United States State AI Laws Overview

Overview

State-level artificial intelligence regulation across the United States has expanded into a complex regulatory environment. State legislatures, executive branches, and municipal authorities have enacted statutes, executive orders, administrative rules, and enforcement frameworks targeting high-risk AI deployments, deepfakes, conversational AI, healthcare algorithms, and public sector procurement. While federal legislative efforts remain focused on agency guidelines and study commissions, individual U.S. states have created binding obligations for developers, deployers, and commercial operators of automated decision-making systems.

The scope of state legislation spans comprehensive governance frameworks to targeted sectoral interventions. Key regulatory domains include election integrity and synthetic media disclosures, consumer protection against deceptive AI chatbots, algorithmic discrimination prohibitions in employment and housing, prior authorization restrictions in healthcare insurance, and child online safety guardrails. States have also enacted statutory provisions establishing digital likeness rights, defining computational rights, prohibiting non-consensual deepfake intimate imagery, and regulating public sector AI procurement.

Regulatory activity is distributed across all 50 states, Puerto Rico, and major municipal jurisdictions. States like California, Colorado, Utah, Texas, New York, Illinois, Connecticut, and Tennessee have enacted major foundational statutes, while nearly every state has introduced specific criminal prohibitions, campaign finance disclaimers, or administrative policies governing artificial intelligence technologies.

Regulatory Approach

State regulatory approaches to artificial intelligence reflect varied legislative philosophy and governance models. Several states favor comprehensive, horizontal governance models that establish broad duty-of-care standards, mandatory risk management policies, and algorithmic discrimination prohibitions across high-risk automated decision-making tools. For example, Colorado enacted Senate Bill 26-189 (repealing earlier legislation SB 24-205) to govern automated decision-making technology in consequential decisions across employment, housing, healthcare, education, financial services, insurance, and public benefits. Similarly, the Texas Responsible Artificial Intelligence Governance Act (TRAIGA, HB 149) establishes broad prohibitions against discriminatory AI design, social scoring, and systems causing physical self-harm.

Other jurisdictions adopt targeted, light-touch, or innovation-friendly frameworks centered on consumer disclosure, public sector inventorying, and regulatory sandboxes. Utah enacted the Artificial Intelligence Policy Act (SB 149) alongside amendments creating an Office of Artificial Intelligence Policy and a Learning Laboratory Program, enabling controlled testing of AI applications while mandating clear consumer disclosures. Arkansas passed Act 848 (HB 1958) requiring public entities to adopt formal AI policies and maintain human final decision-making authority, and Act 927 (HB 1876) establishing ownership standards for generative AI content and training data. Montana enacted the Right to Compute Act (SB 212), establishing a strict scrutiny standard for government restrictions on computational resources while requiring risk management for AI controlling critical infrastructure.

In contrast, states like California and New York focus on frontier model safety and supply-chain transparency. California's Transparency in Frontier Artificial Intelligence Act (SB 53) targets developers of large-scale models trained using high computational thresholds, requiring published safety frameworks, catastrophic risk management, and mandatory incident reporting. New York's Senate Bill S8828 establishes binding transparency and safety frameworks for frontier AI developers under Department of Financial Services oversight. Meanwhile, states such as Mississippi have established foundational statutory definitions of artificial intelligence (HB 1723) to establish legal baselines without imposing immediate compliance obligations.

Key State Legislation

State AI legislation covers broad functional themes across multiple jurisdictions:

• Frontier AI Safety & Transparency: California SB 53 mandates frontier AI frameworks and catastrophic risk reporting; California AB 2013 requires generative AI training data transparency; New York SB S8828 imposes safety assessments and incident reporting for frontier model developers; Illinois SB 315 requires independent third-party audits of frontier AI safety protocols.
• Conversational AI & Minor Safeguards: Hawaii SB 3001 (Act 248) and Iowa SF 2417 impose disclosure rules, minor engagement restrictions, and self-harm crisis protocols on conversational AI; Georgia SB 540 and Washington HB 2225 regulate companion chatbots and require crisis referrals; New Jersey A4015 (Kids Code Act) mandates age-appropriate design; California SB 243 mandates companion chatbot disclaimers and crisis prevention protocols.
• Healthcare & Insurance Utilization: Colorado HB 26-1139 and HB 1195 restrict AI in utilization review and ban direct AI psychotherapy; Georgia SB 444, Arizona HB 2175, Indiana HB 1271, Nebraska LB 77, and Washington SB 5395 prohibit AI from serving as the sole automated basis for healthcare coverage denials or downcoding without human medical review; Louisiana HB 475 requires verbal disclosure when AI transcribes medical visits; Maine LD 2082, Missouri SB 1019, Vermont H.816, and Tennessee SB 1580 restrict AI from acting as or impersonating licensed mental health professionals.
• Digital Likeness, Rights of Publicity, & Deepfakes: Tennessee's ELVIS Act protects voice rights as property rights; Arkansas Act 159 (HB 1071) expands right-of-publicity laws to AI synthetic voices; California AB 1836 protects deceased performers' digital replicas; Washington SB 5886 establishes personality rights against forged digital likenesses; Utah SB 256 creates an exclusive personal identity right for 70 years post-mortem; Hawaii HB 2137 prohibits unauthorized realistic digital imitations.
• Elections & Synthetic Media Disclaimers: California AB 2355, AB 2655, and AB 2839 regulate election deepfakes and mandate AI disclaimers; Arizona SB 1359, Florida HB 919, Idaho HB 664, Indiana PL 81, Michigan Public Acts 263-266, Montana SB 25, New Hampshire HB 1596, New Mexico HB 182, Nevada AB 73, North Dakota HB 1167, Oregon SB 1571, Rhode Island PL 2025 Ch. 409, South Dakota SB 164, Tennessee HB 1513, and Wisconsin Act 123 require disclaimers or ban materially deceptive campaign deepfakes near elections.
• Criminalizing Deepfakes & AI CSAM: California AB 1831, SB 926, and SB 981; Iowa HF 2240 and SF 2243; Kansas SB 186; Louisiana HB 119; Michigan HB 4047-4048; Oklahoma HB 1364 and HB 3642; Utah HB 289 and HB 276; Washington SB 5105; Wyoming HB 102 and HB 85 criminalize non-consensual intimate deepfakes and AI-generated child sexual abuse material.
• Employment & Public Sector Governance: Illinois HB 3773 prohibits algorithmic discrimination in employment; NYC Local Law 144 mandates bias audits for automated employment decision tools; Maryland HB 1202 restricts facial recognition in job interviews; Connecticut Public Act 23-16 and California EO N-5-26 establish public-sector AI procurement and inventory requirements.

Enforcement Bodies

Enforcement and administrative oversight of state AI legislation are distributed across state attorneys general, specialized administrative divisions, executive technology departments, and professional licensing boards. State attorneys general serve as the primary enforcement authority under general consumer protection and deceptive trade practices acts in states including Colorado, California, Hawaii, Iowa, Washington, Texas, Utah, Illinois, Maine, and New York. In these jurisdictions, attorneys general hold investigatory powers, civil investigative demand authority, and the ability to seek judicial injunctions and monetary penalties.

Sector-specific enforcement is assigned to specialized administrative authorities. State insurance departments—such as the Arizona Department of Insurance and Financial Institutions, Maryland Insurance Administration, Vermont Department of Financial Regulation, Colorado Division of Insurance, and Washington State Office of the Insurance Commissioner—enforce compliance regarding health insurance prior authorization and algorithmic underwriting. Professional licensing bodies, including state medical boards, nursing boards, and ethics boards, oversee practitioners utilizing AI transcription or clinical support. Executive IT agencies, such as the California Department of Technology, the Georgia Technology Authority, the North Carolina Department of Information Technology, and the Utah Division of Consumer Protection within the Department of Commerce, supervise public sector AI inventories, advisory councils, and regulatory sandboxes.

Penalties & Enforcement

Penalties and enforcement mechanisms under state AI laws vary according to statutory classification, ranging from civil administrative fines to felony criminal convictions. Deceptive trade practice violations enforced by attorneys general carry substantial civil monetary penalties. For instance, Iowa's Conversational AI Chatbot Safety Act authorizes civil penalties up to $100,000 per violation. In California, violations of generative AI transparency obligations under SB 942 carry civil penalties of $5,000 per violation per day, while SB 53 authorizes penalties up to $1,000,000 for non-compliant frontier developers. New York S8828 allows administrative penalties of $1,000 per day for failing to submit required frontier AI risk assessments, alongside court penalties up to $15,000 per day under chatbot toy restrictions (S9408A).

Criminal enforcement mechanisms target malicious deepfakes, election interference, and synthetic child sexual abuse material (CSAM). Creation or dissemination of AI-generated CSAM or non-consensual explicit deepfakes constitutes a felony offense in jurisdictions like Kansas (SB 186), Louisiana (HB 119), Wyoming (HB 102), Oklahoma (HB 3642), and California (AB 1831), carrying multi-year prison sentences and mandatory sex offender registration. Election deepfake non-disclosure violations range from Class 1 misdemeanors to Class 4 felonies in Arizona (SB 1359) and Michigan (Public Act 265), or Class C misdemeanors in Tennessee (HB 1513). Private rights of action are established in several states—including Hawaii (HB 2137), Oregon (SB 1546), Utah (HB 276 / SB 256), New Hampshire (HB 1432), and Washington (SB 5886)—allowing aggrieved individuals to seek statutory damages ranging from $1,000 to $25,000 per violation, actual damages, and attorney fees.

Sector Focus Areas

State AI legislation concentrates heavily on key societal and economic sectors where automated decision-making poses severe risks to civil rights, health, and consumer welfare:

Healthcare and health insurance represent major legislative focal points. States have enacted strict human-in-the-loop requirements to prevent automated algorithms from making final denials of medical coverage or prior authorization. Statutes in Arizona, Georgia, Indiana, Nebraska, Washington, and Maryland prohibit insurers from relying solely on AI outputs for claim downcoding or coverage denials, requiring individualized clinical review by licensed human physicians. Furthermore, multiple states—including Colorado, Maine, Missouri, Tennessee, and Vermont—have banned AI systems from providing direct, unsupervised psychotherapy or impersonating credentialed mental health professionals.

Elections and public discourse form another primary sector focus. Over twenty states have passed laws requiring disclaimers or prohibiting deceptive synthetic media distributed near elections, aiming to prevent voter deception and protect candidate reputations. Additionally, the employment sector is heavily regulated regarding algorithmic bias and workplace transparency: Illinois prohibits discriminatory AI hiring tools and restricts AI in teacher evaluations (SB 2909), New York City mandates bias audits for automated employment decision tools, and California requires 45 days' written notice to public employee unions before deploying generative AI in represented job classifications (AB 2656).

National/Federal Alignment

State artificial intelligence laws interact directly with federal frameworks, executive orders, and national technical standards. State statutory definitions and risk management frameworks frequently incorporate or align with benchmarks established by federal institutions, such as the National Institute of Standards and Technology (NIST) AI Risk Management Framework and ISO standards. For instance, Kentucky Senate Bill 4 directs state technology offices to align agency AI oversight with NIST and ISO standards, while North Carolina's NCDIT Framework integrates NIST guidelines for ethical public sector AI deployment.

State frameworks also navigate federal supply chain and statutory boundaries. Under California Executive Order N-5-26, state authorities are empowered to evaluate federal supply chain risk determinations independently to prevent state procurement disruptions. State election deepfake regulations are structured around federal statutory safe harbors, including Section 230 of the Communications Decency Act (47 U.S.C. § 230), providing explicit exemptions for interactive computer service providers, telecommunications carriers, and broadcasting entities airing unedited third-party content. However, judicial rulings have addressed federal preemption and constitutional limits; for example, federal court orders in Kohls v. Bonta enjoined enforcement of California's election deepfake law (AB 2655) against interactive computer service providers based on Section 230 preemption and First Amendment grounds.

Notable Provisions

State legislative bodies have pioneered innovative and unique statutory mechanisms to address emerging technological challenges:

Tennessee's ELVIS Act established a groundbreaking legal precedent by expanding state personal rights protections to include an individual's voice as a protected property right alongside image and likeness, specifically targeting unauthorized AI voice cloning in the music industry. Arkansas enacted Act 927 (HB 1876), establishing statutory standards for generative AI content ownership and specifying work-made-for-hire provisions for employer-directed AI training data. Montana passed the Right to Compute Act (SB 212), establishing private computational resource usage as a fundamental right subject to strict scrutiny judicial review. Vermont enacted H.814, establishing statutory neurological rights and requiring explicit consent for brain-computer interfaces.

In the realm of frontier technology governance, Illinois enacted SB 315, becoming the first state to mandate independent third-party audits of frontier AI safety protocols. New York SB S9408A proposed a five-year moratorium on conversational chatbot toys for children. Utah established an AI Learning Laboratory Program (SB 149 / HB 320) and a regulatory sandbox administered by the Office of Artificial Intelligence Policy, providing controlled conditions for testing AI innovations under relaxed regulatory requirements. Additionally, Maryland enacted HB 895 (Protection From Predatory Pricing Act), establishing the nation's first state prohibition against personalized dynamic pricing in the food and delivery sector using AI and personal data.

Future Developments

State-level AI legislative activity is set to intensify as enacted statutes reach their effective dates and pending legislative measures advance. Key state statutory milestones taking effect between late 2026 and 2028 include Colorado's SB 26-189 (governing automated decision-making technology, effective January 1, 2027), New York's S8828 (frontier model developer obligations, effective January 1, 2027), Washington's HB 1170 and HB 2225 (AI content disclosure and companion chatbot rules, effective 2027), and Georgia's SB 540 (effective July 1, 2027).

Legislative bodies continue to evaluate pending measures targeting emerging AI risks. In New York, Senate Bill S1169 (the New York Artificial Intelligence Act) remains under legislative consideration to prohibit algorithmic discrimination across high-stakes domains and create private civil remedies. In Virginia, measures such as SB 796 continue to refine child safety guardrails for companion chatbots. Furthermore, state regulatory sandboxes, advisory commissions—including the Virginia Commission on AI, West Virginia Task Force on AI, and Georgia's Senate Study Committee recommendations—and mandatory agency annual reports will drive future legislative proposals across state capitols nationwide.