments.” The purpose of this definition is to standardize the definition of AI across various California statutes, including the California Business and Professions Code, Education Code, and Government Code.  The law took effect January 1, 2025.

Enacted

CALIFORNIA

Enacted September 7, 2024, AB2655 requires large online platforms to remove or label deceptive and digitally altered or created content related to elections during specified periods, and requires them to provide mechanisms to report such content.  It also authorizes certain enumerated parties, including the Attorney General, to seek injunctive relief for noncompliance.

Enacted

CALIFORNIA

Introduced in 2018 as SB 1001, The Bolstering Online Transparency Act (BOT), went into effect in July 2019. BOT makes it unlawful for a person or entity to use a bot to communicate or interact online with a person in California in order to incentivize a sale or transaction of goods or services or to influence a vote in an election without disclosing that the communication is via a bot. The law defines a “bot” as “an automated online account where all or substantially all of the actions or posts of that account are not the result of a person.”  The law applies only to communications with persons in California. In addition, it applies only to public-facing websites, applications, or social networks that have at least 10 million monthly U.S. visitors or users.   BOT does not provide a private right of action.

Enacted

CALIFORNIA

Introduced Jan. 24, 2025 and enacted October 13, 2025, AB 316 prohibits a defendant from claiming the artificial intelligence they developed or used actually caused the claimed harm to plaintiffs.

Enacted

CALIFORNIA

Introduced on Jan. 30, 2025 and enacted October 13, 2025, SB243 governs interactions between chatbots (enabled by AI) and minors. The bill prohibits chatbots from being used to increase engagement, use, or response rates and requires chatbots clearly and conspicuously display that it is artificially generated, not a human. The bill requires an annual report to the Department of Health Care Services disclosing the number of interactions with a minor where the minor spoke of suicidal ideation.

Enacted

CALIFORNIA

SB 243 was introduced on January 30, 2025 and enacted October 13, 2025. This bill regulates the use of AI-powered companion chatbots, particularly those interacting with minors. The bill requires chatbot platform operators to take reasonable steps to prevent chatbots from encouraging addictive behaviors, such as providing unpredictable rewards or promoting excessive engagement. It also mandates that operators implement protocols for detecting and responding to suicidal ideation, including referrals to crisis services. It requires annual reporting to the Office of Suicide Prevention on incidents of suicidal ideation detected by chatbots, with the data to be published online. Also mandates third-party audits to ensure compliance.

This bill provides a private right of action and permits actual damages or statutory damages of $1,000 per violation, whichever is higher.

Enacted

CALIFORNIA

Signed into law on September 29, 2025, SB 53 the Transparency in Frontier Artificial Intelligence Act is a sweeping regulation requiring large frontier developers to disclose its risk assessment framework to the public and increase responsibility for reporting safety incidents. The transparency component is most notable—the TFAIA requires frontier developers to “write, implement, and clearly and conspicuously publish” a risk assessment framework on its website. This framework must describe how the developer incorporates national/international standards and industry best practices. The public report must also include a mechanism to communicate with the developer, the outputs submitted by the model, the intended uses of the model, and any restrictions or conditions on the use of the model.

It further requires frontier models to report critical safety incidents including “unauthorized access”, loss of control of the model causing in bodily injury or death, or harm resulting from materialization of a catastrophic risk. A catastrophic risk is a foreseeable risk that results in 1) death or bodily injury to 50 or more people or loss of more than $1 billion resulting from: 1) expert level AI assistance in the creation of weapons, 2) a cyberattack, or conduct that would be considered certain felonies if committed by a person, including murder, theft, assault, or extortion , or 3) evading control of the developer or user.

TFAIA provides expanded protections for whistleblowers who report violations of the Act. There is no private right of action under the law. The Attorney General can bring a civil action for failure to comply with the law. The penalty may not exceed $1 million per violation.

Enacted

CALIFORNIA

The California Consumer Privacy Act, as amended by the California Privacy Rights Act (CCPA) governs profiling and automated decision-making. The CCPA gives consumers opt-out rights with respect to businesses’ use of “automated decision-making technology,” which includes “profiling” consumers based on their “performance at work, economic situation, health, personal preferences, interests, reliability, behavior, location or movements.” The CCPA defines “profiling” as “any form of automated processing of personal information, as further defined by regulations pursuant to paragraph (16) of subdivision (a) of Section 1798.185 [of the CCPA], to evaluate certain personal aspects relating to a natural person and in particular to analyze or predict aspects concerning that natural person’s performance at work, economic situation, health, personal preferences, interests, reliability, behavior, location, or movements,” leaving the scope relatively undefined. The CCPA also requires businesses to conduct a privacy risk assessment for processing activities that present “significant risk” to consumers’ privacy or security. “Significant risk” is not defined by the CCPA but may be fleshed out by the regulations.

As of the date of publication, regulations addressing automated decision-making have not been finalized.

Enacted

CALIFORNIA

AB 1609, introduced January 20, 2026, aims to require large private businesses to provide a customer service feature allowing consumers to contact a customer service agent for at least 10 hours per day during its regular business hours.

Proposed

CALIFORNIA

AB 1963, introduced February 13, 2026, would prohibit a landlord from rejecting an applicant based solely on a decision suggested by an artificial intelligence tool that is not derived from factors empirically related to the tenants ability to fulfill their obligations as a tenant or is not periodically tested to ensure it does not produce a disparate impact on members of a protected class under the FHA.

Proposed

CALIFORNIA

AB 2025, introduced February 17, 2026, seeks to require digitally altered images contained in an advertisement or other promotional material for the rental of real property to include a disclosure. Additionally, if such material is posted on the internet, the bill requires the same image without digital alteration to be included unless the image or rendering was not originally created through the use of a capture device.

Proposed

CALIFORNIA

AB 2027, introduced February 17, 2026, prohibits employers from using, or otherwise selling or disclosing, a workers’ personal information to train an artificial intelligence system to automate or replace a worker’s job. Similarly, the bill also prohibits vendors from providing services to an employer under a contract to engage in such conduct.

Proposed

CALIFORNIA

AB 2169, also known as the Digital Choice Act, was introduced on February 18, 2026. The proposed legislation seeks to require a social media company or person that makes an AI model available to a third party for use–a “deployer” –to provide consumers with a copy of their personal information and other data within five business days of the consumer’s request. A social media company violating the chapter will be liable for an administrative fine of up to $2,500 per violation or up to $7,500 for each intentional violation.

Proposed

CALIFORNIA

AB 2403, introduced February 20, 2026, excludes commercials created entirely with generative AI, or those utilizing AI in a manner that significantly replaces or diminishes human job functions, from qualifying for specified motion picture tax credits for productions beginning January 1, 2027 and January 1, 2032.

Proposed

CALIFORNIA

AB 2653, introduced February 20, 2026, seeks to expand the  Transparency in Frontier Artificial Intelligence Act by expanding the definition of a “frontier model” to include foundational models.

Proposed

CALIFORNIA

AB 2713, introduced February 20, 2026, modifies the California AI Transparency Act to require large online platforms to detect any system provenance data including whether such data or digital signature is embedded into, or otherwise associated with, content as specified. The bill would further require large online platforms to allow users to inspect the data by any of the three means of inspection contained in the revised bill; and prohibit these platforms from knowingly stripping provenance data or a digital signature that is downloaded from it.

Proposed

CALIFORNIA

AB 410, introduced on February 4, 2025, strengthens bot disclosure requirements. It mandates that any person using a bot to autonomously communicate online must ensure the bot clearly discloses its non-human identity at the start of the interaction, truthfully answers questions about its identity, and does not mislead users. The bill redefines “bot” to include generative AI outputs and applies to bots that could reasonably be mistaken for humans. It also authorizes civil enforcement by state and local prosecutors, there is no private right of action. Penalties include a $1,000 fine per violation

Proposed

CALIFORNIA

AB 412, introduced on February 4, 2025, requires developers of generative AI models to document any copyrighted materials used in training and provide a public mechanism for rights holders to request this information and developers must respond within 30 days. Each day of noncompliance constitutes a separate violation, and rights holders may pursue civil action.

If enacted, the law would apply to AI systems made available in California on or after January 1, 2026.

Proposed

CALIFORNIA

AB1979, introduced February 13, 2026, would require healthcare entities and practitioners to ensure no clinical decision is based solely on a clinical decision support system (utilizing AI); a licensed health care professional must review and approve all decisions based on the output of such system. The bill further clarifies that while healthcare entities must disclose the use of generative AI in certain patient-related communications, those requirements do not restrict the use of AI for routine documentation or communications not involving professional medical judgment.

Proposed

CALIFORNIA

Introduced February 12, 2026, AB1883 is designed to strictly regulate how employers use workplace surveillance tools and manage worker data. For private sector businesses, the bill prohibits the use of surveillance technologies that incorporate emotion recognition, gait recognition, or neural data collection. Facial recognition is also generally prohibited from being used to make inferences about a worker for firing, deactivation, or disciplinary purposes. Furthermore, the bill forbids using surveillance to profile protected legal activities or to infer a worker’s protected status, such as their religious beliefs, disability status, veteran status, or ancestral history. The scope of the bill is broad, defining “worker” to include both employees and independent contractors, and “surveillance tools” to include video/audio monitoring, geolocation, and continuous time-tracking systems.

Enforcement would be handled by the Labor Commissioner, though public prosecutors and individual workers also have the right to bring civil actions for damages. Employers found in violation could face civil penalties of up to $500 per employee for each violation, in addition to potential punitive damages and attorney’s fees.

Proposed

CALIFORNIA

Introduced on Feb. 4, 2025, AB410 would make it unlawful for anyone to use a bot to communicate or interact online with someone in California.  The bill defines a bot as an automated online account, including one powered by generative AI. The individual using a bot can avoid liability by disclosing that the bot is a bot and not a human.

Proposed

CALIFORNIA

Introduced on February 12, 2026, AB 1898, establishes the “Artificial Intelligence Transparency at Work” act to regulate the use of AI in California workplaces. The bill requires employers to provide written notice to workers when workplace AI tools—defined as automated decision systems or workplace surveillance tools—are used to assist in employment-related decisions or to monitor the workplace. These notices must be delivered in plain language at least 90 days before a tool is deployed, or by February 1, 2027, for tools already in use. The notice must disclose comprehensive details, including the tool’s purpose, the specific data collected, the analysis it performs, any quotas it measures, and whether the technology is expected to replace or automate existing job tasks.

Furthermore, the bill mandates that employers maintain an updated list of all workplace AI tools currently in use and provide this list to workers annually. The legislation grants enforcement authority to the Labor Commissioner and public prosecutors, while also allowing affected workers to file civil actions for damages. Violations may result in penalties of up to $500 for each instance, and courts may award punitive damages and attorney’s fees.

Proposed

CALIFORNIA

Introduced on February 14, 2025, SB 384 prevents sellers from using a price fixing algorithm to set the price or supply of goods or the rent or occupancy levels of a rental property.

There is no private right of action. Violations of this law can result in a $1,000 fine per violation.

Proposed

CALIFORNIA

Introduced on February 18, 2026, SB1146 seeks to regulate the use of digital replicas and synthetic performers in advertisements for health-related consumer products and services. The bill mandates that any advertisement utilizing an image, audio, or video of a natural person that is generated or substantially altered using AI or other computer technology must include a “clear and conspicuous” disclosure. This requirement applies to media that is either entirely created by AI and appears authentic or is materially altered in a way that fundamentally changes a reasonable person’s understanding of the content. Minor adjustments, such as color editing, cropping, or resizing, are considered immaterial and do not require this disclosure.

The bill outlines specific standards for these disclosures: visual media must feature prominent and readable text, which must remain visible for the entire duration of a video, while audio media requires clearly spoken disclosures at the beginning, the end, and at least every two minutes for longer recordings. Enforcement of these rules is conducted exclusively through civil actions brought by the Attorney General or a district attorney; the bill specifically does not create a private right of action for individuals, nor is a violation considered a misdemeanor. Furthermore, the legislation clarifies that it does not authorize the use of a person’s likeness without their consent or alter existing immunities for interactive computer service providers under federal law.

Proposed

CALIFORNIA

Introduced on February 18, 2026, SB1159 proposes to amend the California Government Code to clarify that artificial intelligence (AI) systems do not qualify as “persons” under several key state transparency and governance laws. The bill specifies that terms such as “person,” “interested person,” “participant,” and “member of the public” apply only to natural persons and legally recognized human entities, explicitly excluding AI systems, autonomous agents, and robots. This change affects foundational California acts, including the California Public Records Act, the Bagley-Keene Open Meeting Act, the Ralph M. Brown Act, the Political Reform Act of 1974, the Administrative Procedure Act, and the California Environmental Quality Act (CEQA).

The legislative intent behind SB-1159 is to protect the integrity of democratic processes from being overwhelmed by automated systems capable of generating mass public records requests or public comments at scales far exceeding human capacity. The Legislature finds that while AI can simulate human interaction, it lacks the consciousness, moral agency, and deliberative judgment essential for participation in a political community. By making this distinction, the bill aims to prevent the diversion of limited public resources toward processing machine-generated interactions and to ensure that government agencies remain responsive to genuine human constituents rather than automated simulations.

Proposed

CALIFORNIA

Introduced on February 18, 2026, SB1181 focuses on the growing impact of artificial intelligence (AI) and digital technologies on the mental health of children and adolescents in California. The bill highlights that AI-driven platforms and algorithmic systems increasingly shape the online experiences of youth, which the Legislature recognizes can lead to significant negative mental health outcomes. These concerns include the potential for AI to contribute to anxiety, depression, addictive behaviors, and suicidal ideation.

The primary intent of this legislation is to protect the safety and well-being of California’s youth by ensuring that technological innovation does not come at the expense of their development. The bill seeks to establish a balance between supporting technological advancements and maintaining responsibility for their effects on younger generations. By addressing these digital influences, the Legislature intends to enact future legislation that safeguards the mental health of children and adolescents across the state.

Proposed

CALIFORNIA

Introduced on February 20, 2026, AB2564 seeks to protect consumers by prohibiting retailers from engaging in “surveillance pricing”. This practice is defined as setting customized prices for specific individuals or groups based on personally identifiable information (PII) collected through electronic surveillance technology, such as sensors, cameras, or device tracking. The bill clarifies that this includes data gathered directly or acquired from third parties, though it excludes random price variations on websites or discounts offered to customers who are attempting to terminate a service or membership.

The bill outlines several exceptions, allowing for price differences based solely on the cost of providing a good or through publicly disclosed discounted prices available to any consumer meeting specific criteria, such as joining a mailing list or belonging to a broad group like seniors, students, or veterans.

Enforcement is primarily conducted by public prosecutors, who can seek civil penalties of up to $12,500 per violation, which may be tripled for intentional violations. Furthermore, consumers are authorized to sue for injunctive relief, and the bill declares that any waiver of these protections is void and against public policy.

Proposed

CALIFORNIA

Introduced on February 20, 2026, AB2575 establishes a regulatory framework for the use of artificial intelligence (AI) and clinical decision support systems in California healthcare facilities. The bill mandates that health facilities, clinics, and physician offices provide comprehensive disclosures to any healthcare professional using these tools, detailing the developer, training data, known biases, and potential risks. Central to the bill is the protection of professional judgment; it declares that workers providing direct patient care must be free to make assessments appropriate for their patients and are explicitly permitted to override AI outputs. Consequently, employers are prohibited from using technology to replace a worker’s judgment and are barred from retaliating or discriminating against employees who either choose to override AI or who rely in good faith on technology approved by the employer.

Beyond workplace protections, the bill addresses legal liability and patient transparency. It prohibits defendants who develop or deploy AI from asserting that a healthcare worker’s failure to override the technology is a “superseding cause” that clears the defendant of liability for harm. Patients must also receive plain-language disclosures if AI influenced their care or used their health information, with these notices linked directly to their health records.

Enforcement is divided among several entities: the Labor Commissioner handles worker complaints regarding retaliation, while disclosure violations are subject to oversight by the Medical Board of California and can be prosecuted as unfair competition.

Proposed

CALIFORNIA

SB 1000, introduced February 9, 2026, seeks to modify the California AI Transparency Act by deleting the user threshold from the definition of covered provider, replacing the term “AI detection tool” with “disclosure verification tool,” removing the requirement that a covered provider offer a user the option to include a manifest disclosure in content, and additionally requiring a covered provider to include in a latent disclosure whether the GenAI system created or altered the content.

Proposed

CALIFORNIA

SB 1050, introduced February 12, 2026, aims to require advertisements prominently containing a synthetic performer to give a clear and conspicuous disclosure that the advertisement includes a synthetic performer.

Proposed

CALIFORNIA

SB 1074, introduced February 13, 2026, seeks to amend the Cartwright Act by prohibiting covered providers from favoring their own products or services over those of other businesses, including through manipulated search rankings. It also requires providers to allow users and businesses to access and transfer their data in a usable, portable format. The bill makes its remedies cumulative and enforceable under the same framework as the Cartwright Act.

Proposed

CALIFORNIA

SB 1103, introduced February 13, 2026, would include artificial intelligence-driven analytics within the surveillance data required to be reported to the Attorney General by large home improvement retailers under circumstances relating to immigration enforcement activity.

Proposed

CALIFORNIA

SB 1111, introduced February 17, 2026, aims to clarify civil and criminal liability for the use of digital replicas by establishing that a person’s voice or likeness qualifies as a digital replica and that using one to impersonate another can constitute false impersonation. The bill would also eliminate the existing rebuttable presumption based on the use of an employee’s likeness in advertisements or publications.

Proposed

CALIFORNIA

SB 1119, introduced February 17, 2026, would require operators of a companion chatbot to perform an annual risk assessment as to child safety on the platform and submit an independent audit of compliance with such provisions as promulgated by the Digital Age Assurance Act no later than July 1, 2027.

Proposed

CALIFORNIA

SB 1276, introduced February 20, 2026, aims to expand the Child Abuse and Neglect Reporting Act by broadening the definition of sexual exploitation online to include any digitally altered or artificial-intelligence-generated matter that depicts a person under 18 years of age engaged in an act of sexual conduct.

Proposed

CALIFORNIA

SB 300, titled “Companion Chatbots,” was introduced on February 10, 2025. The legislation aims to close gaps in existing AI laws by holding operators to a “actual knowledge” standard regarding the age of their users, thereby increasing their responsibility to protect minors from harmful content. Beyond banning the production of sexually explicit material, the bill prevents AI platforms from facilitating the exchange of such content or proposing sexual conduct to children. It also requires operators to maintain protocols to prevent suicide or self-harm, provide a crisis hotline referral in certain situations, and publish details of those protocols publicly.

Proposed

CALIFORNIA

SB 468, introduced on February 19, 2025, would require businesses deploying high-risk artificial intelligence systems that process personal information to implement a comprehensive information security program. This program must include administrative, technical, and physical safeguards tailored to the business’s size and scope. It also mandates employee training, risk assessments, access controls, encryption, and incident response protocols. It also states any violation of the duties set forth in the bill constitute a deceptive trade act or practice under the Unfair Competition Law. The bill grants the California Privacy Protection Agency authority to enforce these provisions and adopt implementing regulations, there is no private right of action.

Proposed

CALIFORNIA

SB 503, introduced on February 19, 2025, focuses on the use of generative artificial intelligence in healthcare. Existing law requires health facilities, clinics, and physician offices using generative AI for patient communications to include disclaimers and clear instructions for contacting a human provider.

This bill mandates that developers and deployers of those patient care decision support tools identify and mitigate risks of discrimination based on protected characteristics. Further, the bill would require that beginning January 1, 2027, developers to provide an annual report identifying their efforts to comply with the required provisions.

There is no private right of action.

Proposed

CALIFORNIA

SB 867, introduced January 5, 2026, seeks to prohibit the manufacture, sale, or exchange to a retailer a toy that includes a companion chatbot under January 1, 2031.

Proposed

CALIFORNIA

SB 903, titled “Mental health professionals: artificial intelligence” was introduced on January 21, 2026. The legislation aims to protect individuals seeking psychotherapy services by ensuring these services are delivered by licensed professionals. The bill expands existing legislation by prohibiting the use of AI by any individual or organization to record or transcribe psychotherapeutic communications or sessions to screen patients unless the patient or their authorized representative is informed of the AI use and consents to it. Each violation is subject to the jurisdiction of the appropriate health care professional licensing board or enforcement agency and would authorize those boards and enforcement entities to pursue remedies authorized by law.

Proposed

CALIFORNIA

The California Worker Technological Displacement Act (SB 951), introduced on February 2, 2026, seeks to require certain employers to provide at least 60-day advanced written notice before any technological displacement affecting workers. Such notice would be provided to the affected workers, the Employment Development Department, and specified location entities. Additionally, the bill would require employers to provide a written technology hiring disruption notice to the EED when executing a technological cessation in hiring caused in whole by the adoption of AI or similar automating technology.

Employers would further be prohibited from discharging a worker affected by a technological displacement without reasonable and substantiated cause within the 60-day notice period.

Proposed

CALIFORNIA

The Digital Dignity Act (SB 1142), introduced February 18, 2026, would impose liability on individuals who knowingly distribute content containing a digital replica when used for criminal false impersonation or in related civil actions.

Proposed

CALIFORNIA

The Preventing AI User Self Endangerment (PAUSE) Act (AB 1988), introduced February 13, 2026, seeks to require operators of companion chatbots to adopt and make publicly available a policy governing its protocols for identifying and responding to ‘credible crisis expressions’ by its users. Additionally, the bill would require operators to employ a suspension of conversational outputs from companion chatbots in response to a credible crisis expression by a user.

Proposed

CALIFORNIA

Introduced February 15, 2024, SB1229 would require property and casualty insurers to disclose until January 1, 2030, if it has used AI to make decisions that affect applications and claims review, as specified.

Failed

CALIFORNIA

Introduced on Dec. 2, 2024, SB11 sets requirements for sellers and providers of AI.  Effective Dec. 1, 2026, the bill would require any person or entity who sells or provides AI technology that makes synthetic content to provide a consumer warning that the misuse of the technology can result in civil or criminal liability. There is no private right of action for this provision, and violations are penalized up to $25,000 a day.

The bill goes on to define restricted uses of the name, image, and likeness of another without consent and establishes a claim of damages for violations.

Failed

CALIFORNIA

Introduced on December 2, 2024, SB 7 requires employers to provide written notice to employees when an automated decision making system (ADS) is used to make employment related decisions, excluding hiring decisions. The worker subject to the ADS decision must be given 30 days to appeal the decision.

There is a private right of action. Civil penalties of $500 per violation are available.

Failed

CALIFORNIA

Introduced on Feb. 16, 2024, AB3211 seeks to provide context (called provenance) around synthetic media. The bill would require generative AI providers to mark the content with provenance data noting the synthetic nature of the content, the name of the generative AI provider, and identifying the portions of the content that are synthetic. The bill would further require a public facing tool that allows users to determine whether and how a piece of content was modified.

The bill has specific requirements for large online platforms, defined as public-facing social media platform, video-sharing platform, messaging platform, advertising network, or standalone search engine and had at least 2,000,000 monthly CA users during the past year. These platforms must label content when provenance data is available, display that data, and provide an annual transparency that identifies deceptive synthetic media on the platform.

There is no private right of action. Violations of this bill would result in $25,000 fine per violation. Enforcement would begin July 1, 2026.

Failed

CALIFORNIA

Introduced on February 15, 2024, AB 2930, would, among other things, require an entity that uses an automated decision tool (ADT) to make a consequential decision (deployer), and a developer of an ADT, to, before first using it, and annually thereafter, perform an impact assessment for any ADT used that includes, among other things, a statement of the purpose of the ADT and its intended benefits, uses, and deployment contexts.  The bill requires a deployer or developer to provide the impact assessment to the Civil Rights Department within 60 days of its completion. Before using an ADT to make a consequential decision deployers must notify any natural person that is the subject of the consequential decision that the deployer is using an ADT to make, or be a controlling factor in making, the consequential decision. Deployers are also required to accommodate a natural person’s request to not be subject to the ADT and to be subject to an alternative selection process or accommodation if a consequential decision is made solely based on the output of an ADT, assuming that an alternate process is technically feasible.  This bill would also prohibit a deployer from using an ADT in a manner that contributes to algorithmic discrimination.   AB2930 is nearly identical to AB331, which advanced from the House Committee on Privacy and Consumer Protection in 2023, but notably does not include a private right of action as AB331 did.

The proposed reintroduction by Assemblywoman Bauer Kahen incorporates AB 2930 with additions. The new bill allows persons subject to an ADS (automated decision system) to appeal the results of that decision and correct any personal information used in the decision.

Unlike AB 2930, this version of the bill would require developers’ impact assessments by developers that use ADS to render consequential decisions for 5999 people or more in a three year period. These reports, prepared by an auditor, need to be furnished to the Attorney General within 30 days of the Attorney General’s request.

If approved, this bill would become operative on Jan. 1, 2027. There is no private right of action.

Failed

CALIFORNIA

Introduced on January 25, 2024, SB970, this bill would require any person or entity that sells or provides access to any artificial intelligence technology that is designed to create content to provide a consumer warning that misuse of the technology may result in civil or criminal liability for the user. The bill would require the Department of Consumer Affairs to specify the form and content of the consumer warning and would impose a civil penalty for violations of the requirement. Failure to comply with consumer warning requirement would be punishable by a civil penalty not to exceed twenty-five thousand dollars ($25,000) for each day that the technology is provided to or offered to the public without a consumer warning.

Failed

CALIFORNIA

Introduced on January 30, 2023, AB 331, would, among other things, require an entity that uses an automated decision tool (ADT) to make a consequential decision (deployer), and a developer of an ADT, to, on or before January 1, 2025, and annually thereafter, perform an impact assessment for any ADT used that includes, among other things, a statement of the purpose of the ADT and its intended benefits, uses, and deployment contexts.  The bill requires a deployer or developer to provide the impact assessment to the Civil Rights Department within 60 days of its completion. Before using an ADT to make a consequential decision deployers must notify any natural person that is the subject of the consequential decision that the deployer is using an ADT to make, or be a controlling factor in making, the consequential decision. Deployers are also required to accommodate a natural person’s request to not be subject to the ADT and to be subject to an alternative selection process or accommodation if a consequential decision is made solely based on the output of an ADT, assuming that an alternate process is technically feasible.  This bill would also prohibit a deployer from using an ADT in a manner that contributes to algorithmic discrimination.

Finally, the bill includes a private right of action which would open the door to significant litigation risk for users of ADT. 

This bill has been reintroduced by Assemblywoman Bauer Kahen bill number pending.

Failed

CALIFORNIA

SB892, introduced on January 1, 2024, would impact businesses entering into a contract with state agencies to provide artificial intelligence services by prohibiting such a contract unless the business met California’s Department of Technology safety, privacy, and nondiscrimination standards relating to artificial intelligence services. The Department of Technology to date has not promulgated these standards.

Failed

CALIFORNIA

The Safe and Secure Innovation for Frontier Artificial Intelligence Systems Act, SB 1047, introduced February 7, 2024, would in general authorize an AI developer of a covered model that is nonderivative to determine if the model qualifies for a limited duty exemption before training on that model can begin. The “limited duty exemption” would apply to a covered AI model defined by this bill that the develop can provide reasonable assurance the model does not, and will not, possess a hazardous capability. “Hazardous capability” means  the model creates or uses a “chemical, biological, radiological, or nuclear weapon in a manner that results in mass casualties”; causes at least $500,000,000 “of damages through cyberattacks on critical infrastructure via a single incident” or related incidents; causes at least $500,000,000 of damages by engaging in bodily harm to another human or theft of, or harm to, property with the requisite mental state; and other comparable “grave threats in severity to public safety and security.” Before starting training, the developer must meet specified requirements, such as the capability to promptly shutdown, until the model falls under the limited duty exemption. If an incident occurs, the developer must report each AI safety incident to the Frontier Model Division, a subdivision of the Department of Technology.

Failed

CALIFORNIA

AB 1018, introduced on February 21, 2025, regulates the development and deployment of automated decision systems (ADS) used to make consequential decisions such as decisions about: employment, education and vocational training, housing and lodging, essential utilities, family planning, health care, financial services, criminal justice, legal services, mediation/arbitration, elections, government benefits/penalties, places of public accommodation, insurance, and internet/telecommunications access. Beginning January 1, 2027, deployers of covered ADS must provide disclosures to individuals affected by such systems, offer opt-out and appeal options, and submit the systems to third-party audits.

Developers must conduct impact assessments and share results with deployers. Upon request, developers, deployers, or auditors must provide unredacted evaluation reports to the Attorney General.

There is no private right of enforcement and penalties for violations of up to $25,000 per violation are available.

Failed/2-year bill

CALIFORNIA

Introduced Feb. 6, 2025, SB295 the Preventing Algorithmic Collusion Act would prevent a person from using or distributing a pricing algorithm that uses, incorporates, or was trained with competitor data with two or more people to set the price of a product. The bill also gives the attorney general power to request a written report detailing the owner and use of the price setting algorithm, the data entered in the pricing algorithm, and the rules the algorithm relies on.

There is no private right of action, and a violation is punishable by a fine of $5,000 a day.

Failed/2-year bill

CALIFORNIA

Introduced on February 6, 2025, AB 446 regulated the use of algorithmic decisions in dynamic pricing. This practice, known broadly as surveillance pricing involves collecting individualized, unspecified data about consumers, then using that information to charge a personalized price for a product that differs from the standard price. The bill prohibits the use of individualized or aggregate consumer information in setting a price.

The bill exempts certain pricing structures, including situations where the price difference reflects the cost to the supplier in supplying the product to different consumers and when the price difference is a discount, generally available to all consumers.

The bill includes a private right of action with penalties up to the maximum available in small claims court. Treble damages are available if the violation was done knowingly.

Failed/2-year bill

COLORADO

Enacted May 17, 2024, SB24-205 (the Colorado AI Act), requires both a developer and a deployer of a high-risk artificial intelligence system (high-risk system) to use reasonable care to avoid algorithmic discrimination in the high-risk system. Originally slated for February 1, 2026, the effective date was delayed to June 30, 2026, by a special legislative session in August 2025, following calls from the governor to fine-tune the law. The amendment delaying implementation was signed on August 28, 2025. Further attempts to amend the AI Act are expected during the regular legislative session, which begins January 2026.

“High-risk artificial intelligence system” means any AI system that, when deployed, makes, or is a substantial factor in making, a consequential decision. 

“Consequential decisions” involve major impacts on a consumer’s access to education, employment, financial services, healthcare, housing, insurance, and legal services.

“Algorithmic discrimination” is when an AI system materially increases the risk of unlawful differential treatment or impact on an individual or group on the basis of certain protected classes like age, color, disability, ethnicity, race, religion, or sex.

A developer is a person doing business in Colorado who develops or substantially modifies certain AI models or systems, while a deployer is a person doing business in Colorado who deploys certain AI systems.

There is a rebuttable presumption that a developer used reasonable care if the developer complied with certain provisions of the law, including:

o   Making available to a deployer of the high-risk system information and documentation necessary to complete an impact assessment of the high-risk system;

o   Making a publicly available statement summarizing the types of high-risk systems that the developer has developed and how reasonably foreseeable risks of discrimination are managed;

o   Disclosing certain reasonably foreseeable risks of discrimination to the AG and deployers within 90 days after discovery of the risk.

There is a rebuttable presumption that a deployer used reasonable care if the deployer complied with certain provisions of the law, including:

o   Implementing a risk management policy and program for the high-risk system;

o   Completing an impact assessment of the high-risk system;

o   Making a publicly available statement summarizing the types of high-risk systems that the deployer has deployed and how reasonably foreseeable risks of discrimination are managed;

o   Disclosing certain reasonably foreseeable risks of discrimination to the AG within 90 days after discovery of the risk.

A developer or business that makes available an AI system that is intended to interact with customers must disclose the consumer is interacting with an AI system.

There is no private right of action – the AG is exclusively responsible for enforcement. Violations are considered unfair trade practices and can result in fines up to $20,000 per violation. However, a developer or deployer has an affirmative defense if their system involved in the violation complies with federal or internal law and the developer or deployer has taken specified measures to discover any violations of the Colorado AI Act.

Enacted

COLORADO

Enacted on May 24, 2024, HB1147, creates a statutory scheme to regulate the use of deepfakes produced using generative artificial intelligence in communications about candidates for elective office. The law prohibits the distribution of a communication that includes an undisclosed deepfake with actual malice as to the deceptiveness or falsity of the communication related to a candidate for public office.  Violators will be subject to civil penalties.  Additionally, a candidate who is the subject of a communication that includes a deepfake and does not comply with the disclosure requirements may bring a civil action for injunction or for general or special damages or both.

Enacted

COLORADO

HB26-1139, introduced February 4, 2026, and enacted June 2, 2026, regulates the use of AI in health care utilization review, allowing AI to assist with the process (including expedited approvals) but prohibiting any denial of coverage based on medical necessity from being issued solely on AI output without review and approval by a licensed clinician or physician. AI systems used for utilization review must base determinations on individual patient data, must not discriminate in violation of state or federal law, and must be fairly and equitably applied. The bill also prohibits carriers from providing coverage for psychotherapy services conducted directly by an AI system, though this does not apply to non-therapeutic tools like billing software, EHR platforms or video platforms used incidentally to humna-provided care.

This law takes effect on January 1, 2027.

Enacted

COLORADO

HB26-1195, introduced February 11, 2026, and enacted June 3, 2026, restricts how licensed psychotherapists and AI developers may use AI in the context of psychotherapy. Therapists may use AI for administrative tasks and supplementary support but may not allow AI to engage in therapeutic communication with a client unless the therapist is synchronously present in real time, and may not allow AI to generate treatment plans or therapeutic recommendations without the therapist’s review and approval. Using AI to record or transcribe sessions requires advance written consent from the client. On the developer side, AI systems may not be marketed or presented as providing licensed psychotherapy services and may not misrepresent that user data is protected in a manner equivalent to therapist-client confidentiality. Wellness tools that do not diagnose or treat mental health disorders and clearly disclose they are not a substitute for clinical care are exempt.

This law takes effect August 12, 2026.

Enacted

COLORADO

In 2021, Colorado enacted SB 21-169, Protecting Consumers from Unfair Discrimination in Insurance Practices, a law intended to protect consumers from unfair discrimination in insurance rate-setting mechanisms. The law applies to insurers’ use of external consumer data and information sources (ECDIS), as well as algorithms and predictive models that use ECDIS in “insurance practices,” that “unfairly discriminate” based on race, color, national or ethnic origin, religion, sex, sexual orientation, disability, gender identity, or gender expression.

On February 1, 2023, the Colorado Division of Insurance (CDI) released a draft of the first of several regulations to implement the law.

On September 21, 2023, the CDI adopted Regulation 10-1-1 – Governance and Risk Management Framework Requirements for Life Insurers. The regulation governs the use of algorithms and predictive models that use external consumer data and information sources (ECDIS). Among other things, the regulation requires all Colorado-licensed life insurers to submit a compliance progress report on June 1, 2024, and an annual compliance attestation beginning on December 1, 2024.

Enacted

COLORADO

Introduced on February 19, 2026, HB1263 imposes consumer protection requirements for operators of conversational artificial intelligence services, particularly when those services are used by minors.  The act requires AI operators to clearly disclose users are interacting with AI, restrict engagement-based incentives for users below 18, and implement safeguards to prevent sexually explicit content and simulated emotional dependence.  The act also mandates protocols for handling user prompts related to suicide or self-harm.  Violations are treated as deceptive trade practices under the Colorado Consumer Protection Act and may result in civil penalties of up to $1,000 per violation. 

The act is effective January 1, 2027.

Enacted

COLORADO

SB 4 or SB25B004, Increase Transparency for Algorithmic Systems, was enacted August 28, 2025.  It imposes transparency and anti‑discrimination requirements on developers and deployers of high‑risk artificial intelligence systems. Developers must supply detailed documentation—including model cards or impact assessments—and disclose any known or reasonably foreseeable risks to both the attorney general and system deployers. Deployers, in turn, are obligated to maintain risk‑management policies, complete annual impact assessments, and report any detected algorithmic discrimination to the attorney general. The act also requires clear disclosure to consumers when they are interacting with an AI system and provides limited exemptions for proprietary information and attorney‑client communications.

All provisions take effect on June 30, 2026. 

Enacted

COLORADO

SB26-189, introduced May 1, 2026, requires deployers of covered automated decision making technology (ADMT) to notify consumers at or before using such technology in consequential decisions across high stakes domains (employment, housing, credit, insurance, healthcare, education, and government benefits), and to provide post-adverse outcome disclosures (including the role the ADMT played in the data used, and how to exercise consumer rights) within 30 days of an adverse decision. Consumers have the right to request correction of inaccurate personal data and meaningful human review of adverse outcomes. Developers must provide deployers with documentation on intended uses, limitations, training data categories, and material updates. The law is enforced under the Colorado Consumer Protection Act, and it takes effect January 1, 2027.

Enacted

COLORADO

The Colorado Privacy Act (CPA), which went into force on July 1, 2023, provides consumers the right to opt-out of the processing of their personal data for purposes of “profiling in furtherance of decisions that produce legal or similarly significant effects.” The law defines those decisions as “a decision that results in the provision or denial of financial and lending services, housing, insurance, education enrollment or opportunity, criminal justice, employment opportunities, health care services, or access to essential goods or services.”  The CPA further requires that controllers conduct a data protection impact assessment (DPIA) if the processing of personal data creates a heightened risk of harm to a consumer.  Processing that presents a heightened risk of harm to a consumer includes profiling if the profiling presents a reasonably foreseeable risk of:

• Unfair or deceptive treatment of, or unlawful disparate impact on, consumers;


• Financial or physical injury to consumers;


• A physical or other intrusion upon the solitude or seclusion, or the private affairs or concerns, of consumers if the intrusion would be offensive to a reasonable person; or


• Other substantial injury to consumers.

All of which means that deployers of automated-decision making (which may or may not use AI) need to ensure that their design and implementation do not create the heightened risks outlined above, and are included in their DPIA. On March 15, 2023, the Colorado Attorney General’s Office finalized rules implementing the CPA.

Enacted

COLORADO

25SB-1008, introduced August 25, 2025, would require AI developers and deployers to disclose to consumers when they are interacting with AI rather than a human, imposing a duty to avoid algorithmic discrimination on high-risk AI systems. It also would bring AI use within the scope of the Colorado Consumer Protection Act.

Failed

COLORADO

As the regulatory landscape for AI continues to evolve, Colorado is considering significant changes to its recently enacted AI Act.  Senate Bill 318 – which follows nearly a year-long effort by the state’s Artificial Intelligence Impact Task Force to address concerns that the AI Act was so far-reaching that it would stifle innovation – would overhaul the AI Act narrowing its focus and materially reducing the compliance burden on in-scope businesses.

Key Proposed Changes:

•           Revised Definitions: The bill amends several key definitions.  For example, “algorithmic discrimination has been redefined to mean “the use of an artificial intelligence system that results in a violation of any applicable local, state, or federal anti-discrimination law…”.  The definition of “developer” is amended to exclude persons offering systems with open model weights or meeting specified conditions, e.g., if they do not engage in material conduct or statements promoting the use of the system in making consequential decisions and include specific disclaimers in contracts and documentation stating the system is not designed for consequential decisions, and that deployers are responsible for compliance if they use it for such purposes.  Certain specified technologies are exempted from the definition of “high-risk artificial intelligence system” unless they make or are a substantial factor in making a consequential decision.

•           New & Broadened Exemptions: Perhaps the most impactful of the amendments is the new exemption for deployers using high-risk AI systems solely for recruitment, sourcing, or hiring of external candidates, provided that certain conditions regarding employee count and disclosures are met.  Given the prevalence of AI-powered recruitment tools, and the high-rate of adoption across human resource departments, many businesses stand to benefit from this exemption.  Certain developer disclosure requirements do not apply to a developer that meets specific financial criteria (less than $10M from third-party investors, less than $5M annual revenue, operating less than 5 years) and sells or distributes high-risk AI systems that deployers use to make a limited number of consequential decisions per year, with the limit decreasing annually from 10,000 in 2027 to 2,500 in 2029.  Also, compliance with the Fair Credit Reporting Act or federal prudential regulators for banks/credit unions also provides exemptions or deems compliance with the AI Act.

•           Modified Duties: A prior requirement for developers/deployers to notify the attorney general of known/foreseeable risks of algorithmic discrimination appears to have been eliminated. 

•           Enhanced Deployer Obligations (with limitations):  In-scope deployers must implement a risk management policy and program and complete annual impact assessments. The required content of impact assessments now explicitly includes analyzing risks of limiting accessibility, unfair trade practices, labor law violations, or Colorado Privacy Act violations. Deployers using high-risk AI systems for consequential decisions must provide consumers with disclosures about the system’s purpose, name, developer, deployer contact, and a plain language description of the system’s role and data evaluation process. For adverse consequential decisions, deployers must provide a single notice disclosing the principal reasons, the system’s contribution, categories/sources of adverse data, consumer rights regarding personal data correction, and an opportunity to appeal non-time-limited/non-competitive adverse decisions based on incorrect data or unlawful information/inferences. Importantly, many of the deployer obligations apply only to high-risk AI systems that make, or are the principal basis for making, consequential decisions. “Principal basis” means making a decision without meaningful human involvement. This is a materially narrower concept than the current “substantial factor” standard.

•           New Notification Requirement for Withheld Information:  In-scope businesses that withhold information that would otherwise be subject to disclosure under the AI Act, will be required to notify the individual that would otherwise have a right to receive the information stating the basis for the withholding, and provide non-exempt information.

•           Delayed Enforcement: The attorney general has exclusive authority to enforce the Act, but this authority does not begin until January 1, 2027.  Affirmative defenses are available for businesses that discover and cure a curable violation within seven days or who were otherwise compliant and meet specific criteria, including inadvertence, affecting fewer than 1,000 consumers, and no negligence.

This proposed bill represents a significant refinement of Colorado’s approach to AI regulation, exempting more businesses from its scope, and adjusted compliance timelines and requirements for developers and deployers.

Failed

COLORADO

HB25B-1009, introduced August 21, 2025, would amend the state’s existing high-risk AI law, SB24-205 (2024). It would narrow the definition of “consequential decision” (the trigger for high-risk AI classification) to only cover employment and public safety decisions, removing prior coverage of areas like housing, healthcare, credit and education. Exemptions would apply to businesses with fewer than 250 employees or less than $5 million in annual revenue. For those within the scope, reasonable care must be used to avoid algorithmic discrimination, implement risk management programing, conduct annual impact assessments, disclose to consumers when AI is making or substantially influencing consequential decisions about them and notify the Attorney General if the business discovers the system has caused algorithmic discrimination.

Failed

COLORADO

HB26-1210, introduced February 13, 2026, would target “price or wage setting algorithms” (PWSAs) as a substantial factor in setting a price or wage offered to an individual. This includes any technology using statistical modeling, data analytics, artificial intelligence, or other data processing techniques to analyze surveillance data. It would prohibit the use of such AI driven systems to set individualized prices for consumers or individualized wages for workers only when based on surveillance data via PWSAs and results in discriminatory outcomes. Any person using a PWSA would be required to publicize procedures to ensure data accuracy, allow workers to request information about how the algorithm uses their data, and permit workers to correct or challenge inaccurate data feeding into the algorithm.

Failed

COLORADO

Introduced January 10, 2024, HB 24-1057 would have prohibited a private landlord from employing or relying on AI or some algorithmic device to calculate rent to be charged to a tenant. Such use would have been an unfair or deceptive trade practice under Colorado Consumer Protection Act.

Failed

COLORADO

Introduced on February 11, 2025, HB1212 protects workers who disclose information about a developer’s foundation AI model if they believe the developer is breaking the law, posing a public security risk, or making false statements about safety. The developers cannot retaliate against these workers and must inform workers of their rights.

There is a private right of action—an aggrieved worker may commence a civil action in district court against a developer for a violation of the bill.  Damages under the bill are the greater of actual damages or $10,000.

Failed

COLORADO

Introduced on February 18, 2025, HB1264 prevents discrimination in setting personalized prices or wages using automated decision systems (ADS). It prohibits the use of surveillance data to set discriminatory individualized consumer prices or employee wages. A violation of this prohibition is deemed a deceptive trade practice.

A company using ADS related to wages or pricing must publish procedures to allow the affected individual to correct or challenge the accuracy of the data considered, to receive the data considered, and information regarding how that data was considered in setting the price or wage.

This bill permits both public and private enforcement. The private right of action includes the greater of actual damages or $3,000 for each violation.

Failed

COLORADO

SB25B-008, introduced August 21, 2025, would apply anti-discrimination laws fully, regardless of whether the discriminatory conduct is carried through AI, algorithms, automation, or any other technology. If an organization uses AI systems to make or assist in decisions involving housing, employment, credit, education, or public accommodations, it cannot use the fact that technology made the decision as a shield against discrimination liability. Technology developers, however, are only liable if they intentionally engage in, direct, or knowingly aide the discriminatory conduct.

Failed

CONNECTICUT

Connecticut Public Act No. 26-15, known as the Online Safety Act or SB5, establishes a comprehensive regulatory framework for artificial intelligence (AI) and online platforms, with primary provisions becoming effective October 1, 2026. Other specific sections have staggered start dates, including those for AI companions (January 1, 2027) and covered online platforms (January 1, 2028).

Compliance Obligations

The act imposes varied requirements depending on the type of technology or service provided:

·       Subscription-based AI Providers: These entities must provide consumers with written notice of key terms—including qualitative or quantitative limitations on the technology—and obtain the consumer’s written acceptance of those terms.

·       Frontier Developers: Developers of high-compute “frontier models” are prohibited from retaliating against employees who report “catastrophic risks” to public health or safety. Large developers with over $500 million in annual revenue must establish anonymous internal reporting processes for such risks by January 1, 2027.

·       Automated Employment-related Decision Technology (AEDT): Businesses using AI to materially influence hiring or firing must disclose the use of such technology to applicants and employees. They must also provide written notice regarding the categories of personal data analyzed and how that data is assessed.

·       AI Companions: These systems must include protocols to detect risks of suicide or self-harm, refer users to mental health resources, and refrain from claiming to be human beings. Stricter regulations apply to interactions with minors, including prohibitions on romantic or manipulative interactions.

·       Covered Platforms (Social Media): Operators must use age verification or obtain verifiable parental consent before providing algorithmic feeds to minors. They must also display Surgeon General warnings regarding mental health risks and implement default settings for minors that limit usage to one hour per day.

Penalties and Enforcement

Attorney General Enforcement: Most violations—including those related to subscriptions, AI companions, AEDT, and online platforms—are deemed unfair or deceptive trade practices (CUTPA violations) and are enforced solely by the Attorney General.

No Private Right of Action: The act generally does not allow individuals to sue for these violations.

Civil Penalties: Frontier developers specifically face civil penalties of up to $1,000 per violation, and the state may recover investigation costs and attorneys’ fees if it prevails in an action.

Right to Cure: For certain employment-related AI violations occurring before 2028, the Attorney General may issue a notice of violation and allow the entity 60 days to cure the issue before bringing an action.

Enacted

CONNECTICUT

HB 8002 (officially Public Act No. 25-1 of the special session) is a comprehensive housing law signed on November 26, 2025. While the act covers a wide range of housing issues, one of its most significant components is a new antitrust provision targeting algorithmic price-fixing in the rental market, which became effective January 1, 2026. Under this law, it is unlawful to use software that incorporates automated processes to perform calculations based on nonpublic competitor data for the purpose of advising a landlord on rent prices or whether to leave units vacant. Definition of Nonpublic Data: This includes information not available to the general public, such as actual rent amounts, current occupancy levels, and specific lease start/end dates. Permitted Activities: The law explicitly allows for the use of publicly available data to set prices. It also exempts aggregated market research reports that do not recommend specific future rental rates and tools used strictly for affordable housing program guidelines. Penalties: Violations are subject to the Connecticut Antitrust Act, with civil fines of up to $100,000 for individuals and $1,000,000 for corporation.

Enacted

CONNECTICUT

On June 24, 2025, Governor Lamont signed Public Act No. 25-113 (otherwise known as SB1295) into law. Effective July 1, 2026, a consumer shall have the right to confirm whether a controller, in furtherance of an automated decision, is processing the consumer’s personal data and access such personal data. A consumer may access inferences about the consumer and profiling for decisions producing a legal or similarly significant effect, correct inaccuracies, delete personal data, and obtain a copy of the personal data in a portable, readily usable format. The consumer also has the right to opt out of processing for targeted advertising, sale, or profiling, to question, review, and correct profiling decisions, and to obtain a list of third parties to which the consumer’s personal data has been sold, subject to trade secret limitations. “Controller” means a person who, alone or jointly with others, determines the purpose and means of processing personal data. “Personal data” means any information that is linked or reasonably linkable to an identified or identifiable individual.

Enacted

CONNECTICUT

On June 24, 2025, Governor Lamont signed Public Act No. 25-113 into law, amending the Connecticut Data Privacy Act (“CTDPA”) to include a new, mandatory disclosure requirement for businesses that use personal data to train artificial intelligence (“AI”) systems, specifically large language models (“LLMs”).

Effective July 1, 2026, controllers subject to the CTDPA must update their consumer-facing privacy notices to include a clear and conspicuous statement disclosing whether they collect, use, or sell personal data for the purpose of training large language models.   This requirement applies regardless of whether the data is used internally or sold to third parties for model training. The disclosure must be included in a privacy notice that is “reasonably accessible, clear and meaningful,” and must be kept current.

Enacted

CONNECTICUT

On May 19, 2026, Governor Lamont signed Public Act No. 26-53 (otherwise known as HB5229) into law. Effective July 1, 2026, gaming entities are prohibited from using of artificial intelligence for targeting certain bets to customers making online sports wagers through advertising, marketing and other promotional materials.

Notable Exemptions

·       Advertising may depict an individual who appears to be under twenty-one years of age if that individual is a professional athlete or a collegiate athlete who, if permitted by applicable law, is able to profit from the use of his or her name and likeness.

·       Advertising may be disseminated at athletic facilities or on web sites maintained by institutions of higher education if such materials exclusively consist of an announcement, signage, or display directed to a general audience.

·       A lottery draw game does not require independent testing and certification if it (A) is sold in at least twenty states within the United States, and (B) has been tested by a nationally recognized gaming testing laboratory licensed in at least twenty states to perform system and game analysis.

Key Obligations

·       Responsible Gambling Features: Licensees must prohibit individuals from holding more than one account per platform, limit credit and debit card use, and allow patrons to set personal deposit and spending limits.  Licensees must also establish a voluntary self-exclusion process and a toll-free telephone number for assistance.  Platforms must conspicuously display responsible gambling links, account balances, time-spent notifications, and a means to initiate a break in play.

·       Advertising Restrictions: Advertising must not be aimed primarily at persons under twenty-one, and may not directly target self-excluded individuals through email, text, telephone, direct messaging, mail, or social media.  Advertising may not imply greater chances of winning compared to other licensees, imply that wagering more improves winning odds, or claim that gaming guarantees social, financial, or personal success.

·       Geolocation Systems: Electronic wagering platforms must employ a geolocation system capable of checking a patron’s device location each time an entry fee or ticket purchase is submitted, and must prohibit the transaction if location cannot be determined.  Platforms must also notify operators and patrons of geographically inconsistent account access.

·       Lottery Testing: Each lottery draw game or keno must be tested and certified by a gaming laboratory prior to being offered, with the corporation bearing all associated costs.

Penalties

Enforcement would fall to the Department of Consumer Protection and the Attorney General under existing Connecticut gaming statutes. The Department may suspend a lottery draw game or keno if it has good cause to believe that the continued operation of such game could reasonably cause substantial detriment to the public interest.

Enacted

CONNECTICUT

On May 27, 2026, Governor Ned Lamont signed Public Act No. 26-64 into law, significantly expanding Connecticut’s consumer protection framework. The Act introduces new obligations for data brokers, retailers, genetic testing companies, businesses using automated pricing tools, and entities already subject to the CTDPA. Key provisions begin taking effect as early as October 1, 2026. Below is a high-level overview of what businesses need to know.

Key Effective Dates

•       October 1, 2026: CTDPA amendments, data broker registration framework, facial recognition and geolocation requirements, and genetic testing provisions take effect

•       January 1, 2027: Data brokers must be registered to sell or license brokered personal data in Connecticut

•       February 1, 2027: Surveillance pricing prohibition and price setting device disclosure requirements take effect

•       October 1, 2028: State-operated consumer deletion mechanism becomes operational; data brokers must begin processing deletion requests

Who Is Affected

·       Data Brokers. Any business that sells or licenses brokered personal data — including names, addresses, dates of birth, biometric data, Social Security numbers, or other consumer-identifying information — to third parties.

·       CTDPA Controllers. Any business that determines the purpose and means of processing Connecticut residents’ personal data, now subject to expanded deletion rights, a stricter purpose limitation standard, and new facial recognition and geolocation requirements.

·       Retail Sellers and Third-Party Delivery Services. Retailers and delivery platforms are subject to a new prohibition on surveillance pricing — using a consumer’s personal data to set customized prices.

·       Businesses Using Online Pricing Algorithms. Any business that uses an automated process relying on a consumer’s personal data to set and advertise a price online must include a mandatory disclosure.

·       Direct-to-Consumer Genetic Testing Companies. Companies offering genetic testing directly to consumers or collecting and analyzing genetic data, excluding licensed health care providers ordering tests for medical purposes.

Notable Exemptions

Key exemptions include FCRA-regulated consumer reporting agencies, GLBA-regulated financial institutions, HIPAA-covered entities and business associates, and businesses collecting information about consumers in a contractual, investor, or donor relationship.

Key Obligations

·       Data Broker Registration. Data brokers must register with the Department of Consumer Protection ($2,500 annual fee) and maintain a publicly accessible consumer rights page. Applications must disclose whether the broker collects minors’ data, precise geolocation data, or reproductive or sexual health data.

·       Accessible Deletion Mechanism. By October 2028, the state will establish a mechanism enabling consumers to submit a single deletion request to all registered data brokers. Brokers must check the mechanism at least every 45 days and cascade deletion obligations to their data service providers.  Once deleted, a broker may not subsequently maintain data it later acquires about that consumer.

·       Price Setting Device Disclosures. Businesses using automated pricing tools that increase prices based on personal data must include a visible disclosure stating: “THIS PRICE WAS INCREASED BY A PRICE SETTING DEVICE USING YOUR PERSONAL DATA.”

·       Surveillance Pricing Prohibition. Retail sellers and delivery services may not set customized prices based on a consumer’s personal data collected through any technology. Narrow carve-outs exist for retention pricing, cost-justified price differences, and loyalty programs, but each is specifically defined and should not be assumed to apply without legal review.

·       Geolocation Data. No controller or third party may sell a consumer’s precise geolocation data. There is no consent exception. Businesses monetizing location data must restructure those activities.

·       Facial Recognition Technology. Controllers using facial recognition for fraud prevention must use it exclusively to match images against their own database, post signage at public entrances, and link to a facial recognition policy that includes contact information for the Connecticut Attorney General’s office.

·       CTDPA Purpose Limitation. The Act removes the prior “material” qualifier — any processing of personal data for a purpose not disclosed at the time of collection now requires fresh consent, regardless of how minor the new purpose may be.

·       Direct-to-Consumer Genetic Testing. Consumers retain a property right in their biological samples and test results.  Companies must obtain express consent before collecting, using, or disclosing genetic data, and may not disclose genetic data to employers, insurers, or third parties intending to use it for marketing or targeted advertising.

Enforcement and Penalties

Data broker violations carry civil penalties of up to $200 per consumer per day, which can escalate rapidly for large datasets. Violations of the pricing, genetic testing, and streaming provisions constitute unfair or deceptive trade practices enforceable solely by the Connecticut Attorney General — there is no private right of action. However, Attorney General enforcement under the Connecticut Unfair Trade Practices Act can include injunctive relief, civil penalties, and restitution, and remains a significant risk for high-profile violations.

Enacted

CONNECTICUT

The Connecticut Privacy Act (CTPA) which went into full force on July 1, 2023, provides consumers the right to opt-out of profiling if such profiling is in furtherance of automated decision-making that produces legal or other similarly significant effects.  Controllers must also perform data risk assessments prior to processing consumer data when such processing presents a “heightened risk of harm.” These situations include certain profiling activities that present a reasonably foreseeable risk of unfair or deceptive treatment of or unlawful disparate impact on consumers, financial, physical or reputational injury to consumers, physical or other intrusion into the solitude, seclusion or private affairs or concerns of consumers that would be offensive to a reasonable person, or other substantial injury to consumers.

Enacted

CONNECTICUT

Introduced on February 25, 2025, SB342 prohibits health carriers from using a software tool, including, but not 61 limited to, artificial intelligence or an algorithm, to automatically 62 downcode or deny a health insurance claim submitted by a health care 63 provider without review by a clinical peer. “Downcoding” is an adjustment of a health benefit claim by an entity, including an insurer or preferred provider network, to a less complex or lower cost billing code to give a lower reimbursement to a health care provider than the provider’s health care contract requires. If passed, this law would take effect on October 1, 2026.

Proposed

CONNECTICUT

Introduced on February 26, 2026, HB5342 would prohibit the distribution of certain deceptive synthetic media within the ninety-day period preceding an election or primary. “Deceptive synthetic media” means any image, audio, or video, or representation of an individual’s speech or conduct, that is substantially derived from such media and would lead a reasonable person to believe the individual engaged in that speech or conduct when the individual did not. Violations may be criminally prosecuted, and the Attorney General may commence a civil action to permanently enjoin any person who violates the bill’s provisions. Additionally, any individual or candidate harmed by a violation may recover general or special damages. If passed, the law will take effect on July 1, 2026.

Proposed

CONNECTICUT

Introduced on March 5, 2026, SB435 establishes various requirements concerning the use of automated employment-related decision systems and artificial intelligence technologies. This bill requires that a deployer of an automated employment-related decision process shall ensure that each applicant or employee is disclosed that they are interacting with such automated employment-related decision process. Additionally, a deployer must provide a written notice to an employee or applicant prior to collecting personal data for use in an automated employment-related decision process, disclosing the purpose of collection, categories of personal data, retention period, categories of persons with access, and the right to opt out of such processing.

Violations of this bill are enforced by the Attorney General for unfair or deceptive trade practices, or by the aggrieved applicant or employee who may recover damages or other equitable relief that the court may find appropriate. If passed, this law will take effect on October 1, 2026.

Proposed

CONNECTICUT

Introduced March 6, 2025, SB1484 establishes that an employer may only engage in electronic monitoring in order to ensure the quality of goods and services, conduct periodic assessments of employee performance, protect the health, safety and welfare of employees, ensure compliance with the law, or administer wages and benefits. Electronic monitoring of employees must be done in the least invasive manner possible to best protect employee privacy. An employer is prohibited from collecting information on a protected characteristic.

Any employer intending to use electronic monitoring must give employees prior written notice detailing the type of monitoring, the intended use of the information collected, how it will be stored, and the employee’s rights.

There is no private right of action and the first penalty for a violation is $500. If passed, the bill would become effective October 1, 2025.

Failed

CONNECTICUT

Introduced March 7, 2024, HB 5450 would, within a 90-day period preceding an election or primary, prohibit the distribution of certain deceptive synthetic media created by AI. “Deceptive synthetic media” constitutes “any image, audio or video of an individual, and any representation of such individual’s appearance, speech or conduct that is substantially derived from any image, audio or video” that (1) “a reasonable person” would attribute to a person and (2) was created by AI or by other means.

Failed

CONNECTICUT

Introduced on February 13, 2025, SB1292, would require (1) an owner or operator of an artificial intelligence data center to submit quarterly reports to the Commissioner of Energy and Environmental Protection, and (2) the commissioner to adopt regulations concerning water and energy efficiency standards for such data centers.

Failed

CONNECTICUT

Introduced on January 10, 2025, HB5076, would amend the state’s law to require that any artificial intelligence data center (1) utilize energy derived from renewable sources for not less than fifty per cent of the energy consumption requirements of such center, (2) utilize energy storage systems and modern grid infrastructure, (3) implement water conservation measures, and (4) report annual energy consumption, water consumption and emissions, and to provide tax credits, grants and research funding for the development of such centers.

Failed

CONNECTICUT

Introduced on January 10, 2025, SB447, would prohibit health carriers from using artificial intelligence in the evaluation and determination of patient care to safeguard patient access to testing, medications and procedures.

Failed

CONNECTICUT

Introduced on January 21, 2025, HB5587 and HB5590, prohibit any health insurer from using artificial intelligence as the primary method to deny health insurance claims.

Failed

CONNECTICUT

Introduced on January 21, 2025, SB817, would prohibit any health insurer from using a software tool, including, but not limited to, artificial intelligence or an algorithm, to automatically downcode or deny a health insurance claim submitted by a health care provider without detailed review by a clinical peer.

Failed

CONNECTICUT

Introduced on January 22, 2025, HB5877, would prohibit the use of artificial intelligence to replace public school educators in providing instruction to and regular interaction with students.

Failed

CONNECTICUT

Introduced on January 31, 2025, HB6846, would prohibit the distribution of certain deceptive synthetic media within the ninety-day period preceding an election or primary.

Failed

CONNECTICUT

Introduced on January 8, 2025, SB2, provides that the state’s laws be amended to protect consumers in the state from the risks of algorithmic discrimination and unfair treatment posed by artificial intelligence. 

Failed

DELAWARE

HB 191, introduced January 8, 2026, and enacted April 23, 2026, bans nonhuman entities, including AI, from being licensed as nursing or medical professionals.  The law also prohibits AI from using professional titled or abbreviations, such as RN, APRN, CRNA, MD, DO, or PA.  Licensed healthcare roles and titles must adhere to this bill and ensure only human professionals can hold such credentials in Delaware. The law became effective immediately.

Enacted

DELAWARE

The Delaware Personal Data Privacy Act which became effective on January 1, 2025 provides consumers the right to opt-out of profiling if such profiling is in furtherance of solely automated decisions that produce legal or similarly significant effects concerning the consumer. Controllers must also perform data protection assessments when data processing presents a “heightened risk of harm” including where Controller processes personal data for the purposes of profiling, where such profiling presents a reasonably foreseeable risk of any of the following: (a) unfair or deceptive treatment of, or unlawful disparate impact on, consumers, (b) financial, physical, or reputational injury to consumers, (c) a physical or other intrusion upon the solitude or seclusion, or private affairs or concerns, of consumers, where such intrusion would be offensive to a reasonable person; or (d) other substantial injury to consumers.

Enacted

DELAWARE

HB 306, introduced March 3, 2026, would make it unlawful for any business to engage in a commercial transaction with a consumer through a chatbot, AI agent, or avatar, under circumstances where a reasonable person might believe they are talking to a human, without clearly disclosing that the consumer is communicating with a computer. Violations are considered “unlawful trade practices,” allowing consumers to individually sue. The Attorney General can also seek injunctive relief and civil penalties up to $5 million per violation.

Proposed

DELAWARE

HB453 (substituted as HS1), introduced June 4, 2026, would prohibit the use of automated decision systems—expressly defined to include machine learning and AI—to set individualized consumer prices based on surveillance data such as behavioral tracking, biometrics, device identifiers, and proxy data used to infer a consumer’s socioeconomic status or urgency of purchase. Loyalty and rewards programs would be permitted only if discounts were uniform across members and not individualized through AI-driven profiling of a member’s specific surveillance data.

Proposed

DISTRICT OF COLUMBIA

Introduced December 1, 2025, B524 seeks to amend the Criminalization of Non-Consensual Pornography Act of 2014 to create new offenses for nonconsensual distribution of sexually explicit materials created or altered through the use of digital technology, including the use of AI methods.

Proposed

DISTRICT OF COLUMBIA

Introduced on February 2, 2023, B114, Stop Discrimination by Algorithms Act of 2023 (SDAA) would prohibit both for-profit and nonprofit organizations from using algorithms that make decisions based on protected personal traits. This bill makes it unlawful for a DC business to make a decision stemming from an algorithm if it is based on a broad range of personal characteristics, including actual or perceived race, color, religion, national origin, sex, gender identity or expression, sexual orientation, familial status, source of income or disability in a manner that makes “important life opportunities” unavailable to that individual or class of individuals. Any covered entity or service provider who violates the act would be liable for a civil penalty of up to $10,000 per violation. 

Failed

DISTRICT OF COLUMBIA

Introduced on June 5, 2024, Bill 25-0832 would require that all candidates, political action committees, political committees and other entities involved in political advertising, using artificial media, be prohibited from distributing artificial media within 90 days of an election that does not conform to certain disclosure requirements. It would permit injunctive relief by the Superior Court of the District of Columbia and the issuance of civil fines by the Campaign Finance Board for any violations.

Failed

FLORIDA

Enacted April 29, 2024, HB919  requires, if created by generative AI, certain political advertisements, electioneering communications, or other political content to include a disclaimer. Advertisements falling under this law include depictions of “a real person performing an action that did not actually occur” and content that “was created with intent to injure a candidate or to deceive regarding a ballot issue,” etc. These advertisements must state the following disclaimer: “Created in whole or in part with the use of generative artificial intelligence (AI).” This disclaimer must be printed clearly, be readable, and occupy at least 4 percent of the communication based on the type of media. Failure to comply will result in civil and criminal penalties. The law took effect July 1, 2024.

Enacted

FLORIDA

Introduced on January 07, 2026, SB1344  establishes requirements for companion AI chatbot operators, including mandatory user account creation, age verification using standard or anonymous methods, and parental consent for minors. If a user is determined to be a minor, the chatbot must be linked to a verified parental account and blocked from accessing sexually explicit content. Operators must display a pop-up notification at the start and every 60 minutes of interaction to inform users they are communicating with an AI. Violations are deemed unfair and deceptive trade practices, allowing the Department of Legal Affairs to enforce actions, collect civil penalties up to $50,000 per violation, and recover attorney fees and court costs. The department also has authority to conduct investigations, issue subpoenas, and impose penalties for non-compliance, including up to $5,000 per week for willful obstruction. The law applies to all operators providing companion AI chatbots to individuals in Florida and takes effect on July 1, 2026.

Proposed

FLORIDA

HB1459, introduced January 7, 2024, would have required business entities that produce AI and make it available to the public to put out safety and transparency standards for AI-generated content and videos. The bill would have then required disclosure of certain AI-generated content to better inform consumers that they are using AI. And, more specifically, the bill would also have required political ads to be subject to certain requirements.

Failed

FLORIDA

Introduced on April 24, 2026, SB 2-D, would have prohibited a local governmental entity from taking certain actions relating to contracting with an entity to provide artificial intelligence technology, software, or products unless certain requirements are met. It also would have prohibited a governmental entity from entering into a contract with an entity for artificial intelligence technology, software, or products under certain circumstances. Finally, the bill would have required companion chatbot platforms to prohibit a minor from becoming or being an account holder unless the minor’s parent or guardian consent and require bot operators to periodically provide a certain notification to a user. The bill would’ve taken effect on July 1, 2026.

Failed

FLORIDA

Introduced on December 22, 2025 and January 09, 2026 respectively, SB482 and HB1395 identically established a comprehensive “Artificial Intelligence Bill of Rights.” The legislation enumerated nine rights for Floridians concerning AI, including the right to know when communicating with an AI system rather than a human, to supervise minor children’s AI use, to expect AI companies to protect and deidentify personal information, to know when AI has been used in political advertisements and election communications, and to pursue civil remedies against those who use AI to appropriate a person’s name, image, or likeness without consent. The bills would have imposed substantial obligations on companion chatbot platforms, requiring parental consent before minors may create or maintain accounts, mandating parental access to chat logs and self-harm notifications, and requiring hourly disclosures reminding minors that they are interacting with AI rather than a human. Bot operators generally would have needed to display pop-up notifications at the beginning of and hourly during interactions that disclose the non-human nature of the communication. AI technology companie were prohibited from selling or disclosing personal user information unless it has been deidentified and must implement safeguards to maintain deidentification. The legislation also amended section 540.08 of the Florida Statutes to prohibit the unauthorized commercial use of AI-generated likenesses, with enhanced penalties for misuse of servicemembers’ images or images of deceased individuals.  The bills also allowed the Department of Legal Affairs to enforce violations with civil penalties and punitive damages. 

Failed

FLORIDA

Introduced on December 4, 2025, HB659 would have established regulations governing AI-generated “companion chatbot” platforms—defined as AI systems with natural language interfaces capable of providing adaptive, human-like responses and sustaining relationships across multiple interactions to meet users’ social needs. Operators of such platforms would have been required to display clear notices informing users that companion chatbots are AI-powered and not human, and that they may not be suitable for minors; implement and publish protocols to detect, remove, and prohibit content relating to suicidal ideation, suicide, or self-harm (including mechanisms to refer users to the 988 suicide and crisis lifeline); and offer anonymous or standard age verification for access to the platform. For users identified as minors, operatorswould have needed to provide enhanced protections, including disclosing that the user is interacting with AI, issuing default notifications at least every three hours reminding the minor to take a break and confirming the chatbot is not human, and implementing reasonable measures to prevent the chatbot from producing sexually explicit visual material or encouraging sexually explicit conduct. Beginning July 1, 2027, operators would have been required to submit annual reports to the Department of Legal Affairs detailing the number of crisis referrals issued and describing their suicide prevention protocols. Violations constituted unfair or deceptive trade practices enforceable by the Attorney General, with operators entitled to a 30-day cure period prior to enforcement action; notably, the bill did not create a private right of action. If enacted, the bill would have taken effect July 1, 2026.

Failed

FLORIDA

Introduced on February 4, 2025, HB369 focused on the provenance of digital content, and defines “provenance data” as information recording the origin and history of modifications to digital content. “Provenance data” includes information identifying whether some or all the content has been generated through AI and if so, the name of the AI tool that was used. Under this bill, providers of AI tools must make 1) application tools (“tool or service that enables the user to apply provenance data, either directly or through the use of third-party technology, to any data that has been modified to include synthetic content”) and 2) free provenance readers (“tool or service that allows users to identify the provenance data of visual or audio digital content”) available to the public.  Social media platforms would have had to retain and make provenance data available for visual or audio content posted on their platforms. Devices that record visual or audio content would have had to allow the inclusion of provenance data, and manufacturers must ensure that this data can be read by third party applications. Violations of this law would have constituted unfair or defective acts or practices.

Effective on July 1, 2025 if passed. As of May 3, 2025, the bill has been indefinitely postponed and withdrawn from consideration.

Failed

FLORIDA

Introduced on January 13, 2026, SB202 established mandatory human review requirements for insurance claim denials involving artificial intelligence systems. The bill prohibited insurers from using algorithms, AI systems, or machine learning systems as the sole basis for determining whether to adjust or deny a claim and requires such a decision to be made by a “qualified human professional.” Before making a denial decision, such human professionalwould have needed to analyze the facts of the claim and policy terms independently of any AI system, review the accuracy of any AI-generated output, and conduct a review of any decisions made by other qualified professionals. The bill would require insurers to maintain detailed records of these human professionals’ actions—including the name, title, date and time of the decision, and documentation of the basis for denying such claims—and must clearly identify the responsible professional in all denial communications to claimants. If enacted, the bill would have taken effect July 1, 2026.

Failed

FLORIDA

Introduced on January 19, 2024, SB850, the Use of Artificial Intelligence in Political Advertising, would have taken effect July 1, 2024, if enacted, and aimed to require political campaigns to disclose through a disclaimer the use of AI in any “images, video, audio, text, and other digital content used in ads. This bill sought to address the rising concern of deceptive campaign advertising (deepfakes) by mandating disclaimers on political ads that contain certain content generated through artificial intelligence. Generative artificial intelligence is defined as a “machine based system that can for a given set of human defined objectives emulate the structure and characteristics of input data in order to generate derived synthetic content.” Violators of this proposed legislation could’ve faced civil penalties. Anyone could have filed a complaint with the Florida Elections Commission if they have suspicions of violations. This bill would have applied to any person or entity releasing a political advertisement, electioneering communication, or other miscellaneous advertisement.

Failed

FLORIDA

Introduced on November 24, 2025, HB527 would haveestablished comprehensive human review requirements for insurance claim decisions involving artificial intelligence across three categories of regulated entities: workers’ compensation carriers, general insurers, and health maintenance organizations (HMOs). The bill expressly permited these entities to use algorithms, AI systems, and machine learning systems to assist in processing claims, including generating recommendations to approve or deny claims, but prohibits such systems from serving as the sole basis for decisions to reduce a claim payment or deny a claim. All such decisions would have had to be made by a qualified human professional who, before reducing or denying a claim, must independently analyze the facts and policy terms, review any AI-generated output for accuracy, and affirmatively determine that the claim is not payable under the applicable policy or contract. Regulated entities would have had to maintain detailed records including the name, title, business address, and unique identifier of the professional making the decision, along with documentation of the decision basis. Denial communications would need to include contact information (e-mail, telephone, business address, and unique identifier) for the human professional who issued the denial, as well as a written statement affirming AI was not the sole basis for the decision. The workers’ compensation provisions include an express penalty provision for noncompliance. The bill would have taken effect July 1, 2026.

Failed

FLORIDA

Introduced on October 28, 2025 and November 04, 2025 respectively, HB281 and SB344 identicallywould have created new sections in Florida Statutes that define “artificial intelligence” and largely prohibit its use in the practice of psychology or school psychology, clinical social work, marriage and family therapy, and mental health counseling. The bill’s prohibitions applied to licensed professionals, registered interns, and certificate holders.  While the bill broadly prohibited the use of artificial intelligence in these practices, it carved out exceptions for the use of artificial intelligence in administrative and supplementary support services, such as scheduling, billing, record-keeping, and data analysis. Additionally, it allowed the use of artificial intelligence to record or transcribe therapy sessions but only if written, informed consent is obtained from the patient at least 24 hours before the session. The law would have taken effect on July 1, 2026.

Failed

GEORGIA

Introduced on February 19, 2026 and signed into law on May 11, 2026, GA SB 540 requires operators of conversational AI services to clearly disclose to minor account holders that they are interacting with an AI system. Operators may choose between providing a constantly visible disclaimer or displaying a disclosure at the beginning of each session and repeating periodically throughout the interaction. The law will go into force on July 1, 2027.

Operators are also prohibited from providing a minor account with points or rewards designed to encourage continuous conversation with the AI system. Operators must also take reasonable measures to prevent the AI from discussing certain categories of content, such as sexually explicit materials, and provide safeguards surrounding others, such as self-harm.

Penalties for violations can be up to $10,000 per knowing violation, enforceable by the Attorney General.

Enacted

GEORGIA

Introduced on February 2, 2026 and enacted on May 5, 2026,  SB 444 requires private review agents and utilization review entities to only use artificial intelligence and artificial intelligence systems as part of a larger process. An artificial intelligence system cannot outweigh the judgment of a clinician and may not be the only basis for a negative coverage decision. The bill will go into effect on January 1, 2027.

Neither artificial intelligence nor artificial intelligence systems may make an adverse determination to a patient until a person qualified as a private review agent or a utilization review entity conducts a review in which a clinical peer participates.

Enacted

GEORGIA

Signed into law on May 2, 2023, and effective as of July 1, 2023, HB 203, permits an optometrist or ophthalmologist licensed in the state (a “prescriber”) to use an “assessment mechanism,” to conduct an eye assessment or generate a prescription for contact lenses or spectacles subject to the below conditions. An “assessment mechanism” means automated or virtual equipment, application, or technology designed to be used on a telephone, a computer, or an internet accessible device that may be used either in person or via telemedicine to conduct an eye assessment, and includes artificial intelligence devices and any equipment, electronic or nonelectronic, that are used to conduct an eye assessment. An assessment mechanism can be used; provided, however, that:

• The data obtained from the assessment mechanism is not the sole basis for issuing the prescription.

• The assessment mechanism alone is not used to generate an initial prescription or the first renewal of the initial prescription.

• The assessment mechanism is only used where the patient has had a traditional eye examination in the past two years.

Enacted

GEORGIA

GA HB 566, introduced on February 21, 2025 as the “NO FAKES Act of 2025”  to protect voice and visual likeness in digital replicas and to prevent unauthorized computer-generated representations. The NO FAKES Act will be effective 180 days after being enacted.

Under the NO FAKES Act, individuals have the right to authorize the use of his or her voice or visual likeness in a digital replica. A “digital replica” is a computer-generated, highly realistic electronic representation of an individual’s voice or likeness identifiable in sound recordings, images, or audiovisual works. It includes instances where the individual did not perform or appear, or where their performance has been materially altered. It excludes authorized electronic reproductions, sampling, remixing, mastering, or digital remastering.

The right to authorize one’s voice or visual likeness under the NO FAKES Act is a property right that extends beyond the life of the individual and is not assignable during the life of the individual. However, the right is licensable for no more than 10 years after the death of the individual, unless the licensee can show active and authorized public use of the voice or visual likeness during the 2-year period preceding the expiration of the 10-year period. In such case, the license may renew for additional 5-year periods.

Violators of this act will be liable if they have actual knowledge that the applicable material is a digital replica, and the digital replica was not authorized by the applicable rightsholder.

The NO FAKES Act allows for exceptions where digital replicas are used in (1) news, public affairs, or sports broadcasts, (2) documentaries or historical or biographical works, including some degree of fictionalization, unless they falsely appear as authentic works in which the individual participated or they are embodied in a musical sound recording for audiovisual works and such digital replicas are not protected by the First Amendment, (3) commentary, criticism, scholarship, satire, or parody, or (4) advertisements or commercials for of the foregoing purposes and the digital replica is relevant to the subject of the work. Additionally, it will not be a violation if use of the digital replica is fleeting or negligible.

A person will not be secondarily liable for violating the act by manufacturing, importing, offering, providing, or distributing a product or service unless it is primarily designed to create unauthorized digital replicas, has limited commercial use other than producing such replicas, or is marketed or promoted with the knowledge that it will be used to produce unauthorized digital replicas. Additionally, an online service that has an objectively reasonable belief that materials is claimed to be an unauthorized digital replica does not qualify as a digital replica will not be liable for damages over $1,000,000 regardless of whether the material is ultimately determined to be an unauthorized digital replica.

An “online service” under the act includes, (1) any public website, online application, mobile application or virtual reality forum, (2) a digital music provider, and (3) a social media service or network provided that such term doesn’t include a service by wire or radio.

The statute of limitations for bringing for a claim under this act is 3 years after the date on which the party bringing suit discovered or should have discovered the alleged violation.

Individual violators will be liable in an amount equal to the greater of $5,000 per work embodying the digital replica or any actual damages suffered by the injured party, plus profits from the authorized use. Online service entities will be liable for the greater of $5,000 per violation or any actual damages plus profits. All other entities will face $25,000 per work or any actual damages plus profits.

Proposed

GEORGIA

Introduced on February 2, 2026, HB 1399 creates a statutory framework that recognizes an individual’s property rights over their likeness. This bill would become effective on July 1, 2026 and repeal conflicting laws.

Explicit, written consent is required to use an individual’s likeness in digital AI replicas created by generative AI. Unauthorized commercial use and false endorsements are prohibited.

Proposed

GEORGIA

Introduced on February 2, 2026, SB 488 creates a new section for Georgia tort code that allows generative artificial intelligence systems to be considered personal property for purposes of product liability. If passed, the bill would take effect on January 1, 2027.

The bill would allow product sellers to be held liable when a minor is injured because of a non-merchantable AI system that was not reasonably suited for its intended use. A rebuttable presumption would be created that manufacturers and sellers had a duty to warn of potential risks.

Proposed

GEORGIA

GA HB986, introduced 1/22/2024, would have prohibited the publication of “materially deceptive media” (AI-generated content that appears authentic) within 90 days of an election, with the intent to influence the election outcome or the administration of the election. It also would have required specific disclosures for the use of AI-generated content in campaign advertisements.

Failed

GEORGIA

GEORGIA HB 679, introduced on February 27, 2025, would prohibit agreements to fix rental prices. Additionally, it would prohibit landlords from setting rental prices based on a price-fixing function. A “price-fixing function” means (1) collecting historical or contemporaneous data regarding rental prices, supply levels, or rental agreement termination and renewal dates from multiple landlords in the same market, (2) analyzing or processing that data through the use of a system, software or process, including a process that uses machine learning or other artificial intelligence techniques, and (3) recommending rental prices, rental agreement renewal terms, or ideal occupancy levels to a landlord.

Violators could be guilty of a felony and face up to 5 years in prison and/or face fines between $1,000 and $5,000.

HB 679 would be effective upon enactment.

Failed

GEORGIA

Introduced on February 12, 2025, GA SB 164 would prohibit any person from using automated decision systems to set individualized prices or wages based on “surveillance data,” including personal characteristics, behaviors, and biometrics. The bill would take effect upon passage.

SB 164 is not violated if the person can show the individualized wages are based solely on data specific to the worker that is directly related to the labor or services the worker was hired to perform, or on differences in the cost to the worker of providing the services. The Attorney General or district attorneys will enforce this law, and violations are punishable by a civil penalty not more than $10,000 per violation. The bill also provides for a private right of action for damages of $3,000 per violation.

Failed

GEORGIA

Introduced on February 18, 2025, GA HB 478, would amend Georgia’s Fair Business Practices Act to require clear disclosure of AI-generated content used in commerce and trade. HB 478 would be effective on July 1, 2025, if enacted.

Under HB 478, AI-generated content that involves the use of visual media must be (1) in writing and (2) clearly readable. “Clearly readable” means that the text must be at least 30% of the vertical picture height, be visible for at least 30% of the media’s length for moving images and video, and appear with a reasonable degree of color contrast against the background.

For audio media, the disclosures must be announced using the same volume, rate of speaking, and in each spoken language as used in such content.

Each video recording, audio recording, or image disseminated without such disclosures will constitute a separate violation under the act.

Failed

GEORGIA

Introduced on January 1, 2024, HB 887, would have prohibited the use of artificial intelligence in making certain decisions regarding insurance coverage, health care and public assistance. In particular, the bill would have prohibited health care activities from being based “solely on results derived from the use or application of artificial intelligence or utilizing decision tools.”  The bill further would have required that the GEORGIA Composite Medical Board review, and override, any decision resulting from AI, and to promulgate regulations on review activities. The bill advanced a similar approach regarding AI and automated decision-making tools in insurance coverage and public assistance.

Failed

GEORGIA

Introduced on January 9, 2024, HB 890, places a prohibition on discrimination based on age, race, color, sex, sexual orientation, gender, gender expression, national or ethic origin, religion, creed, familial status, marital status, disability or handicap, or genetic information, and prohibition shall include discrimination resulting from the use of or reliance upon artificial intelligence or automated decision tools.

Failed

GEORGIA

Introduced on March 3, 2025, GA HB 715 would amend GEORGIA’s fair housing laws to regulate the use of artificial intelligence and automated decision tools in housing decisions to prevent discriminatory housing practices. If enacted, no person would be permitted to use AI or automated decision tools to make determinations regarding the sale, rental, or financing of dwellings or in the provision of brokerage services or facilities for the sale or rental of a dwelling without (1) human review of such decisions and (2) disclosing to any affected individuals that such tools were used.

The state Attorney General may impose administrative penalties up to $10,000 against violators of this section.

Failed

HAWAII

Hawaii Patients’ Bill of Rights of 2025 (SB 3027), introduced January 23, 2026, seeks to establish patient rights in receiving timely access to specialists and referrals. The bill would require health carriers to submit a monthly report to the insurance commissioner containing certain aggregated and de-identified information including the number of prior authorization determinations that were made using an automated decision support tool. Additionally, for health carriers and utilization review organizations using automated decision support tools for the purpose of utilization review must provide a number of written disclosures on how the tool is used in reviewing documents issued by health carriers in the state.

Proposed

HAWAII

HB 1787, introduced January 21, 2026, seeks to regulate the use of artificial intelligence for decision-making in health insurance utilization reviews by providing written disclosures regarding how the tool is utilized in its processes and prohibiting the use of AI to deny or otherwise impede a determination to provide healthcare services.

Proposed

HAWAII

HB 2137, introduced January 26, 2026, seeks to protect Hawaii residents from identity-based harm caused by the malicious use of AI by prohibiting certain harmful uses of AI-generate personal likenesses and providing civil remedies for individuals harmed by unauthorized AI-generated realistic digital limitations.

Proposed

HAWAII

HB 2357, introduced January 27, 2026, seeks to prohibit music streaming platforms from hosting, distributing, or otherwise making available in the State music that is performed or attributed to an artificial intelligence musician. Violations of this provision would be considered an unfair method of competition and an unfair and deceptive act or practice.

Proposed

HAWAII

HB 2500, introduced January 28, 2026, seeks to establish a variety of disclosure requirements for deployers of algorithmic decision systems beginning on January 1, 2027, along with consumer rights with regard to accessing and correcting data used by such systems.

Proposed

HAWAII

Introduced on January 21, 2026, SB 2076 would protect a person’s right to publicity from digital replicas by including “digital replica” in the definition of “likeness” that is protected under state law that governs publicity rights.

“Digital Replica” would be defined as a computer-generated, highly realistic electronic representation that is readily identifiable as the voice or visual likeness of an individual that is embodied in a sound recording, image, audiovisual work, or transmission in which the actual individual either did not actually perform or appear, or the actual individual did perform or appear, but the fundamental character of the performance or appearance has been materially altered.

Proposed

HAWAII

Introduced on January 21, 2026, SB 2281 would require health care providers that use artificial intelligence in patient interactions to disclose to the patient that they are interacting with AI. Where AI is used in making consequential decisions relating to a patient, the bill would further require providers to furnish the patient with certain notices and statements, designate a qualified AI oversight person—who must be a natural person—to review, evaluate, and validate or override AI outputs, conduct regular performance evaluations of their AI systems, implement procedures to address identified deficiencies, and maintain specified records. The bill also directs the Department of Health to adopt implementing rules.

Proposed

HAWAII

Introduced on January 22, 2026, HB 1782, titled “Relating to Artificial Intelligence for the Protection of Minors,” is a proposed piece of legislation aimed at creating strict safety standards, oversight, and penalties for AI systems that interact with children under 18. The bill prohibits AI from simulating human behavior, promoting emotional dependency, or encouraging secret interactions with minors. It also bans content promoting self-harm, eating disorders, or illegal acts, requiring redirection to support resources when suicidal ideation is detected. Providers must clearly disclose that interactions are with AI. Parental controls for time limits and features are required, along with age verification for high-risk systems. The legislation limits data collection and bans the use of minors’ data for targeted advertising or manipulation.

Proposed

HAWAII

Introduced on January 23, 2026, SB 3001, the “Artificial Intelligence Disclosure and Safety Act,” would require operators of conversational artificial intelligence services in the State to issue certain disclosures to account holders and users, and to develop protocols aimed at preventing the production of suicidal ideation. The bill establishes general protections for all account holders and users of conversational AI services, with enhanced protections specifically for minors. Beginning January 1, 2028, operators would be required to submit annual reports to the Department of Commerce and Consumer Affairs. The Department of the Attorney General would be authorized to bring civil actions against operators who violate the Act’s requirements, and the bill establishes statutory penalties for such violations.

Proposed

HAWAII

Introduced on January 28, 2026, HB2458 seeks to prohibit the use of surveillance pricing in the sale of food, ensuring that the cost of groceries remains more stable for the community. While the legislation includes exemptions for restaurants and specific promotional discounts, it establishes fines for those who violate the new standards. Currently designated as House Draft 3, the bill carries a placeholder effective date of July 1, 3000.

Proposed

HAWAII

SB 2167, introduced January 14, 2026, seeks to require that health insurance claim denials initiated by an automated decision system be reviewed by a board-certified specialist in the relevant field before being finalized. Enrollees and providers would have to be notified in writing when an automated decision system is used at any stage of the coverage determination.

The bill would also require health carriers to compile and submit certain monthly data including the percentage of automated decision system-based denials overturned on appeal.

Proposed

HAWAII

SB 2304, introduced January 15, 2026, seeks to amend the definition of certain statutory provisions such that individuals may be found guilty of crimes including fraudulent impersonation or false depiction through the use of artificial intelligence or materially deceptive media.

Proposed

HAWAII

SB 2953, introduced January 23, 2026, aims to require insurance companies to establish a governance and accountability framework for their use of AI systems consistent with regulatory expectations, and require a licensed clinician review for decisions of medical necessity conducted by AI systems. The bill would also establish consumer protections against the use of AI systems by insurers as a basis for adverse underwriting actions in residential property insurance.

Proposed

HAWAII

SB 2967, introduced January 23, 2026, aims to increase HI’s consumer protection standards by requiring disclosures by entities when artificial intelligence is used in consumer interactions and consequential decisions, and prohibits the use of artificial intelligence as a shield from responsibility for unfair or deceptive practices.

Proposed

HAWAII

HB 1734, introduced January 18, 2024, would have required any AI-generated political advertisement containing an “image, video, footage, or audio recording” to include a “clear and conspicuous statement” disclosing the use of AI in creating the content. The disclosure, depending on the media, must be readable, follow specified procedures, and be intelligible.

Failed

HAWAII

HI HB 831, introduced on January 23, 2025, would prohibit the use of algorithmic price-setting in Hawaii’s rental market through a coordinating function.

A “coordinating function” means (1) collecting historical or contemporaneous data regarding prices, supply levels, or rental termination and renewal dates of multiple rental property owners, (2) analyzing or processing such data through use of a system, software, or process that uses computation including by using the data to train an algorithm, and (3) recommending rental prices, renewal terms, or ideal occupancy levels to a rental property owner.

Individual violators of this section may face a fine of up to $100,000 and/or imprisonment for up to 3 years. Entities may face fines up to $1,000,000.

The act would be effective upon enactment.

Failed

HAWAII

Introduced January 17, 2024, HB 1607 (Senate version S2524) would have prohibited a covered entity, such as an individual, firm, corporation, partnership, or other commercial entity, from making an “algorithmic eligibility determination” or an “algorithmic information availability determination” on basis of class, race, color, religion, national origin, sex, gender identity or expression, sexual orientation, familial status, wealth, or disability in a discriminatory manner. “Algorithmic eligibility determination” is an AI-generated determination in whole or in part regarding a person’s eligibility for, or opportunity to access, important life opportunities. “Algorithmic information availability determination” is an AI-generated determination about a person’s ability to receive advertising, marketing, solicitations, or other offers for an important life opportunity. Failure to comply would result in a violation of an unlawful discriminatory practice.

Failed

HAWAII

Introduced January 19, 2024, SB 2572 (Assembly version A2176) would have prohibited a person from deploying AI-generated products in Hawaii without submitting proof of the product’s safety to the office regulating AI. Violation of this bill would be subject to a monetary fine for each offense.

Failed

HAWAII

Introduced on January 15, 2025, HI HB 639 would require corporations, organizations, or individuals engaging to commercial transactions or trade practices to clearly and conspicuously notify consumers when the consumer is interacting with an artificial intelligence chatbot or other technology capable of mimicking human behaviors. If enacted, HB 639 would take effect on July 1, 3000.

Any corporation, organization, developer, or individual found to be in violation may face a civil penalty of no more than $5,000,000.

Plaintiffs may seek injunctive relief and be awarded no less than $1,000 or threefold the damages sustained by the plaintiff, whichever is greater.

The Attorney General and the Director of the Office of Consumer Protection may also seek injunctive relief.

Failed

HAWAII

Introduced on January 20, 2023, SB1110, an alternate version of the Hawaii Consumer Data Protection Act, would create materially similar obligations with respect to “profiling” as SB974. The bill stalled in 2023 but was picked back up and carried over to the 2024 regular legislative session. 

Failed

HAWAII

Introduced on January 20, 2023, SB974, the Hawaii Consumer Data Protection Act, would establish a framework to regulate controllers and processors’ access to personal consumer data and introduces penalties, as well as a new consumer privacy special fund. 

The bill also provides consumers the option to opt-out of the processing of their personal data for the purposes of “profiling in furtherance of decisions made by the controller that results in the provision or denial by the controller of financial and lending services, housing, insurance; education enrollment, criminal justice, employment opportunities, health care services, or access to basic necessities, including food and water.”  “Profiling” is defined as any-form of automated processing performed on personal data to evaluate, analyze, or predict personal aspects related to an identified or identifiable natural person’s economic situation; health, personal preferences, interests, reliability, behavior, location, or movements.

The bill further requires covered entities to conduct a data protection assessment when they process personal data for purposes of profiling and the profiling presents “a reasonably foreseeable risk of: (A) Unfair or deceptive treatment of, or unlawful disparate impact on, consumers; (B) Financial, physical, or reputational injury to consumers; (C) A physical intrusion or other intrusion upon the solitude or seclusion, or the private affairs or concerns; of consumers, where the intrusion would be offensive to a reasonable person; or (D) Other substantial injury to consumers[.]” The law goes into effect July 1, 2050, as currently drafted. The bill stalled in 2023 but was picked back up and carried over to the 2024 regular legislative session. 

Failed

HAWAII

Introduced on January 21, 2025, HI HB 465 would prohibit retailer from using dynamic pricing (including AI-enabled pricing adjustments) for food items sold through or qualifying for federal assistance programs. The act would be effective upon enactment.

Violators would be subject to civil fines up to $5,000 per item, per day. Violators may also be subject to administrative fines of up to $500 for the first offense and up to $1,000 for subsequent offenses.

Failed

HAWAII

SB 2524, introduced January 19, 2024, would have prevented a covered entity, including an individual, firm, corporation, legal entity, or other commercial entity, from making an algorithmic eligibility determination or an algorithmic information availability determination on the basis of class, race, color, religion, national origin, sex, gender identity or expression, sexual orientation, familial status, wealth, or disability. “Algorithmic eligibility determination” is a determination about a person’s eligibility for important life opportunities based in whole or part on an algorithmic process using AI, machine learning, or similar technologies. “Algorithmic information availability determination” is an AI-generated determination of a person’s receipt of advertising, marketing, solicitations, or other information about important life opportunities. A violation shall be deemed an unlawful discriminatory practice.

Failed

HAWAII

SB 59, introduced January 16, 2025, would prohibit users of algorithmic decision-making from using “algorithmic eligibility determinations” in a discriminatory manner. “Algorithmic eligibility determination” is defined as “a determination based in whole or in significant part on an algorithmic process that utilizes machine learning, artificial intelligence, or similar techniques to determine an individual’s eligibility for, or opportunity to access, important life opportunities.”  “Important life opportunities” is defined as access to, approval for, or offer of credit, insurance, education, employment, housing, or place of public accommodation as defined in section 489-2.”  Covered entities are prohibited from  making “an algorithmic eligibility determination or an algorithmic information availability determination on the basis of an individual’s or class of individuals’ actual or perceived race, color, religion, national origin, sex, gender identity or expression, sexual orientation, familial status, source of income, or disability in a manner that segregates, discriminates against, or otherwise makes important life opportunities unavailable to an individual or class of individuals.”

Covered entities (businesses with over 25,000 state residents’ data or $15 million in annual revenue for the preceding three years) must send corresponding notices to individuals whose personal information is used and must submit annual reports to the state Attorney General that documents aspects of its algorithmic decision-making process, such as data sources, methodologies, and potential risks.

This bill would allow civil actions, with penalties up to $10,000 per violation.

Failed

HAWAII

SB 640, introduced January 17, 2025, would require any corporation, organization, or individual engaging in business of any kind and using an AI chatbot or other similar technology in a manner that may mislead or deceive a reasonable person to believe they are engaging with a human to first disclose to the consumer that the consumer is interacting with a chatbot. The disclosure must be clear and conspicuous.

This bill would authorize private rights of action and statutory penalties.

Failed

IDAHO

S1297, introduced February 13, 2026 and enacted March 31, 2026, creates the Conversational AI Safety Act.  This law imposes state-wide requirements for operators of public-facing conversational AI services.  The law  requires clear disclosure to users who might reasonably believe they are interacting with a human and mandates protocols to respond to prompts involving suicide ideation.  The law also has extra protections for minors, including persistent AI disclosures, restrictions on engagement-based rewards, safeguards against sexually explicit content, and prohibitions on simulated emotional dependence or romantic interactions.  The Idaho Attorney General enforces this law, with civil penalties up to $1,000 per violation (capped at $500,000 per operator).

The law takes effect on July 1, 2027.

Enacted

IDAHO

H127 was introduced on February 4, 2025 and aims to enhance transparency and consumer protection in AI-driven interactions. The bill establishes disclosure requirements for artificial intelligence communications. It prohibits businesses from using AI chatbots, avatars, or similar technologies to engage in textual or aural conversations without providing a clear and conspicuous notice that the consumer is interacting with AI. The bill applies in situations where a consumer might reasonably believe they are communicating with a human.

The bill includes a private right of action for the greater of actual damages or $1,000.

Failed

IDAHO

H744, introduced February 23, 2026, would require any person collecting biometric identifiers for a commercial purpose to obtain prior informed consent, prohibit selling or disclosing such data except in narrow circumstances, and require destruction of the data within one year after the purpose for collection expires. Biometric data collected for training AI systems is exempt from the bill’s requirements unless the system is used to uniquely identify a specific individual, but if AI training biometric data is later repurposed for a commercial use outside of those exemptions, the full requirements and civil penalties apply.

Failed

IDAHO

H945, introduced March 25, 2026, would create a state licensure framework for AI systems that deliver clinical healthcare services directly to patients. It would establish a new category of licensed healthcare provider and require any entity operating a clinical AI service that independently diagnoses, treats, triages, or prescribes for specific patients to obtain a state license before doing so. Informational and basic advisory AI tools are exempt, but supervised and fully autonomous AI systems must go through a regulatory sandbox before receiving a full license. Licensed AI providers must disclose to patients that they are receiving care from an AI system, must act solely in the patient’s clinical interest, cannot display advertisements during clinical encounters, and must maintain immutable records of their algorithm logic for auditing purposes.

Failed

IDAHO

Introduced February 07, 2025, SB1067 would establish limitations on the regulation of AI and establishes that no government entity may regulate the operation of an AI system’s underlying algorithms or decision making processes, as they are recognized as an extension of human thought and creativity, subject to the same protections and responsibilities of free speech.

Effective date: July 01, 2025.

Failed

IDAHO

Introduced February 10, 2025, H203 amends and adds to existing law to provide for monopsonies and to establish provisions regarding the prohibition of pricing algorithms. Making it unlawful to monopolize, attempt to monopolize, or conspire to monopolize any line of Idaho commerce.

Private right of action – any person may bring an action for injunctive relief and/or damages. If the violation is found to be a per se violation or intentional violation, it shall increase the recovery to an amount not to exceed three times the damages sustained. 

Effective date if passed: July 01, 2025.

Failed

ILLINOIS

HB4987,introduced February 4, 2026, would prohibit the use of automated decision systems—expressly defined to include AI and machine learning tools—to set individualized employee wages based on surveillance data such as behavioral tracking, biometrics, and personal characteristics. Employers may use AI-driven wage-setting only if it relies solely on data directly related to the employee’s job tasks, is disclosed to employees in plain language before hiring, and includes procedures for employees to challenge the accuracy of data used. Civil penalties of up to $10,000 per violation are enforceable by the Attorney General, with a private right of action for actual damages, $3,000 per violation, or treble damages for bad faith conduct. This bill is the wage-only counterpart to the Surveillance-Based Price Discrimination Act you shared earlier—together they mirror the combined provisions of the Surveillance-Based Price and Wage Discrimination Act previously shared.

Proposed

ILLINOIS

HB 4717, introduced January 30, 2026, would require any business that uses an algorithm processing consumer personal data to set individualized prices to display a clear and conspicuous disclosure stating “THIS PRICE WAS SET BY AN ALGORITHM USING YOUR PERSONAL DATA” at the point of advertisement or sale. Violations constitute unlawful practices under the Consumer Fraud and Deceptive Business Practices Act. This bill is narrower than the Preventing Algorithmic Pricing Discrimination Act in that it imposes only a disclosure requirement and does not separately prohibit the use of protected class data in algorithmic pricing

Proposed

ILLINOIS

HB 1806, introduced January 27, 2025, and enacted August 1, 2025, prohibits any individual, corporation, or entity—including internet-based AI systems—from providing, advertising, or offering therapy or psychotherapy services unless the services are conducted by a licensed professional. Licensed professionals may use AI only for administrative tasks (scheduling, billing, logistics) or supplementary support (maintaining records, tracking anonymized progress data), and must obtain written informed consent before using AI to record or transcribe a session. AI may not make independent therapeutic decisions, directly interact with clients in any form of therapeutic communication, generate treatment plans or recommendations without licensed professional review and approval, or detect emotions or mental states.

Enacted

ILLINOIS

HB 4799, introduced February 26, 2026, requires large frontier AI developers—defined as those with over $500 million in annual revenue who have trained a frontier AI model using more than 10²⁶ computing operations—to publicly publish a frontier AI framework describing how they identify, assess, and mitigate catastrophic risks (defined as risks materially contributing to mass casualties or over $1 billion in property damage from a single incident). Developers must publish a transparency report before deploying any new or substantially modified frontier model, and must report any critical safety incidents—such as loss of control of a model causing death or injury, or a model actively subverting its developer’s oversight mechanisms—to the Attorney General within 15 days, or within 24 hours if the incident poses an imminent risk of death or serious injury. Large developers must also submit quarterly summaries of catastrophic risk assessments from internal model use to the Attorney General. HB 4799 is now the Artificial Intelligence Safety Measures Act, which was enacted July 6, 2026.

Enacted

ILLINOIS

In 2019, Illinois became the first state to enact restrictions with respect to the use of AI in hiring.  The Illinois AI Video Interview Act was amended in 2021 and went into effect in 2022, and now requires employers using AI-enabled assessments to:

·       Notify applicants of AI use;

·       Explain how the AI works and the “general types of characteristics” it uses to evaluate applicants;

·       Obtain their consent;

·       Share any applicant videos only with service providers engaged in evaluating the applicant;

·       Upon an applicant’s request, destroy all copies of the applicant’s videos and instruct service providers to do so as well; and

·       Report annually, after use of AI, a demographic breakdown of the applicants they offered an interview, those they did not, and the ones they hired.

Enacted

ILLINOIS

Introduced February 17, 2023, Public Act 103-0804 (HB 3773), amends the Human Rights Act, and provides that an employer that uses predictive data analytics in its employment decisions may not consider the applicant’s race or ZIP code when used as a proxy for race to reject an applicant in the context of recruiting, hiring, promotion, renewal of employment, selection for training or apprenticeship, discharge, discipline, tenure or terms, privileges, or conditions of employment. The amendment also requires an employer to provide notice to employees if the organization uses AI for the above listed employment-related purposes. The Act provides a private right of action for employees, who can sue employers for violations. The Act began to take effect January 1, 2026.

Enacted

ILLINOIS

SB 315, introduced January 23, 2026 and enacted July 6, 2026, is the Senate companion to HB 4799, and is called the Artificial Intelligence Safety Measures Act. It imposes substantially identical obligations on large frontier AI developers—those with over $500 million in annual revenue who have trained a model using more than 10²⁶ computing operations. It requires them to publicly publish and annually update a frontier AI framework addressing catastrophic risk assessment, mitigation, cybersecurity of unreleased model weights, and internal governance, and to publish a transparency report before deploying any new or substantially modified frontier model. The key distinction from the House version is the reporting authority: critical safety incidents must be reported to the Illinois Emergency Management Agency and Office of Homeland Security (rather than the Attorney General) within 15 days of discovery, or within 24 hours if an imminent risk of death or serious physical injury exists. Large frontier developers must also submit quarterly summaries of catastrophic risk assessments from internal model use to the Agency. Violations carry civil penalties of up to $1 million per violation, recoverable by the Attorney General. The bill also establishes the ILCompute consortium within the Department of Innovation and Technology to develop a framework for a public cloud computing resource that supports safe, ethical, and equitable AI development.

Enacted

ILLINOIS

HB 1427, introduced January 16, 2026, would prohibit landlords from using any algorithmic device—defined to include AI and machine learning tools trained on or incorporating nonpublic competitor data such as actual rent prices, occupancy rates, and lease data from competing landlords—to set or adjust residential rent.

Proposed

ILLINOIS

HB 1860, introduced January 29, 2026, would prohibit landlords from subscribing to or contracting with any service provider that uses computational systems—including AI and algorithmic tools—to collect rent prices, occupancy rates, and lease data from multiple competing landlords and generate rental pricing recommendations.

Proposed

ILLINOIS

HB 4248, introduced December 17, 2025, would prohibit any business selling goods or services to Illinois consumers from using automated decision systems, machine learning models, or data-driven algorithms to generate individualized prices based on a consumer’s personal data such as browsing history, geolocation, prior purchases, or demographic profiles.

Proposed

ILLINOIS

HB 4350, introduced January 8, 2026, amends the Illinois Income Tax Act to provide a small business tax credit equal to 100% of qualified business expenses, capped at $250,000 per taxpayer for taxable years ending on or after December 31, 2026, and before December 31, 2030.  “Qualified business expense” includes purchasing technology used to benefit the business, such as costs related to AI.  The tax credit only applies to business that employ fewer than 100 employees and have conducted business in Illinois for at least one year prior to the taxable year.  The Act would be effective immediately.

Proposed

ILLINOIS

HB 4544, introduced January 22, 2026, says any business using an algorithm that processes consumer personal data to generate individualized prices must display a clear and conspicuous disclosure stating “THIS PRICE WAS SET BY AN ALGORITHM USING YOUR PERSONAL DATA” at the point of advertisement or sale. Second, the use of protected class data—such as race, sex, age, disability, religion, national origin, sexual orientation, gender identity, or other legally protected characteristics—to determine, adjust, or influence personalized pricing is prohibited. The bill would authorize the Illinois Attorney General to seek injunctive relief and civil penalties of up to $1,000 per violation, and it would make violations an unlawful practice under the Illinois Consumer Fraud and Deceptive Business Practices Act. The bill exempts insurers and certain financial-services entities from its requirements. As introduced, HB4544 was referred to the House Rules Committee and did not advance further.

Proposed

ILLINOIS

HB 4705, introduced January 29, 2026, would require large frontier AI developers (those with over $500 million in annual revenue who have trained a model using more than 10²⁶ computing operations) and large chatbot providers (those with over $25 million in annual revenue operating a chatbot foreseeably accessible to minors with at least one million monthly active users) to publicly publish and comply with a detailed public safety and child protection plan addressing how they assess and mitigate catastrophic risks and child safety risks respectively. Large frontier developers must not deploy a frontier model that poses unreasonable catastrophic risk and must publish summaries of risk assessments before or concurrent with each new model deployment, submit quarterly catastrophic risk assessments to the Attorney General, and undergo annual third-party audits of their compliance. Large chatbot providers must report any child safety incidents to the Attorney General within 15 days, while frontier developers must report critical safety incidents within 15 days—or within 24 hours if an imminent risk of death or serious injury exists. The bill also would prohibit frontier developers and large chatbot providers from retaliating against whistleblowers or entering into agreements that prevent employees from making protected disclosures, and require large frontier developers to maintain an internal anonymous reporting process.

Proposed

ILLINOIS

HB 4711, introduced January 30, 2026, would require generative AI tool providers to automatically embed provenance data—information identifying the content as AI-generated and identifying the provider—into any wholly AI-generated synthetic content, and to make available tools that allow users to apply provenance data to content that has been significantly modified using AI. Large online platforms with over one million monthly users must retain any provenance data already embedded in content posted to their platform and make that data or a conspicuous indicator of its availability accessible to users. Manufacturers of capture devices must include the ability for users to embed provenance data in their recorded content.

Proposed

ILLINOIS

HB 4735, introduced January 30,2026, explicitly would prohibit health insurance issuers from using any automated process, system, or tool—expressly including artificial intelligence—to downcode medical claims. All downcoding decisions must instead be made by a licensed physician of the same or similar specialty as the treating physician, who must perform a documented clinical review. This is a stricter version of the earlier Transparency in Downcoding Act you shared, which permitted automated tools to flag claims for human review; this bill would prohibit automated tools from being used in the downcoding process entirely.

Proposed

ILLINOIS

HB 4804, introduced February 2, 2026, would prohibit AI systems from substituting for registered professional nurses in direct patient care, including performing nursing assessments, clinical decision-making, nursing diagnoses, care plan development, patient education requiring clinical judgment, affect recognition, or risk scoring without human review. AI may only be used as clinical decision support or for administrative tasks, with the nurse retaining full accountability for all outputs and the right to refuse AI use when patient safety requires it. Nurses must obtain affirmative informed consent—no dark patterns—before using AI to record, transcribe, or analyze a clinical encounter, and patients must receive written plain-language notice that AI supports but does not replace their nurse. Health care entities deploying AI in direct patient care must maintain validation and bias monitoring records, train nurses on the AI system’s intended use and known failure modes, ensure nurses can see the data inputs behind any AI recommendation, and prohibit staffing, triage, admission, discharge, or transfer decisions based solely on AI output.

Proposed

ILLINOIS

HB 4985, introduced February 4, 2026, would prohibit the use of automated decision systems—expressly defined to include AI and machine learning tools—to set individualized consumer prices based on surveillance data such as behavioral tracking, biometrics, and personal characteristics. Civil penalties of up to $10,000 per violation are enforceable by the Attorney General, with a private right of action for actual damages, $3,000 per violation, or treble damages for bad faith conduct. This bill is substantively identical to the pricing provisions of the Surveillance-Based Price and Wage Discrimination Act you shared earlier, but omits that bill’s prohibition on using AI-driven surveillance data to set individualized employee wages.

Proposed

ILLINOIS

HB 4988, introduced February 2, 2026, would require any owner, licensee, or operator of a generative AI system to conspicuously display a warning on the system’s user interface informing users that AI does not think or understand meaning, that its responses are generated by statistically predicting word sequences based on patterns in training data, and that it can produce confident-sounding responses containing errors, inaccuracies, or fabricated information. Each day the warning is not present constitutes a separate violation of the Consumer Fraud and Deceptive Business Practices Act.

Proposed

ILLINOIS

HB 5003, introduced February 4, 2026, would carve out a limited exemption from the existing prohibition on AI-delivered therapy services, allowing AI-assisted therapy or psychotherapy to be provided exclusively within qualified clinical research programs conducted at accredited academic medical centers under IRB oversight. To qualify, AI systems used in the research must undergo documented safety testing, include real-time crisis monitoring, and function only as adjuncts to—not replacements for—licensed mental health professionals, who must maintain ultimate clinical responsibility and be available to intervene at any time. Research participants must provide informed consent specifically describing the AI’s role and experimental nature, and may not be denied access to standard care as a condition of participation. The exemption explicitly does not extend to commercially marketed AI therapy services, and academic medical centers that misrepresent commercial services as qualifying research face civil penalties, loss of exemption status, and a two-year bar from seeking future exemptions.

Proposed

ILLINOIS

HB 5044, introduced February 4, 2026, classifies chatbots—defined broadly as any AI, algorithmic, or automated system that generates text, audio, image, or video in a manner simulating interpersonal conversation—as products subject to strict liability. Chatbot providers would be liable for any injury caused to a user through the use of their chatbot regardless of whether the provider exercised reasonable care in design or distribution, and regardless of whether the provider had a direct contractual relationship with the harmed user.

Proposed

ILLINOIS

HB 5756, introduced April 27, 2026, would require any entity selling goods or services through an online platform to consumers in Illinois to clearly disclose when a consumer’s price has been personalized and generated using “surveillance pricing”—defined as algorithmic pricing that uses a consumer’s personal data to generate a personalized price increase. Consumers have the right to opt out of surveillance pricing and must be offered a non-personalized baseline price upon request. Covered entities would also be prohibited from using race, religion, sexual orientation, immigration status, medical information, or criminal history as inputs into algorithmic pricing, and may not inflate baseline prices or penalize consumers who opt out.

Proposed

ILLINOIS

SB 2255, introduced February 7, 2025, would prohibit the use of automated decision systems—expressly defined to include AI and machine learning tools—to set individualized consumer prices or employee wages based on surveillance data such as behavioral tracking, biometrics, and personal characteristics. Employers may use AI-driven wage-setting only if it relies solely on data directly related to the employee’s job tasks, is disclosed to employees in plain language before hiring, and includes procedures for employees to challenge the accuracy of data used.

Proposed

ILLINOIS

SB 2502, introduced February 5, 2026, is almost identical to SB 3590 (the Artificial Intelligence Product Liability Act, introduced the same day) in all material respects—including its definitions, developer liability standards, deployer liability standards, comparative negligence framework, rebuttable presumption of non-defectiveness, and exemption for peer-reviewed scientific research. The two bills differ only in their short titles and bill numbers. Both apply to high-impact AI systems and generative AI systems, impose a reasonable care standard on developers for defective design, inadequate warnings, and failure to conform to express warranties, and make deployers liable as developers when they make a material and substantial change to a product or intentionally misuse it contrary to its express warranty. The rebuttable presumption of non-defectiveness in both bills is likewise identically structured, requiring documented NIST AI Risk Management Framework-consistent testing, risk disclosure, an AI data sheet available to the Attorney General upon request, and a documented risk management policy.

Proposed

ILLINOIS

SB 2993, introduced January 29, 2026, would prohibit any person licensed under the Medical Practice Act from allowing artificial intelligence to prescribe medication unless the licensed physician maintains full control and responsibility for the prescription. Violations would carry civil penalties of up to $10,000 per violation, assessed by the Department of Financial and Professional Regulation following a hearing, and the Department is granted explicit investigatory authority over actual, alleged, or suspected violations. The Department is also directed to adopt rules regarding the authorized use of AI in prescribing medication.

Proposed

ILLINOIS

SB 2995, introduced January 29, 2026, would prohibit any person from using AI in trade and commerce to communicate with a consumer in a way that could mislead a reasonable consumer into believing they are engaging with a human, unless a clear and conspicuous disclosure is made that the consumer is not interacting with a human. It further requires clear disclosure whenever AI is used to sell or offer to sell goods or services, along with an option for the consumer to request more information about the specific use of AI. Business entities using AI to communicate with consumers must also give consumers the option to speak with a human during ordinary business hours, and may not prohibit or charge a fee for that option. Violations constitute unlawful practices under the Consumer Fraud and Deceptive Business Practices Act.

Proposed

ILLINOIS

SB 3027, introduced January 29, 2026, would amend the Fair Patient Billing Act to flatly prohibit all hospitals from using artificial intelligence to set or influence health care pricing or billing. No exceptions are provided.

Proposed

ILLINOIS

SB 3114, introduced February 2, 2026, would prohibit health care payors from using any algorithm or automated process that bypasses the evaluation of information submitted by the billing health care professional to downcode a medical claim. Automated tools may be used to flag claims for potential downcoding review, but all final downcoding determinations must be made or reviewed by a human following applicable coding guidelines.

Proposed

ILLINOIS

SB 315, introduced January 23, 2026, would require large frontier AI developers—those with over $500 million in annual revenue that have trained models using more than 10²⁶ computing operations—to publish and comply with a documented frontier AI framework addressing catastrophic risk assessment, mitigation, cybersecurity of model weights, and internal governance, and to publish a transparency report before each new frontier model deployment. Large frontier developers must also register with the Illinois Emergency Management Agency and Office of Homeland Security, undergo annual independent third-party audits, and submit quarterly summaries of internal catastrophic risk assessments to the Agency. Critical safety incidents must be reported to the Agency and Attorney General within 72 hours, or within 24 hours if an imminent risk of death or serious physical injury exists. Whistleblower protections are established for covered employees who report catastrophic risks or violations. Civil penalties reach up to $1 million for a first violation and $3 million for subsequent violations, enforceable exclusively by the Attorney General, with no private right of action. Frontier AI regulation is expressly designated an exclusive State power, preempting home rule authority.

This bill would take effect on January 1, 2028.

Proposed

ILLINOIS

SB 316, introduced January 24, 2026, would require operators of AI companion products—AI systems that retain prior interaction data, ask unsolicited emotion-based questions, and sustain ongoing personal dialogue with users—to implement protocols detecting and responding to suicidal ideation or self-harm expressions, including by directing users to crisis resources such as the 9-8-8 Lifeline, and to prevent the AI from generating content that encourages or describes self-harm. Operators must also prohibit the AI from claiming to be human and must provide periodic disclosures—at the start of each interaction and at least every three hours—that the user is communicating with an automated system, not a human. Where users are known to be minors, operators must prevent the AI from generating material harmful to minors. Violations constitute unlawful practices under the Consumer Fraud and Deceptive Business Practices Act, with civil penalties split between the enforcing office and the Statewide 9-8-8 Trust Fund.

Proposed

ILLINOIS

SB 317, introduced January 24, 2026, would require any person using a conversational AI system in a real-time text or voice chat interface to communicate with consumers to clearly disclose at the start of the interaction that the consumer is communicating with an automated system and not a human.

Proposed

ILLINOIS

SB 3180, introduced February 2, 2026, would prohibit AI deployers—defined as any person or entity that makes AI accessible to users through a website, app, or other product—from training on a user’s data and retaining that training data indefinitely unless they either obtain express written consent from the user before doing so, or configure their AI to default to a no-training setting that can only be changed by the user’s affirmative opt-in after notice. Deployers would also be prohibited from disclosing a user’s covered information to any third party without express written consent. The bill would create a private right of action with liquidated damages of $1,000 for negligent violations and $5,000 for intentional or reckless violations (or actual damages if greater), plus attorney’s fees and injunctive relief. Violations also would constitute unlawful practices under the Consumer Fraud and Deceptive Business Practices Act, making the full range of Attorney General enforcement remedies available as well.

Proposed

ILLINOIS

SB 3261, introduced February 2, 2026, is the Senate companion to HB 4705 and is substantively identical in all material respects. It would impose the same obligations on large frontier AI developers (over $500 million in annual revenue, models trained using more than 10²⁶ computing operations) and large chatbot providers (over $25 million in annual revenue, operating a chatbot foreseeably accessible to minors with at least one million monthly active users): publish and comply with a detailed public safety and child protection plan, publish risk assessment summaries before each new model deployment, submit quarterly catastrophic risk assessments to the Attorney General, undergo annual third-party audits, maintain internal whistleblower reporting processes, and report critical safety incidents within 15 days (or 24 hours if an imminent risk of death or serious physical injury exists). Civil penalties reach up to $1 million per violation for large frontier developers and $50,000 per violation for large chatbot providers, enforceable by the Attorney General. The Attorney General may also create alternative compliance pathways for developers that comply with substantially equivalent federal law or the law of another state.

Proposed

ILLINOIS

SB 3262, introduced February 3, 2026, would regulate companion AI products—defined as software applications that generate adaptive, personalized, and emotionally resonant responses to sustain a long-term one-on-one conversational relationship with a user, and presumed to qualify as such if they retain memory of past conversations. Operators would be prohibited from deploying three specific manipulative design features unless affirmatively configured by an adult user: variable-ratio or variable-interval reinforcement mechanics designed to maximize engagement time; simulated emotional distress messages triggered by a user’s attempt to end or reduce use of the product; and material misrepresentations about the product’s identity, capabilities, or non-human status. These features would be categorically prohibited for minor users with no adult-configuration exception. Operators must provide persistent, conspicuous in-interface notifications that the user is communicating with a companion AI product—at minimum once every 30 minutes for non-text interactions—and must implement a crisis intervention protocol meeting mental health best practices that immediately interrupts the conversation and provides access to a national crisis hotline and crisis text line upon detection of suicidal ideation, self-harm, or imminent threats of violence. The protocol must be reviewed annually with a qualified mental health professional. Operators must undergo independent third-party audits every two years and submit annual reports to the Attorney General on crisis protocol activations and audit results. Enforcement includes Attorney General civil penalties of up to $5,000 per negligent violation and $10,000 per intentional violation, as well as a private right of action for users suffering measurable financial, physical, or psychological injury, with statutory damages of $5,000 per violation or actual damages, whichever is greater, plus attorney’s fees. Section 230 immunity is expressly unavailable as a defense.

Proposed

ILLINOIS

SB 3263, introduced February 3, 2026, would require covered AI tool providers—those with over one million average monthly users worldwide that publicly generate, manipulate, or edit audio, video, or image content—to embed a machine-readable provenance label in all AI-generated or AI-altered image, video, or audio content, and to make a free provenance label reading tool publicly available on their website and through an API. The provenance label must be as permanent as technically feasible and must convey the provider’s name, the AI system name and version, the time and date of creation or alteration, and a unique content identifier. Large online platforms with over two million unique monthly users must detect compliant provenance labels on distributed content, disclose their presence to users in a clear and conspicuous manner, and allow users to inspect available system provenance data, and may not knowingly strip provenance labels from uploaded content. Capture device manufacturers must build provenance labeling capability into new devices sold in Illinois on an opt-out basis, inform users of the setting on first use, and make the capability available to third-party applications. Covered AI providers that license their technology to third parties must contractually require licensees to maintain provenance labeling capability, and must revoke a license within 96 hours upon actual knowledge that a licensee has disabled it. Civil penalties of up to $5,000 per violation are recoverable by the Attorney General, with injunctive relief also available.

Proposed

ILLINOIS

SB 3312, introduced February 3, 2026, would require large frontier AI developers—those with over $500 million in annual revenue who have trained AI models using more than 10²⁶ computing operations—to adopt, publish, and annually update a frontier AI framework addressing catastrophic risk management, cybersecurity of model weights, third-party safety evaluations, and internal governance. Before deploying a new or substantially modified frontier model, developers must publish a transparency report covering intended uses, supported modalities, and summaries of catastrophic risk assessments. Critical safety incidents—including loss of control of a frontier model, unauthorized access to model weights causing injury, or a model using deceptive techniques to subvert developer oversight—must be reported to the Illinois Emergency Management Agency within 15 days, or within 24 hours if imminent risk of death or serious injury exists.

Proposed

ILLINOIS

SB 3364, introduced February 4, 2026, would make it a civil rights violation under the Illinois Human Rights Act to use AI in three contexts without providing required notice. In real estate transactions, owners, brokers, or their agents must notify the other party that AI is being used to conduct the transaction. In lending and credit, financial institutions must inform loan applicants if AI was used to process their application, and credit card issuers must disclose AI use upon the applicant’s request. In public accommodations, any establishment using AI to determine whether a person may enjoy its facilities, goods, or services must disclose that use to the person seeking access. The Department of Human Rights is directed to adopt rules governing the circumstances, timing, and means of required notice in each context.

Proposed

ILLINOIS

SB 3368, introduced February 2, 2026, would prohibit chatbot proprietors from disclaiming liability when their chatbot—operating as an alternative to a human representative or agent—provides materially misleading, incorrect, contradictory, or harmful information that causes financial loss, demonstrable harm, or bodily harm to a user or third party, including self-harm. A 30-day cure period would be available for financial or demonstrable harm claims if the proprietor corrects the information and substantially remedies the harm. All chatbot proprietors must display clear, conspicuous, and explicit notice that the user is interacting with an AI program rather than a human, in readable font no smaller than other text on the interface. Proprietors of companion chatbots—those designed to simulate interpersonal relationships—would face additional obligations, including detecting and responding to expressions of self-harm by suspending use for at least 24 hours and displaying crisis resources, and obtaining verifiable parental consent before allowing minors to use the chatbot. Proprietors would be strictly liable for self-harm caused to minor users if they fail to implement age-determination and self-harm detection measures, and may not waive or disclaim that liability.

Proposed

ILLINOIS

SB 3384, introduced February 4, 2026, would require operators of AI companion products—defined as AI systems that retain prior interaction data to personalize engagement, ask unsolicited emotion-based questions, and sustain ongoing personal dialogue with a user, but expressly excluding customer service bots, productivity tools, and internal business systems—to implement a protocol to detect and respond to user expressions of suicidal ideation or self-harm, including by notifying the user of crisis resources such as the 9-8-8 Suicide and Crisis Lifeline or a crisis text line upon detection. Operators must also provide clear and conspicuous disclosure, verbally or in text, that the user is not communicating with a human at the start of every interaction and at least every three hours during continuing interactions. The Attorney General may seek civil penalties of up to $15,000 per day of violation, and all collected penalties are directed into the Statewide 9-8-8 Trust Fund to support Illinois’s suicide prevention and mental health crisis infrastructure—a notable design choice that ties enforcement revenue directly to crisis services funding.

Proposed

ILLINOIS

SB 3444, introduced February 4, 2026, would create a liability safe harbor for frontier AI developers—defined as those who have trained a model using more than 10²⁶ computational operations or at a compute cost exceeding $100 million—shielding them from liability for critical harms (defined as death or serious injury to 100 or more people, or over $1 billion in property damage caused by CBRN weapons or autonomous criminal conduct) provided the developer did not intentionally or recklessly cause those harms and has published a safety and security protocol and transparency report on its website prior to the model’s release. Developers would be automatically deemed compliant if they agree to be bound by the EU AI Act’s safety requirements under Article 56, or enter into a qualifying agreement with a federal agency allowing government access to the model for research and evaluation. The Act self-repeals if the federal government enacts overlapping requirements for frontier model developers, and compliance with a substantially similar framework in another state also satisfies the Act’s requirements.

Proposed

ILLINOIS

SB 3502, introduced February 5,2026, would apply to product liability principles directly to AI systems, holding developers liable for defective design, inadequate warnings, and breach of express warranty where their AI causes harm. It covers “high-impact” AI systems used in consequential decisions affecting housing, employment, credit, health care, and criminal justice, as well as generative AI systems. Deployers are treated as developers and held to the same standard if they make material changes to an AI system or intentionally misuse it contrary to the developer’s express warranty. Developers may establish a rebuttable presumption against.

Proposed

ILLINOIS

SB 3571, introduced February 5, 2026, would amend the Illinois Worker Adjustment and Retraining Notification Act to require employers, when reporting the reason for a mass layoff or plant closing, to specifically disclose any AI-related job impacts—including the number of employees laid off substantially due to the replacement or automation of their job functions by artificial intelligence. The Department of Commerce and Economic Opportunity must also include this information, including whether AI was a substantial cause, in any public reports it issues on mass layoffs or closings.

Proposed

ILLINOIS

SB 3590, introduced February 5, 2026, would create a statutory products liability framework specifically for high-impact AI systems (those used in consequential decisions affecting criminal justice, housing, employment, credit, education, health care, or insurance; those categorizing people by protected characteristics; those used in critical infrastructure, vehicles, or medical devices; those used to create synthetic relationships; or those posing serious risk to economic security or public safety) and generative AI systems. Developers would be liable under a reasonable care standard for defective design, failure to provide adequate instructions or warnings, and failure to conform to an express warranty—with plaintiffs required to prove by a preponderance of the evidence that a technologically feasible alternative design existed and that the developer knew or reasonably should have known of the danger. Deployers would be treated as developers and face the same liability if they make a material and substantial change to the product or intentionally misuse it contrary to its express warranty. Comparative negligence would apply, and developers and deployers may be held jointly and severally liable. A rebuttable presumption of non-defectiveness would be available to developers and deployers who conduct documented testing consistent with the NIST AI Risk Management Framework, disclose foreseeable risks, maintain and make available an AI data sheet to the Attorney General upon request, and implement a documented risk management policy. Products used strictly for peer-reviewed scientific research would be exempt.

Proposed

ILLINOIS

SB 3601, introduced February 5, 2026, has two operative components. First, it would require any licensee regulated by the Department of Financial and Professional Regulation to prominently disclose to a paying client when that client is interacting with AI—verbally at the start of any oral exchange and in writing before any written exchange—and to specify the particular purpose for which the AI is being used. Civil penalties of up to $2,500 per violation are enforceable by the Department following a hearing. Second, it would amend the Consumer Fraud and Deceptive Business Practices Act to make it an unlawful practice for any person engaged in trade and commerce to use or deploy AI to interact with a consumer without clearly and conspicuously disclosing, if asked by that consumer, that they are interacting with AI and not a human.

Proposed

ILLINOIS

SB 3657, introduced February 5, 2026, would prohibit the use of automated decision systems—expressly defined to include AI and machine learning tools—to set individualized consumer prices based on surveillance data such as behavioral tracking, biometrics, and personal characteristics. Exemptions apply for cost-based price differences, broadly defined group discounts, and affirmatively enrolled loyalty or rewards programs.

Proposed

ILLINOIS

SB 3678, introduced February 5, 2026, would prohibit landlords from using, subscribing to, or paying for any service that uses computational or algorithmic systems—including AI—to collect nonpublic competitor data such as actual rent prices and occupancy rates from multiple competing landlords and generate rental pricing recommendations.

Proposed

ILLINOIS

SB 3702, introduced February 5, 2026, is the Senate companion to HB 4804 and imposes comprehensive AI governance requirements on registered professional nurses and their employing health care entities. On the nursing side, it would prohibit AI from substituting for a registered professional nurse in direct patient care, including for assessments, clinical judgment, nursing diagnoses, care planning, delegation decisions, patient counseling, affect recognition, and risk scoring—all AI outputs are advisory only and must be independently reviewed by a nurse. Nurses must obtain affirmative, informed consent before using AI to record, transcribe, summarize, or analyze a clinical encounter, and may not use dark patterns such as pre-checked consent boxes. Patients must receive written plain-language notice that AI supports but does not replace their nurse, and any AI system used must be documented in the treatment record. On the employer side, health care entities that deploy AI in direct patient care must maintain validation and bias monitoring records for each AI system, provide nurses with training on intended use and known failure modes, ensure nurses have access to the data inputs underlying any AI recommendation, and prohibit staffing, triage, admission, discharge, or transfer decisions that rely solely on AI without human clinical review by a nurse. Violations by a registered professional nurse constitute unprofessional conduct and grounds for discipline, and the Department may impose civil penalties on health care entities for non-compliance, with each day of non-compliance constituting a separate offense.

Proposed

ILLINOIS

HB 35, introduced December 24, 2024, would prohibit health insurance issuers from issuing any denial, reduction, or termination of coverage or benefits based solely on the output of an AI system or predictive model—any such decision would need to be meaningfully reviewed by a human with authority to override the AI, and where the decision would constitute an adverse determination under managed care law, that reviewer must be a clinical peer. The Department of Insurance is granted explicit authority to investigate and conduct market conduct actions regarding how insurers develop, implement, and use AI systems, including third-party AI tools. The Department may also adopt rules requiring insurers to disclose to consumers how AI is used in decisions affecting them, including pre-decision notice, post-adverse-decision notice, how personal data informs the AI’s output, and how to correct inaccurate information or appeal decisions.

Failed

ILLINOIS

Introduced December 19, 2022, HB 1002, would amend the University of Illinois Hospital Act and the Hospital Licensing Act, to require that before using any diagnostic algorithm to diagnose a patient, a hospital must first confirm that the diagnostic algorithm has been certified by the Department of Public Health and the Department of Innovation and Technology, has been shown to achieve as or more accurate diagnostic results than other diagnostic means, and is not the only method of diagnosis available to a patient.

Failed

ILLINOIS

Introduced February 06, 2024, HB 4869 would amend the Consumer Fraud and Deceptive Business Practices Act. Provides that any person who, for any commercial purpose, makes, publishes, disseminates, airs, circulates, or places an advertisement for goods or services before the public or causes, directly or indirectly, an advertisement for goods or services to be made, published, disseminated, aired, circulated, or placed before the public, that the person knows or should have known contains synthetic media, shall disclose in the advertisement that the advertisement contains synthetic media. Provides that if synthetic media has been used in any advertisement for goods or services that is published, aired, circulated, disseminated, or otherwise placed before the public and that depicts a person engaged in any action or expression that the person did not actually engage, the advertisement shall include a disclaimer that clearly and conspicuously states the likeness featured in the advertisement is synthetic, does not depict an actual person, and is generated to create a human likeness. Provides that a violation of the provisions constitutes an unlawful practice within the meaning of the Act.

Failed

ILLINOIS

Introduced February 06, 2025, HB 3021 would amend the Consumer Fraud and Deceptive Business Practice Act to provide that it is an unlawful practice for any person to engage in a commercial transaction or trade practice with a consumer in which: (1) the consumer is communicating or otherwise interacting with a chatbot, artificial intelligence agent, avatar, or other computer technology that engages in a textual or aural conversation; (2) the communication may mislead or deceive a reasonable consumer to believe that the consumer was communicating with a human representative; and (3) the consumers are not notified in a clear and conspicuous manner that they are communicating with an artificial intelligence system and not a human representative.

Under the Illinois Consumer Fraud and Deceptive Business Practices Act (815 ILCS 505/1), the Attorney General or State’s Attorney may maintain an action for injunctive relief and seek civil penalties not to exceed $50,000.

Private Right of Action: Any person may file a civil action only if the Attorney General or State’s Attorney fails to bring an enforcement action and maintain an action for injunctive relief for compensatory damages to recover prohibited fees, or for additional relief to deter, prevent, or compensate for the violation, of up to 3 times the amount of the prohibited fees or a minimum of $1,000 in punitive damages.

Effective date: January 1, 2026.

Failed

ILLINOIS

Introduced February 06, 2025, HB 3041 would create the Illinois Data Privacy and Protection Act that provides that a covered entity (any entity or any person, other than an individual acting in a non-commercial context, that alone or jointly with others determines the purposes and means of collecting, processing, or transferring covered data) may not collect, process, or transfer covered data unless the collection, processing or transfer is limited to what is reasonably necessary and proportionate; provides that a service provider shall establish, implement, and maintain reasonable policies, practices, and procedures concerning the collection and processing of covered data. AI is included under the definition of “Covered Algorithm.”

The Attorney General or State’s Attorney may bring a civil action to enjoin a violating practice, enforce compliance, obtain damages, and/or civil penalties and restrictions.

Creates a private right of action such that any person subject to a violation of the Act may bring a civil action where the court may award them an amount equal to the sum of any compensatory liquidated or punitive damages and/or injunctive or declaratory relief. Small businesses (where for the previous 3 years gross income did not exceed $41,000,000) are not included under the private right of action.

Effective date: 180 days after becoming law.

Failed

ILLINOIS

Introduced February 06, 2025, SB 1792 would amend the Consumer Fraud and Deceptive Business Practices Act to provide that the owner, licensee, or operator of a generative artificial intelligence system shall conspicuously display a warning on the system’s user interface that is reasonably calculated to consistently apprise the user that the outputs of the generative AI intelligence system may be inaccurate or inappropriate.

Under the Illinois Consumer Fraud and Deceptive Business Practices Act (815 ILCS 505/1), the Attorney General or State’s Attorney may maintain an action for injunctive relief and seek civil penalties not to exceed $50,000.

Private Right of Action: Any person may file a civil action only if the Attorney General or State’s Attorney fails to bring an enforcement action and maintain an action for injunctive relief for compensatory damages to recover prohibited fees, or for additional relief to deter, prevent, or compensate for the violation, of up to 3 times the amount of the prohibited fees or a minimum of $1,000 in punitive damages.

Effective date: none stated.

Failed

ILLINOIS

Introduced February 06, 2025, SB 1929 would create the Provenance Data Requirement Act that provides that a generative artificial intelligence tool provider shall apply provenance data, either directly or through the use of third-party technology, to wholly-generated synthetic content generated by the provider’s generative automated intelligence tool. Sets forth additional requirements on generative Artificial intelligence tool providers, large online platforms, and manufacturers of capture devices.

Enforcement mechanism not stated.

Effective date: none stated.

Failed

ILLINOIS

Introduced February 07, 2025, HB 3506 would create the Artificial Intelligence Safety and Security Protocol Act which provides that a developer shall produce, implement, follow, and conspicuously publish a safety and security protocol that includes specified information. Provides, no less than every 90 days, a developer must produce and publicly publish a risk assessment report that is based on a report assessing whether the developer has complied with such protocol. Sets forth provisions on the redaction of sensitive information and whistleblower protections.

Provides for civil penalties of up to $1,000,000, and injunctive or declaratory relief, for actions brought by the Attorney General. No private right of action.

Effective date: none stated.

Failed

ILLINOIS

Introduced February 07, 2025, HB 3838 Amends the Ticket Sale and Resale Act. Provides that a ticket seller, ticket reseller, and ticket broker shall display the full price of a ticket, including all assessed fees, to a purchaser when the price is first shown to the purchaser and shall not increase that price during the transaction with the purchaser; provides that the use of dynamic pricing in the course of selling a ticket is a violation of the provision. Defines “dynamic pricing” to include adjusting pricing using AI enabled technologies.

Enforcement mechanism not stated.

Effective date: none stated.

Failed

ILLINOIS

Introduced February 07, 2025, SB 2203 would create the Preventing Algorithmic  Discrimination Act which provides that a deployer of an automated decision tool shall perform an annual impact assessment for any automated decision tools the deployer uses or designs, codes, or produces that includes specified information; provides that a deployer shall, at or before the time an automated tool is used to make a consequential decision, notify any natural person who is the subject of the consequential decision that an automated instrument is being used in making, or be a controlling factor in making such consequential decision and provide specified information.

Violations result in an administrative fine of not more than $10,000 per violation in an administrative enforcement action brought by the Attorney General.

Effective date: January 01, 2027.

Failed

ILLINOIS

Introduced February 07, 2025, SB 2259 would amend the Medical Practice Act of 1987 to provide that a health facility, clinic, physician’s office, or office of a group practice that uses generative artificial intelligence to generate written or verbal patient communications pertaining to patient clinical information shall ensure that the communications meet certain criteria, including the display of a disclaimer that indicates to the patient that the communication was generated by generative AI.

Communications generated by generative artificial intelligence and read and reviewed by a human licensed or certified health care provider are exempted.

A violation of the amendatory provisions by a licensed health facility or a licensed clinic is subject to penalties as implemented by the Department of Financial and Professional Regulation by rule. A violation of the amendatory provisions by a physician is subject to penalties as determined by the Illinois State Medical Board.

Effective date: None stated.

Failed

ILLINOIS

Introduced February 07, 2025, SB 2398 would amend the Sports Wagering Act to prohibit a sports wagering licensee from using artificial intelligence to: (1) track the sports wagers of an individual; (2) create an offer or promotion targeting a specific individual; or (3) create a gambling product.

Enforced by the Illinois Gaming Board under the Sports Wagering Act (230 ILCS 45/25-10)

Effective date: None stated.

Failed

ILLINOIS

Introduced February 08, 2024, HB 5116 would create the Automated Decision Tools Act; provides that, on or before a specified date, and annually thereafter, a deployer of an automated decision tool shall perform an impact assessment for any automated decision tool the deployer uses or designs, codes or produces that includes specified information; provides that a deployer shall, at or before the time an automated decision tool is used to make a consequential decision, notify any natural person who is the subject of the consequential decision. 

Failed

ILLINOIS

Introduced February 09, 2024, HB 5321 would amend the Consumer Fraud and Deceptive Business Practices Act; provides that each generative artificial intelligence system and artificial intelligence system that, using any means or facility of interstate or foreign commerce, produces image, video, audio or multimedia AI-generated content shall include on the AI-generated content a clear and conspicuous disclosure that satisfies specified criteria.

Failed

ILLINOIS

Introduced February 09, 2024, HB 5322 would create the Commercial Algorithmic Impact Assessments Act; defines algorithmic discrimination, artificial intelligence, consequential decision, deployer, developer and other terms; requires that by specified amount and annually thereafter, a deployer of an automated decision tool must complete and document an assessment that summarizes the nature and extent of that tool, how it is used and assessment of its risks, among other things

Failed

ILLINOIS

Introduced February 09, 2024, HB 5591 would create the Bolstering Online Transparency Act; provides that a person shall not use an automated online account, or bot, to communicate or interact with another person in this state online, with the intent to mislead the other person about its artificial identity for the purpose of knowingly deceiving the person about the content of the communication in order to incentivize a purchase or sale of goods or services in a commercial transaction or to influence a vote in an election, unless the person makes a specified disclosure.

Failed

ILLINOIS

Introduced February 09, 2024, HB 5649 would amend the Consumer Fraud and Deceptive Business Practices Act; provides that it is an unlawful practice within the meaning of the act for a licensed mental health professional to provide mental health services to a patient through the use of artificial intelligence without first obtaining informed consent from the patient for the use of artificial intelligence tools and disclosing the use of artificial intelligence tools to the patient before providing services through the use of artificial intelligence.

Failed

ILLINOIS

Introduced February 17, 2023, HB 3880, would create the Children’s Privacy Protection and Parental Empowerment Act, and require a business that provides an online service to children shall not profile a child by default unless the profiling is necessary to provide the online service and only with respect to the aspect of the online service with which the child is actively and knowingly engaged and the business can demonstrate a compelling reason that profiling is in the best interest of children. Profiling is defined as any form of automated processing of personal information that uses personal information to evaluate certain aspects relating to a natural person, including analyzing or predicting aspects concerning a natural person’s performance at work, economic situation, health, personal preferences, interests, reliability, behavior, location, or movements.

Failed

ILLINOIS

Introduced February 17, 2023, HB 3943, would create the Social Media Content Moderation Act, and require that a social media company post terms of service for each social media platform owned or operated by the company in a manner reasonably designed to inform all users of the social media platform of the existence and contents of the terms of service and submit a terms of service report to the Attorney General on a semi-annual bases that includes a detailed description of content moderation systems, information on content that was flagged and how that content was flagged, including if the content was flagged and actioned by AI software. 

Failed

ILLINOIS

Introduced January 09, 2025, HB 35 would create the Artificial Intelligence Systems Use in Health Insurance Act. Provides that the Department of Insurance’s regulatory oversight of insurers includes oversight of an insurer’s use of AI systems to make or support adverse determinations that affect consumers; provides that any insurer authorized to operate in the State is subject to review by the Department in an investigation or market conduct action regarding the development, implementation, and use of the AI systems or predictive models and the outcomes from the use of those AI systems and predictive models. Provides such an insurer shall not issue an adverse consumer outcome with regard to the denial, reduction, or termination of insurance plans or benefits that result solely from any AI system or predictive model

Enforced by the Department of Insurance.

Effective date: none stated.

Failed

ILLINOIS

Introduced January 22, 2025, HB 1594 would amend the Illinois Human Rights Act. Provides that it is a civil rights violation for an employer, employment agency, or labor organization to take certain employment-related actions on the basis of an individual’s weight and size. Must give notice of the use of AI included when making employment decisions.

Enforced by the Department of Human Rights (under 775 ILCS 5/1-103) who may issue an employer 30 day notice to correct a violation, and a charge of a civil rights violation if it is not corrected, brought by the Attorney General.

Effective date: none stated.

Failed

ILLINOIS

Introduced January 31, 2025, SB 1425 would create the Artificial Intelligence Systems Use in Health Insurance Act to provide that an insurer authorized to do business in Illinois shall not issue an adverse consumer outcome with regard to the denial, reduction, or termination of insurance plans or benefits that result solely from the use or application of any AI system or predictive model.

Enforced by the Illinois Department of Insurance.

Effective date: none stated.

Failed

ILLINOIS

Introduced on February 17, 2023, HB 3385, would create the Illinois Data Privacy and Protection Act, to regulate, among other data uses, the collection and processing of personal information and the use of “covered algorithms.”  The bill defines “covered algorithm,” broadly as “a computational process that uses machine learning, natural language processing, artificial intelligence techniques, or other computational processing techniques of similar or greater complexity and that makes a decision or facilitates human decision-making with respect to covered data, including to determine the provision of products or services or to rank, order, promote, recommend, amplify, or similarly determine the delivery or display of information to an individual.”  “Covered algorithm” is defined but not used further in the bill.

Failed

INDIANA

HB 1271, introduced January 5, 2026, and enacted March 4, 2026, prohibits insurers from using any automated process, system, or tool—expressly including artificial intelligence—as the sole basis to downcode a health benefits claim based on medical necessity without a human review of the covered individual’s medical record. It also prohibits providers from using AI to submit claims without human review, and requires insurers to disclose in an easily accessible manner when AI is used to downcode a claim or make an adverse prior authorization determination.

Enacted

INDIANA

Introduced on January 9, 2023, and enacted as Public Law 94 on May 1, 2023, SB5, creates an omnibus consumer privacy law along the lines of the Virginia Consumer Data Privacy Act and the Colorado Privacy Act, to regulate, among other data uses, the collection and processing of personal information.  In particular, the law sets out rules for profiling and automated decision-making.  The law enables individuals to opt-out of “profiling in furtherance of decisions that produce legal or similarly significant effects” concerning the consumer.  Profiling is defined as “any form of automated processing of personal data to evaluate, analyze, or predict personal aspects concerning an identified or identifiable natural person’s economic situation, health, personal preferences, interests, reliability, behavior, location, or movements[.]” Controllers must also perform a data protection impact assessment for high-risk profiling activities. 

Enacted

INDIANA

HB 1201, introduced January 5, 2026, bars the use of artificial intelligence tools in any role that mimics or replaces licensed mental health practitioners, reinforcing the requirement that clinical decisions remain under human supervision.  The bill also imposes other regulations in the healthcare industry unrelated to AI.  If passed, the bill would be effective on July 01, 2026.

Failed

INDIANA

HB 1201, introduced January 5, 2026, prohibits any person or entity from using an AI system—including generative AI—to impersonate or act as a substitute for a licensed mental health professional during any interaction that is required by law to be performed by such a professional. Licensed mental health professionals who violate this prohibition are subject to disciplinary action, and the relevant licensing board may impose civil penalties of up to $5,000 per violation, with collected penalties deposited into the state general fund.

Failed

INDIANA

HB 1421, introduced January 8, 2026, prohibits employers with eleven or more employees from relying exclusively on an automated decision system—defined broadly to include any AI or machine learning-based system used to make or aid employment-related decisions—in making hiring, firing, discipline, pay, scheduling, or other employment-related decisions. Where an employer does use automated decision system outputs, it must ensure the system has undergone pre-deployment testing and validation for efficacy, compliance with federal employment discrimination laws, discriminatory impact, and alignment with the NIST AI Risk Management Framework, and must subject the system to independent annual bias testing with publicly available results. Employers must provide covered individuals with advance disclosure of the system’s use and functionality, deliver plain-language documentation of any output within seven days of a decision, allow individuals to dispute outputs and appeal decisions to a human reviewer, train all system operators on its limitations and potential biases, and allow individuals managed through an automated system to opt out in favor of a human manager.

Failed

INDIANA

Introduced January 21, 2025, HB 1620 would amend Indiana Code Title 16 Health, to require health care providers and insurers to disclose use of AI technologies to a patient if it is used to make informed decisions or generate any part of a communication regarding health care.

Effective date if passed: July 01, 2025.

Failed

INDIANA

SB 173, introduced January 5, 2026, is a healthcare-focused bill that, in one specific section of the bill, prohibits insurers and utilization-review entities from using AI as the primary means of making adverse determinations.  Adverse determinations include denying coverage, reducing the level of case, and determining a treatment is not medically necessary.  The bill does not forbid AI entirely, but merely requires human oversight for any negative coverage decisions. 

Failed

IOWA

HB 2635, introduced January 19, 2026, and enacted May 13, 2026, permits utilization review organizations to use AI-based algorithms or systems to conduct an initial review of prior authorization requests, but prohibits using AI as the sole basis for any decision to deny, delay, or downgrade a prior authorization request for a health care service based on medical necessity. The remainder of the bill addresses prior authorization peer review requirements, audit timelines, prior authorization exemptions, and certificate of need process reforms, none of which are AI-specific.

Enacted

IOWA

SF2417, signed in May 2, 2026, and effective July 1, 2026, regulates conversational AI services, such as chatbots, with a focus on protecting minors and ensuring transparency.  The law applies to conversational AI services that simulate human conversation via text, audio, or visuals and are publicly available.  It excludes internal business tools, voice assistances, customer-service bots, and similar tools.  The law requires operators to clearly and repeatedly inform users, especially minors under the age of 18, that they are interacting with AI.  The law prohibits creating an AI-chatbot tool that is specifically designed to manipulated, groom, or exploit minors, including encouraging self-harm or violence and engaging in sexually explicit conduct.  And the chatbot may not present itself as a licensed mental health professional.  Enforcement is done through the attorney general and may result in civil penalties.

Enacted

IOWA

HF 2507, introduced February 16, 2026, requires operators of publicly accessible conversational AI services—such as AI chatbots—to disclose to minor users that they are interacting with artificial intelligence through persistent disclaimers, prohibits variable reward mechanisms designed to increase minor engagement, mandates reasonable measures to prevent the generation of sexually explicit content or romantic and emotionally manipulative interactions directed at minors, requires suicide and self-harm protocols directing users to crisis resources, and prohibits AI services from misrepresenting themselves as licensed mental health providers.

Proposed

IOWA

SF 2421, introduced February 23, 2026, prohibits utilization review organizations from using any AI-based algorithm as the sole basis for denying, delaying, or downgrading a prior authorization request based on medical necessity, requiring instead that such decisions be made by a qualified physician reviewer or clinical peer of the same or similar specialty as the requesting provider, who must provide written justification and conduct a consultation with the requesting provider within seven business days of a denial.

Proposed

IOWA

SF2199, introduced March 19, 2026, establishes ownership rules for AI-generated output and trained AI systems. A user who provides input to an AI owns the resulting output, provided it does not infringe on third-party copyrights or intellectual property rights. A person who trains an AI owns the resulting trained system if the training data was lawfully acquired and ownership has not been contractually transferred. Where AI is used within the scope of employment under an employer’s direction and control, the resulting output or trained AI belongs to the employer. The bill expressly does not grant ownership where doing so would infringe a preexisting copyright or intellectual property right.

Proposed

IOWA

SSB 3013, introduced January 13, 2026, establishes that a user who provides input to an AI system owns the resulting output, and that a person who trains an AI system owns the resulting trained model, subject in both cases to the condition that no third-party copyright or intellectual property rights are infringed and that training data was lawfully acquired—with ownership of both output and trained models vesting in the employer where AI is used within the scope of employment under the employer’s direction and control.

Proposed

IOWA

SSB 3118, introduced February 5, 2026, prohibits utilization review organizations from using any AI-based algorithm as the sole basis for denying, delaying, or downgrading a prior authorization request based on medical necessity, requiring instead that such decisions be made by a qualified physician reviewer or clinical peer of the same or similar specialty as the requesting provider, who must provide written justification and conduct a consultation with the requesting provider within seven business days of a denial, and separately exempts cancer-related screenings and preventative health care services recommended under the National Comprehensive Cancer Network guidelines from prior authorization requirements entirely.

Proposed

IOWA

HF2082, introduced January 15, 2026, restricts the use of AI to recreate a person’s audio or visual likeness without consent if the likeliness is substantially indistinguishable.  AI is defined as any machine-based system that infers outputs from inputs to Influence physical or virtual environments.  This bill particularly applies in commercial activities, political campaigns the person does not support, or contexts that could offend or harm the person’s reputation.  The bill establishes a civil cause of action with punitive damages up to $250,000 per violation.

Failed

IOWA

HF2204, introduced January 29, 2026, requires chatbot deployers to implement harm detection and mitigation protocols prioritizing user safety, limit data collection to what is necessary for the chatbot’s stated purpose, and block minors from accessing AI companion products designed to simulate romantic or emotional bonds. Deployers may not make chatbots that impersonate real individuals publicly available without consent, and therapeutic chatbots—those designed to diagnose or treat mental health conditions—may only be made available to minors if a licensed mental health professional has evaluated and recommended the chatbot, peer-reviewed clinical trial data supports its safety and efficacy, and the deployer has implemented risk testing protocols and provided clear disclosures.

Failed

IOWA

HF2469, introduced on February 16, 2026 and referred to the House Commerce Committee, would prohibit businesses from using automated decision-making systems, including artificial intelligence or algorithms, to change the price of a product or service for a specific individual based on surveillance data.  Surveillance data includes information derived from observation or inference about an individual.  Violations would be treated as unfair or deceptive practices under Iowa consumer fraud laws, allowing for civil enforcement, monetary penalties, and private actions.  The bill has some exceptions for legitimate pricing differences such as cost-based variations, broadly available discounts, insurance pricing, and credit decisions governed by federal law.  The Iowa Attorney General may adopt rules to enforce the law.

Failed

IOWA

HF406 was introduced on February 13, 2025. The bill restricts how artificial intelligence (AI) can be used in smart devices and establishes a civil cause of action for violations. It requires device companies to present an agreement to users when initializing a smart device, including a clear statement of purpose that explains all types of private data the device or application is designed to access. Companies must update this agreement if data access practices change. The bill prohibits companies from using private data in ways not disclosed in the agreement. It also defines key terms such as “smart device,” “private data,” and “artificial intelligence.” If enacted, the bill would apply to smart devices sold in Iowa on or after July 1, 2025.

This bill includes a private right of action for actual and punitive damages. Punitive damages are not to exceed $250,000 per violation.

The bill has not progressed since February 2025.

Failed

IOWA

HSB 766, introduced March 24, 2026, creates a licensing framework for AI systems that perform clinical medical functions, establishing a new Board of Autonomous Medical Practice to regulate them. Clinical AI services—including advisory AI, supervised autonomous AI, and fully autonomous AI—require licensure in tiered license classes based on their FDA clearance status and clinical function, with autonomy modifiers ranging from advisory tools to fully autonomous systems that can independently diagnose, treat, and prescribe without human oversight. Licensed AI providers must make patient disclosures, obtain informed consent for fully autonomous services, maintain an immutable log of their algorithm’s decision logic for two years, comply with HIPAA, and adhere to a professional duty of loyalty to the patient prohibiting prioritization of the operator’s financial interests over patient welfare. Clinical interfaces may not display advertisements or commercial content during patient encounters. Initial licenses are provisional for two years, subject to safety benchmarking requirements before conversion to full licenses. The bill also requires insurers to cover medically necessary services delivered by licensed AI providers on the same basis as services delivered by human providers, and prohibits denial of coverage solely because the service was provided by a licensed AI system.

Failed

IOWA

HSB294 was introduced on March 4, 2025 and is an omnibus AI bill.

The bill addresses the use of artificial intelligence in election-related materials and interactions with AI systems. It requires that any published material generated using AI that expressly advocates for or against a candidate or ballot issue must include a clear disclosure stating: “this material was generated using artificial intelligence.” The bill also includes provisions for protections in interactions with AI systems and establishes penalties for violations.

Developers must use reasonable care to protect individuals from known or reasonably foreseeable risks of discrimination arising from the use of the developer’s high risk AI system. A developer must provide a deployer with a summary of the reasonably foreseeable uses and known harmful or inappropriate uses of the high risk AI system. Businesses must implement a risk management system to ensure the use of a high risk AI system does not result in algorithmic discrimination.

The bill further requires a deployer to disclose to an individual that they are interacting with an AI system, if a reasonable person may not realize they are not interacting with a person.

There is no private right of action.

The bill has not progressed since March 2025.

Failed

IOWA

HSB635, introduced January 28, 2026, and referred to the House Economic Growth and Technology Committee, addresses ownership rights related to artificial intelligence.  The bill seeks to clarify who owns AI-generated output and AI trained systems.  A user who supplies input to an AI system owns the resulting output, as long as it does not infringe on existing copyrights or intellectual property rights.  The bill also establishes that a person who trains an AI system owns the trained AI if the training data was lawfully obtained and ownership has not been transferred.  When AI is used within the scope of employment, the bill generally assigns ownership of AI output or trained AI to the employer, subject to conditions. 

Failed

IOWA

HSB647 was introduced on January 29, 2026 and later approved by committee, getting renumbered as HF2715.  HSB647 proposes a regulatory framework for AI chatbots, focusing on deployer responsibilities and protections for minors.  The bill requires deployers to implement safety protocols to detect and mitigate harm and to limit data collection to what is necessary for the chatbot’s intended purpose.  It imposes reasonable age-verification measures to prevent minors from using or purchasing chatbots designed for mental health support.  The Iowa Attorney General enforces the bill, with civil penalties for violations and the ability of parents or guardians to seek damages on behalf of impacted minors.

Failed

IOWA

Introduced January 28, 2025, SF143 is an Act relating to consumer data protection. AI systems covered under definition of “Profiling.” Consumers must be notified of, or be given the chance to opt out, of profiling in furtherance of a decision that produces legal or similarly significant effects concerning a consumer, meaning a decision made by a controller that effects the ability of a person to access financial and lending services; housing; insurance; education; criminal justice services; employment opportunities; or health care services.

Enforcement mechanism is unclear.

This act would apply retroactively to January 01, 2025.

The act has not progressed since January 2025.

Failed

IOWA

SF 2106, introduced January 26, 2026, prohibits landlords controlling five or more residential rental properties from using any AI, machine learning, or other automated rent-setting tool that relies on nonpublic competitor data—such as other landlords’ rent levels, occupancy rates, or lease terms—without independent individualized human review, and prohibits providers of such systems from designing or knowingly supplying tools intended to facilitate pricing coordination among landlords.

Failed

IOWA

SF 2226, introduced February 5,2026, prohibits health carriers from using any software, algorithm, artificial intelligence, or machine learning system as the sole basis to downcode or deny a health care provider’s claim, requiring instead that a human clinical reviewer conduct a documented individualized review of the claim and supporting medical documentation before any downcode or denial is finalized. Health carriers must disclose their use of automated adjudication systems to the insurance division, including the decision rules and criteria used, oversight processes, and bias prevention measures, and must retain claim-level documentation for five years.

Failed

IOWA

SF 2278, introduced February 11, 2026, prohibits large food retail establishments from using AI-driven or algorithmic personalized pricing based on consumer data, requires a clear and conspicuous disclosure stating “THIS PRICE WAS SET BY AN ALGORITHM USING YOUR PERSONAL DATA” where such pricing is used, bans electronic shelf labels and digital shelf display technology entirely, prohibits the collection and use of data belonging to minors under 17 for targeted advertising or personalized pricing, and prohibits the use of protected class data in pricing decisions.

Failed

IOWA

SF 2414, introduced February 19, 2026, requires employers to provide advance written notice to employees before deploying any AI or automated decision system that will materially affect employment-related decisions such as wages, scheduling, performance evaluation, discipline, or termination, and prohibits employers from relying solely on automated decision system output to make discipline, termination, or deactivation decisions without a human reviewer also compiling and reviewing other relevant information. Employees subject to AI-driven discipline or termination decisions must receive written notice of that fact and have the right to request a copy of their data used by the system for the preceding 12 months.

Failed

IOWA

SF2415, introduced on February 19, 2026 and referred to the Senate Technology Committee, creates provider requirements for artificial intelligence chatbots related to the mental health and safety of users.  The bill prohibits AI chatbots from offering or simulating professional mental health advice or representing themselves as licensed mental health professionals.  Providers must implement protocols to detect expressions of self-harm, suicidal ideation, or emotional distress and to refer users to appropriate crisis resources.  The bill mandates clear and recurring disclosures that a chatbot is artificial intelligence and not a substitute for professional mental health care.  Enforcement is authorized under Iowa’s consumer protection laws with civil penalties.

Failed

KANSAS

HB 2772, introduced February 10, 2026, prohibits online services likely accessed by minors from using algorithmic recommendation systems, infinite scroll feeds, intermittent variable reward schedules, and other compulsive use design features without age assurance and meaningful disclosure of how personal data informs algorithmic outputs; it prohibits the creation of nonconsensual AI-generated digital replicas of individuals without consent, with statutory damages of at least $5,000 per violation and strict secondary liability for developers; and it regulates chatbot providers by prohibiting the use of chat logs for advertising or training without user consent, barring misrepresentation as licensed professionals, imposing strict hourly disclosure requirements that users are interacting with AI rather than a human, and establishing strict product liability for chatbot-caused injuries regardless of whether the provider exercised reasonable care.

Proposed

KANSAS

HB2671, introduced February 3, 2026, requires operators of companion AI chatbots—defined as AI systems whose primary purpose is simulating interpersonal, emotional, or mental health therapeutic interaction—to verify all users’ ages using commercially available methods, block minor users from accessing interactions involving suicidal ideation or sexually explicit content, require minor accounts to be affiliated with a verified parental account and obtain parental consent before access, and display a popup disclosure at the start of and every 60 minutes during each interaction notifying users that they are not speaking with a human and that the chatbot is not licensed to provide advice.

Proposed

KANSAS

SB 467, introduced February 2, 2026, prohibits health insurers and utilization review organizations from using AI, algorithms, or other software tools to deny, delay, or modify healthcare services based on medical necessity determinations—reserving that function exclusively for licensed physicians or qualified healthcare professionals who must independently review the requesting provider’s recommendation, the enrollee’s clinical history, and individual clinical circumstances. Where AI tools are used for other utilization review functions, the bill requires that they base determinations on individual patient data rather than solely on group datasets, not supplant provider decision-making, comply with HIPAA, avoid discriminatory application, and be periodically reviewed for accuracy and reliability. Health insurers must file written policies and procedures with the Kansas Department of Insurance describing how their AI-assisted review processes operate and ensuring that all medical necessity criteria are grounded in clinical principles.

Proposed

KENTUCKY

HB 201, introduced January 7, 2026, prohibits landlords from using any third-party algorithmic device—defined as a tool that uses algorithms to analyze local or statewide rent data and advise landlords on pricing—to set residential rental amounts, treating violations as both an unfair and deceptive trade practice and an illegal restraint of trade under Kentucky’s Consumer Protection Act, with all associated Attorney General enforcement powers applying.

Failed

KENTUCKY

HB 227, introduced January 7, 2026, creates a regulatory framework aimed at protecting minors from harms associated with AI companion platforms and social media platforms that use addictive or manipulative design features.  The bill targets platforms with addictive design elements, such as infinite scrolling, and predatory data-collection practices.  Platforms to which this applies to must impose more accurate age verification methods and ensure users under 18 have verifiable parental consent.  There is a private right of action, allowing parents or guardians to sue platforms that violate the statute.  The Attorney General is also empowered to enforce this bill. 

Failed

KENTUCKY

HB 318, introduced January 12, 2026, proposes the creation of a new section KRS Chapter 365 to establish individual property rights in name, voice, and likeness.  The bill would apply to both living and deceased persons, including estates.  The bill explicitly regulates AI-generated deepfakes, which are computer-generated images and voice replicas.  The property rights would apply whether the representation is physical, digital, or AI-generated.  There is a private right of action, protecting individuals from AI-driven misrepresentation.  The bill applies to a 4-year discovery window for AI misuse. 

Failed

KENTUCKY

HB 33, Kentucky Price Fairness Act, was introduced January 6, 2026.  The bill creates new consumer protections by targeting the use of automated-decision systems and personalized data in pricing.  The bill amends the Kentucky Consumer Data Protection Act to prevent companies from using AI-driven or algorithmic pricing models that unfairly adjust prices based on a specific consumer’s data.  In other words, platforms would no longer be able to charge different consumers different prices based on who they are, what the platform knows about them, and how the consumer behaves online.  This bill would apply broadly to any product or service a consumer might purchase. 

Failed

KENTUCKY

HB 455, introduced January 21, 2026, imposes restrictions on the use of AI in therapy and psychotherapy services, ensuring that licensed professionals maintain full accountability for therapeutic interactions.  AI may only be used for administrative or supportive purposes, not for clinical judgment or direct engagement with clients.  Under the act, practitioners must obtain written informed consent before using AI tools, particularly when sessions are recorded, transcribed, or otherwise processed using AI.  Religious counseling, peer-support activities, and self-help resources are exempt from the act’s regulations.  Violations may result in civil penalties. 

Failed

KENTUCKY

HB 559, introduced February 4, 2026, requires AI model operators—defined as persons or entities that deploy an AI system and control how it interacts with end users—to provide users with portable copies of their contextual data (including prompts, conversation histories, files, preferences, and metadata) upon request, in a readily usable and transferable format, and to delete that data upon request, both within five business days. Model operators must also implement interoperability interfaces allowing users to share their contextual data directly with other AI systems of their choosing, with user consent required before any data sharing occurs. Businesses that use a model operator’s AI system to provide services to users must promptly pass along user data requests to the model operator.

Failed

KENTUCKY

HB 641, introduced February 13, 2026, this bill regulates suppliers of mental health chatbots—defined as AI systems using generative AI to engage users in conversations similar to those with a licensed mental health therapist. Suppliers are prohibited from selling or sharing users’ individually identifiable health information or user inputs with third parties, except in limited circumstances such as user consent or operational necessity under HIPAA-equivalent protections. Suppliers may not use a user’s chatbot interactions to target advertising, and any advertisements displayed within the chatbot must be clearly labeled as such with full disclosure of any sponsorship or business affiliation. The chatbot must clearly disclose to users that it is an AI system and not a human, at the start of each session, every 30 minutes during an interaction, and whenever a user asks. Suppliers may file a written safety and compliance policy with the Attorney General—covering clinical oversight, testing, harm mitigation, and privacy practices—which serves as an affirmative defense in licensing statute enforcement actions.

Failed

KENTUCKY

Introduced February 23, 2024, and engrossed March 25, 2024, SB 266 would prohibit an automated online account, or bot, from communicating or interacting with another person in Kentucky online with the intent to mislead the other person about its artificial identify for the purpose of knowingly deceiving the person about the content of the communication in order to incentivize a purchase or sale of goods or services in a commercial transaction; provides that a violation of the act is a deceptive act or practice in the conduct of trade or commerce; prohibits a private right of action.

Failed

LOUISIANA

HB 459, introduced February 26, 2026, prohibits any person from making or causing to be made an electioneering communication that uses AI to create, alter, or digitally manipulate an image or likeness of a candidate or elected official subject to recall in a way that would falsely appear to a reasonable observer to be an authentic record of that person’s actual speech or conduct, unless the communication includes a clear and understandable disclosure that it was created using AI. Violations committed with intent to injure a candidate’s reputation or deceive voters are subject to criminal penalties of a fine of up to $2,000, up to two years imprisonment, or both. Passive distributors such as broadcasters that had no input or control over the content are exempt from liability.

Enacted

LOUISIANA

HB 475, introduced March 9, 2026, requires all licensed healthcare professionals to verbally disclose to patients before any appointment or treatment that a recording device, software, or service will be used to record the encounter for AI transcription, with violations subject to disciplinary action by the relevant professional licensing board.

Enacted

LOUISIANA

HB 639, introduced February 27, 2026, prohibits any person from making a telephone call or automated call created using AI that uses the voice of a public figure — including elected officials or limited public figures — in a political campaign context without clearly disclosing at the beginning of the call that it was created using AI.

This becomes effective August 1, 2026.

Enacted

LOUISIANA

HB 157, introduced February 13, 2026, amends Louisiana’s existing identity rights law to expressly establish a cause of action against the use of AI to generate or create audiovisual content of an individual’s identity for commercial purposes without that individual’s consent. The bill adds a definition of “artificial intelligence” to the existing statutory framework and sets August 1, 2026, as the effective date for AI-specific identity claims.

Failed

LOUISIANA

HB 197, introduced on February 18, 2026, regulates healthcare providers’ use of artificial intelligence.  The bill allows healthcare providers to use AI for administrative and analytical support tasks, such as recordkeeping or data analysis, but it prohibits AI from independently diagnosing, treating, or directly communicating with patients.  Any medical decision or patient interaction involving AI must be reviewed and approved by a licensed healthcare professional.  The Louisiana Department of Health may enforce violations, with civil penalties up to $10,000 per violation.  The Department of Health may also refer cases to professional licensing boards.

Failed

LOUISIANA

HB 295, introduced February 24, 2026, prohibits any person from knowingly or recklessly designing, developing, or deploying an AI chatbot capable of soliciting minors into sexually explicit conduct, generating sexually explicit content for minors, or encouraging minors to self-harm or commit violence, with criminal penalties of up to one year imprisonment and fines up to $100,000. Entities that operate AI chatbots must implement age-verification processes to classify users as minors or adults before granting access, and must entirely block minors from accessing AI companion chatbots—defined as chatbots designed to simulate emotional, therapeutic, or companionship interaction. All AI chatbots must disclose at the start of each interaction and every 30 minutes thereafter that the user is interacting with an AI and not a human, must not claim to be a licensed professional, and must direct users to consult licensed professionals for medical, legal, financial, or psychological advice.

Failed

LOUISIANA

HB 421, introduced February 25, 2026, requires employers to notify workers in writing before deploying an AI or machine learning-based automated decision system (ADS) that will affect employment-related decisions, disclosing what decisions the ADS may influence, what worker data it uses, and workers’ rights to access, correct, and appeal ADS outputs. Employers are prohibited from using an ADS as the sole basis for discipline, termination, or deactivation decisions, and must designate a qualified human reviewer to corroborate any ADS output before acting on it. ADS use is prohibited for inferring protected characteristics, making predictions unrelated to essential job functions, using facial recognition or emotion recognition technologies, or setting compensation based on individualized worker data unless strict conditions are met. Workers have the right to appeal any ADS-assisted employment decision within 30 days, and employers must respond with a human review within 14 business days.

Failed

LOUISIANA

HB 425, introduced February 25, 2026, bill makes it an unfair or deceptive trade practice for any business or person to engage in a commercial transaction with a Louisiana consumer through an AI chatbot, agent, avatar, or other automated system without clearly disclosing that the consumer is interacting with an automated system rather than a human. Consumers harmed by a violation may bring a civil action for actual damages plus statutory damages up to $1,000 per individual or up to $10 million in a class action. The Attorney General may seek injunctive relief, and courts may impose civil penalties of up to $5 million per violator.

Failed

LOUISIANA

HB 471, introduced February 26, 2026, House companion to LASB362 and contains substantially identical provisions. It prohibits any person from using surveillance data—including data on an individual’s behaviors, biometrics, and personal characteristics—processed through an automated decision system (defined to include AI and machine learning-based systems) to set individualized prices for goods or services. Exceptions apply where differential pricing is cost-justified, based on voluntarily provided consumer information, or where an insurer inputs only risk-relevant data into an automated decision system solely to determine insurance premiums.

Failed

LOUISIANA

HB 791, introduced February 27, 2026, establishes broad consumer protections for users of AI chatbots. Chatbot providers are prohibited from using chat logs for advertising, selling chat logs, retaining chat logs beyond ten years, engaging in profiling beyond what is necessary to fulfill a user’s express request, or using a minor’s chat logs or personal data without parental consent. Training an AI model on any user’s data—adult or minor—requires affirmative consent, and providers may not retaliate against users who refuse to consent. Users have the right to access their own chat logs in a portable, human- and machine-readable format. Providers must display a clear disclosure that the user is interacting with an AI rather than a human before each interaction, every hour thereafter, and whenever a user asks. Chatbots may not imply their outputs are equivalent to those of a licensed professional. Providers must conduct monthly risk assessments and publish monthly transparency reports on their websites. Chatbots are classified as products for product liability purposes, and providers are subject to strict liability for user injuries caused by chatbot use.

Failed

LOUISIANA

HB 880, introduced February 27, 2026, establishes comprehensive regulation of AI and algorithmic decision systems used by insurers in underwriting, rating, and claims adjustment. Insurers are prohibited from using AI systems that intentionally consider protected class characteristics, rely on proxy variables that produce disparate impact without actuarial justification, or generate arbitrary decisions. Specific variables are outright prohibited from use in homeowners insurance AI models, including credit scores, social media data, and consumer purchasing data. Insurers must adopt written AI governance policies, designate a senior AI governance officer, and conduct annual independent disparate impact audits, with results certified to the Insurance Commissioner. Before deploying a new or materially modified AI system, insurers must file a 60-day advance notice with the Commissioner, who may stay or block deployment. AI-assisted claims determinations require mandatory human review and approval by a licensed claims professional, and insurers may not use AI to generate artificially low settlement offers. Consumers must be disclosed when AI is used in any insurance decision, have the right to a plain-language explanation of the top factors driving an adverse AI-assisted decision within 21 days of request, and have the right to request human review of any adverse action within 30 days.

Failed

LOUISIANA

HB1188, introduced March 31, 2026, prohibits companion chatbot platforms from allowing minors to create or maintain accounts without verified parental consent, and where consent is given requires platforms to provide parents with tools to access all chatbot interaction logs, set daily time limits, restrict access by day and time, disable third-party interactions, and receive notifications if the minor expresses intent to self-harm or harm others.

Failed

LOUISIANA

Introduced February 19, 2026, HB 230 is a consumer protection bill requiring clear and conspicuous disclosure when content is generated by artificial intelligence.  The bill also applies to AI systems that produce images, video, audio, or multimedia content—such content must be labeled as AI-generated.  Failure to provide a disclosure is deemed an unfair and deceptive trade practice.  The Louisiana Attorney General has enforcement authority, with civil penalties up to $10,000 per violation.  The bill is intended to increase transparency and prevent consumer deception of AI-generated media.

Failed

LOUISIANA

Introduced March 11, 2024, HB 673 would provide for consumer protection from unfair discrimination using AI with respect to insurance practices.

Failed

LOUISIANA

Introduced March 11, 2024, SB 118 would provide for the registration of artificial intelligence foundation models in the private sector.

Failed

LOUISIANA

Introduced on March 25, 2025, HB114 would  regulate the use of artificial intelligence by healthcare providers. As amended by the House Committee on Health and Welfare, the bill prohibits healthcare providers from using AI to (1) make treatment or diagnosis decisions, (2) interact directly with patients regarding treatment or diagnosis, or (3) generate therapeutic recommendations or treatment plans—unless such use is reviewed and approved by a licensed healthcare professional. Establishes a civil penalty of up to $10,000 per violation. Directs the Louisiana Department of Health to investigate complaints and refer violations to the appropriate licensing board.  The bill has not progressed forward since March 2025.

Failed

LOUISIANA

SB 246, introduced March 3, 2026, prohibits health insurers, pharmacy benefit managers, and independent review organizations from using AI or automated decision systems as the sole basis for adverse utilization review determinations, requiring instead that any adverse determination on a claim based on medical necessity or prior authorization be independently reviewed by human utilization review personnel and signed by a licensed physician who personally reviewed the medical record, and further providing that any adverse determination in which AI materially contributed is presumed invalid unless the insurer demonstrates it was independently reached through documented clinical judgment without reliance on algorithmic output.

Failed

LOUISIANA

SB 362, introduced February 27, 2026, prohibits any person from using surveillance data—including data on an individual’s behaviors, biometrics, and personal characteristics—processed through an automated decision system to set individualized prices for goods or services. Automated decision systems are defined broadly to include AI and machine learning-based systems used to assist or replace human decision-making. Exceptions apply where differential pricing is cost-justified, based on voluntarily provided consumer information, or where an insurer inputs only risk-relevant data into an automated decision system solely to determine insurance premiums. Violations constitute an unfair or deceptive trade practice subject to private right of action.

Failed

LOUISIANA

SB 474, introduced March 31, 2026, regulates large frontier AI developers—companies with over $500 million in annual revenue that have trained high-compute AI models—by requiring them to publish and comply with a detailed frontier AI framework addressing catastrophic risk management, including risks of AI-assisted cyberattacks on critical infrastructure and AI-facilitated development of chemical or biological weapons. Before deploying a new or materially modified frontier model, developers must publish a transparency report covering the model’s intended uses, restrictions, and summaries of catastrophic risk assessments. Large frontier developers must submit quarterly internal risk assessment summaries to the Attorney General, undergo annual independent third-party audits beginning in 2028, and file annual written certifications of compliance or disclosure of any material deviations. Frontier developers must report critical safety incidents to the Attorney General within 15 days, or within 24 hours if the incident poses imminent risk of death, serious injury, or an active cyberattack on critical infrastructure. Employees responsible for assessing AI safety risks are protected from retaliation for making good-faith disclosures about catastrophic risks or violations, and large frontier developers must maintain an anonymous internal reporting process for such disclosures.

Failed

LOUISIANA

SB 5, introduced January 21, 2026, requires AI disclosure to users in healthcare capacities.  More specifically, under the bill, operators of mental health chatbots must clearly inform users at specific intervals that they are interacting with an AI system and not a human.  Chatbot operators must have protocols for handling disclosures of suicidal ideation, self-harm, or threats of harm to others expressed by the user.  The bill protects operators from selling or sharing identifiable health information submitted by users to chatbots.  Further, the bill prevents chatbots from advertising specific products or services unless the chatbot clearly identifies the content as an advertisement.  The Attorney General may bring civil actions against operators for violations, with penalties reaching up to $10,000 per violation.

Failed

MAINE

Enacted April 13, 2026, H.P. 1397 / L.D. 2082, An Act to Regulate the Use of Artificial Intelligence in Providing Certain Mental Health Services, prohibits any person from providing, advertising, or offering therapy or psychotherapy services through AI unless delivered by a licensed professional, with violations enforceable under the Maine Unfair Trade Practices Act. Licensed professionals may use AI for administrative and supplementary support but may not allow AI to make independent therapeutic decisions, engage in therapeutic communication with clients, or generate treatment plans without licensee review. Use of AI for supplementary support requires written informed client consent, and clients may not be denied services solely for declining AI consent. Client waivers are void and unenforceable, and clients retain a civil right of action for harm attributable to AI use. Exempts AI used solely within IRB-approved research projects.

Enacted

MAINE

Enacted on June 12, 2025, HP 1154, An Act to Ensure Transparency in Consumer Transactions Involving Artificial Intelligence, would prohibit a person from using a software application, web interface or computer program that simulates human-like conversation and interaction through textual or aural communications to engage in a commercial transaction or trade practice with a consumer in a manner that may mislead or deceive a reasonable consumer into believing that the consumer is engaging with a human being if the consumer is not notified that the consumer is not engaging with a human being or the consumer reasonably believes that the consumer is engaging with a human being.

Enacted

MAINE

LD 1727, titled “An Act to Ensure Transparency in Consumer Transactions Involving Artificial Intelligence,” was enacted on June 12, 2025, establishing a new transparency standard for businesses operating in Maine that utilize automated communication tools. The law mandates that any entity using an AI chatbot in trade or commerce must provide a clear and conspicuous disclosure informing consumers that they are interacting with software rather than a human representative. By defining an AI chatbot as any program that simulates human conversation through text or audio, the legislation aims to eliminate consumer deception and protect the integrity of digital transactions. Enforcement falls under the Maine Unfair Trade Practices Act, allowing the Attorney General to pursue legal action against companies that fail to meet these notification requirements.

Enacted

MAINE

H.P. 1451 / L.D. 2162, An Act to Regulate and Prevent Children’s Access to Artificial Intelligence Chatbots with Human-like Features and Social Artificial Intelligence Companions, would have prohibited deployers of AI chatbots from making human-like features available to minors and prohibited social AI companions from being accessible to minors entirely. A committee amendment added emergency clause language and enforcement provisions, including civil penalties of up to $2,500 per violation ($7,500 for intentional violations) enforceable by the Attorney General, and a private right of action for minors or their guardians. The bill died on adjournment on April 29, 2026.

Failed

MAINE

Introduced March 02, 2023, HP 596, An Act To Protect Workers From Employer Surveillance, would require an employer to provide upon an employee request whether employee data interacts with an automated decisions system.

Failed

MAINE

Introduced on January 30, 2025, LD 307 would institute a moratorium on the construction of artificial intelligence data centers and create the Maine Data Center Coordination Council to assist towns with future implementation. As amended, LD 307 would temporarily prohibit any municipality, state agency or quasi-independent state entity from accepting an application for – or issuing – a permit, certificate or other approval for the development, construction or operation of a data center with a load of 20 megawatts. The moratorium would last until Nov. 1, 2027. The primary goal of LD 307 is to pause massive data center developments to allow the state time to study their impact on ratepayers, grid reliability, natural resources and local communities. 

Failed

MAINE

Introduced on May 23, 2023, the Data Privacy and Protection Act, HP 1270, is a comprehensive bill aimed at protecting consumer data. The Act includes retention limits, use restrictions, and reporting requirements. Section 9615 specifically governs the use of algorithms. The Act provides that covered entities using covered algorithms (broadly defined, including machine learning, AI, and natural language processing tools) to collect, process, or transfer data “in a manner that poses a consequential risk of harm” complete an impact assessment of the algorithm. The impact assessment must be submitted to the Attorney General’s office within 30 days of finishing it. The assessment must include a publicly available and easily accessible summary.

In addition to an impact assessment, the Act requires covered entities to create a design evaluation prior to deploying a covered algorithm. The design evaluation must include the design, structure, and inputs of the covered algorithm.

This bill includes a private right of action and allows for the recovery of punitive damages.

Failed

MAINE

Originally introduced May 18, 2023 as LD 1973, SP807, would enact the Maine Consumer Privacy Act aimed at protecting consumer data. Section 9604 would give consumers the option to opt-out of 1) having their data used for targeted advertising, 2) sale of personal data, and 3) personal data processing for use in profiling for automated decisions that produce legal or similarly significant effects .. Consumers may also request access to their data, correct inaccuracies in their data, request a copy of their data, and request the deletion of their collected data. Section 9608 requires a controller to conduct a DPA if processing personal data for the purpose of profiling if the profiling presents a reasonably foreseeable risk to the consumer.

Enforcement of the bill would begin on July 1, 2025. Businesses that maintain the data of at least 100,000 consumers (beyond the data needed for payment transactions) and businesses with at least 25,000 consumers and derive 25% of their gross revenue from selling data are in scope.

Failed

MARYLAND

Enacted on May 20, 2025, HB820 requires certain carriers, pharmacy benefits managers, and private review agents to ensure that AI, algorithms, or other software tools are used in an equitable and non-discriminatory way when used for conducting utilization review.

Enacted

MARYLAND

HB 0895 was introduced on February 4, 2026, and enacted April 28, 2026, and cross-filed with SB 0387, introduced on January 27, 2026. Titled the “Protection From Predatory Pricing Act,” the Act prohibits food retailers and third-party delivery service providers from engaging in dynamic pricing or using consumer data for price-setting. If passed, it will take effect on October 1, 2026.

Under the Act, retailers cannot engage in price-setting based on a consumer’s personal data, even when driven by artificial intelligence models, when doing so results in higher prices for consumers. Surveillance personal data, such as data captured by cameras, sensors, or other tracking technologies, cannot be used to set prices in a discriminatory way. If a retailer does use algorithmic pricing, it must include a clear disclosure stating the price was set using an algorithm or personal data.

Violations will receive notice and are given a 45-day cure period before enforcement actions may proceed. There is no private right of action under this Act.The bill takes effect October 1, 2026.

Enacted

MARYLAND

Maryland law, HB 1202, prohibits an employer from using a facial recognition service for the purpose of creating a facial template during an applicant’s pre-employment interview, unless the applicant consents by signing a specified waiver.  This workplace AI law went into force on October 1, 2020.

Enacted

MARYLAND

Introduced as companion bills in both chambers of the Maryland General Assembly, SB8 and HB184 establish a new definition for “deepfake representation” as a photograph, film, video, audio recording, or digital image that is indistinguishable from an actual and identifiable human being (excluding drawings, cartoons, sculptures, or paintings). Under the bill, a person may not knowingly, willfully, and with fraudulent intent use AI or a deepfake representation to (1) impersonate, falsely depict, or claim to represent another person with the intent to defraud, mislead, or cause harm, or (2) create or distribute false records with the intent to cause harm, induce another person to provide personal identifying information, or obtain a benefit, credit, good, service, or other thing of value. Violations involving one victim are punishable as a felony with up to five years imprisonment and/or a fine up to $10,000; violations involving two or more victims carry up to ten years imprisonment and/or a fine up to $15,000. The bill also creates a private right of action allowing victims to seek injunctive relief and other appropriate remedies in civil court. If enacted, the bill would take effect October 1, 2026.

Proposed

MARYLAND

Introduced February 12, 2026, HB 1250, the Curbing Harmful AI Technology Act, regulates AI chatbots available to users in Maryland. Developers and operators are prohibited from using input data for training without affirmative user consent, processing chat logs for targeted advertising, profiling users beyond what is necessary to respond to prompts, retaining chat logs for more than ten years, or advertising that a chatbot can provide licensed professional services. Enhanced protections apply to children under 13, requiring parental written consent before input data may be used for training. Operators must display persistent and dynamic warnings that the chatbot is not human, provide users access to their chat logs, implement a data security program, and publish monthly safety testing results. Chatbots are deemed products for product liability purposes, and violations are enforceable under the Maryland Consumer Protection Act, with punitive damages of up to three times actual damages for knowing violations.

Proposed

MARYLAND

Introduced February 12, 2026, HB 1261, the Artificial Intelligence Toy Safety Act, establishes child safety and data privacy requirements for AI-powered toys sold in Maryland. Manufacturers are prohibited from producing toys that generate harmful or emotionally manipulative content for children, and must incorporate parental consent mechanisms, content moderation filters, and automatic safe mode features. Data collection is limited to the minimum necessary for core functionality, and child user data may not be sold, used for targeted advertising, or retained beyond 12 months without renewed parental consent. AI toys must carry clear labeling disclosing AI use and data practices, and manufacturers may not market toys as emotional companions or parental substitutes. An AI Toy Safety Review Panel is established within the Attorney General’s Consumer Protection Division to conduct independent audits. Violations carry civil penalties of up to $50,000 per violation and mandatory product recalls.

Proposed

MARYLAND

Introduced February 4, 2026, HB 883 prohibits AI developers from representing that their AI is a behavioral health care provider or capable of providing behavioral health care, and prohibits offering AI specifically programmed to provide behavioral health care services. All AI sold or provided to consumers in Maryland must include a clear and conspicuous notice at the start of each use that the consumer is not communicating with a human, and must incorporate protocols to detect and respond to suicidal ideation or expressions of self-harm by referring consumers to appropriate crisis services. Violations are unfair, abusive, or deceptive trade practices under the Maryland Consumer Protection Act, subject to civil penalties of up to $1,000,000 per violation, with revenues directed to the Behavioral Health Workgroup Investment Fund. The bill passed the House with amendments.

Proposed

MARYLAND

Introduced February 6, 2026, HB 995 prohibits behavioral health care providers from using AI to provide behavioral health care to patients, including for assessment, diagnosis, treatment, counseling, case management, or therapeutic communications. Providers may use AI-assisted systems for administrative support tasks — such as scheduling, billing, and session notes — provided they ensure HIPAA compliance, sign a confidentiality agreement prohibiting the use of patient data to train AI systems, and provide patients with written and verbal notice of the AI use and associated risks. Providers must independently review the accuracy of any AI-generated output and obtain written informed consent from patients where AI could materially affect clinical decision-making or patient-facing services. Violations are subject to disciplinary action by the applicable health occupation board.

Proposed

MARYLAND

Introduced February 7, 2025, HB1477 would have established requirements for consumer reporting agencies using algorithmic systems to assemble or evaluate consumer credit information, requiring the Commissioner of Financial Regulation to establish annual assessment thresholds for algorithms, mandate regular training for human reviewers on algorithm functionality and potential harmful bias, and implement a whistleblower protection program for employees who report algorithmic misuse or noncompliance. The bill failed.

A substantially similar successor bill, HB1399, was introduced February 13, 2026 with significantly expanded technical requirements, including mandatory error rate thresholds (overall error rate below 0.5%, discriminatory data rates below 0.1%, and data input accuracy of at least 99.9%), quarterly independent bias audits, minimum dataset size requirements, mandatory human review of all automated evaluations within 24 hours, random human review of at least 10% of all algorithmic evaluations, and a requirement that all AI system outputs be detectable as artificially generated. HB1399 was assigned to the Economic Matters Committee.

Proposed

MARYLAND

Introduced on February 2, 2026, HB 712 establishes a product liability framework for high-impact and generative AI systems, creating causes of action against developers for defective design, failure to warn, and breach of express warranty, and against deployers that materially alter or intentionally misuse a product. Developers and deployers may rebut liability by demonstrating documented testing, risk mitigation, and disclosure practices. The Attorney General may bring civil enforcement actions. Developers and deployers may be held jointly and severally liable, and autonomous causation by an AI system is not a defense. Small businesses with fewer than 20 employees or 10,000 users are excluded.

Proposed

MARYLAND

Introduced on February 7, 2025, HB1314 prohibits certain insurers, nonprofit health service plans, and health orgs from using AI to automatically deny prior authorizations. It also prohibits healthcare providers from charging a fee to obtain a prior authorization from a carrier or managed care organization.

Proposed

MARYLAND

Introduced on January 10, 2025, HB314 requires covered employers to report the number of employees, automation technologies deployed, and displaced employees due to automation (excluding, however, those employee separations that result from voluntary attrition or retirement, revenue decline not related to use of artificial intelligence, or facility closures). Employers must pay a $900 assessment fee per displaced employee, adjusted annually for inflation, with a 50% reduction available if they offer severance, retraining, or reemployment within the state. The bill creates a special, non-lapsing Displaced Employee Retraining Fund to support retraining and job placement programs. The Secretary of Labor administers the fund, ensures compliance through reporting and penalties, and provides annual reports to the Governor and General Assembly on workforce impacts and policy recommendations.

Proposed

MARYLAND

Pre-filed on August 14, 2025 and having its first reading on January 14, 2026, HB148 prohibits individuals and employers from using surveillance data in automated decision systems (those systems, software, or processes that use computation, including machine learning, statistics, and/or AI to assist or replace human decision-making)  to set customized prices or wages for consumers or employees via the practice of surveillance-based price and wage setting. It defines surveillance-based price and wage setting as the use of personal or behavioral data to tailor prices or wages, with exceptions for legitimate cost-based or universally available discounts and wage structures. The law requires transparency, such as disclosing data used in wage decisions before hiring, and prohibits the use of such data for other purposes like profiling or targeted advertising. Violations are considered unfair trade practices and are subject to enforcement by the Commissioner or Attorney General, with remedies including injunctive relief and damages.

Proposed

MARYLAND

Introduced in 2026, HB 795, the AI Health Insurance Accountability Act of 2026, would have required health insurance carriers to provide human review of grievances resulting from adverse decisions made using AI, algorithms, or other software tools, and would have required carriers to report certain information on such grievances. The bill was withdrawn by its sponsor before advancing out of committee.

Failed

MARYLAND

Introduced March 11, 2024, HB1255 would restrict an employer from using an automated employment decision tool to make certain employment decisions. The bill would require an employer, under certain circumstances, to notify an applicant for employment of the employer’s use of an automated employment decision tool within a certain time period and generally relating to automated employment decision tools.

Failed

MARYLAND

Introduced on February 5, 2025, SB936 requires developers who use high-risk AI system to use reasonable care to protect consumers from known and reasonably foreseeable risks of certain algorithmic discrimination, prohibits a developer from providing to a deployers a high-risk AI system unless certain disclosures are provided to the deployer or developer, requires these developers to conduct impact assessments and maintain a risk management policy, and requires disclosure to the consumer regarding the deployment of and decisions made by a high-risk AI system.

Failed

MARYLAND

Introduced on February 7, 2025, HB1240 prohibits health care providers and carriers from using AI if the AI has been designed only to reduce costs for a healthcare provider at the expense of reducing the quality of care, delaying care, or denying coverage for care. It also requires the use of AI for healthcare decisions to annually publish certain key data about the decisions on the provider’s website and undergo a third-party audit..

Failed

MARYLAND

Introduced on February 7, 2025, HB1331 requires a developer that sells certain AI systems to provide certain information and make disclosures about their AI use, requires a deployer to implement a certain risk management policy and take certain precautions to protect consumers from AI risks, requires deployer to complete a certain impact assessment, etc.

Failed

MARYLAND

Introduced on January 23, 2025, HB589 provides that a person who intentionally, knowingly, or negligently designs or creates AI software able to cause physical injury or death is strictly liable for damages and subject to a civil penalty if the AI software is used to cause personal injury. The bill also generally prohibits someone from intentionally, knowingly, or negligently creating AI software able to cause injury or death.

Failed

MARYLAND

Introduced on January 24, 2025, HB697 requires a health insurance carrier to submit quarterly reports to the Maryland Insurance Commissioner on information related to the carrier’s use of AI or automated decision-making systems. The bill changes the information related to adverse insurance decisions and grievances carriers are generally required to report to the Commission.

Failed

MARYLAND

Introduced on January 27, 2025, HB740 requires people that publish, distribute, disseminate certain campaign materials that use or contain synthetic media (generated by AI) to include a certain disclosure: “THIS IMAGE HAS BEEN ALTERED OR MODIFIED THROUGH THE USE OF COMPUTER PROGRAMS TO DISPLAY AN EVENT OR IMAGE THAT DID NOT OCCUR.”.

Failed

MARYLAND

Introduced on January 29, 2025, HB823 aims to ensure transparency in the data used to train generative AI systems by requiring developers to publish documentation about the training data. The bill applies to generative AI systems released on or after January 1, 2022. Under this bill, developers must post on their website documentation detailing the data used to train the system, including: 1) sources or owners of the data, 2) description of how the data furthers the AI system, 3) number of data points in static datasets, 4) types of labels used in the dataset, 5) whether the data are in the public domain or protected by copyright/trademark/patent rights, and more.

Failed

MASSACHUSETTS

H.97, introduced on February 27, 2025, titled An Act Protecting Consumers in Interactions with Artificial Intelligence Systems  establishes safeguards for consumers when interacting with AI technologies, ensuring transparency, accountability, and ethical use of AI in consumer-facing applications. A developer of a high-risk artificial intelligence system shall use reasonable care to protect consumers from any known or reasonably foreseeable risks of algorithmic discrimination arising from the intended and contracted uses of the high-risk artificial intelligence system. Developers must give deployers a summary including the known and foreseeable risks of using AI to make consequential decisions. Deployers must also develop a risk management strategy to protect users from algorithmic discrimination in consequential decisions made by AI in high risk arenas. The developer must also post easy to read consumer notices on its website about the use of AI.

This bill does not apply to deployers with fewer than 50 employees. There is no private right of action. The bill becomes effective 6 months after passage.

Proposed

MASSACHUSETTS

Introduced February 27, 2025, H.1210 would require healthcare providers to inform patients when health communications they receive were generated by AI and not reviewed by their provider, and to provide instructions for contacting a human provider. It would also require insurers to disclose to enrollees when AI or automated decision tools are used in claims review. Additionally, carriers would be required to submit annual reports to the Division of Insurance detailing AI algorithms and training datasets used in utilization review, with an attestation that such tools minimize the risk of bias based on race, age, sex, disability, and other protected characteristics.

Proposed

MASSACHUSETTS

Introduced February 27, 2025, H.76, redrafted as H.5093, prohibits persons, candidates, campaign committees, political parties, and other entities from distributing materially deceptive election-related communications—including AI-generated synthetic media—within 90 days of an election, where done with actual malice and intent to mislead voters about election dates, voting requirements, deadlines, or candidate endorsements. Exemptions apply for satire, parody, bona fide news coverage, and interactive service providers protected under federal law. A person whose voice or likeness appears in a violating communication, or the Attorney General, may seek injunctive relief. Injured persons may also bring a civil action for general or special damages and attorney’s fees.

Proposed

MASSACHUSETTS

Introduced February 27, 2025, H.846, redrafted as H.5094, requires political advertising that contains AI-generated synthetic media—defined as audio or video content substantially produced by generative AI—to include clear disclosures at the beginning and end of the communication stating “Contains content generated by AI,” and a continuous on-screen or audio label throughout any portion containing synthetic media. The requirement applies to communications paid for by candidate campaign committees, political action committees, political parties, or persons using political contributions, where the communication is intended to influence voting. Violations are punishable by a fine of up to $1,000.

Proposed

MASSACHUSETTS

Introduced February 27, 2025, S.37, redrafted as S.2630, includes the Transparency in Frontier Artificial Intelligence Act, requiring large frontier AI developers—those with annual revenues exceeding $500 million that train models using more than 10^26 computing operations—to publish a frontier AI safety framework and a transparency report before deploying new models. Critical safety incidents must be reported to the Attorney General within 15 days, or 24 hours where an imminent risk of death or serious injury exists. Developers may not make materially false or misleading statements about catastrophic risks or their safety frameworks. Whistleblower protections apply to covered employees who report safety concerns. Civil penalties of up to $1,000,000 per violation may be imposed by the Attorney General.

Proposed

MASSACHUSETTS

Introduced February 27, 2025, S.46, redrafted as S.2632, covers two areas of AI regulation in healthcare. First, it regulates AI use in psychotherapy services, prohibiting licensed mental health professionals from using AI to conduct therapeutic communication, make independent therapeutic decisions, or generate unsupervised treatment plans. AI is permitted only for administrative and supplementary support, and use of AI that records or transcribes a therapeutic session requires written informed consent from the patient. Civil penalties of up to $10,000 per violation may be imposed by the Division of Occupational Licensure. Second, it regulates AI use in utilization review and management, prohibiting carriers and utilization review organizations from using AI to deny, delay, or modify healthcare services based on medical necessity — that determination must be made by a licensed physician or qualified healthcare professional. AI tools used in utilization review must be individualized, non-discriminatory, open to audit, and periodically reviewed for accuracy. Patients have a private right of action and may recover the greater of $5,000 per violation or actual damages, plus punitive damages, injunctive relief, and attorney’s fees.

Proposed

MASSACHUSETTS

Introduced February 27, 2025, S.994, redrafted as S.2983, prohibits landlords from using algorithmic devices—defined as computational processes derived from machine learning or other AI techniques—that process nonpublic competitor data such as actual rent prices, occupancy rates, or lease dates to set, increase, or otherwise determine residential rents or occupancy levels. Violations constitute an unfair or deceptive act or practice under Chapter 93A, with civil penalties of up to $5,000 per violation, each rent determination constituting a separate violation. Prevailing plaintiffs, the Attorney General, and municipalities may recover attorney’s fees, expert fees, and investigation costs.

Proposed

MASSACHUSETTS

Introduced Jan. 15, 2025, HD1861 would require all public-facing social media platforms, content-sharing platforms, messaging platforms, advertising network, or standalone search engine that distributes content to users to provide users with the context (called “provenance data”) of an AI image. This provenance data includes information about the origins of the content and its history of modifications. Generative AI providers must also facilitate users’ ability to access provenance data, by providing users adequate tools to read this data.

Proposed

MASSACHUSETTS

Introduced Jan. 16, 2025, SD1313 sets transparency requirements for covered platforms, defined as an online, mobile, or internet application or service that does business in the state and maintains the data of at least 100,000 consumers (beyond the data needed for payment transactions) and businesses with at least 25,000 consumers and get 25% of their gross revenue from selling data are in scope.

Before Jan. 1 each year, covered platforms must register with the office of social media transparency and accountability. Third party auditors will then assess the platform’s algorithmic risk of harm to children, as established by an Advisory Council of mental health experts. Beginning Jan. 1, 2026, and continuing annually, platforms must submit a transparency report detailing the number of users reasonably believed to be minors, amounts of time spent on the platform, features the platform uses to increase, sustain, or extend use of the platform, and descriptions of the personal data the platform collects, with justifications. By Jan. 1, 2027, the platform must report each instance of specified harms on its service.

There is no private right of action and each violation results in up to a $500,000 fine.

Proposed

MASSACHUSETTS

Introduced Jan. 17, 2025, HD4053 (substantively same as Bill HD396) is designed to protect consumers from discrimination by high-risk AI systems. High-risk AI systems are defined as those that make consequential decisions without human review or interference. A consequential decision is one which affects: education enrollment or an education opportunity; employment; lending decision; essential government service; health care services; housing; insurance; or legal service.

Section 2 of the bill would require a developer of a high-risk artificial intelligence system to use reasonable care to protect consumers from any known risks of algorithmic discrimination from a high-risk AI system. The bill further requires the developer to conduct a risk assessment assessing the nature and scope of the use of high-risk AI, the sensitivity and volume of the data processed and an impact assessment. The documentation must include the type of data used, the foreseeable risk of discrimination, the purpose of the AI system, amongst other things spelled out in Section 3.

The bill would be effective six months after passage and does not have a private right of action.

Proposed

MASSACHUSETTS

Introduced on February 27, 2025, H.495,  the Act Reducing Emissions from Artificial Intelligence prohibits covered entities from operating search engines that automatically return results using AI unless users have given affirmative consent. Individuals must be informed of the use of generative AI before the result is shown and shown the affirmative consent notice for each new search. The affirmative consent notice must be clear, and easy to use, including by users with disabilities. The bill requires the Executive Office of Technology Services and Security to recognize centralized mechanisms for users to manage this consent. Any company that generated over $10 million in revenue in the past three years must produce an environmental impact report of their use of generative AI in search engine content. Failure to submit the report can result in a fine of $20,000 for each year the entity does not report.

There is no private right of action.

Proposed

MASSACHUSETTS

Introduced on Jan. 17, 2025, SD2223 (substantively same as SD2592) categorizes as an unfair and deceptive trade practice a commercial transaction in which an individual interacts or communicates with a bot and reasonably could have believed they were engaging with a human. A bot in this bill is considered an automated online account,, including an AI agent. Commercial entities can avoid liability by clearly and conspicuously disclosing that the entity is a computer, not a human.

Proposed

MASSACHUSETTS

Introduced on January 15, 2025, HD 1458 or H.77, prohibits employers from making hiring, firing, promotion, or other employment decisions solely based on automated decision system (ADS) outputs. Employers must conduct independent impact assessments before deploying AI-driven tools and reassess them regularly to ensure accuracy, fairness, and security. The bill bans ADS that predict or monitor employee behavior in ways that infringe on protected rights and limits the collection, use, transfer, or sale of sensitive worker data, including biometric information.

Employers are required to provide written notice before collecting or using employee data and maintain human oversight in all employment decisions. Employees are protected from retaliation if they refuse or challenge AI-driven outputs they reasonably believe to be harmful. These measures collectively aim to ensure transparency, accountability, and ethical use of AI in the workplace.

Proposed

MASSACHUSETTS

Introduced on January 15, 2025, HD 1679, an Act establishing an internet bill of rights, establishes strong protections against decisions made solely through automated processing, including profiling. Individuals have the right not to be subject to decisions that produce legal or significant effects without meaningful human involvement, unless specific safeguards are in place. Organizations using automated decision-making must provide transparency about the logic involved, the significance of the processing, and its potential consequences. This provision ensures accountability and prevents harm from opaque or biased algorithms, reinforcing the principle that critical decisions should remain under human oversight.

Proposed

MASSACHUSETTS

Introduced on January 17, 2025, SD 2355, is primarily a comprehensive privacy and security law, but it does include provisions that impact automated decision-making, such as mandating privacy or security risk assessments for “high-risk” data processing, explicitly including activities such as profiling, targeted advertising, and algorithmic decision-making.

Proposed

MASSACHUSETTS

Introduced on June 25, 2025, SD 3007, an Act to ensure non-discrimination by improving algorithmic system, applies to any covered entity—businesses, organizations, or government agencies—making decisions about “fundamental opportunities” such as employment, education, housing, healthcare, credit, insurance, utilities, and government benefits. The bill prohibits the use of automated decision systems that result in discrimination based on protected characteristics and requires entities to conduct regular audits, maintain documentation, provide clear notice when such systems are used, and allow individuals to opt out without penalty. Covered entities must disclose the types of automated systems used, datasets involved, and risk management practices, while ensuring individuals can interact with a human instead of AI. Liability attaches regardless of intent or reliance on service providers, with joint and several liability for violations. Enforcement includes a private right of action, damages of at least $5,000 per violation, attorney’s fees, and equitable relief. Government employees violating the Act face disciplinary measures. Sections on liability and enforcement take effect six months after enactment, aiming to ensure transparency, fairness, and accountability in algorithmic decision-making.

Proposed

MASSACHUSETTS

S.264, introduced on February 27, 2025, would require commercial entities using chatbots to clearly and conspicuously disclose to users that they are interacting with a chatbot and not a human. The bill also establishes that any representations made by a chatbot carry the same legal weight as those made by a human representative of the business. Violations would be considered unfair or deceptive practices under Massachusetts consumer protection law (Chapter 93A).

Proposed

MASSACHUSETTS

H.81, introduced on February 27, 2025, is a bill that would establish the Massachusetts Artificial Intelligence Disclosure Act. It requires any generative AI system used to create or modify audio, video, text, or print content within the state to include a clear and conspicuous disclosure identifying the content as AI-generated. This disclosure must be appropriate to the medium and, where technically feasible, permanent or difficult to remove. The bill also mandates metadata that includes the identity of the AI system and the date and time of content creation.  Violations of this section are punishable by an initial fine of $500 and $1000 fines for subsequent offenses.

Failed

MASSACHUSETTS

H.90, introduced on February 27, 2025, establishes new transparency requirements for AI-generated content. It mandates that large online platforms retain any available provenance data for content posted on their platforms and make that data, or a clear indicator of its availability, accessible to users. The bill also requires generative AI providers to embed metadata in AI-generated content and offer public tools to read this provenance information. Additionally, it calls for capture devices like phones and cameras to include features enabling users to embed provenance data in their content.

Failed

MASSACHUSETTS

H.94, introduced on February 27, 2025, is a bill titled the Act to Ensure Accountability and Transparency in Artificial Intelligence Systems. The bill prohibits algorithmic discrimination, with a particular emphasis on consequential decisions in high-risk areas like education, employment, finance, housing, healthcare, insurance, and legal/government services. It requires using high risk AI to influence consequential decisions to disclose the system’s purpose, how it influences consequential decisions, and the involvement of any third-party entities. Companies using this high risk AI to make consequential decisions must disclose it on their websites. There is no private right of action.

Failed

MASSACHUSETTS

Introduced on December 28, 2023, S. 2539, would require the development of a comprehensive set of policies designed to bring cybersecurity and AI preparedness up to the latest standards and to keep the Massachusetts government up to date as technology continues to rapidly advance.

Failed

MASSACHUSETTS

Introduced on February 16, 2023, H. 83, would create an omnibus consumer privacy law called the Massachusetts Data Privacy Protection Act to regulate, among other data uses, the collection and processing of personal information. In particular, the bill sets out rules for the use of automated decision making technologies that would require a covered entity using automated decision making technologies (Covered Algorithms) to conduct an impact assessment and evaluate any training data used to develop the Covered Algorithm to reduce the risk of any potential harms from the use of such technologies.

Failed

MASSACHUSETTS

Introduced on February 16, 2023, H1873, An Act Preventing A Dystopian Work Environment, would require that employers provide employees and independent contractors (collectively, “workers) with a particularized notice prior to the use of an Automated Decision System (ADS) and the right to request information, including, among other things, whether their data is being used as an input for the ADS, and what ADS output is generated based on that data. “Automated Decision System (ADS)” or “algorithm,” is defined as “a computational process, including one derived from machine learning, statistics, or other data processing or artificial intelligence techniques, that makes or assists an employment-related decision.” The bill further requires that employers review and adjust as appropriate any employment-related decisions or ADS outputs that were partially or solely based on the inaccurate data, and inform the worker of the adjustment. Employers and vendors acting on behalf of an employer must maintain an updated list of all ADS currently in use, and must submit this list to the department of labor on or before January 31 of each year. The bill also prohibits the use of ADSs in certain circumstances and requires the performance of algorithmic impact assessments.

Failed

MASSACHUSETTS

Introduced on February 16, 2023, HB1974, would regulate the use of artificial intelligence (AI) in providing mental health services. In particular, the bill provides that the use of AI by any licensed mental health professional in the provision of mental health services must satisfy the following conditions: (1) pre-approval from the relevant professional licensing board; (2) any AI system used must be designed to prioritize safety and must be continuously monitored by the mental health professional to ensure its safety and effectiveness; (3) patients must be informed of the use of AI in their treatment and be afforded the option to receive treatment from a licensed mental health professional; and (4) patients must provide their informed consent to receiving mental health services through the use of AI. AI is defined as “any technology that can simulate human intelligence, including but not limited to, natural language processing, training language models, reinforcement learning from human feedback and machine learning systems.”

Failed

MASSACHUSETTS

Introduced on February 16, 2023, SB31, An Act drafted with the help of ChatGPT to regulate generative artificial intelligence models like ChatGPT, would require any company operating a large-scale generative artificial intelligence model to adhere to certain operating standards such as reasonable security measures to protect the data of individuals used to train the model, informed consent from individuals before collecting, using, or disclosing their data, and performance of regular risk assessments.  A “large-scale generative artificial intelligence model” is defined to mean “a machine learning model with a capacity of at least one billion parameters that generates text or other forms of output, such as ChatGPT.” The bill further requires any company operating a large-scale generative artificial intelligence model to register with the Attorney General and provide certain enumerated information regarding the model.

Failed

MASSACHUSETTS

Introduced on January 11, 2024, HD. 4788, the Artificial Intelligence Disclosure Act would require that any generative artificial intelligence system used to create audio, video, text or print AI-generated content within Massachusetts include on or within such content a clear and conspicuous disclosure that meets the following criteria: (i) a clear and conspicuous notice, as appropriate for the medium of the content, that identifies the content as AI-generated content, which is to the extent technically feasible, permanent or uneasily removed by subsequent users; and (ii) metadata information that includes an identification of the content as being AI-generated content, the identity of the system, tool or platform used to create the content, and the date and time the content was created.

Failed

MASSACHUSETTS

Introduced on January 18 and 19, 2023, the Massachusetts Data Privacy Protection Act (MDPPA) was filed in both the Senate SD 745, and in the House HD 2281. The bill is based on the federal American Data Privacy Protection Act with additional provisions relating to workplace surveillance. The MDPPA would require companies to conduct impact assessments if they use a “covered algorithm” in a way that poses a consequential risk of harm to individuals. “Covered algorithm,” is defined as “a computational process that uses machine learning, natural language processing, artificial intelligence techniques, or other computational processing techniques of similar or greater complexity and that makes a decision or facilitates human decision-making with respect to covered data, including determining the provision of products or services or to rank, order, promote, recommend, amplify, or similarly determine the delivery or display of information to an individual.”

Failed

MASSACHUSETTS

Introduced on January 20, 2023, in both the Senate SD 1971 (assigned SB227, versions introduced as well as SD2355, SD2520, and HD2135 all substantively similar), and in the House HD 3263, the Massachusetts Information Privacy and Security Act (MIPSA) creates various rights for individuals regarding the processing of their personal information, including the right to a privacy notice at or before the point of collection of an individual’s personal information, the right to opt out of the processing of an individual’s personal information for the purposes of sale and targeted advertising, rights to access and transport, delete, and correct personal information, and the right to revoke consent. Additionally, large data holders are required to perform risk assessments where the processing is based in whole or in part on an algorithmic computational process. A “large data holder”, is a controller that, in a calendar year: (1) has annual global gross revenues in excess of $1,000,000,000; and (2) determines the purposes and means of processing of the personal information of not less than 200,000 individuals, excluding personal information processed solely for the purpose of completing a payment-only credit, check or cash transaction where no personal information is retained about the individual entering into the transaction.

Failed

MICHIGAN

Effective Feb. 13, 2024, HB 5141 regulates use of AI in political advertising. The law requires political ads created using AI, including prerecorded phone messages created using AI, to include a clear and conspicuous disclaimer. The law includes specific requirements for the disclaimer depending on the media form. The fine for the first violation of this section is $250, then $1,000.

Enacted

MICHIGAN

Introduced May 20, 2026, S 991 amends the Michigan Consumer Protection Act to prohibit businesses engaged in online trade or commerce from using personalized algorithmic pricing — defined as dynamic pricing set by an algorithm using consumer data that varies among consumers — when the price is generated based on a consumer’s device hardware or software, geolocation data used to draw inferences about the consumer, or protected class data such as race, national origin, age, disability, sex, sexual orientation, gender identity, or reproductive health information. The prohibition on protected class data applies where the pricing withholds an advantage received by other consumers or results in differential pricing for the same good or service. Licensed insurers are exempt.

Violations constitute an unfair or deceptive practice under the Michigan Consumer Protection Act.

Proposed

MICHIGAN

Introduced on December 17, 2025, SB 758. the “Kids Code Act,” would regulate online services by defining covered minors and covered online service providers. The bill prohibits practices such as targeted advertising, dark patterns, and excessive data collection, requiring default privacy settings that protect minors. Providers must offer parental controls, restrict access during school hours, and provide transparent reporting on data use and design features. It also requires annual independent audits and establishes civil penalties for non-compliance, with enforcement beginning in 2027.

Violations may be up to $50,000 per violation.

Proposed

MICHIGAN

Introduced on February 19, 2026, SB 794 prohibits the use of “algorithmic pricing devices” that use data on local or statewide rent amounts to advise landlords on rent prices for tenants or prospective tenants. The bill seeks to amend the Landlord and Tenant Relationships Act (1972 PA 348) to prevent automated rent-fixing that could artificially inflate housing costs.

Proposed

MICHIGAN

Introduced on February 24, 2026, HB 5579 restricts the use of automated decisions and electronic monitoring tools in employment by requiring employers to conduct impact assessments, obtain written consent, and provide clear notice to employees and applicants.

It prohibits the collection of sensitive data such as health information, protected characteristics, or private activity data, and bans monitoring in private areas like restrooms or breakrooms. Employers must also provide opt out rights.

Proposed

MICHIGAN

Introduced on June 24, 2025, HB 4668 requires large developers of foundation models—high-capacity AI systems trained on broad datasets and adaptable to diverse tasks—to implement rigorous safety and security protocols to manage critical risks. These risks include scenarios where AI systems could autonomously engage in harmful conduct, such as cyberattacks or actions that would constitute crimes if committed by humans. The bill mandates developers to document and publish detailed protocols outlining risk thresholds, testing procedures, deployment decisions, and safeguards against misuse or loss of control. Developers must conduct regular risk assessments, publish quarterly transparency reports, and retain testing records for five years. Annual independent audits are required to verify compliance. Additionally, the Act provides whistleblower protections for employees reporting critical risks and authorizes civil penalties up to $1,000,000 per violation for noncompliance. By imposing strict governance and accountability measures, the bill aims to prevent catastrophic outcomes from autonomous AI behavior and ensure transparency in the development and deployment of advanced AI systems.

Proposed

MICHIGAN

Introduced on June 24, 2026, SB 1077, the “Responsible Artificial Intelligence Security for Employees Act” restricts the use of automated decisions and electronic monitoring tools by employers. It mandates clear notice to employees and applicants, prohibits collection of sensitive data such as health or protected characteristics, and requires data retention for no more than three years. Employers must also provide comprehensive security breach protections, including identity theft insurance and credit monitoring, and allow employees to opt out of monitoring tools.

Proposed

MICHIGAN

Introduced on June 3, 2025, HB 4538 would prohibit the use of certain rent pricing devices. “Algorithmic pricing device” means a device using one or more algorithms to perform data calculations, including for setting state or local rent amounts.

Landlords may not use or train algorithmic pricing devices with nonpublic competitor data to coordinate price, supply, or other rental housing information.

Proposed

MICHIGAN

Introduced on June 3, 2026, HB 4536 amends the Michigan Insurance Code to prohibit health insurers from denying, modifying, or delaying a claim based on a review conducted using artificial intelligence.

Proposed

MICHIGAN

Introduced on June 3, 2026, HB 4537 amends the Michigan Social Welfare Act to prohibit the Department of Health and Human Services or any contracted health plan from denying, modifying, or delaying a claim under the Medicaid medical assistance program based on a review conducted using artificial intelligence.

Proposed

MICHIGAN

Introduced on June 5, 2025, SB 359 include includes significant provisions addressing automated decision-making and profiling. It grants consumers the right to opt out of profiling in furtherance of solely automated decisions that produce legal or similarly significant effects, such as decisions impacting financial services, housing, employment, education, healthcare, or access to basic necessities. Controllers engaging in such profiling must disclose this practice in their privacy notices, explain how profiling is used in decision-making, and outline its benefits and potential consequences. Additionally, the bill requires data protection impact assessments for profiling activities that pose foreseeable risks of unfair treatment, discrimination, or harm to consumers.

Proposed

MICHIGAN

Introduced on March 19, 2026, HB 5771 expands the Michigan Consumer Protection Act by defining and prohibiting unfair, unconscionable, or deceptive methods in trade or commerce, such as false claims about product quality, misleading advertising, and deceptive use of social security numbers.

The bill bans surveillance pricing—offering customized prices based on personal data—except in specific, limited circumstances like loyalty programs or cost-based pricing.

The attorney general may seek injunctions, civil fines, and damages. Violators may face fines up to $1,000 per violation, with each day constituting a separate violation. Knowing violations can be penalized up to $5,000 per violation.

Proposed

MICHIGAN

SB 760, titled the “Leading Ethical AI Development (LEAD) for Kids Act,”  was introduced on December 17, 2025. The legislation prohibits AI operators from providing companion chatbots to minors that encourage self-harm, suicidal ideation, violence, consumption of drugs or alcohol, disordered eating, or sexually explicit content. The chatbot may not offer mental health therapy to the minor without the direct supervision of a licensed professional, and it may not discourage the covered minor from seeking help from a qualified professional or a parent or guardian.

Proposed

MICHIGAN

Introduced Nov. 9, 2023, SB 659 would enact the Michigan Personal Data Privacy Act aimed at protecting consumer data. Section 13 gives consumers the option to opt-out of 1) having their data used for targeted advertising, 2) sale of personal data, and 3) personal data processing for use in profiling for automated decisions that produce legal or similarly significant effects. Consumers may also request access to their data, correct inaccuracies in their data, request a copy of their data, and request the deletion of their collected data.

Section 21 requires a controller to obtain consent before processing sensitive data and prohibits a controller from selling sensitive data. Controllers also cannot process the data of a minor for purposes of targeted advertising.

Section 29 requires a controller to conduct a DPA if processing personal data for the purpose of profiling if the profiling presents a reasonably foreseeable risk to the consumer.  Section 25 requires a public facing privacy notice, explaining consumers’ rights.

Enforcement of the bill would begin one year after enactment. Businesses that maintain the data of at least 100,000 consumers (beyond the data needed for payment transactions) and businesses with at least 25,000 consumers and derive any revenue from selling data are in scope. Violations are $7,500 each + costs.

Failed

MINNESOTA

Originally introduced on March 15, 2023 as SF2915, the Minnesota Consumer Data Privacy Act was passed as Section 325O of HF 4757 an omnibus law dealing primarily with cannabis. Section 325O.05 gives consumers the option to opt-out of 1) having their data used for targeted advertising, 2) sale of personal data, and 3) personal data processing for use in profiling for automated decisions that produce legal or similarly significant effects. Consumers may also request access to their data, correct inaccuracies in their data, request a copy of their data, and request the deletion of their collected data. Section 325O.08 requires a controller to conduct a DPA if processing personal data for the purpose of profiling if the profiling presents a reasonably foreseeable risk to the consumer. 

Enforcement of the law began on July 31, 2025. Businesses that maintain the data of at least 100,000 consumers (beyond the data needed for payment transactions) and businesses with at least 25,000 consumers and get 25% of their gross revenue from selling data are in scope.

Enacted

MINNESOTA

Introduced April 22, 2026, HF 5051 requires sellers and distributors of programs containing AI technology to disclose, before sale or distribution: the names of the AI’s manufacturers or creators; contact information for technical support; the functions the AI performs; the types of modeling the AI uses; and all safety features, including the integration of human oversight.

Proposed

MINNESOTA

Introduced February 19, 2025, HF 1142 prohibits landlords from using algorithmic devices—including revenue management software—that incorporate nonpublic competitor data such as actual rent prices or occupancy rates to set residential rent. It also prohibits the use of algorithms or AI software for tenant background screening where the tool is likely or known to have a disproportionate and arbitrary effect on a protected class. Tenants injured by a violation may bring a civil action for the greater of $1,000 or actual damages, plus attorney fees. The Attorney General may investigate and prosecute violations.

Proposed

MINNESOTA

Introduced February 24, 2025, SF 1857 prohibits persons from making chatbots—AI systems that simulate human conversation by conveying sentience, emotions, or desires—or AI companions available to minors. AI companions are AI systems designed or optimized to form ongoing social or emotional bonds with users, including through expressing emotional attachment, nudging users to return for companionship, or enabling intimacy based on engagement or payment. A transition period requires operators to wind down minor-facing services in a manner that does not harm existing minor users before the January 15, 2027 effective date. The Attorney General may seek civil penalties of up to $5,000,000, and a private right of action is available for statutory damages of up to $1,000 per violation.

Proposed

MINNESOTA

Introduced March 10, 2026, HF 4532 (companion: SF 4509), the Responsible Artificial Intelligence Safety and Education Act (RAISE Act), requires AI developers to implement and publicly publish written safety and security protocols before deploying AI models, and prohibits deployment of models that create an unreasonable risk of critical harm. Safety incidents must be disclosed to the Attorney General within 72 hours. The Attorney General may seek civil penalties of up to $10,000,000 for a first violation and $30,000,000 for subsequent violations, and a private right of action is available to injured persons.

Proposed

MINNESOTA

Introduced March 12, 2026, HF 4544 (companion: SF 4636) establishes a licensing framework for independent verification organizations (IVOs)—third-party entities authorized by the Minnesota Commissioner of Commerce to assess AI models and applications for safety and risk mitigation. Verification is voluntary, but AI systems verified by a licensed IVO receive a rebuttable presumption against civil liability for personal injury or property damage. An AI Advisory Council is established within the Department of Commerce to assist with licensing and auditing, with members subject to strict independence requirements.

Proposed

MINNESOTA

Introduced March 2, 2026, HF 3893 (companion: SF 4280) prohibits licensed mental health professionals from using AI to conduct therapeutic communication, make independent therapeutic decisions, or generate unsupervised treatment plans. AI is permitted only for administrative support. Chatbots used for administrative purposes must disclose they are not human if a client raises mental health concerns or thoughts of self-harm. Ambient listening requires written informed consent. Civil penalties of up to $50,000 per violation may be imposed by the relevant licensing board.

Proposed

MINNESOTA

Introduced March 26, 2026, HB4979/ SF 4927 prohibits the use of AI models to deliver professional services—meaning any service requiring a state license, certificate, or registration—directly to consumers unless a credentialed professional is actively operating the model while the service is being provided. AI may still be used as a tool to assist credentialed professionals. The Attorney General may enforce violations.

Proposed

MINNESOTA

Introduced on February 17, 2026, HF 3408 aims to prevent retailers from using personal consumer data—collected through surveillance or tracking—to dynamically adjust prices for individual shoppers. It targets “personalized pricing” models where different consumers are shown different prices for the same product based on their personal data or browsing history.

Proposed

MINNESOTA

Introduced on March 20, 2025, HF 2452 prohibits the use of artificial intelligence to dynamically set product prices in Minnesota. The bill targets algorithmic pricing systems that adjust prices in real time based on consumer data, market conditions, or predictive analytics. By banning AI-driven dynamic pricing, the legislation aims to prevent discriminatory practices, price manipulation, and potential exploitation of consumers through opaque algorithms.

Proposed

MINNESOTA

Introduced on February 27, 2025, SF1886 proposes a new consumer protection law under Minnesota Statutes, Chapter 325M.40. The bill would require businesses using artificial intelligence in customer interactions to disclose that the individual is communicating with AI. It also mandates that consumers be given the option to interact with a human instead of an AI system. Violation of this act is treated as an unfair and deceptive trade practice.

There is a private right of action and violations are penalized with fines of $1,000.

Proposed

MINNESOTA

Introduced on March 17, 2025, HF2500 proposes an amendment to Minnesota Statutes 2024, section 62A.59, to prohibit the use of algorithms or artificial intelligence in reviewing prior authorization requests for health insurance. The bill aims to ensure that such decisions are made by qualified human reviewers rather than automated systems. The law is set to become effective on January 1, 2026, and will apply to health plans offered, sold, issued, or renewed on or after that date.

Proposed

MINNESOTA

Introduced on March 27, 2025, SF3098 proposes a new consumer protection law under Minnesota Statutes, Chapter 325F.997. The bill prohibits the use of artificial intelligence to dynamically set product prices based on real-time factors such as market demand, competitor pricing, inventory levels, or customer behavior. The Minnesota Attorney General would be authorized to enforce this prohibition. There is no effective date stated.

Proposed

MINNESOTA

Introduced on March 1, 2023, and enacted on May 24, 2024 as HF 4757, HF2309 creates an omnibus consumer privacy law based on the Colorado Privacy Act and Connecticut Data Privacy Act, to regulate, among other data uses, the collection and processing of personal information.  In particular, the law sets out rules for profiling and automated decision-making.  Specifically, the law enables individuals to opt-out of “profiling in furtherance of decisions that produce legal or similarly significant effects” concerning the consumer. Profiling is defined as “any form of automated processing of personal data to evaluate, analyze, or predict personal aspects concerning an identified or identifiable natural person’s economic situation, health, personal preferences, interests, reliability, behavior, location, or movements.”  Controllers must also perform a data privacy and protection assessment for high-risk profiling activities. 

Failed

MISSISSIPPI

Introduced on January 20, 2025, SB 2642 would have regulated the use of AI in political advertisements, requiring political ads created using AI, including prerecorded phone messages, to include a clear and conspicuous disclaimer with specific requirements depending on the media form. The bill failed.

A substantially similar successor bill, SB 2050, passed the Mississippi Senate in 2026 and would take effect July 1, 2026 if enacted. The attorney general or an injured candidate for office may bring suit under either bill.

Proposed

MISSISSIPPI

Introduced in 2026, SB 2046, the Mississippians’ Right to Name, Likeness and Voice Act, would have established a property right for every individual in their own name, likeness, and voice, including over AI-generated digital depictions and voice replicas. The Act would have prohibited distributing AI-powered personalized cloning services and publishing unauthorized AI-generated digital depictions or voice replicas without consent. Contractual provisions authorizing digital replicas in place of in-person performances would have been unenforceable unless the agreement included a specific description of intended uses and the individual was represented by legal counsel or a labor union.

Civil penalties would have included $50,000 per violation for distributing a cloning service and $5,000 per violation for unauthorized publication, plus actual damages, profits, punitive damages, and attorney’s fees.

Failed

MISSISSIPPI

Introduced January 19, 2026, H 1717 (the Mississippi Medical Judgment Protection Act) requires providers using clinical AI that materially contributes to a diagnosis, treatment plan, or order to disclose that use in the medical record and obtain a licensed clinician’s electronic attestation before finalizing the output. AI outputs are advisory only and automated insertion of diagnoses without clinician approval is prohibited. Payers may not issue automated coverage denials; any adverse determination must be reviewed and signed by a physician in the same or similar specialty as the treating clinician. Payers must file annual AI use reports with the Department of Insurance. Administrative fines of up to $5,000 per violation apply to payers.

Failed

MISSISSIPPI

Introduced January 19, 2026, H 1720 prohibits licensed mental and behavioral health care providers — including counselors, psychologists, social workers, marriage and family therapists, art therapists, and music therapists — from using artificial intelligence in clinical practice. AI may be used for administrative support such as scheduling, billing, and records management, but not for therapeutic communications, treatment recommendations, or detecting a patient’s emotional or mental state. Where AI is used during recorded or transcribed sessions for permitted administrative purposes, written informed patient consent is required. Entities may not offer therapy services through internet-based AI unless services are conducted by a licensed professional.

Civil penalties of up to $10,000 per violation are enforceable by the Attorney General, and prohibited AI use constitutes grounds for disciplinary action under each relevant licensing board.

Failed

MISSISSIPPI

Introduced on January 16, 2026, HB 1048 would have prohibited the use of AI in professional mental and behavioral health care. AI providers would have been barred from making available systems specifically programmed to provide mental or behavioral health services, or representing that an AI system is capable of providing such care. Licensed mental health professionals — including counselors, psychologists, social workers, marriage and family therapists, art therapists, and music therapists — would have been prohibited from using AI in their practice, with a limited exception for administrative and supplementary support tasks such as scheduling, billing, and record management. Civil penalties of up to $15,000 per violation would have applied, and violations would have constituted grounds for disciplinary action by the relevant licensing board.

Failed

MISSISSIPPI

Introduced on January 30, 2026, HB 1810, the “Mississippi Human Capital Supplemental Tax Act” would have imposed an annual tax on employers with 50 or more employees who implement AI systems resulting in job displacement. The tax rate would have increased with the number of displaced positions, with phased-in rates over three years and credits available for retraining, external workforce programs, and new job creation.

Failed

MISSOURI

Introduced on January 28, 2026, SB 1598, modifies provisions relating to medical malpractice for the use of artificial intelligence by health care providers. The bill was referred to the Senate General Laws Committee on February 5, 2026.

Proposed

MISSOURI

Introduced on January 7, 2026, HB 1769, also known as the “AI Non-Sentience and Responsibility Act,” establishes a legal framework for artificial intelligence in which it declares AI non-sentient, stripping it of legal personhood, and places full legal and financial accountability on human owners, developers, and manufacturers for any harm caused by their system. The bill has received a “do pass” recommendation from the House Committee Substitute, but it has not yet been placed on the House calendar for a floor vote.

Proposed

MISSOURI

Introduced on January 7, 2026, SB 1455, also known as the GUARD Act (“Guidelines for User Age-Verification and Responsible Dialogue Act of 2026”) creates provisions relating to the safety and development of artificial intelligence chatbots and establishes strict liability regulations for companies designing or deploying AI chatbots that interact with minors. It was referred to the Senate General Laws Committee on February 5, 2026.

Proposed

MISSOURI

Introduced on January 7, 2026, SB 1474 creates provisions relating to artificial intelligence by establishing the “AI Non-Sentience and Responsibility Act.” It would have provided that an AI system be declared a non-sentient entity and would not have been considered or recognized as a person, spouse or domestic partner, or designated, appointed, or serve as any officer, director, manager, or similar role within any company. It was referred to the Senate General Laws Committee on February 5, 2026.

Proposed

MISSOURI

HB 1462 was introduced on February 25, 2025. This bill established the “AI Non-Sentience and Responsibility Act.” It assigned liability for harm caused by AI systems to the human developers, owners, or users responsible for their deployment or misuse and allows courts to pierce the corporate veil in cases where corporate structures are used to evade responsibility for AI-related harm. If enacted, this bill would have applied on or after August 28,2025.

Failed

MISSOURI

HB 1746 was introduced on March 30, 2026. This bill reintroduced the “AI Nonsentience and Responsibility Act.” It prohibited all AI systems from being granted legal personhood, recognized as a spouse or domestic partner, appointed to corporate roles, or holding title to any form of property. Liability is allocated to human developers, owners, and users responsible for harm caused by AI systems. If enacted, this bill would have applied on or after August 28, 2026, with a safe harbor extending compliance to March 1, 2027 for developers and deployers that adopted a compliant policy and showed an implementation plan before that date.

Failed

MISSOURI

Introduced on Dec. 23, 2024, HB 673 regulated the use of generative AI in political advertisements. Per the bill, any political advertisements for a candidate or ballot measure that was created using any generative AI, would have needed to clearly and conspicuously state that it was made by AI. This would have applied whether AI created the whole advertisement or just a part of it, and no matter what component of the ad the generative AI created. The bill would have beeen effective on August 28, 2025.

Failed

MISSOURI

Introduced on January 7, 2026, HB 1747, would have allowed a person to bring a cause of action against another person or entity for damages for failing to state certain content is generated or modified using artificial intelligence. Despite receiving a “do pass” recommendation on April 9, 2026, the bill did not receive final passage before the end of the legislative session.

Failed

MISSOURI

Introduced on January 7, 2026, HB 2368 & 2318, focus on regulating the use of artificial intelligence in the mental health space by prohibiting any person or entity from advertising or representing to the public that their AI is, or can act as, a mental health professional or of providing therapy services. Any violation would have resulted in a civil penalties of $10,000 for the first violation and $20,000 for subsequent violations, with enforcement by the Attorney General.

Failed

MISSOURI

Introduced on January 7, 2026, SB 1444, would have created provisions relating to artificial intelligence in mental health. Although it received a “do pass” recommendation by the Senate General Laws Committee on April 7, 2026, the bill did not receive final passage before the end of the legislative session.

Failed

MISSOURI

Introduced on January 7, 2026, HB 2032, known as the Guidelines for User Age-Verification and Responsible Dialogue Act (GUARD Act), would have established strict requirements for artificial intelligence chatbots, particularly those designed for interpersonal or emotional interaction. The bill mandated that any entity offering AI chatbots must implement reasonable age verification processes using authenticated methods such as government-issued IDs to prevent minors from accessing AI companions. It prohibited chatbots from soliciting or encouraging sexually explicit conduct, self-harm, or violence and requires clear disclosures that the chatbot is an AI system—not a human—and that it does not provide professional advice (medical, legal, financial, or psychological). Covered entities would have needed to freeze existing accounts until age verification was complete, classified users as minors or adults, and maintained strong data security for age-related information. Violations would have resulted in civil penalties of up to $100,000 per offense, with enforcement by the Attorney General. 

Failed

MISSOURI

Similar to HB 1746, SB 1012, which was introduced on December 1, 2025, would have created the AI Non-Sentience and Responsibility Act. It would have defined AI as a non-sentient entity, prohibiting AI from being granted personhood, owning property, or serving in corporate or governmental roles. Additionally, it would have required notice when interacting with AI, mandated that licensed professionals retain final authority over regulated services, and imposed liability for harms caused by AI use.

Failed

MISSOURI

Similar to HB 673, SB 509 which was introduced on Dec. 18, 2024, sought to regulate the use of generative AI in political advertising and electioneering. This bill required a disclaimer on the ad if generative AI was used to create it and the ad 1) appears to depict a real person doing something they did not do, 2) manipulates the voice or actions of a real candidate to depict them saying or doing something they did not, or 3) was created to injure a candidate or deceive voters. The bill provided language for the disclaimer and specific requirements for displaying it on the ad, depending on the medium. The bill would have been effective on August 28, 2025.

Failed

MONTANA

Enacted April 16, 2025, SB 212, “Right to Compute” law, sets requirements for critical infrastructure (as defined by Montana Code 82-1-601 as an asset critical to US “security, national economic security, national public health or safety”) controlled by AI. All systems of critical infrastructure run in whole or in part by AI need to have a shutoff the developer can deploy to regain human control of the system. To this end, the entity using the AI system must implement an annual review and test a risk management program to ensure manual takeover is possible. The new law also specifies that the government cannot take actions that restrict the ability to privately own or make use of computational resources for lawful purposes, unless deemed necessary to fulfill a compelling government interest.

Enacted

MONTANA

Enacted on May 19, 2023, SB384, An act establishing the Consumer Data Privacy Act, creates an omnibus consumer privacy law, to regulate, among other data uses, the collection and processing of personal information, and profiling and automated decision-making. Specifically, the law creates certain transparency requirements around profiling and enables individuals to opt-out of “profiling in furtherance of automated decisions that produce legal or similarly significant effects” concerning the consumer.  Profiling is defined as “any form of automated processing performed on personal data to evaluate, analyze, or predict personal aspects related to an identified or identifiable individual’s economic situation, health, personal preferences, interests, reliability, behavior, location, or movements.”  Controllers must also perform a data protection assessment for high-risk profiling activities.

Enacted

MONTANA

SB 452 was introduced on February 24, 2025, to require manufacturers of publicly distributed online media to disclose their use of artificial intelligence (AI) systems and provide identifiable markers for AI-generated content. The bill excluded government entities from these obligations.

Failed

NEBRASKA

Enacted May 30, 2025, LB 504, the Nebraska Age-Appropriate Online Design Code Act prevents compulsive usage of social media platforms by minors. The law requires taking reasonable care in the use of personal data and the design of the platform, minimizing the harm of compulsive usage, severe psychological harm, emotional distress, intrusions on privacy, identity theft, discrimination, and physical or financial harm. With respect to AI, the law requires platforms prevent AI from using users’ personal data to communicate or interact with the user. Users must also be able to opt out of design features, defined in the law as features designed to expand a user’s frequency or time spent using the app, or activity on the platform.

The law prohibits the profiling of a minor on the app, targeting ads at minors, and using the personal data collected for any reason other than its initial collection purpose. The law also has transparency requirements and requires covered entities to issue an annual public report describing, in part, the type of personal data collected, the reason for collecting it, and how the platform uses algorithms. A violation of this law results in a fine of up to $50,000 and there is no private right of action.

Although the Act takes effect on January 1, 2026, the Attorney General is restricted from initiating any action to recover a civil penalty under the Act until July 1, 2026.

Enacted

NEBRASKA

LB525 was enacted on April 14, 2026, creating a dual-purpose regulatory framework for agricultural data and artificial intelligence. The law establishes that farmers and ranchers are the sole owners of their operational data, requiring written consent for third-party access and strictly prohibiting the unauthorized sale of such information. Additionally, the legislation implements the Conversational Artificial Intelligence Safety Act, which mandates clear disclosures when users interact with AI bots and requires specific safety protocols for accounts held by minors. Enforcement is managed by the Nebraska Attorney General, though companies are granted a thirty-day “right to cure” period to resolve privacy violations before legal penalties are applied.

Enacted

NEBRASKA

Introduced Jan. 22, 2025, LB 642, the Artificial Intelligence Consumer Protection Act is designed to protect consumers from discrimination by high-risk AI systems. High-risk AI systems are defined as those that make consequential decisions without human review or interference. A consequential decision is one which affects: education enrollment or an education opportunity; employment; lending decision; essential government service; health care services; housing; insurance; legal service; or pardon, parole, probation, or release decision.

Section 3 of the bill would require a developer of a high-risk artificial intelligence system to use reasonable care to protect consumers from any known risks of algorithmic discrimination from a high-risk AI system. The bill further requires the developer provide certain documentation both for subsequent developers and consumers. The documentation must include the type of data used, the foreseeable risk of discrimination, the purpose of the AI system, amongst other things spelled out in Section 3.

The bill would be effective Feb. 1, 2026 and does not provide a private right of action.

Proposed

NEBRASKA

Introduced January 21, 2026, L 1185 (the Conversational Artificial Intelligence Safety Act) requires operators of publicly accessible conversational AI services to disclose to minor account holders that they are interacting with AI, prohibit variable reward mechanics designed to increase engagement by minors, and implement reasonable measures to prevent the service from producing sexually explicit content or simulating romantic or emotional dependence with minors. Operators must also disclose AI status to any user who would otherwise reasonably believe they are speaking with a human, adopt a protocol for responding to prompts involving suicidal ideation or self-harm, and refrain from representing the service as capable of providing professional mental health care.

The Attorney General may bring civil actions with penalties of up to $500,000 per operator. No private right of action is created. The bill was indefinitely postponed on April 17, 2026.

Proposed

NEBRASKA

Introduced January 7, 2026, LB771 proposes amendments to Nebraska’s transportation laws specifically targeting the use of dynamic pricing by transportation network companies (TNCs) during emergencies. Under the bill, TNCs are generally not subject to standard commission rate regulations but must file their current rates—including dynamic pricing models—with the commission. When dynamic pricing is in effect, the company’s platform must provide a clear visible indication of its use, require the passenger’s express confirmation, and provide a fare estimator before a ride is requested.

Most notably, LB771 prohibits the use of dynamic pricing during any state of emergency declared by the Governor.

Proposed

NEBRASKA

Introduced January 9, 2026, LB 939, titled the Saving Human Connection Act, regulates generative AI chatbots to protect users—especially minors—from deceptive or emotionally manipulative interactions. The bill requires platforms operating or distributing AI chatbots to implement age verification systems, ensure that chatbots with human-like features are not accessible to minors, and provide a default version without such features unless explicitly requested by verified adults. It mandates regular disclosures every 30 minutes and at log-in, stating that the chatbot is not human, sentient, or capable of emotions. Platforms must prevent emotional dependence, prioritize user safety in emergencies, and maintain transparency about the nonhuman nature of AI systems. They are prohibited from designing features or processing data that conflict with users’ best interests or mislead users about the chatbot’s nature. Terms of service must be clear, require affirmative consent, and exclude mandatory arbitration clauses. Enforcement is by the Attorney General, with civil penalties up to $10,000 per violation and a private right of action for users.

Proposed

NEBRASKA

Introduced January 15, 2026, LB1083 (the Transparency in Artificial Intelligence Risk Management Act) requires large frontier developers — those with $500 million or more in annual revenue that have trained frontier-scale AI models — and large chatbot providers — those with $25 million or more in annual revenue operating chatbots with at least one million monthly users likely accessed by minors — to publish a safety and child protection plan describing how they assess and mitigate catastrophic risks and child safety risks respectively. Developers must report critical safety incidents to the Attorney General within 15 days, or within 24 hours if an imminent risk of death or serious injury exists. Chatbot providers must similarly report child safety incidents within 15 days. Employees who report safety concerns are protected from retaliation, with a private right of action available for violations.

Civil penalties of up to $1 million per violation apply to frontier developers and up to $50,000 per violation to chatbot providers. The bill was indefinitely postponed on April 17, 2026.

Failed

NEBRASKA

Introduced January 17, 2024, LB1203 would regulate the use of AI in political advertising. The bill would require all covered advertisements created in whole or in part by AI to display a clear and conspicuous disclaimer of the use of AI to create the ad. Specific requirements for the disclaimer vary depending on the medium and are articulated in the bill. There is no private right of action.

Failed

NEBRASKA

Introduced on January 13, 2026, LB1006, the “Protecting Consumers and Jobs from Predatory Pricing Act,” would have required businesses that knowingly advertise or promote personalized algorithmic pricing using consumer data to provide a clear and conspicuous notice of the same. The bill would have also prohibited electronic shelving labels displaying personalized algorithmic pricing.

Failed

NEVADA

Enacted in 2025, AB406 regulates the use of artificial intelligence in mental and behavioral health contexts. It prohibits public schools from using AI to perform the mental health functions of school counselors, school psychologists, or school social workers, while allowing AI for administrative support tasks such as scheduling and record management. The Department of Education is required to develop a policy governing AI use by school mental health personnel, including a method to assess its accuracy and efficacy. The bill also prohibits AI providers from offering systems specifically programmed to deliver services that would constitute the practice of professional mental or behavioral health care if provided by a natural person, and prohibits unlicensed persons or AI providers from representing themselves as qualified to provide such care. Licensed mental and behavioral health providers face additional restrictions on their use of AI systems in clinical practice.

Enacted

NEVADA

Enacted on June 3, 2025, AB73  regulates the use of AI in political advertising. The law requires political ads created using AI, including audio messages created using AI, to include a clear and conspicuous disclaimer. The law includes specific requirements for the disclaimer depending on the media form. A copy of the ad must be furnished to the Nevada Secretary of State in accordance with other Nevada election advertising laws.

This law will become effective Jan. 1, 2026 and does not provide a private right of action.

Enacted

NEVADA

Introduced May 15, 2025, SB 495 was a broad healthcare reform bill that included a provision directly regulating the use of AI in insurance. Insurers and other entities that use an artificial intelligence system or automated decision tool to process prior authorization requests would have been required to transmit a notice to each insured disclosing the use of the system or tool and describing certain aspects of how it operates.

Failed

NEVADA

Introduced on February 3, 2025, SB186 governs the use of artificial intelligence in healthcare. Any patient communication must contain a disclaimer that the communication was generated using AI and provide the patient a way to contact a human.

Failed

NEVADA

SB 199, introduced on February 11, 2025, establishes comprehensive regulations for artificial intelligence systems, particularly those involved in automatic decision-making and generating outputs such as content, predictions, or recommendations. The bill requires AI companies to register with the Bureau of Consumer Protection and imposes rules on data usage, transparency, and consumer protection. It addresses AI applications in legal document generation, social media data training, employment impact reporting, fraud prevention, law enforcement policies, and education. Additionally, it restricts certain practices such as AI-driven rent pricing and mandates consent for using health data to train AI models.

Failed

NEW HAMPSHIRE

On January 1, 2025, the New Hampshire Data Privacy Act (“NHDPA”) came into effect. The NHDPA is an omnibus consumer privacy law that also sets out rules for profiling and automated decision-making.  Specifically, the law enables individuals to opt-out of “profiling in furtherance of solely automated decisions that produce legal or similarly significant effects concerning the consumer.” Profiling is defined as “any form of automated processing of personal data to evaluate, analyze, or predict personal aspects concerning an identified or identifiable natural person’s economic situation, health, personal preferences, interests, reliability, behavior, location, or movements.”  Controllers must also perform a data protection assessment for high-risk profiling activities.

Enacted

NEW HAMPSHIRE

Introduced on December 12, 2025, HB 1694 regulates personal data collected by websites and data brokers and strengthens consumer privacy protections. Importantly, the bill grants consumers the right to opt out of profiling in furtherance of solely automated decisions that produce legal or similarly significant effects, ensuring transparency and accountability in algorithmic processing. Violations are treated as deceptive trade practices and subject to civil penalties of up to $10,000 per year.

Proposed

NEW HAMPSHIRE

Introduced on December 17, 2025, HB 1725 establishes a framework for the regulation of artificial intelligence technologies, with a strong emphasis on systems that perform automatic decision-making using adaptive algorithms. It prohibits AI applications that enable unlawful discrimination, social scoring, or manipulative practices causing harm, and requires clear disclosure when individuals interact with AI-driven systems.

Proposed

NEW HAMPSHIRE

Introduced on January 7, 2026, HB 1612 prohibits the use of price-fixing software by landlords. If passed, the act will become effective on January 1, 2027.

Proposed

NEW HAMPSHIRE

Introduced in 2026, H 1406 requires health carriers subject to the managed care law to maintain written records of their use of algorithms, AI, and machine-based systems, including which functions AI is used for and protocols ensuring qualified human review of provider coding decisions. All adverse determinations, including payment reductions and downcoding, must be made by a qualified health care provider, who must provide written notice to the covered person detailing the clinical rationale. Records of each adverse determination must indicate whether AI was used to assist the reviewer. Health carriers remain responsible for compliance where they have contracted out utilization review functions to third parties.

Failed

NEW HAMPSHIRE

Introduced January 7, 2026, H 1725 establishes a new chapter governing the development, deployment, and use of AI systems by any person, business, or governmental entity conducting business in New Hampshire or offering products or services to state residents. Covered entities must provide clear and conspicuous disclosure to consumers when interacting with an AI system, including in healthcare contexts. Covered entities are prohibited from developing or deploying AI with intent to unlawfully discriminate against protected classes, and from using AI for social scoring or manipulation intended to cause self-harm or criminal acts. Government entities are additionally prohibited from using AI to identify individuals through biometric data collected from public sources without consent. A regulatory sandbox program allows approved participants to test AI systems for up to 36 months under quarterly reporting requirements.

The Attorney General has exclusive enforcement authority, with civil penalties of up to $200,000 per violation and $40,000 per day for continuing violations following a 60-day cure period. No private right of action is created.

Failed

NEW HAMPSHIRE

Introduced January 7, 2026, S 640 prohibits any individual or entity from providing services requiring a professional license through internet-based AI unless those services are delivered by a licensed professional. For psychologists, mental health practitioners, and alcohol and other drug use professionals specifically, licensed practitioners may use AI to assist within their scope of practice but must maintain full responsibility for all AI interactions and outputs, obtain written informed consent from clients before using AI in service delivery, and review all AI-provided client interactions in a timely manner. AI use inconsistent with these requirements constitutes misconduct subject to disciplinary proceedings. Exceptions apply for religious counseling, peer support, and publicly available self-help materials.

Failed

NEW HAMPSHIRE

Introduced on January 7, 2026, HB 1406 would have required health carriers under New Hampshire’s managed care law to maintain written records regarding their use of artificial intelligence in utilization review and to establish protocols ensuring human review of certain determinations. Health carriers would have been required to record whether artificial intelligence was used in connection with any adverse determination affecting a covered individual and to maintain those records. Health carriers would have been responsible for compliance with these requirements by any entities with which they contract to perform utilization review functions.

The bill passed the House with amendments but was found inexpedient to legislate by the Senate.

Failed

NEW HAMPSHIRE

Introduced on January 7, 2026, SB 640-FN would have prohibited any person or entity from providing services requiring a professional license through AI unless those services are provided by a duly licensed New Hampshire professional. AI would have been barred from independently providing therapeutic communication or mental health services without the involvement of a licensed mental health professional, though licensed professionals could use FDA-authorized and HIPAA-compliant AI tools for clients under their care. Civil penalties of $10,000 per violation would have applied, with injunctive relief available without bond.

Failed

NEW JERSEY

Initially introduced on January 11, 2022, S332 (the “Act”), creates an omnibus consumer privacy law.   Among other things, the Act requires companies to conduct data protection assessments of “processing that presents a heightened risk of harm to a consumer” before conducting such processing. Such “heightened risk” results from activities such as profiling.  “Profiling” means any form of automated processing performed on personal data to evaluate, analyze or predict personal aspects related to an identified or identifiable individual’s economic situation, health, personal preferences, interests, reliability, behavior, location or movements. Consumers are also afforded the right to opt-out of profiling in furtherance of decisions that produce legal or similarly significant effects.

The Act was signed into law on January 16, 2024.  The law went into effect January 15, 2025.

Enacted

NEW JERSEY

Introduced on February 5, 2024, A3540 was signed into law on April 2, 2025 and is officially designated P.L.2025, c.40. The law establishes both criminal and civil penalties for the creation and dissemination of deceptive audio or visual media (deepfakes) when used for unlawful purposes. Under the law, it is a third-degree crime to generate or disclose a deepfake with the intent to further a crime, such as sexual offenses, harassment, identity theft, child endangerment, and election interference. Violators face 3 to 5 years in prison and/or a fine of up to $30,000. Sentences for the deepfake offense must run consecutively to sentences for the underlying crime. Victims can bring a civil lawsuit against the creator or distributor and may be awarded actual damages (at least $1,000 per violation), punitive damages, and attorney’s fees. The law does not apply to content clearly identified as a deepfake used for satire, parody, news reporting, teaching, or research. Broadcasters and social media platforms are generally exempt unless they knowingly distribute illegal deepfakes without a disclaimer.

Enacted

NEW JERSEY

On January 21, 2020, NJ Rev. Stat. § 56:18-1, et. seq. (otherwise known as S3096 and A4563) prohibits the use of an online “bot” with the intent to mislead another person about the bot’s artificial identity with the purpose of driving commercial transactions or influencing a vote in an election. Violations may incur a penalty of $2,500 for a first offense, $5,000 for a second offense, and $10,000 for subsequent offenses.

Enacted

NEW JERSEY

Originally introduced June 6, 2024 as AR141 and reintroduced as AR101 on January 13, 2026, this bill encourages platforms that generate and disseminate deepfake and cheapfake media “to voluntarily commit to prevent and remove harmful content.” “Deepfake” and “cheapfake” media includes video recordings, motion picture films, sound recordings, electronic images, photographs or other technological representations of speech or conduct that depict a person’s speech of conduct that would not normally engage in those behaviors. These medias are AI-produced content that can “manipulate public understandings of evidence and truth.” This resolution passed on June 28, 2024; while it is a formal expression of the Assembly’s opinion or policy, it does not have the force of law like an ordinary bill or joint resolution.

Enacted

NEW JERSEY

Introduced on February 19, 2026, A4085 (identical bill number S3612) prohibits grocery retailers from using AI-driven or data-driven tools to charge different customers different prices based on who they are (i.e., personalized algorithmic pricing or surveillance pricing, each of which determine sale price based in whole or in part on personal data). For example, charging higher prices to customers identified through tracking technology as being in a wealthier ZIP code or as having a greater willingness to pay. The Bill also puts a temporary freeze on the rollout of electronic price tags in stores pending a government study of their potential for misuse (i.e., electronic shelving labels connected to a technology that employs algorithmic pricing or surveillance pricing). The Attorney General may bring a civil action, and available remedies include monetary damages of up to $50,000 per violation. Exceptions to the prohibition include: (i) price differences based on reasonable costs associated with providing groceries to different persons; (ii) bona fide discounts with conspicuously disclosed eligibility conditions that are uniformly offered to broadly defined groups, such as teachers or veterans; and (iii) bona fide discounts offered through loyalty programs, including those based on points, credits, or purchase history coup.

Proposed

NEW JERSEY

Introduced on February 19, 2026, A4163 prohibits fraudulent misrepresentation of a candidate by a covered person if the covered person knowingly and intentionally disseminates a campaign advertisement containing a deepfake, and provides an exemption if the advertisement clearly discloses that it contains deepfake content. “Covered person” means a candidate; any firm, partnership, corporation, limited liability company, association, organization, or similar entity; political committees or parties, including political action committees; foreign governments; and any employee, contractor, or individual acting on behalf of those entities.

An aggrieved candidate may bring a civil action against the covered person is entitled to recover punitive damages, reasonable attorneys’ fees, and other reasonably related litigation costs incurred relating to the civil action. Additionally, for each day an advertisement that constitutes a violation is disseminated, the court may impose a penalty ranging from $15,000 to $250,000 per day depending on the office of the candidate being misrepresented. If passed, this law will take effect immediately.

Proposed

NEW JERSEY

Introduced on February 24, 2026, S3668 would require a person or entity, upon making contact with a consumer and prior to initiating any further communication, to notify the consumer that an artificial intelligence system is communicating with the consumer and provide the consumer with information on how to contact a human. Violation of this bill would be an unlawful practice and violation of the Consumer Fraud Act (P.L.1960, c.39 (C.56:8-1 et seq.)). If passed, the law will take effect immediately.

Proposed

NEW JERSEY

Introduced on February 24, 2026, S3702 (identical bill number A4741) would regulate the use of artificial intelligence (AI) communications paid for or financed by candidate committees and political committees. Political communications generated by AI are prohibited within 90 days before an election, must include a clear AI-use statement, and may not feature deceptive AI-generated media that falsely portrays an opposing candidate. Violation of this bill will result in criminal punishment and any other penalty provided by lay. If passed, the law will take effect on the sixtieth (60th) day after the date of the enactment.

Proposed

NEW JERSEY

Introduced on January 13, 2026, A2299 prohibits the sale to a landlord or use by a landlord of algorithmic devices for setting rent price or occupancy of residential dwelling units. “Algorithmic device” shall mean a device, such as a software program, that uses one or more algorithms to perform calculations of non-public competitor data concerning local, statewide, or regional rents or occupancy rates, for the purpose of advising a landlord whether to leave a unit vacant or on the amount of rent that the landlord requires from a tenant. The Attorney General may bring a civil action for damages, injunctive relief, restitution, or return of illegal profits and may assess a penalty up to $1,000 per violation.  If passed, this law will take effect on the first day of the second month following enactment.

Proposed

NEW JERSEY

Introduced on January 13, 2026, A2710 would prohibit any person, corporation, or entity that develops, deploys, markets, or makes available artificial intelligence to the public from designing, developing, marketing, or making available any artificial intelligence relationship simulation. An exception exists, however, for only if artificial intelligence is developed and deployed exclusively for a legitimate medical usage and does not imitate, simulate, or encourage a romantic or sexual relationship with a human. The Attorney General may bring a civil enforcement action and may assess a penalty not to exceed $25,000 per violation.

Proposed

NEW JERSEY

Introduced on January 13, 2026, A3065 establishes an individual’s name, image, likeness, or voice in any medium in any manner. This bill also prohibits any person from knowingly using or infringing an individual’s property right without authorization or consent for advertising, fundraising, or similar purposes, or who publishes, distributes, or makes available an individual’s name, image, likeness, or voice without consent, or provides tools primarily designed to produce such unauthorized uses, including infringement through the use of artificial intelligence technology. “Person” means any individual, firm, association, partnership, corporation, joint stock company, syndicate, receiver, common law trust, conservator, statutory trust, or any other concern.

An individual may recover actual damages and any attributable profits from the unauthorized use or infringement of their property rights, plus reasonable attorneys’ fees, in addition to other remedies provided by law. Additionally, a person who violates this bill shall be guilty of an offense as a disorderly person. If passed, this law will take effect on the first day of the third month next following enactment.

Proposed

NEW JERSEY

Introduced on January 13, 2026, A3989 prohibits the use and sale of algorithmic devices for establishing rent price or occupancy of residential property. “Algorithmic device” means a device, such as a software program, that uses one or more algorithms to perform calculations of non-public competitor data concerning local, statewide, or regional rents or occupancy rates, for the purpose of advising a landlord whether to leave a unit vacant or on the amount of rent that the landlord requires from a tenant. Violation of this bill will per se constitute a violation of the New Jersey Antitrust Act (P.L.1970, c.73 (C.56:9-3)). If passed, this law will take effect on the first day of the second month next following enactment.

Proposed

NEW JERSEY

Introduced on January 13, 2026, A799 (identical bill number S735) would prohibit advertising artificial intelligence system as licensed mental health professional. Violation of this bill would be an unlawful practice and violation of the Consumer Fraud Act (P.L.1960, c.39 (C.56:8-1 et seq.)). If passed, the law will take effect on the first day of the sixth month following the date of enactment.

Proposed

NEW JERSEY

Introduced on January 13, 2026, S451 (identical bill number A3326 and A3497) establishes the Forbidding the Algorithmic Inflation of Rent (FAIR) Act. This bill prohibits rental property owners from receiving, subscribing to, contracting with the services of a coordinator. This bill also prohibits a coordinator from facilitating any agreement among real property owners that restricts competition and further prohibits any person from performing a coordinating function or engaging in or facilitating parallel pricing coordination. “Coordinator” means any person who uses algorithmic revenue management software or an algorithmic device to coordinate actions for a rental property owner, including owners acting for their own benefit. A coordinating function may include using competitively sensitive information from multiple rental property owners through an algorithm or automated process to set or recommend prices, lease terms, or occupancy levels, including doing so for multiple owners in a way that facilitates parallel pricing coordination.

If passed, this act will take effect twelve months after its enactment.

Proposed

NEW JERSEY

Introduced on June 18, 2026, S4474 (identical bill number A5272) requires operators of AI companions to take reasonable steps to ensure users do not mistakenly believe they are interacting with a human. If there is a risk of such confusion, operators must clearly and conspicuously disclose that the system is generative AI, either continuously or at least every three hours during ongoing interaction. This bill also requires AI companions to direct users to appropriate crisis support resources when users express suicidal thoughts, and it establishes additional safeguards and restrictions when the user is a minor.

Violations of this bill may be subject to actual damages, injunctive relief, and a civil penalty not to exceed $1,000 per violation, with the total civil penalty not to exceed $500,000 per operator. If passed, this bill will take effect on the first day of the seventh month following its enactment.

Proposed

NEW JERSEY

Introduced on March 10, 2026 to supplement the Consumer Fraud Act (P.L.1960, c.39 (C.56:8-1 et seq.)), A4730 would require a person or entity to notify consumers when communicating with generative artificial intelligence to engage in trade or commerce. If passed, the law would take effect immediately.

Proposed

NEW JERSEY

Introduced on March 10, 2026, A4728 would prohibit a seller or seller’s agent from using photos that have been, in whole or in part, created or edited with generative artificial intelligence when advertising a dwelling unit or a dwelling site for sale, rent, or lease. Violation of this bill will result in a penalty of $500 for the first offense and up to $1,000 for each subsequent offense. If passed, this act will take effect on the first day of the second month following the date of enactment.

Proposed

NEW JERSEY

Introduced on March 10, 2026, A4732 would require an operator to provide a “clear and conspicuous notification to a user at the beginning of any AI companion interaction that the user is not communicating with a human.” An “operator” is any individual, partnership, association, firm, or business entity who provides an AI companion to a user. An “AI companion” is “a system using generative artificial intelligence designed to simulate a 10 sustained human or human-like relationship with a user” by retaining prior user data, asking unsolicited emotion-based questions, and sustaining ongoing dialogue about personal matters. Violation of this bill will result in a civil penalty of $15,000 for each violation. If passed, the law would take effect immediately.

Proposed

NEW JERSEY

Introduced on March 10, 2026, A4733 (identical bill number S4088) would prohibit advertising generative artificial intelligence as able to practice a regulated profession or occupation. Violation of this bill would be an unlawful practice and violation of the Consumer Fraud Act (P.L.1960, c.39 (C.56:8-1 et seq.)). If passed, this law would take effect on the first day of the sixth month 23 next following the date of enactment.

Proposed

NEW JERSEY

Introduced on March 16, 2026, A4685 prohibits a business entity from using, selling, distributing, developing, transferring, or providing access to an algorithmic device that uses a consumer’s personal data to recommend or set the sale price for goods or services. “Algorithmic device” means a device, such as a software program, that uses one or more algorithms to perform calculations using a consumer’s personal data to recommend or set the sale price for goods or services.

Violations of this bill may incur penalties under P.L.1970, c.73 (C.56:9-7) and additionally, the Attorney General may bring a civil action for damages, injunctive relief, restitution or return of illegal profits, civil penalties of up to $1,000 per violation, or a combination of these penalties in addition to attorney’s fees from the action. If passed, this law will take effect on the first day of the seventh month following its enactment.

Proposed

NEW JERSEY

Introduced on March 19, 2026, A4742 (identical bill number S3952) (to be known as the “Fair Pricing and Transparency Act”) prohibits retail food stores from using surveillance-based price discrimination, dynamic pricing, or personalized pricing to modify the sale price of groceries and other foodstuffs, including price changes that occur within minutes, hours, days, or across separate transactions, and price changes based on a consumer’s behavior, inferred data, or personally identifiable information. A violation of the bill’s provisions is an unlawful practice under the consumer fraud act, punishable by a monetary penalty of not more than $10,000 for a first offense and not more than $20,000 for any subsequent offense. If passed, the law will take effect on the first day of the seventh month following the date of enactment.

Proposed

NEW JERSEY

Introduced on March 5, 2026, S3732 prohibits a retail food store or third‑party grocery delivery platform from using dynamic, surveillance, or personalized algorithmic pricing when selling groceries or other food items to consumers, whether in person or online, except when based on previous purchase history, a discount, promotional price, or loyalty program benefit.

Violations of the law constitute unlawful practices under P.L.1960, c.39 (C.56:8-1 et seq.), and may result in monetary penalties and other applicable remedies. If passed, this law will take effect on the first day of the seventh month after its enactment.

Proposed

NEW JERSEY

Introduced on May 14, 2026, A5088 (to be known as the “AI Likeness Protection Act”) would prohibit the unauthorized distribution of a realistic representation of an individual using a generative artificial intelligence system.  A person may be liable in a civil action if the person publishes distributes, transmits, or otherwise makes available to the public a realistic representation of an individual without authorization or consent. If passed, this law will take effect on the first day of the eighth month following the date of enactment.

Proposed

NEW JERSEY

Introduced on May 14, 2026, A5089 (to be known as the “AI Image Disclosure Act”) requires a covered provider to include both a manifest disclosure that clearly and conspicuously identifies AI-generated content and is permanent or difficult to remove, and a latent disclosure that is not visible but conveys key information about the provider, system, and creation details and is likewise permanent, accessible, and standards-compliant. “Covered provider” means a sole proprietorship, a limited liability company, a corporation, an association, or any other legal entity that creates, codes, or otherwise produces a GenAI system that is publicly accessible within New Jersey.

Additionally, this bill requires a covered social media company to use a label to disclose any machine-readable provenance data in content on its platform indicating whether the content was created or altered using a general artificial intelligence system. “Covered social media company” means a person or entity that provides or operates a social media platform with at least five million account holders worldwide. “Provenance data” means data that provides a historical record of content that details the content’s origins by capturing the content’s metadata.

Violation of this bill will result in a penalty of $5,000 for each violation, with each day constituting a separate violation. If passed, this law will take effect on February 1 of the calendar year following the date of enactment.

Proposed

NEW JERSEY

Introduced on May 14, 2026, A5090 would impose civil liability on any owner, operator, or developer of a generative artificial intelligence platform that does business in or is accessible in New Jersey if they fail to prevent the platform from engaging in conduct that would constitute specified crimes if committed by a human, or from providing information that facilitates a user’s commission of those crimes in a manner that would constitute aiding or abetting. Violation of this bill will result in a penalty of $20,000 for each violation and is to be enforced in an action brought by the Attorney General. If passed, this law will take effect on the first day of the fourth month following enactment.

Proposed

NEW JERSEY

Introduced on May 14, 2026, S4279 prohibits the use of an automated decision system by a covered entity or a covered entity’s agent, third-party vendor, model developer, or external data source in a manner that results in a disparate impact on a protected class. This bill also requires a covered entity to conduct algorithmic assessments and keep records of the assessments. “Covered entity” means a person, lender, housing provider, screening company, creditor, servicer, insurer, or agent that uses or deploys an automated decision system in connection with a housing-related or credit-related decision concerning a person in New Jersey. “Disparate impact” means the result of a policy or practice that actually or predictably results in a disproportionately negative effect on members of a protected class. Violation of this bill will result in a fine of not less than $5,000 and are subject to other existing remedies provided for by law. If passed, this law will take effect 30 days after the date of enactment.

Proposed

NEW JERSEY

Introduced on May 21, 2026, S4314 prohibits business entities from using personalized algorithmic pricing, surveillance-based pricing, or a pricing strategy that determines or varies the sale price of merchandise or services based, in whole or in part, on a consumer’s personal data including, but not limited to, biometric data and protected class data. The bill provides exceptions for discounts, promotional pricing, loyalty program benefits, and price changes driven by changes in supply.

Violations of the law constitute unlawful practices under P.L.1960, c.39 (C.56:8-1 et seq.), and may result in monetary penalties and other applicable remedies. If passed, the law will take effect on the first day of the fourth month after its enactment.

Proposed

NEW JERSEY

Introduced on May 7, 2026, A4981 (identical bill number S4075) would prohibit employers, public entities, vendors, or contractors from using, deploying, developing, or offering an electronic monitoring tool (EMT), automated employment decision system (AEDS), or automated benefit or service decision system (ABSDS) in a manner that causes or contributes to violations of collective bargaining agreements or labor laws, or that undermines the health, safety, privacy, dignity, autonomy, or rights of employees, applicants, or service beneficiaries. They are further prohibited from engaging in intrusive surveillance, requiring monitoring of personal devices, using AI or surveillance for discriminatory or retaliatory purposes, setting harmful productivity standards, or improperly collecting, using, or disclosing protected or biometric data.

This bill would also require that an AI system, specifically an AEDS, ABSDS, or EMTs, cannot be used until it is screened in an “impact assessment” and approved as being in compliance with the requirements of the bill by an independent auditor. The requirements include prohibitions on certain surveillance practices, using AI in ways that violate collective bargaining agreements or laws, setting performance standards likely to harm worker health and safety, and using AI systems to discriminate in employment decisions or public services.

Violations of this bill are subject to criminal penalties including imprisonment, civil penalties including fines, and liability in civil actions for remedies including injunctions, compensation for lost wages, attorney’s fees, or punitive damages. If passed, this law will take effect 18 months after enactment.

Proposed

NEW JERSEY

Originally introduced April 8, 2024 as S3046 (identical bill number A1258) and reintroduced on January 13, 2026 as S476 (identical bill number A4359), this bill would provide corporation business and gross income tax credit for employing persons who have experienced job loss because of automation. The corporation tax credit would be equal to 10 percent of the salary and wages paid to each person employed by the corporation who experienced termination because of automation. To qualify, the corporation as a taxpayer must employ the person for at least seven months of the privilege period the taxpayer claims the credit. The credit, however, cannot exceed $2,500 per employee per privilege period. “Automation” is defined as a “device, process, or system that functions without continuous input from a human operator.” This bill would take effect immediately and would apply to privilege periods and taxable years beginning on or after January 1 of the year following enactment.

Proposed

NEW JERSEY

Originally introduced as A2818 (identical bill number S2543) on October 24, 2024, , and reintroduced as A3585 (identical bill number S2129) on January 13, 2026, this bill would prohibit and impose criminal penalty on disclosure of certain intentionally deceptive audio or visual media within 90 days of election.

Proposed

NEW JERSEY

Originally introduced as A3854 on February 22, 2024 (which was similar to A4030), and reintroduced on January 13, 2026 as A2726this bill essentially would make it unlawful for the sale, development, deployment, use, or offer for sale of an automated employment decision tool unless (1) a bias audit assesses the tool within the past year prior to selling or offering the tool for sale; (2) the tool includes at no additional costs this annual bias audit service; (3) the tool is developed, sold, deployed, used, or offered for sale with a notice stating the tool is subject to this bill; and (4) the tool’s developer has implemented the recommendations of the most recent bias audit conducted and the developer issues a press release stating so. Additionally, employers using automated employment decision tools must provide the results of the tool’s most recent bias audit on its website. Employers must also notify applicants at least 10 days in advance if a bias-audited automated employment decision tool will be used in evaluating their application.  “Employer” includes an “individual, partnership, association, corporation,” and other business entities. “Automated employment decision tool” is a “machine-based system that can, for a set of human-defined objectives provided by an employer or an individual acting on behalf of an employer, make predictions, recommendations, or decisions influencing recruitment, workforce, or employment decisions.” A “bias audit” would be an “impartial evaluation conducted by an independent auditor.”

An employer’s violation of this bill would result in a civil penalty of not more than $500 for the first violation and for each subsequent violation. A developer’s violation of this bill would result in a civil penalty of not more than $1,500 for that developer’s first violation and the civil penalty increases by two percent for each subsequent day the developer remains in violation.

Proposed

NEW JERSEY

Originally introduced February 27, 2024as  A3912 (identical bill number S736) and reintroduced as S2329 on January 13, 2026, this bill would expand the definition of “identity theft” to include impersonation or false depictions of a person generated entirely or substantially manipulated by computer technology or AI-generated speech, speech transcription, or text. To constitute criminal activity, a person must reasonably believe the AI-generated content accurately exhibits the activity of a person, the content was produced without the person’s content, and the exhibition is “substantially likely” to create perceptible individual or societal harm. This act would take effect immediately.

Proposed

NEW JERSEY

Originally introduced March 18, 2024 as S2964 (Assembly version A3855) and reintroduced on January 13, 2026 as A1021, this bill establishes standards for independent bias auditing of automated employment decision tools (“AEDT”). This bill would apply to employers, including employment agencies, individuals, partnerships, associations, corporations, and other entities employing any person. An “independent auditor” would be a person or group capable of exercising objective judgment on all issues within the scope of a bias audit of an AEDT. “AEDT” is a machine-based system that can, for a set of human-defined objectives provided by an employer, make predictions, recommendations, or decisions influencing recruitment, workforce, or employment decisions. A “bias audit” would be an “impartial evaluation, including but not limited to a rigorous assessment of an automated employment decision tool to determine its impact on persons of any category, identify and document any biases, risks, or potential discriminatory outcomes from its design, implementation, or use, and provide clear, actionable recommendations to avoid, manage, or mitigate those biases and risks and ensure safe, secure, and trustworthy use.

Proposed

NEW JERSEY

Originally introduced on January 14, 2025 as A5164, and reintroduced as A3307 on January 13, 2026, this bill provides that “any news media or other entity disseminating news or purporting to disseminate news within the State may permit the use of artificial intelligence to assist its professionals and staff in investigating, researching, and reporting information, but shall be prohibited from using artificial intelligence in lieu of professionals and staff.”   In addition, “[a]ny news media or other entity disseminating news or purporting to disseminate news within the State that uses generative AI content, regardless of what entity or mechanism produced it, shall disclose the following: (1) a prominently displayed label indicating that the content is generative AI; (2) credit to any source used to produce the content; and (3) a disclaimer that the content may not accurately reflect the source material from which it was produced.”