Compliance

Covered Entity

Healthcare organization subject to HIPAA requirements.

How the laws define this

At its core, a covered entity is any organization, operator, or person subject to a regulatory body's jurisdiction that bears legal responsibility for compliance—such as performing impact assessments, submitting reports, or meeting delivery standards—when deploying regulated tools or services. Frameworks diverge primarily on whether qualification depends on specific scale thresholds or purely on functional roles. Scale-sensitive measures like the Algorithmic Accountability Act (H.R. 5628 and S. 2892) restrict coverage to FTC-regulated organizations meeting statutory revenue, equity, or data thresholds, while SB 796 and the Artificial Intelligence Chatbots and Minors Act established law limit scope to chatbot operators with at least 500,000 monthly active users worldwide. In contrast, role-based rules apply based on activity alone regardless of size: the Guidance on Algorithmic Discrimination and the New Jersey Law Against Discrimination covers defined entities like employers or credit providers using automated tools, and the Proposed Rule: Electronic Delivery of Information Under the Federal Securities Laws applies broadly to anyone obligated to deliver securities information.

Synthesised from the 6 statutory definitions below. Each one is quoted in full, with its source.

How jurisdictions differ

What is distinctive in each definition, binding law in force first. Showing 5 of the 6 instruments that define this term; all are listed under Definitions below.

Jurisdiction	Instrument	Status	What is distinctive
New Jersey, United States	Guidance on Algorithmic Discrimination and the New Jersey Law Against Discrimination	In Force	Limits covered entities to those subject to the New Jersey Law Against Discrimination, such as employers, housing providers, places of public accommodation, credit providers, and contractors using automated tools.
United States	Proposed Rule: Electronic Delivery of Information Under the Federal Securities Laws	Proposed	Expands to any person required to deliver information under federal securities laws, including issuers, broker-dealers, investment advisers, registered investment companies, transfer agents, business development companies, and proxy or tender offer parties.
Virginia, United States	Artificial Intelligence Chatbots and Minors Act established; enforcement; civil penalties; individual action.	Under Review	Restricts to operators of chatbots with 500,000 or more monthly active users worldwide, excluding those not offered to the general public like internal, clinical, or research tools.
United States	Algorithmic Accountability Act (H.R. 5628, House version)	Withdrawn	Targets organizations under FTC jurisdiction meeting revenue, equity, or data-holding thresholds, requiring impact assessments and summary reports to the FTC for critical decisions.
United States	Algorithmic Accountability Act (S. 2892, Senate version)	Withdrawn	Specifies entities within FTC jurisdiction deploying augmented critical decision processes that meet revenue, equity, data scale, or ownership thresholds, with FTC defining calculation methods.

What it triggers

In New Jersey, United States, the Guidance on Algorithmic Discrimination sets out responsibility for compliance when using automated tools.source
Under the Proposed Rule: Electronic Delivery of Information Under the Federal Securities Laws, would require electronic delivery as the default for disclosures, shifting to an opt-out model.source
In Virginia, United States, under the Artificial Intelligence Chatbots and Minors Act, would require age verification for minors and a duty of loyalty to ensure user safety.
Under the Algorithmic Accountability Act (H.R. 5628, House version), would have required covered entities to perform and retain impact assessments and submit summary reports to the FTC.source
Under the Algorithmic Accountability Act (S. 2892, Senate version), would have required covered entities to conduct ongoing impact assessments, maintain documentation, and submit reports.source

Definitions (6)

An entity subject to the requirements of the New Jersey Law Against Discrimination, including employers, housing providers, places of public accommodation, credit providers, and contractors, which bears responsibility for compliance when using automated tools.

Guidance on Algorithmic Discrimination and the New Jersey Law Against DiscriminationDefinition 1 of 6

An organization subject to the Act defined by FTC jurisdiction and meeting statutory revenue, equity, or data-holding thresholds; covered entities are required to perform and retain impact assessments and submit required summary reports to the FTC.

Algorithmic Accountability Act (H.R. 5628, House version)Definition 2 of 6

An entity within the FTC's jurisdiction that deploys augmented critical decision processes and meets statutory thresholds (such as revenue, equity value, scale of consumer data, or ownership relationships), thereby becoming subject to the Act's assessment, retention, and reporting obligations. The FTC is required to define the calculation methods and provide guidance to determine covered status.

Algorithmic Accountability Act (S. 2892, Senate version)Definition 3 of 6

An operator of a chatbot that has 500,000 or more monthly active users worldwide, subject to specific reporting and loyalty duties.

SB 796 - Artificial Intelligence Companion Chatbots and Minors ActDefinition 4 of 6

An operator of a chatbot that has 500,000 or more monthly active users worldwide. Excludes chatbots not offered to the general public (e.g., internal tools, clinical tools, research systems) or used solely by a business entity.

Artificial Intelligence Chatbots and Minors Act established; enforcement; civil penalties; individual action.Definition 5 of 6

Any person required to deliver information under the federal securities laws, including issuers, broker-dealers, investment advisers, registered investment companies, transfer agents, business development companies, and parties conducting proxy solicitations or tender offers.

Proposed Rule: Electronic Delivery of Information Under the Federal Securities LawsDefinition 6 of 6

Not to be confused with

Organization

Covered entity under these definitions targets specific sectors or thresholds like anti-discrimination law or FTC jurisdiction, while organization broadly means any entity subject to CPPA obligations.

Personal information processor

Covered entity focuses on regulated roles in healthcare, securities, or AI tools, whereas personal information processor determines purposes and means of personal data processing.

Questions and answers

What entities are covered under New Jersey's algorithmic discrimination guidance?

Entities subject to the New Jersey Law Against Discrimination, including employers, housing providers, places of public accommodation, credit providers, and contractors using automated tools. The guidance clarifies compliance responsibilities.

Who are covered entities in the Algorithmic Accountability Act?

Organizations or entities under FTC jurisdiction meeting revenue, equity, data, or ownership thresholds that deploy automated systems for critical decisions. Both House and Senate versions were withdrawn.

Does the Virginia AI Chatbots Act apply to internal tools?

No, it excludes chatbots not offered to the general public, such as internal tools, clinical tools, or research systems. It covers operators with 500,000 or more monthly active users worldwide.