AI Laws by State: The Complete US Regulation Guide

As AI systems move deeper into everyday experiences — hiring, lending, healthcare, public services, customer support — US states are advancing legislation that governs how these systems are developed, deployed and managed.

The result is not a single federal framework, but an increasingly complex mosaic of state-level laws that businesses must follow.

Feds Attempt to Block State AI Laws

In December 2025, the White House issued an Executive Order directing federal agencies to review and, where appropriate, challenge state laws that could obstruct national AI policy objectives.

The order does not automatically invalidate state AI laws, but it does introduce a new layer of uncertainty. Agencies were told to determine whether certain state measures conflicted with federal priorities (to not allow “any foreign nation to beat us”) or impose burdens that could warrant preemption.

For enterprise AI leaders, this creates a dual reality: state-level obligations remain enforceable, but the long-term stability of some frameworks may depend on evolving federal policy and potential legal challenges.

AI Regulations State-by-State

Below is a state-by-state breakdown of the laws, policies and mandates that enterprise leadership should track.

California

California is one of the most active AI regulatory jurisdictions in the United States.

• The Bolstering Online Transparency Act (BOT Act) prohibits the use of undisclosed automated accounts to influence commercial transactions or elections.
• The California Consumer Privacy Act (CCPA) gives Californians the right to know, delete and limit the sale of personal information collected by businesses.
• The California Privacy Rights Act (CPRA) expands the CCPA with additional protections for sensitive data, data correction and limits on sharing information for targeted advertising.
• The Transparency in Frontier Artificial Intelligence Act applies to developers of the most advanced AI models and requires publication of safety and risk documentation related to catastrophic misuse.

The state has also enacted measures requiring disclosure of AI-generated or manipulated content in election contexts, and continues to advance protections around digital replicas and synthetic media. For enterprises, California’s approach often functions as a regulatory bellwether, with its privacy, transparency and automated decision-making standards shaping AI governance strategies nationwide.

Colorado

The Colorado Artificial Intelligence Act (CAIA), which took effect in February 2026, is one of the most comprehensive state-level AI governance frameworks to date.

The law imposes obligations on developers and deployers of “high-risk” AI systems, particularly those used in consequential decisions like employment, housing, financial services, education and healthcare. It requires risk management programs, impact assessments, documentation and measures to prevent algorithmic discrimination.

CAIA also mandates consumer disclosures when high-risk AI systems are used, and provides individuals with rights to correction and appeals.

By focusing on documented governance, transparency and bias mitigation rather than outright restrictions, Colorado’s framework has become a reference point for other states considering comprehensive AI legislation.

Delaware

• The Delaware Artificial Intelligence Commission, established in 2024, inventories generative AI use across executive, legislative and judicial agencies and recommends statewide policies and guidelines for ethical and safe AI deployment in government.
• Delaware’s Generative Artificial Intelligence Policy guides state employee use of genAI tools.
• Deepfake-related criminal and civil penalties exist for harmful synthetic media distribution.
• The Delaware Supreme Court also adopted interim guidance permitting limited generative AI use by judges and court staff, requiring administrative approval and reinforcing human accountability for all judicial decisions.

Florida

Florida’s AI-related regulatory activity remains targeted rather than comprehensive, with a primary focus on transparency in political communications and harmful synthetic content.

• Bill HB 919, enacted in 2024, requires political advertisements containing AI-generated or AI-modulated content to include clear disclosures.
• Strengthened criminal statutes prohibit the creation and distribution of AI-generated child sexual abuse material.
• The Artificial Intelligence Bill of Rights, introduced during the 2026 legislative session, will, if passed, establish parental controls, disclosure requirements, limits on unauthorized use of personal likenesses and protections for minors using chatbot platforms.

Illinois

• House Bill 3773, which became effective in January 2026, amends the Illinois Human Rights Act and requires companies to notify employees and job applicants when AI assists with recruitment, hiring, promotion, discipline or other employment terms. Plus, they cannot use AI systems in ways that discriminate against protected classes.
• Illinois still enforces the Artificial Intelligence Video Interview Act, which requires employers to inform applicants before using AI to analyze video interviews, explain how the technology operates and obtain consent.

Indiana

Indiana has adopted a formal statewide Artificial Intelligence Policy.

The policy requires all state agencies to align AI systems with the NIST AI Risk Management Framework and obtain approval before deploying AI systems.

Agencies must conduct readiness and maturity assessments during planning and pre-deployment phases, with ongoing oversight managed by the Office of the Chief Data Officer (OCDO) and the State Chief Privacy Officer.

The policy emphasizes transparency, risk management and “just-in-time” notice to individuals when interacting with AI systems. It also mandates documentation, exception controls, contractual safeguards for external partners and enforcement mechanisms for violations.

Louisiana

• House Bill 178 establishes a framework for the admissibility and use of AI-generated evidence in court proceedings.
• The AI Acceptable Use Policy for state government agencies sets ethical, privacy and security guidelines governing agency use of AI technologies.
• Louisiana’s governor has issued executive orders directing agency inventory and CIO approval requirements for AI deployments.
• Louisiana SB 42 also prohibits AI-generated child sexual abuse material, aligning with widespread state action.

Maryland

Maryland does not currently have a single, comprehensive AI law, but it has enacted several meaningful policies and sector-specific statutes that shape how AI systems are used, especially in government and regulated industries.

• Maryland’s Responsible AI Policy, issued in 2025, establishes a risk-management and ethical use framework for AI systems deployed by executive branch agencies and defines roles, responsibilities and prohibited uses for those systems.
• The state adopted healthcare regulations, HB 820, that require fair and equitable use of AI by health plans, prohibiting AI-driven denials or delays of care and mandating transparency and reporting around AI-supported utilization review decisions.
• Expanded criminal statutes address fraud and impersonation involving AI or deepfakes, making the knowing use of such technology to mislead or harm others a felony offense.

New Hampshire

• Four AI Bills restrict how state agencies can deploy AI systems, including limits on surveillance and automated data collection without proper legal authority
• The state’s AI Code of Ethics outlines requirements for AI systems such as human oversight, data governance, transparency, fairness and accountability.
• House Bill 1432 also criminalized the creation and distribution of fraudulent or harmful deepfake content, reinforcing protections against AI-enabled deception.

New Jersey

New Jersey has taken a dual-track approach to AI governance, combining economic development initiatives with oversight and task force-driven policy development.

• Executive Order 346 establishes New Jersey’s AI Task Force, which studies the societal, economic and ethical implications of artificial intelligence and recommends policy standards.
• The state also started its Next New Jersey Program, which offers substantial tax incentives to attract AI businesses and data centers, alongside partnerships with academic institutions like Princeton University.

New Mexico

• House Bill 182 requires political campaigns to disclose the use of AI-generated content in advertisements that may mislead voters, a transparency mandate designed to curb AI-driven deception in election messaging.
• The Government Use of Artificial Intelligence Act requires each state agency to annually submit an inventory of the agency’s AI systems to the Department of Information Technology.
• The Artificial Intelligence Accountability Act (AI2A), introduced in early 2026, will, if passed, require latent digital markers in AI-generated images, audio and video to enable verification and tracking. It will also allow the attorney general to investigate violations and impose penalties, and create civil liability for those who knowingly disseminate harmful synthetic content. The bill also calls for free provenance-detection tools and enhanced penalties for using AI to commit felony offenses.

New York

New York, alongside California, has become one of the most active US states on AI regulation.

• The Responsible AI Safety and Education Act (RAISE Act) imposes safety, transparency, reporting and compliance requirements on developers of the most advanced “frontier” AI models and establishes a state framework for oversight of highly capable systems.
• Several consumer-facing AI laws require conspicuous disclosure when “synthetic performers” are used in advertising and expand protections related to digital replicas and algorithmic pricing transparency.
• NYC’s Local Law 144 mandates bias audits for certain automated decision tools used in hiring.

Oregon

• Senate Bill 1571, enacted in 2024, is one of the first state laws in the country to regulate the use of AI in political campaign communications by requiring campaigns to disclose when AI or synthetic media are used in images, audio or video, with potential civil penalties for noncompliance.
• The State Government’s Artificial Intelligence Advisory Council is charged with developing strategic recommendations on responsible AI adoption, ethical guidelines, and risk management for public agencies.
• Proposed Senate Bill 1546, which, if passed, will impose additional safety and transparency obligations on AI chatbots, requiring operators to notify users they’re interacting with a machine, adopt protocols for self-harm and suicide screening and apply special protections for minors.

Pennsylvania

• SB 649 created new criminal penalties for the use of artificial intelligence to produce non-consensual “forged digital likenesses,” including deepfakes and AI-generated voice impersonations, used to defraud or harm individuals.
• SB 1213 expands mandatory reporting requirements to cover AI-generated child sexual abuse material.
• An interim policy on AI use was implemented in late 2025 to ensure responsible use of genAI within the judiciary.

Puerto Rico

Senate Bill 1179 and House Bill 2027 together establish a framework requiring the creation of an Artificial Intelligence Officer within the Puerto Rican Innovation and Technology Service (PRITS) who must evaluate, authorize and oversee the use of AI systems by executive branch agencies and ensure that automated decisions are transparent, accountable and compliant with existing civil rights and data protection standards.

In addition to establishing governance structures, Puerto Rico’s legislation empowers PRITS to develop policies on risk assessment, bias mitigation, data privacy and documentation for public-sector AI use.

South Dakota

In 2024, South Dakota updated its criminal code with Senate Bill 79, which clarifies that possession of AI-generated child pornography is a Class 4 felony, aligning state penalties with existing law for real-victim child abuse material and affirming that synthetic depictions of minors in sexually explicit content are unlawful regardless of whether a real child was involved.

Tennessee

• The Ensuring Likeness Voice and Image Security Act (ELVIS Act) amends the Personal Rights Protection Act to prohibit the unauthorized replication of an individual’s voice or likeness using AI without consent. The law makes the creation, distribution and monetization of deepfake content that mimics a real person without permission unlawful and provides for civil remedies and statutory damages for affected individuals.
• Tennessee’s Enterprise Artificial Intelligence Policy establishes requirements for risk assessment, documentation, human oversight, vendor evaluation, transparency, security standards and accountability measures for agency AI deployments, requiring planning and documentation before procurement, ongoing monitoring, and clear lines of responsibility.

Texas

The Texas Responsible Artificial Intelligence Governance Act (TRAIGA) took effect in January 2026. It governs high-risk AI uses, including prohibitions on deploying AI systems in ways that intentionally discriminate against protected classes, capture biometric identifiers without consent or materially mislead consumers. The law also includes provisions addressing AI-enabled impersonation, fraud, and deceptive synthetic media.

Unlike Colorado’s comprehensive governance model, Texas has adopted a more targeted regulatory approach focused on specific harmful uses rather than broad documentation mandates.

Utah

• Utah’s Artificial Intelligence Policy Act (UAIPA) requires the disclosure of genAI use in consumer interactions when directly asked or in certain regulated services. It also makes businesses responsible for AI-related violations of state consumer protection law, eliminating the defense that an AI system “made” a statement on its own.
• SB 226 and SB 332 extend UAIPA’s sunset date from 2025 to July 1, 2027 and narrow the disclosure duties to instances where consumers make clear and unambiguous requests about AI use or when high-risk interactions occur.

Virginia

• Virginia’s Executive Order 30 establishes ethical guidelines for AI use in state government and directs the formation of an AI Task Force to advise on policies that ensure privacy, security and transparency.
• The Artificial Intelligence Act (House Bill 2028 / Senate Bill 1710) establishes risk-based obligations for developers and deployers of advanced automated decision systems, including requirements for impact assessments, bias testing, documentation and reporting on algorithmic risk management for systems used in employment, consumer financial services, housing, public accommodations and other high-stakes areas.

Washington

Washington has taken substantive steps to shape responsible AI deployment in government and inform future policy development.

• Executive Order 24-01 directs state agencies to develop guidelines for the ethical, transparent and risk-aware use of generative AI within public-sector operations. The order calls for development of procurement standards, risk assessments for high-risk systems and analysis of workforce and equity impacts.
• ESSB 5838 established the Washington State Artificial Intelligence Task Force to study both public and private AI uses, assess benefits and risks and deliver recommendations to the governor and legislature.

West Virginia

House Bill 5690 established the West Virginia Task Force on Artificial Intelligence to recommend definitions of AI for legislative use, determine relevant state agencies to oversee AI policy, assess public-sector use cases and propose legislation to protect individual rights and consumer data related to generative and automated systems.

Lawmakers have introduced HB 4496 — which would require AI-generated media disclosures — and SB 198 — which would create criminal penalties for distribution of AI-generated child pornography — in the 2026 legislative session.

Wisconsin

• In 2025, Wisconsin passed bills to expand existing criminal statutes to cover AI-generated “synthetic intimate representations” such as deepfake pornography or explicit images of real people without consent, making creation or dissemination of such material a misdemeanor or felony depending on intent and harm.
• In January 2026, the Wisconsin Assembly passed legislation aimed at regulating data centers and related high-intensity computing facilities.