AI laws and Proposed Laws

In the US, artificial intelligence (AI) is regulated at both the federal and state levels. While the US lacks a unified federal AI law, the states have been active in modifying existing laws to account for AI and, in some cases, passing targeted AI-specific legislation.

This section outlines the major enacted laws at both federal and state levels, highlighting how states have taken the lead in adapting existing legal frameworks and introducing AI-specific laws in the absence of a comprehensive federal approach.

Federal AI legislation landscape

The federal regulatory landscape for AI remains limited in scope. Although a significant volume of AI-related legislation has been introduced in Congress, only one standalone statute intended to regulate the posting and distribution of AI-generated content has been enacted to date: 

• Tools to Address Known Exploitation by Immobilizing Technological Deepfakes on Websites and Networks Act (TAKE IT DOWN Act): Although the statute does not regulate AI systems directly, it requires online platforms to delete flagged non-consensual intimate imagery, including AI-generated deepfakes, within 48 hours. The law creates criminal penalties for distributing such content and empowers the Federal Trade Commission (FTC) to enforce compliance.

Accordingly, federal policy is more defined by proposals than binding obligations, and most operational guidance continues to come from executive actions and agency-level enforcement.

Potential federal framework

On 20 March 2026, the White House released a National Policy Framework for Artificial Intelligence, a set of non-binding legislative recommendations urging Congress to enact a uniform national AI standard that would preempt conflicting state laws. The Framework is organised around a broad set of objectives, including protecting children and empowering parents; safeguarding American communities (such as streamlining data-centre construction while protecting residential ratepayers, and augmenting enforcement against AI-enabled impersonation scams); respecting intellectual property and supporting creators; preventing censorship and protecting free speech; enabling innovation and ensuring American AI dominance; and educating Americans and developing an AI-ready workforce. The Framework does not itself create new legal obligations, but it signals the Administration’s priorities for the AI legislation it hopes Congress will advance.

This Framework grew out of Executive Order 14365, ‘Ensuring a National Policy Framework for Artificial Intelligence’ (the EO), which President Trump signed on 11 December 2025 with the stated aim of creating American dominance in the field. The EO sought to replace the existing patchwork of state laws—which the Trump Administration views as burdensome and detrimental to innovation—with a unified standard, and it directed federal officials to develop the legislative recommendations that became the March 2026 Framework.

To achieve this, the EO outlined a two-pronged strategy: challenging existing state AI laws in court and establishing a new federal regulatory framework that would preempt them. Pursuant to the EO, on 9 January 2026, the Attorney General (AG) established an AI Litigation Task Force to raise legal challenges to state laws that are viewed as unconstitutional or otherwise conflicting with federal regulations; as of mid-2026, however, the Task Force had not yet filed any lawsuits. The EO also directed the Secretary of Commerce to publish, within 90 days, an evaluation identifying ‘onerous’ state AI laws for possible referral to the Task Force. The federal framework the EO envisioned focuses on key areas such as child safety, censorship prevention, and copyright protection, while preempting conflicting state-level regulations.

State-level AI legislation landscape

The lack of comprehensive federal AI legislation has led to a proliferation of state-level laws and regulations, with many more bills working their way through state legislatures in 2026. Some of these laws establish frameworks and requirements that impact both public- and private-sector use of AI technologies.

In 2025, all 50 states, Puerto Rico, the Virgin Islands, and Washington, D.C., introduced AI-related legislation. According to the National Conference of State Legislatures, 38 states adopted or enacted approximately 100 AI‑related measures. What materially changes in 2026 is enforceability: several major state AI laws take effect, significantly increasing the need for cross‑state governance frameworks, comprehensive inventories, and demonstrable evidence of controls.

These laws and regulations impose transparency and disclosure obligations, prohibit deceptive use of generative AI, and seek to mitigate algorithmic discrimination in certain domains. The following list includes the principal state laws shaping AI regulation in the US and a few examples of some of the narrower AI-focused laws:

California

• California has enacted significant AI-related legislation, establishing new requirements for transparency, safety, and accountability across various AI applications. California’s SB53, the Transparency in Frontier Artificial Intelligence Act (TFAIA), was signed into law on 29 September 2025, and took effect on 1 January 2026. It requires large frontier AI developers to publish transparency reports and annually update a public frontier AI safety framework describing how they assess and mitigate ‘catastrophic risk’, secure unreleased model weights, and respond to critical safety incidents. Further, California’s AB2013, Generative Artificial Intelligence: Training Data Transparency Act (TDTA) was signed into law 28 September 2024, and took effect 1 January 2026. The TDTA requires AI developers to publicly post a high-level summary of the datasets used to train generative AI systems or services made available to the public since January 2022, enumerating specific categories of required disclosures.
• During 2025, the California state legislature continued to pass many AI-related bills, most of which took effect on 1 January 2026. Signed into law on 13 October 2025, the California AI Transparency Act (AB853) mandates that developers of generative AI must embed ‘provenance data’ into digital content to verify its authenticity and origin. (This law has staggered effective dates through 1 January 2028.) AB489, signed into law on 11 October 2025, prohibits the use of AI to falsely imply that advice or services are being provided by a licensed healthcare professional. Further, enacted on 13 October 2025, SB243 imposes specific safety protocols on ‘companion bots’, requiring them to prevent harmful conversations and regularly remind users that they are interacting with an AI. Other new laws, also enacted on 13 October 2025, create liability for services that enable deepfake pornography (AB621) and bar defendants from claiming an AI ‘autonomously caused the harm’ in civil actions (AB316).

Connecticut

• Connecticut enacted Substitute Senate Bill No. 5 (SB5), ‘An Act Concerning Online Safety’ (Public Act No. 26-15), which Governor Ned Lamont signed in May 2026. Rather than a single broad governance statute, the 67-page law links together several separate AI measures, but taken together it establishes Connecticut as a major AI-regulation state. SB5 addresses, among other things: safeguards and disclosure requirements for AI ‘companion’ chatbots, including extensive child-protection provisions; ‘provenance data’ transparency obligations for large generative-AI providers of synthetic audio, image, and video content; disclosure requirements for automated employment-related decision technology, together with an amendment providing that the use of such technology is not a defence to an employment-discrimination claim; whistleblower protections for employees of frontier-model developers; an AI regulatory sandbox; and governance requirements for state agencies’ use of AI. Its provisions take effect on a staggered basis, with several effective 1 October 2026 and others on 1 January 2027.

Colorado 

• On 14 May 2026, Governor Jared Polis signed a new, narrower Colorado Automated Decision-Making Technology in Consequential Decisions Act (enacted as SB 189 and retaining the ‘Colorado AI Act’ short title), which takes effect 1 January 2027 and repeals and replaces the State’s broad 2024 Colorado AI Act before that earlier law ever took effect. As originally enacted, in May 2024, the Colorado Act had been recognised as the first comprehensive statute in the US specifically targeting ‘high-risk’ AI systems, requiring developers and deployers of qualifying AI applications to use reasonable care in preventing algorithmic discrimination, mandate clear documentation of AI activities, and hold entities accountable for the outputs of their AI systems in critical areas such as employment, healthcare, lending, housing, and government services. Its effective date was first delayed from 1 February 2026 to 30 June 2026 and then, following the enactment of SB 189 signed on 14 May 2026, postponed again to 1 January 2027. SB 189 also significantly narrowed the law before it took effect, eliminating the original risk-based framework—including the duty to use reasonable care to prevent algorithmic discrimination, deployer risk management programmes and impact assessments, and certain reporting obligations to the AG—and replacing it with a narrower set of disclosure and transparency requirements focused on automated decision-making technology (ADMT). As revised, developers must provide deployers with specified information about the ADMT they supply (such as intended uses, potentially harmful uses, and categories of training data), and the law preserves limited individual rights to access and correct data and to obtain meaningful human review of adverse automated decisions.

Illinois

• In August 2025, Illinois enacted the Wellness and Oversight for Psychological Resources Act, which imposes significant restrictions on the use of AI in mental healthcare. The law, effective immediately, broadly prohibits any entity without a professional licence from offering therapy services, a rule that explicitly includes services delivered via AI, and bars licensed healthcare professionals from delegating therapeutic decisions to AI systems. More recently, on 6 July 2026, Governor JB Pritzker signed SB 315, a frontier model safety law that closely resembles California’s TFAIA and New York’s RAISE Act—requiring large frontier developers to implement and publicly post a frontier AI framework, publish transparency reports, and report critical safety incidents. Notably, however, SB 315 also imposes a third-party independent audit requirement found in neither the California nor the New York law, obligating large frontier developers to retain independent auditors to assess their compliance annually. The law takes effect on 1 January 2027, with transparency-reporting and audit obligations beginning 1 January 2028.

Kentucky

• Signed and effective on 24 March 2025, Kentucky’s AI Governance Act (SB4) establishes a comprehensive framework for AI use within state government. It calls for adoption of uniform AI policy standards and creates a governance committee to oversee ethical, transparent, and responsible AI use across state agencies. It includes provisions for human oversight, public disclosure, and protection of personal and business information.

Nevada

• On 5 June 2025, Nevada enacted AB406, which makes it a deceptive trade practice to misrepresent the capabilities of AI in mental healthcare. The law prohibits offering AI systems that are programmed to perform services that would constitute the practice of professional mental healthcare if done by a person. Furthermore, providers are barred from marketing or otherwise representing that their AI systems are capable of delivering such care. AB406 took effect on 1 July 2025.

New York

• New York enacted the Responsible AI Safety and Education (RAISE) Act on 19 December 2025, which establishes a comprehensive regulatory framework for developers of large-scale ‘frontier’ AI models. Effective on 1 January 2027, this law requires large developers to implement and publicly disclose a detailed ‘safety and security protocol’ designed to mitigate the risk of ‘critical harm’, defined as events causing mass injury or over USD 1 billion in damages. It also requires developers to report any ‘safety incident’ that demonstrates an increased risk of such harm to the state attorney general within 72 hours.
• Further, New York enacted a first-of-its-kind law requiring advertisers to disclose the use of AI-generated individuals in commercial advertising on 11 December 2025. The law mandates a conspicuous disclosure when a ‘synthetic performer’—a digitally created asset made with generative AI to resemble a human who is not an identifiable person—is featured in a visual or audiovisual advertisement. This rule is narrowly targeted at AI-generated actors and does not apply to audio-only ads, deepfakes of real performers, or AI enhancements of real performers. This law takes effect on 9 June 2026.
• Enacted on 11 December 2021, New York City’s Local Law 144 regulates the use of ‘automated employment decision tools’ (AEDTs) in hiring and promotion decisions. Effective since 5 July 2023, the law imposes three core obligations on employers: they must conduct an annual independent bias audit to assess whether the tool has a disparate impact on candidates based on race, ethnicity, or sex; they must post a summary of the audit results publicly on their websites; and they must provide notice to candidates that an AEDT is being used and of their right to request an alternative screening process.

Texas

• Texas enacted the Texas Responsible AI Governance Act (TRAIGA) on 22 June 2025, establishing foundational duties for state agencies, developers, and deployers of AI systems operating within Texas. The law went into effect on 1 January 2026, and prohibits state agencies from certain uses of social scoring and biometric data. Developers and deployers face prohibitions on the intentional misuse of AI for certain types of behavioural manipulation, unlawful discrimination, deepfakes, and infringement of constitutional rights. TRAIGA provides protections for organisations that follow recognised frameworks, such as the National Institute of Standards and Technology (NIST) AI Risk Management Framework, as well as a 60-day cure period for violations, and the creation of a regulatory sandbox.

Utah 

• Utah employed a relatively comprehensive approach to AI oversight by adopting, and making effective, the AI Policy Act (SB149) on 1 May 2024. This legislation requires professionals in regulated occupations—such as law, medicine, and financial services—to disclose their use of generative AI tools during high-risk interactions, such as when providing sensitive advice or handling personal data. Additionally, consumers must be informed if they explicitly enquire whether they are interacting with AI.

A handful of other U.S. states have considered and rejected broad AI laws. In addition, numerous other states and localities have enacted specific statutes or municipal ordinances that regulate discrete aspects of AI. The following list includes several such examples:  

Maine

• Maine enacted ‘An Act to Ensure Transparency in Consumer Transactions Involving Artificial Intelligence’ (the Maine AI Chatbot Disclosure Act) on 12 June 2025. Effective 23 September 2025, the law establishes targeted disclosure requirements for AI‑driven interactions. It generally prohibits businesses (and other persons) from using an AI chatbot—or similar text or voice‑based computer technology—in trade or commerce in a manner that may mislead or deceive a reasonable consumer into believing they are interacting with a human, unless the business provides a clear and conspicuous disclosure that the interaction involves AI.

Maryland

• Maryland enacted HB820 on 20 May 2025, regulating how health insurance plans and related entities may use AI in coverage and treatment decisions made in utilisation management and review decisions. Effective 1 October 2025, the law requires covered entities to ensure that the AI tool’s determinations are grounded in the enrollee’s individual clinical information, do not replace the role of a healthcare provider, and are applied fairly and equitably without resulting in unfair discrimination.

Pennsylvania

• On 7 July 2025, Pennsylvania enacted Act 35 (formerly SB649) to address the malicious use of AI-generated deepfakes. Effective 5 September 2025, the law establishes criminal penalties for generating (or creating and distributing) a forged digital likeness with intent to defraud or injure, or with knowledge and intent to facilitate fraud or injury by another—including where the actor knows or reasonably should know the audio or visual at issue is forged.

Illinois

• Illinois enacted HB3773 on 9 August 2024, amending the Illinois Human Rights Act to regulate the use of AI in employment decisions, prohibiting discriminatory practices. Effective 1 January 2026, the law requires employers to provide notice to applicants and workers if they use AI for hiring, discipline, discharge, or other workplace-related purposes.

This continued surge in state legislative activity reflects a wide range of approaches and priorities—from establishing task forces to study AI’s impact to imposing specific obligations on companies deploying AI systems. This dynamic landscape may underscore the growing value of state-level action in the absence of federal guidance, and organisations are encouraged to closely monitor both enacted laws and pending legislation in the jurisdictions in which they operate.