United States AI Policy 50-State Tracker: How U.S. States Are Regulating Artificial Intelligence Amid an Unsettled Federal Preemption Fight - Center for Assurance Research and Engineering

I. Scope & Methodology

State AI lawmaking has grown roughly tenfold since 2023, from fewer than 200 bills to 1,208 in 2025 and 1,561+ across 45 states by March 2026, with enough churn (Colorado's flagship law was repealed and replaced before it ever took effect) that uniform 50-state depth isn't practical. This tracker uses three tiers instead:

Tier 1 (Deep Profiles): 17 states with the most significant laws. Full field template: Status, Category, Key provisions, Enforcement, Timeline, Federal exposure.
Tier 2 (Short Entries): 22 states with narrower notable laws, one paragraph each.
Tier 3 (Summary Table): All 50 states + D.C., at a glance.

Primary sources: NCSL's AI Legislation Database (updated monthly), MultiState.ai, and IAPP's State AI Governance Tracker. Bill counts and statuses change monthly, so check these databases for anything newer than this tracker's date.

II. The State AI Law Taxonomy

III. The Federal Preemption Fight

Connects to the global tracker's USA entry (Model 4: Deliberate Non-Regulation), this is the state-level battleground underneath that federal stance. As of October 17, 2026, no federal preemption has actually been enacted; state AI laws remain fully operative despite a year-long federal pressure campaign.

A. Executive Action

EO 14365, “Ensuring a National Policy Framework for AI” (Dec. 11, 2025), anchors the campaign. It orders a DOJ AI Litigation Task Force to challenge state AI laws, a Commerce Dept. review of “onerous” laws within 90 days, BEAD broadband funding leverage, and FTC/FCC preemption proceedings. Implementation has stalled: as of mid-October the Commerce review and BEAD notice remain unpublished, more than seven months past the 90-day deadline, and the FTC's July 1, 2026 statement naming Colorado's AI Act is still only a proposal. Two later EOs are unrelated to preemption: a June 2, 2026 order on AI cybersecurity and EO 14434 (Sept. 29, 2026), which renames “AI” as “Super Intelligence” in federal documents and orders a proposed legal definition within 60 days.

B. Congressional Attempts and Failures

A 10-year moratorium on state AI laws was stripped from the “One Big Beautiful Bill Act” by a 99-1 Senate vote (July 1, 2025). Successor bills, Cruz's SANDBOX Act, Baumgartner's American AI Leadership and Uniformity Act, and the bipartisan Obernolte-Trahan Great American AI Act, remain pending; none has been enacted. In July 2026 Reps. Obernolte and Trahan also introduced the bipartisan FRONTIER Act (H.R. 9925) on oversight of advanced AI, reportedly including limits on state frontier-AI requirements; it remains in committee with no markup reported.

C. State Responses

No state has sued over the EO. The one concrete court fight, xAI v. Weiser, is a private suit against Colorado's AI Act in which DOJ intervened, producing a stipulated enforcement stay (April 27, 2026), not a preemption ruling. Colorado then replaced its law legislatively (SB 26-189). California pushed back with its own EOs (March and May 2026) tightening state AI procurement and safety rules. What has actually constrained state AI laws is constitutional litigation, not preemption: in September 2026 a federal judge in Montana preliminarily enjoined that state's election-deepfake law (SB 25) as to the plaintiffs in a First Amendment challenge, echoing Hawaii's Act 191. In early October 2026 the Eighth Circuit granted xAI an injunction pending appeal that pauses enforcement of Minnesota's AI nudification law (Minn. Stat. § 325E.91), and on October 14 eight state attorneys general (Iowa, Kansas, Arizona, Arkansas, Idaho, Montana, Nebraska, West Virginia) filed separate, coordinated state-court suits against OpenAI over ChatGPT safety and consumer protection.

Bottom line: pressure, not preemption. State AI law is still the law. Primary source: Executive Order 14365 (90 Fed. Reg. 58499); every other action here traces back to its sections.

IV. Tier 1: Deep Profiles

Colorado

● Status: Enacted. SB 26-189 (Automated Decision-Making Technology Act) and HB 26-1263 (Chatbot Safety Act) both take effect January 1, 2027; the AG filed formal proposed rules (4 CCR 904-6) on August 11, 2026, released a revised interim draft on October 6, 2026, and has a comment period and hearing set for October 26, 2026.

● Category: Category 6, Privacy-Law-Adjacent ADM Rights (moved from Category 1 when the original law was replaced; itself an illustration of the taxonomy in Section II).

● Key provisions:

○ ADMT developers must give deployers technical documentation and change notices; deployers must give consumers pre-use notice and, within 30 days, an adverse-outcome notice with a path to human review, plus 3-year recordkeeping.

○ HB 26-1263 adds chatbot-specific duties: age estimation, AI-disclosure, protections against sexually explicit content and simulated emotional dependence for minors, and suicide/self-harm response protocols.

● Enforcement: Colorado AG only, no private right of action; 90-day cure period before penalties attach; chatbot operators must file annual compliance reports with the AG.

● Timeline & amendments: SB 24-205 signed May 17, 2024 (first comprehensive state AI law) → delayed via SB 25B-004 to June 30, 2026 → AI Policy Work Group proposed a replacement framework March 17, 2026 → repealed and replaced by SB 26-189, signed May 14, 2026 → companion HB 26-1263 signed May 29, 2026 → formal ADMT and Chatbot Safety rules filed August 11, 2026, revised interim draft released October 6, 2026, comment period and hearing October 26, 2026 → both statutes effective January 1, 2027.

● Federal exposure: xAI sued to block the original law in April 2026; DOJ intervened days later, the first federal move against a state AI law, producing a stipulated enforcement stay (April 27, 2026). Whether the new transparency-only law itself survives a First Amendment compelled-disclosure challenge under EO 14365 remains an open question.

The clearest case study of state AI law volatility in this tracker: a comprehensive law replaced by a narrower one before it ever took effect.

California

● Status: Enacted. SB 53 (frontier AI) effective January 1, 2026; AB 853 (AI Transparency Act amendments) phased in through August 2026–2028; 20+ other AI laws took effect January 1, 2026. More AI bills were signed in September 2026 (see Key provisions).

● Category: Spans multiple categories rather than fitting one: Category 2 (Frontier Transparency, SB 53), Category 4 (Sector-Specific, employment, health, chatbots), and Category 5 (Deepfake/Likeness, AB 621, SB 683) simultaneously. No other Tier 1 state has this breadth.

● Key provisions:

○ SB 53 requires large frontier developers (models trained above 10²⁶ FLOPs and $500M+ revenue, currently ~5–8 companies) to publish safety frameworks, report catastrophic-risk incidents within 15 days (24 hours if imminent), and maintain whistleblower channels; it also creates CalCompute, a public-compute consortium.

○ AB 853 phases in AI-content provenance detection and labeling for large platforms (2027) and capture devices (2028).

○ Beyond these two comprehensive laws, California enacted 18+ more AI laws in the same cycle: social media (AB 56, addiction warnings for minors; AB 656, account-deletion rights); employment (updated ADS regulations barring discriminatory AI hiring tools); data privacy (SB 361, data-broker disclosures; AB 45, reproductive-health geofencing ban; SB 683, AI-likeness injunctive relief; AB 566, browser opt-out signals); chatbots and health AI (SB 243, companion-chatbot minor safeguards; SB 857, public-safety omnibus including AI-CSAM provisions; AB 489, bars AI systems from implying they're licensed health professionals); generative AI liability (AB 316, bars developers from blaming the AI itself); pricing algorithms (AB 325/SB 763, ban AI-driven pricing collusion under the Cartwright Act); deepfakes and digital replicas (AB 621, deepfake pornography; AB 723, real-estate photo-alteration disclosure); and cybersecurity, law enforcement, and education (AB 979; SB 524; SB 241/SB 253/AB 1170).

○ The 2026 session added a second wave, signed in September 2026: companion-chatbot safety for children (SB 1119, with independent child-safety audits and annual risk assessments; SB 867 on chatbot toys); AI oversight (SB 813, independent verification organizations; AB 1405, an AI auditor registry); workplace AI (SB 947 on automated decision systems in employment, SB 951 on technological-displacement notice, AB 1883 and AB 1331 on workplace surveillance); AI Transparency Act amendments (SB 1000, AB 2713); health-care AI (AB 1979, SB 503); and advertising and likeness (SB 1050 on disclosures in AI-generated advertising, SB 1111 on digital replicas). Gov. Newsom vetoed AB 2575 and SB 903 (the latter a health-care AI bill the Governor called overly broad for clinicians) on September 30.

● Enforcement: Mixed model: the Attorney General enforces SB 53 (up to $1M per violation) and most other laws; the California Privacy Protection Agency handles privacy-adjacent rules; licensing boards enforce health-AI restrictions; deepfake pornography (AB 621) and likeness violations (SB 683) carry a private right of action.

● Timeline & amendments: 2023 EO on state AI use → March 2025 California Report on Frontier AI Policy → SB 53 and AB 853 signed September 29, 2025 → most laws effective January 1, 2026 → March 30, 2026 procurement/civil-rights EO → June 25, 2026 AI-Unemployment Tracker launched → September 2026: SB 813 and AB 1405 signed Sept. 9, SB 1119 and SB 867 Sept. 10, SB 1050 Sept. 16, and 13 more AI bills Sept. 30, with AB 2575 and SB 903 vetoed Sept. 30, and EO N-9-26 (Sept. 18, reported) ordering faster third-party oversight under SB 813 and AB 1405 and an expert guide to strengthen the state's AI safety laws within two months → AB 853 phases continue through 2028.

● Federal exposure: Named alongside Colorado in EO 14365's “algorithmic discrimination” language. A federal court already struck down parts of California's deepfake-election law (AB 2655) on First Amendment grounds, the clearest case yet of a state AI law actually losing in court. SB 53 builds in its own hedge: a federal-deference clause that accepts compliance with comparable federal standards instead of requiring duplicate state filings.

Not one law but an entire regulatory ecosystem, more AI laws than any other state by a wide margin. Because most AI companies are headquartered there, California's rules tend to function as a de facto national standard regardless of what other states do.

Texas

● Status: Enacted. TRAIGA (HB 149) took effect January 1, 2026, and the Attorney General's online AI complaint mechanism, required by September 1, 2026, is now live; no TRAIGA enforcement action had been publicly reported as of mid-October 2026.

● Category: Category 3, Restricted-Purposes Prohibition. TRAIGA is the taxonomy's clearest example: it began in late 2024 as a sweeping Colorado/EU-style “high-risk AI” bill and was scaled back in March 2025 to a short list of banned uses instead.

● Key provisions:

○ Bans developing or deploying AI with intent to: incite self-harm or crime, infringe constitutional rights, discriminate against a protected class (disparate impact alone is not enough, intent is required), or produce CSAM or unlawful deepfakes.

○ Government-only bans on social scoring and biometric identification. Government agencies must disclose AI interactions to consumers, but “consumer” excludes employment and commercial contexts, so most disclosure duties don't reach employers.

○ Creates a 36-month regulatory sandbox and a non-binding AI Advisory Council. Preempts all local AI ordinances statewide.

● Enforcement: Texas AG has exclusive enforcement authority, no private right of action. 60-day cure period before penalties attach. Curable violations: $10,000–$12,000; uncurable: $80,000–$200,000; continuing violations: $2,000–$40,000 per day. State licensing boards can add penalties up to $100,000 on the AG's recommendation. Following NIST's AI Risk Management Framework is a statutory affirmative defense.

● Timeline & amendments: Introduced December 2024 as HB 1709, modeled on Colorado's broad framework → substantially scaled back in a March 2025 committee substitute → passed the legislature May 31, 2025 → signed by Gov. Abbott June 22, 2025 → effective January 1, 2026 → AG complaint portal required by September 1, 2026 and now live.

● Federal exposure: Not named in EO 14365, unlike Colorado and California. Gov. Abbott has publicly signaled he would comply with a congressional moratorium on state AI enforcement to protect federal funding, a voluntary-deference posture rather than Colorado's litigation fight or California's built-in deference clause.

Essentially what Colorado's law might have looked like if industry pushback had prevailed before enactment rather than after, narrow, intent-based, and light on the private sector by design.

Illinois

● Status: Three separate laws at different stages: the therapy law has been in force since August 1, 2025; the employment law has been in force since January 1, 2026, but its implementing notice rules are still pending; SB 315 (frontier AI) was signed July 6, 2026 but isn't effective until January 1, 2027.

● Category: Spans Category 2 (Frontier Transparency, SB 315) and Category 4 (Sector-Specific, employment and therapy), like California, but achieved through three separate narrower laws passed over about a year rather than one sweeping statute.

● Key provisions:

○ SB 315 (Artificial Intelligence Safety Measures Act) requires frontier developers (models trained above 10²⁶ FLOPs) and large frontier developers ($500M+ revenue) to publish a frontier AI framework, assess “catastrophic risk” (50+ deaths/injuries or $1B+ property damage via WMD assistance, autonomous cyberattacks, or loss of model control), publish pre-deployment transparency reports, report incidents within 72 hours (24 if imminent), and, uniquely among state frontier laws, undergo a mandatory independent third-party audit every year.

○ The employment law (Public Act 103-804) bars discriminatory AI use in hiring, promotion, and discipline decisions (including using ZIP codes as a discrimination proxy) and requires employee notice; the Department of Human Rights proposed notice rules in May 2026 but postponed the rulemaking in June 2026 pending further inter-agency coordination, so the specific notice requirements remain unsettled.

○ The therapy law (Public Act 104-0054) bans AI-only therapy and limits licensed professionals to narrow permitted AI uses, no independent therapeutic decisions, no unreviewed treatment plans, no direct AI-client therapeutic communication.

● Enforcement: SB 315: Illinois AG exclusive, no private right of action (aside from Whistleblower Act claims), $1M for a first offense and $3M for subsequent violations. Employment law: enforced through the Illinois Human Rights Act's civil-rights-violation framework via the Department of Human Rights. Therapy law: Department of Financial and Professional Regulation, up to $10,000 per violation after a hearing.

● Timeline & amendments: Therapy law (HB 1806) signed and effective August 1, 2025 → employment law effective January 1, 2026 → Dept. of Human Rights proposed employment notice rules May 15, 2026 (comment period closed June 29, 2026, not yet finalized) → SB 315 passed the House unanimously and the Senate near-unanimously in May 2026 → signed July 6, 2026 → effective January 1, 2027, with transparency-report and audit obligations phasing in January 1, 2028. Separately, Gov. Pritzker created an Illinois AI Cabinet by Executive Order 2026-07 on September 22, 2026 (confirmed, governor's order), which is to study, among other things, whether existing legal remedies are sufficient to hold AI companies accountable for harm, and sunsets no later than December 31, 2027.

● Federal exposure: Not named in EO 14365, unlike Colorado and California. Illinois AG Kwame Raoul has framed SB 315 explicitly as filling a federal vacuum rather than defying federal authority. Illinois, California, and New York are coordinating their frontier-AI laws deliberately, lawmakers estimate the three states together cover roughly 40% of the US AI market, a bloc strategy that may prove more resilient to federal preemption than any single state acting alone.

The newest law in this tracker, SB 315 was signed five days before this document's “as of” date. Illinois is also the only Tier 1 state to regulate AI through three distinct, purpose-built statutes rather than one comprehensive law.

Utah

● Status: Enacted. The original Utah Artificial Intelligence Policy Act (SB 149) took effect May 1, 2024; it was narrowed by SB 226 and SB 332, with a companion mental-health-chatbot law (HB 452), all effective May 7, 2025.

● Category: Doesn't fit the seven categories cleanly. Closest is Category 4 (Sector-Specific), since regulated occupations face a heightened duty, but the law is really its own narrow model, mandatory generative-AI disclosure, distinct from comprehensive, frontier, or restricted-purposes approaches.

● Key provisions:

○ Businesses using generative AI to interact with consumers must disclose that fact if directly and unambiguously asked. Regulated occupations (those requiring a state license) must prominently disclose GenAI use up front, but only for “high-risk” interactions, ones involving sensitive personal data (health, financial, biometric) plus personalized advice in financial, legal, medical, or mental-health contexts.

○ Companies can't blame AI output to escape liability under Utah consumer protection law. A safe harbor applies if a business discloses GenAI use both at the outset and continuously throughout an interaction.

○ HB 452 separately bans mental-health chatbots from covertly advertising to users or using their input to target ads, requires a clear “not human” disclosure, and bars selling or sharing users' health information with third parties.

● Enforcement: Utah Division of Consumer Protection, with the Attorney General's counsel; administrative fines up to $2,500 per violation. The AG can seek an additional $5,000 per violation for breach of a resulting court or administrative order. Courts can order injunctions and disgorgement of profits. No private right of action.

● Timeline & amendments: SB 149 signed March 13, 2024 (Senate 26-0-3, House 73-0-2) → effective May 1, 2024 → SB 226, SB 332, and HB 452 signed late March 2025 → effective May 7, 2025 → UAIPA's original automatic-repeal date pushed from May 2025 to July 2027.

● Federal exposure: Not named in EO 14365. Utah's light-touch, disclosure-only, sandbox-paired approach is broadly aligned with the federal deregulatory posture rather than in tension with it, commentators have noted its continued innovation focus is consistent with the administration's stated AI policy.

The earliest mover of any state (May 2024), but also the fastest to self-correct: Utah's own legislature narrowed the law within a year, calmly and by sponsor request, rather than under litigation or federal pressure, a useful contrast to Colorado's rockier retreat.

New York

● Status: The RAISE Act (frontier AI) is effective January 1, 2027, after a March 2026 chapter amendment. The Synthetic Performers Disclosure Law has been in effect since June 9, 2026. More than a dozen narrower AI laws, companion chatbots, algorithmic pricing, deepfakes and likeness, government AI use, are already in force.

● Category: Spans Category 2 (Frontier, RAISE Act) and Category 5 (Deepfake/Election/Likeness, Synthetic Performers, AI Deceptive Practices Act) plus elements of Category 4/6 (algorithmic pricing disclosure, government AI oversight). New York's breadth rivals California's.

● Key provisions:

○ RAISE Act: large frontier developers ($500M+ revenue, models above 10²⁶ FLOPs) must publish a frontier AI framework, issue transparency reports before deploying or materially modifying a model, report critical safety incidents within 72 hours (24 if imminent), and file a disclosure statement with a new DFS oversight office, renewed every two years.

○ Synthetic Performers Disclosure Law requires conspicuous disclosure in any commercial ad featuring an AI-generated fabricated human. AI Companion Models law requires self-harm/suicide detection with crisis referral and a “not human” disclosure at least every three hours.

○ The AI Deceptive Practices Act extends right-of-publicity protection to AI-generated likeness and voice and requires disclosure for AI deepfakes in political ads.

○ Algorithmic pricing laws require disclosure when prices are personalized by algorithm, and separately make AI-coordinated landlord rent-pricing collusion a felony. The LOADinG Act requires state agencies to inventory their AI tools and conduct impact assessments.

● Enforcement: Varies sharply by law. RAISE Act: NY Attorney General exclusive, $1M first violation/$3M subsequent, no private right of action. Synthetic Performers: $1,000/$5,000 civil penalties. AI Companion Models: up to $15,000 per day. Landlord Algorithmic Pricing: a Class E felony (up to $1M corporate fine, up to 4 years imprisonment for individuals). NYC Local Law 144 (employment bias audits, in force since 2023): $500–$1,500 per violation.

● Timeline & amendments: RAISE Act passed the legislature June 2025 → signed December 19, 2025 → chapter-amended March 27, 2026, shifting oversight from a homeland-security office to a new Department of Financial Services unit → effective January 1, 2027. Synthetic Performers Disclosure Law signed December 11, 2025 → effective June 9, 2026. Companion Models law effective November 5, 2025. Algorithmic Pricing Disclosure Act effective November 10, 2025. A separate bill, the FAIR News Act (AI-generated news disclosure), passed the legislature in June 2026; as of mid-October 2026 it remained unsigned, with Gov. Hochul facing a December 31, 2026 deadline to sign or veto. On September 21, 2026 the state announced that large frontier AI developers will be directed to register with DFS starting in November (confirmed, DFS release).

● Federal exposure: The RAISE Act was signed just 8 days after EO 14365, the closest collision of any state law in this tracker with the federal order. Commentators consider a DOJ challenge likely. The legislature's original penalty structure ($10M/$30M) was negotiated down to match California's ($1M/$3M) specifically to reduce friction. New York is also standing up a new state office (DIGIT) to take over frontier-AI oversight, a bet that state regulation continues regardless of federal pressure.

Not one law but a dense patchwork of a dozen-plus AI statutes passed within about 18 months, New York's breadth rivals California's, and its posture toward the federal preemption fight is more openly adversarial than Texas's compliance or California's built-in deference clause.

Connecticut

● Status: Enacted. Public Act No. 26-15 (Substitute SB 5, informally the “CART Act”) signed May 27, 2026. Most provisions are effective October 1, 2026; the employee-notice requirement for workplace AI is delayed to October 1, 2027; large frontier developers' internal reporting systems are due January 1, 2027.

● Category: The closest thing to a new comprehensive law since Colorado's 2024 original, but built as modular, targeted provisions across use cases (companions, frontier models, employment, synthetic media) rather than one unified risk-based framework, distinguishing it from Colorado's original Category 1 approach.

● Key provisions:

○ AI companion operators must detect and respond to self-harm expressions, disclose that the user isn't talking to a human, and add extra safeguards for known minors (including a ban on romantic/sexual engagement).

○ All frontier developers must protect whistleblowers reporting catastrophic-risk concerns; large frontier developers ($500M+ revenue) must build formal internal reporting systems by January 1, 2027.

○ Employers using automated employment-decision technology must disclose that fact and (from October 2027) give employees/applicants written notice covering the technology's purpose and data sources; AI use is explicitly not a defense to a discrimination claim, though anti-bias testing can mitigate. Employers filing WARN Act mass-layoff notices must disclose whether AI or other technological change contributed.

○ Large generative AI providers (1M+ monthly users) must embed provenance data in AI-generated or materially altered content. The law also creates a regulatory sandbox and bundles in youth social-media rules (age verification, notification curfews, default limits on algorithmic feeds for minors) and a healthcare-AI innovation competition run by the Comptroller's office. Its AI subscription provisions require subscription-based providers to disclose key subscription terms in writing before enrolling or renewing a consumer, enforced exclusively by the Attorney General under CUTPA (effective October 1, 2026).

● Enforcement: Connecticut Attorney General exclusive, no private right of action. Frontier whistleblower retaliation: up to $1,000 per violation. Employment notice failures: treated as an unfair or deceptive trade practice. Notice-and-cure period runs through December 31, 2027 before formal enforcement actions begin.

● Timeline & amendments: Signed May 27, 2026, days after Colorado's own scaled-back rewrite (SB 26-189, signed May 14, 2026), general provisions effective October 1, 2026; WARN Act AI-disclosure and anti-

discrimination-defense clarification effective October 1, 2026; employee-notice requirement effective October 1, 2027; large frontier developer reporting systems due January 1, 2027.

● Federal exposure: Not named in EO 14365, but widely framed by commentators as the next comprehensive-law test case after Colorado, Connecticut's bill moved forward in the same window that DOJ intervened in xAI's suit against Colorado's original law, making Connecticut's law a bellwether for whether comprehensive state AI regulation can still advance despite that federal pressure.

Structurally the opposite of Colorado's retreat: rather than narrowing an existing broad law, Connecticut built a new one from targeted, use-case-specific pieces, a modular design that may prove more durable precisely because no single provision looks like the sweeping “high-risk AI” framework that drew federal and industry fire elsewhere.

Virginia

● Status: No comprehensive AI law in force. HB 2094 (High-Risk AI Developer and Deployer Act) passed the legislature but was vetoed in March 2025. Narrower laws exist instead: HB 1642 (judicial AI oversight, effective July 1, 2025), SB 84 (AI traffic cameras, effective July 1, 2026), and SB 394 (Chapter 943, approved April 13, 2026), which directs the Department of Education to issue statewide guidance on classroom AI use, requires school boards to adopt consistent policies, and creates an AI innovation pilot program. Most other 2026-session AI bills were tabled to 2027.

● Category: Category 7 in practice, no binding comprehensive law, but not for lack of trying. The most instructive veto case in this tracker, paired with real government-use-of-AI activity (Executive Orders 30 and 46) rather than private-sector regulation.

● Key provisions:

○ HB 2094, had it been signed, would have created a Colorado-style duty-of-care and impact-assessment framework for “high-risk” AI; it never took effect.

○ What did pass: HB 1642 bars AI recommendations or predictions from being the sole basis for pretrial detention, prosecution, sentencing, probation, or parole decisions, and makes AI-influenced decisions objectable or appealable.

○ SB 84 authorizes (but doesn't require) localities to deploy AI-powered stop-sign and crosswalk cameras in school and work zones, with on-device processing, face-blurring, and violator-funded revenue.

○ Executive Order 30 governs state agency AI procurement and use through VITA's EA-225 standard; Executive Order 46 separately banned the DeepSeek AI app on state devices and networks.

● Enforcement: HB 1642 works through court objection and appeal, not civil penalties. SB 84 citations are civil, non-moving violations enforced by opting-in localities. Neither creates a new regulatory agency or AG enforcement program of the kind seen in Colorado, California, or Connecticut.

● Timeline & amendments: HB 2094 passed the legislature February 2025 → vetoed by Gov. Youngkin March 24, 2025, citing an estimated $30M compliance burden → HB 1642 returned with gubernatorial amendments and enacted, effective July 1, 2025 → Gov. Spanberger succeeded Youngkin in January 2026 → SB 84 signed April 2026, effective July 1, 2026 → most other 2026 AI bills (chatbot child-safety rules, AI-in-therapy rules, police AI disclosure) continued to the 2027 session.

● Federal exposure: The clearest documented case in this tracker of EO 14365 chilling state legislation in real time, not through litigation but through legislators' own choices. A House committee chair described a three-part test bills must pass, including not conflicting with the federal EO; sponsors explicitly cited fear of losing Virginia's roughly $1.5 billion BEAD broadband allocation as their reason for shelving bills, including ones focused on child safety.

Virginia's real AI story may not be regulation at all: the state used AI internally to streamline its own regulatory code, cutting requirements by over a third and saving an estimated $1.4 billion a year, a genuinely distinct governance model from every other Tier 1 state in this tracker.

Washington

● Status: Enacted. Four laws signed by Gov. Ferguson in 2026: SB 5886 (AI likeness/deepfake law, effective June 2026), SB 5395 (bars AI as the sole basis for health-insurance prior-authorization denials, effective June 2026), HB 2225 (companion chatbots, effective January 1, 2027), and HB 1170 (AI content provenance/watermarking, effective February 2027).

● Category: Spans Category 5 (Deepfake/Likeness, SB 5886) and a chatbot-specific slice of Category 4, plus content-provenance requirements similar to Connecticut's and Colorado's, narrower in scope than California, New York, or Illinois, but notable for how it was built.

● Key provisions:

○ HB 2225 requires AI companion chatbot operators to disclose upfront and repeatedly (every 3 hours for adults, hourly for minors) that the user isn't talking to a human, bans a specific list of manipulative engagement tactics (simulating emotional distress at goodbye, discouraging breaks, soliciting gifts to maintain the “relationship”), and requires published self-harm detection and crisis-referral protocols.

○ HB 1170 requires large AI companies to disclose, where commercially and technically feasible, when images, video, or audio are AI-generated or altered, via watermarking or embedded data, and to offer detection tools.

○ SB 5886 creates a cause of action for unauthorized AI-generated use of a person's voice or image.

○ SB 5395 bars health plans from using AI as the sole basis to deny, delay, or modify a prior-authorization request; it took effect alongside SB 5886 on June 11, 2026.

● Enforcement: HB 2225 violations are unfair or deceptive acts under the state Consumer Protection Act, enforced by the AG, but the law also includes a private right of action, unusual among Tier 1 states and specifically opposed by industry groups who asked the governor to veto that provision. He signed it unchanged.

● Timeline & amendments: ESSB 5838 (2024) created a 19-member AI Task Force with eight subcommittees, spanning industry, labor, civil liberties, and law enforcement representatives; it delivered a preliminary report (Dec. 2024) and interim report (Dec. 2025) ahead of a final report due July 1, 2026. SB 5886, SB 5395, HB 2225, and HB 1170 all followed from that two-year process and were signed in 2026, with effective dates staggered from June 2026 through February 2027.

● Federal exposure: Not yet documented in reviewed sources, open item for further research.

The clearest case in this tracker of the “study commission” model actually working as designed: a broad, multi-stakeholder task force ran for two full years before any bill was introduced, and the resulting laws are narrow and use-case-specific rather than a single sweeping framework.

Oregon

● Status: Enacted. Four AI-specific statutes in force or scheduled: SB 1571 (campaign deepfake disclosure, effective March 27, 2024), HB 2299 (AI intimate-image deepfakes, effective January 1, 2026), HB 2748 (bars AI from using nursing titles, effective January 1, 2026), and SB 1546 (AI companion chatbots, effective January 1, 2027). Promoted from Tier 2 given this multi-domain breadth.

● Category: Spans Category 5 (Deepfake/Election, SB 1571, HB 2299), a distinct healthcare-title/impersonation category (HB 2748, paralleling Illinois's therapy-AI law), and the emerging companion-chatbot category alongside Washington and Connecticut (SB 1546), genuine multi-domain activity comparable to Utah's breadth.

● Key provisions:

○ SB 1571 requires disclosure when campaign communications use “synthetic media.”

○ HB 2299 makes disseminating an AI-generated or altered intimate image a Class A misdemeanor where the defendant intended to harass, humiliate, or injure the victim.

○ HB 2748 bars any “nonhuman entity, including . . . an agent powered by artificial intelligence” from using protected nursing titles (RN, LPN, APRN, CRNA), a first-in-nation law prompted by an AI company marketing a $9-per-hour virtual-nurse product.

○ SB 1546 requires AI companion operators to disclose non-human status wherever a reasonable person might believe otherwise, and imposes heightened duties for users an operator has “reason to believe” are minors, including a ban on simulating emotional distress when a minor tries to end a conversation. All companion operators must adopt and publicly disclose evidence-based self-harm and suicide-crisis detection protocols, referring users to the 988 Lifeline (or youth peer-support lines for minors) and applying clinical best practices if a user's suicidal ideation continues after referral.

● Enforcement: Varies by law: SB 1571 is enforced by the Secretary of State with civil penalties up to $10,000; two investigations were opened under it in 2026 (a congressional candidate's AI attack videos and a county-commission candidate's AI-generated self-images), the law's first real-world tests. HB 2299 is a criminal Class A misdemeanor. SB 1546 has no AG enforcement at all, it relies entirely on a private right of action, letting anyone who suffers an “ascertainable loss or other injury in fact” recover the greater of actual damages or $1,000 per violation, plus injunctive relief and attorney fees.

● Timeline & amendments: SB 1571 signed March 27, 2024 (emergency clause, effective immediately) → HB 2299 passed the House unanimously April 15, 2025, effective January 1, 2026 → HB 2748 effective January 1, 2026 → SB 1546 passed the legislature March 5, 2026, signed March 31, 2026, effective January 1, 2027. A parallel governance track: Gov. Kotek's State Government AI Advisory Council (Executive Order 23-26) delivered a final action plan on state AI use February 11, 2025, and the Oregon Consumer Privacy Act (amended by HB 2008, effective January 1, 2026) added AI-profiling opt-out rights.

● Federal exposure: Not named in any federal action. SB 1546's minor-protection provisions may be shielded from a preemption challenge by EO 14365's own child-safety carve-out, and Oregon's reliance on amending existing criminal and election statutes (rather than a comprehensive new framework) makes it a less obvious target than Colorado's or California's approach.

Oregon and Washington passed nearly parallel AI companion laws within weeks of each other in 2026, but Oregon's is the stricter of the two: broader “reason to believe” minor-detection standard, no government enforcement backstop at all, just private lawsuits, and a real, already-underway test case for its older campaign-deepfake law.

Nevada

● Status: Several narrow laws enacted in the 2025 session (AB 406, AB 325, SB 213, SB 263, AB 73); a comprehensive framework bill (SB 199) failed to clear the Senate, and a narrower bill on AI health-insurance denials (SB 128) was vetoed. No comprehensive AI law in force.

● Category: Category 3 (Restricted-Purposes Prohibition) plus Category 5 (Deepfake/Election, AB 73, SB 213). A second clear example, alongside Texas, of the “narrow laws succeed, broad framework fails” pattern in this tracker.

● Key provisions:

○ AB 406 bans AI systems from being marketed or represented as capable of providing professional mental or behavioral healthcare (including using terms like “therapist”), and limits how licensed providers may use AI clinically, administrative use is fine, but AI can't interact directly with patients.

○ SB 213 expands Nevada's revenge-porn statute to cover AI-generated and deepfake intimate images as a category D felony. SB 263 similarly updates the state's child sexual abuse material statute to explicitly cover AI-generated and computer-modified content.

○ AB 73 requires political ads containing AI-manipulated images, audio, or video to carry a clear disclosure (“this [image/video/audio] has been manipulated”) and lets depicted candidates seek an injunction if it's missing.

○ AB 325 revised how AI may be used in state emergency planning.

● Enforcement: AB 406: Division of Public and Behavioral Health investigation, civil penalties up to $15,000 per violation. SB 213/SB 263: criminal felony penalties under existing statutes. AB 73: notably weak, no financial penalty, only a private injunction available to the candidate depicted, which critics say gives it “very little teeth.”

● Timeline & amendments: AB 406 and SB 213 signed June 5, 2025; SB 263 signed June 6, 2025, effective October 1, 2025; AB 73 effective January 1, 2026, ahead of the 2026 election cycle; SB 128 (AI health-insurance denial oversight) passed both chambers but was vetoed by Gov. Lombardo; SB 199 (comprehensive AI framework) failed to advance out of the Senate.

● Federal exposure: Not named in EO 14365. An AP wire analysis explicitly grouped Nevada with Texas as states that scaled back from broader AI regulation partly in response to federal pressure, even as Trump's EO otherwise failed to stop the overall wave of state AI legislation.

A second, independent data point for the same pattern Texas established: when a broad AI bill and several narrow ones are both on the table in the same session, the narrow ones pass and the broad one dies, not necessarily because of federal pressure alone, but because narrow, harm-specific bills build easier coalitions.

Maryland

● Status: Enacted. Roughly 10 AI-related laws since 2020, the broadest record of any state outside the original Tier 1 group. A comprehensive, Colorado-style framework (HB 1331, Preventing Algorithmic Discrimination Act) died in the 2025 session. Promoted from Tier 2 given this breadth.

● Category: Spans nearly the full taxonomy: Category 4 (Sector-Specific, HB 1202 employment, HB 820 healthcare), Category 5 (Deepfake/Election, SB 360, SB 141, SB 8), government AI governance (SB 818, the DoIT Responsible AI Policy), and a failed Category 1 attempt (Comprehensive, HB 1331, which died in 2025), breadth comparable to Connecticut's.

● Key provisions:

○ HB 1202 (2020) bars employers from using facial recognition in job interviews without the applicant's signed waiver. SB 818 (2024, the AI Governance Act) requires state units to inventory high-risk AI systems and creates the Governor's AI Subcabinet; the resulting DoIT Responsible AI Policy (May 2025) bans state government use of real-time covert biometric identification, emotion-recognition AI, fully autonomous “unacceptable risk” decisions, social scoring, and cognitive-behavioral manipulation, under a 4-tier risk classification system with a mandatory public annual AI inventory.

○ SB 360 (2025) expands Maryland's revenge-porn statute to cover AI-generated deepfakes, with a civil cause of action.

○ HB 820 (2025), modeled on California's SB 1120, requires health carriers, PBMs, and utilization-review agents to base AI-assisted coverage determinations on an enrollee's individual clinical history rather than group statistics, with quarterly performance reviews and Insurance Commissioner audit authority.

○ SB 141 (2026) makes Maryland the 30th state with election-deepfake protections, empowering the State Administrator of Elections to act on and publicly correct reported deepfakes. SB 8 (2026) targets AI-enabled identity fraud, with a victim civil cause of action and restitution. HB 895 (2026) bans AI-driven personalized “surveillance pricing” for food retailers, a first-in-nation law in effect since October 1, 2026. HB 956 (2025) created the Workgroup on Artificial Intelligence Implementation; its report was due July 1, 2026, but the workgroup did not hold its first meeting until July 23, 2026, and a follow-up bill (SB 564) extended its deadline to January 1, 2027.

● Enforcement: Varies by law: SB 360, SB 141, and SB 8 carry criminal penalties (up to 5 years for election deepfakes) plus civil causes of action; HB 820 is enforced by the Insurance Commissioner (misdemeanor

charges, administrative penalties, license actions); SB 818 and the DoIT policy are internal government governance with no external penalty. The failed HB 1331 would have been AG-only, classified as an unfair trade practice, EPIC's testimony specifically objected to the bill's lack of a private right of action, unusual since “all 50 states have laws prohibiting unfair, deceptive, or abusive practices that provide consumers with a private right of action.”

● Timeline & amendments: HB 1202 effective October 1, 2020 → Gov. Moore's AI executive order January 8, 2024 → SB 818 and SB 1068 (Ch. 496/450) effective July 1, 2024 → DoIT Responsible AI Policy issued May 23, 2025 → SB 360, HB 956, SB 294/HB 376 all passed the 2025 session → HB 820 effective October 1, 2025 → SB 141 effective June 1, 2026 → HB 895 signed April 28, 2026 → HB 895 and SB 8 took effect October 1, 2026 → HB 1331 (comprehensive) died in the 2025 session; the Workgroup on Artificial Intelligence Implementation missed its July 1, 2026 report deadline, holding its first meeting July 23, 2026, with a new deadline of January 1, 2027 under SB 564.

● Federal exposure: Maryland's AG joined the 36-state coalition opposing federal preemption and the 23-AG FCC comment letter against it. Commentators note Maryland's government-use and criminal-law-based statutes (SB 818, SB 360) sit in areas traditionally reserved to state authority and are less exposed to an EO 14365 challenge than the comprehensive HB 1331 would have been had it passed.

Maryland has quietly built the broadest AI law portfolio of any state outside the original Tier 1 group, one narrow bill at a time, while still working toward a Colorado-style comprehensive law that hasn't yet passed, in some ways the mirror image of Colorado's retreat from comprehensive regulation.

Arizona

● Status: Enacted. 5 AI-specific laws since 2024 (SB 1359, HB 2394, SB 1295, HB 2678, HB 2175) plus an active AI Steering Committee and a state-agency Generative AI Policy. Live AG enforcement is already underway.

● Category: Spans Category 5 (Deepfake/Election, SB 1359, HB 2394), impersonation/fraud (SB 1295), CSAM (HB 2678), and healthcare AI (HB 2175), four distinct domains plus government-use governance.

● Key provisions:

○ SB 1359 requires disclosure when campaign communications use deepfakes.

○ HB 2394 creates a civil right of action for anyone depicted in a non-consensual, undisclosed deepfake, with preliminary injunctive relief available to candidates within 180 days of an election or for sexualized/criminal depictions.

○ SB 1295 reclassifies AI-generated-voice or image impersonation used for fraud or harassment as a Class 5 felony, more severe than ordinary impersonation. HB 2678 (signed by Gov. Hobbs, enacted September 2025) criminalizes AI-generated or digitally altered CSAM indistinguishable from a real minor; the Maricopa County Attorney's Office secured the law's first indictments in May 2026 against a man accused of superimposing a real child's face onto explicit images.

○ HB 2175 requires an Arizona-licensed medical director to personally review AI-assisted medical-necessity and prior-authorization denials rather than rely solely on algorithmic output, the Arizona Medical Association calls it a national precedent.

● Enforcement: Criminal felony charges for SB 1295 and HB 2678 (active prosecutions underway); private right of action plus injunctive relief for HB 2394; HB 2175 is enforced through medical licensing and insurance regulation, effective July 1, 2026. Attorney General Kris Mayes opened an investigation into Grok/xAI in January 2026 over AI-generated sexualized images (including alleged CSAM), invoking consumer-protection and child-exploitation law alongside HB 2678, and coordinating with counterparts in other states including California.

● Timeline & amendments: SB 1359 signed 2024 → HB 2394 and SB 1295 signed 2024 → Gov. Hobbs's AI Steering Committee announced May 21, 2025 (18 members across government, academia, and industry; recommendations expected spring 2026) → HB 2678 enacted September 2025 → HB 2175 passed May 12, 2025 (Chapter 165), effective July 1, 2026 → first HB 2678 indictments, May 2026. The Arizona Supreme Court separately adopted a first-in-nation judicial technology-competence rule (effective January 1, 2026).

● Federal exposure: Not named in EO 14365. Arizona's laws fall largely within the EO's child-safety and healthcare carve-outs; the multi-state coordination on the Grok/xAI investigation (with California's AG office) suggests states are pooling enforcement rather than waiting on federal action.

One of the few states where these laws are already being actively prosecuted rather than sitting on the books, the HB 2678 indictments and the Grok/xAI investigation make Arizona a live enforcement case study, not just a legislative one.

Arkansas

● Status: Enacted. 5 AI-specific laws (Acts 159, 827, 848, 927, 977), all signed in a single 2025 session, plus an evolving executive AI governance structure.

● Category: Five distinct domains in one session: publicity/likeness rights, non-consensual sexual deepfakes, government AI use, generative-AI content ownership, and AI-generated CSAM, the broadest single-session sweep of any state in this tracker.

● Key provisions:

○ Act 159 (HB 1071) amends the Frank Broyles Publicity Rights Protection Act of 2016 to cover AI-generated likeness and voice replication, with civil remedies including injunctions and damages.

○ Act 827 (HB 1529) criminalizes distributing deepfake sexual material of an identifiable, non-consenting person.

○ Act 848 (HB 1958) requires every public entity, state agencies, political subdivisions, school districts, and higher-education institutions, to adopt an AI/automated-decision-tool policy requiring a human employee to make the final decision regardless of what the tool recommends, mandatory employee training, and public disclosure of the policy on request. Act 927 (HB 1876) is among the first US laws to define generative-AI content ownership: a user owns AI output if inputs were lawfully obtained, an employer owns output created within an employee's work scope.

○ Act 977 (HB 1877) criminalizes AI-generated CSAM indistinguishable from a real child, with exemptions for law enforcement and good-faith AI-safety researchers.

● Enforcement: Acts 827 and 977 carry criminal penalties under existing exploitation and obscenity frameworks. Act 848 has no financial penalty regime, compliance is structural (mandatory policy, training, disciplinary procedure) rather than punitive. Act 927 disputes are resolved through ordinary civil litigation; no new agency or penalty was created.

● Timeline & amendments: Gov. Sanders launched an AI working group in June 2024 → Act 159 signed February 26, 2025 → Acts 827, 848, 927, and 977 all signed April 17–22, 2025, with Act 848 effective August 3, 2025 alongside Act 927 → the AI and Analytics Center of Excellence delivered a two-part Effectiveness and Safety report to Gov. Sanders on February 13, 2026, recommending a Chief Artificial Intelligence Officer role and NIST-standards-based evaluation of state AI systems.

● Federal exposure: Not named in EO 14365. Commentators view Acts 827, 848, and 977 as unlikely federal-preemption targets given their child-safety and government-procurement footing.

Five laws in one legislative session, covering five different problems, is the broadest single-session sweep in this tracker, Arkansas didn't pass one big AI law, it passed five small, purpose-built ones back to back.

Tennessee

● Status: Enacted. The ELVIS Act (2024), the Preventing Deepfake Images Act (2025), and SB 1580 barring AI from posing as a mental-health professional (2026) are all in force. A proposed fourth law, the AI Public Safety and Child Protection Transparency Act (HB 1898/SB 2171), passed the House 94–0 but stalled in the Senate and was not enacted; lawmakers substituted a study directive instead.

● Category: Spans Category 5 (Deepfake/Likeness, ELVIS Act, Preventing Deepfake Images Act) and Category 4 (Healthcare, SB 1580), built from narrow, purpose-built statutes rather than one comprehensive framework; an attempted Category 2 (Frontier Transparency) law did not survive the legislature.

● Key provisions:

○ The ELVIS Act (signed March 21, 2024, effective July 1, 2024) added “voice”, including AI simulation of a voice, as a protected personal-property right alongside name, photo, and likeness; it was the first state law in the nation written specifically to address AI voice cloning, and other states' publicity laws (Montana's HB 513, Arkansas's Act 159, Washington's SSB 5886) are explicitly modeled on it.

○ The Preventing Deepfake Images Act (Public Chapter 466, effective July 1, 2025) creates civil and criminal liability for disclosing an AI-generated intimate depiction without consent.

○ SB 1580 (signed April 1, 2026, effective July 1, 2026) bars any AI system from advertising or representing itself as a qualified mental-health professional; a broader alternative bill (HB 1455) that would have made simulating a human friendship a Class A felony did not pass in that form.

○ HB 1898/SB 2171, as introduced, would have defined “frontier developers” ($500M+ revenue) and “covered chatbots” ($25M+ revenue, 1M+ monthly users) and required public safety plans, child-safety plans, and incident reporting to the Attorney General; the bill passed the House 94–0 but was rewritten on the Senate floor and never enacted in that form.

● Enforcement: The ELVIS Act combines a civil cause of action with a Class A misdemeanor (up to 11 months 29 days, $2,500), treble damages for knowing violations, and lets a record label sue on an artist's behalf. The Preventing Deepfake Images Act is a Class E felony, escalating to Class C when aggravated. SB 1580 creates a private right of action under the Tennessee Consumer Protection Act, with a $5,000 civil penalty per violation. HB 1898/SB 2171's proposed Attorney General enforcement regime never took effect, since the bill was not enacted.

● Timeline & amendments: ELVIS Act signed March 21, 2024 → Preventing Deepfake Images Act effective July 1, 2025 → a companion 2025-2026 bill (SB 1493) that would have made training AI to “simulate a human being” a Class A felony was narrowed, after criticism, into a study mandate for the Tennessee Advisory Commission

on Intergovernmental Relations, due January 31, 2027 → SB 1580 signed April 1, 2026 → HB 1898/SB 2171 passed the House 94–0 on April 16, 2026, cleared the Senate Commerce and Labor Committee 6–3, then stalled on the Senate floor and was not enacted; a TACIR study directive was adopted instead of the substantive bill.

● Federal exposure: Unusual in this tracker: rather than facing federal pushback, HB 1898/SB 2171 was reportedly narrowed with direct White House input before reaching the Senate floor. A policy analyst told Tennessee's AI Advisory Council in April 2026 that the bill was being redrafted to fit EO 14365's child-safety carve-out; even that narrowed version did not survive the Senate, so no frontier-AI transparency law was ultimately enacted in Tennessee this session. Separately, the ELVIS Act has directly shaped proposed federal right-of-publicity legislation, a state law influencing Washington rather than the reverse.

Tennessee's approach has been called “surgical, not sweeping”: a series of narrow, purpose-built statutes rather than one comprehensive framework. Its one attempt at a fourth, frontier-AI law is also the only case in this tracker where White House input reportedly reshaped a bill during drafting, though even the narrowed version ultimately did not survive the legislature.

Rhode Island

● Status: Enacted. 5 AI-specific laws: NCII deepfakes, election deepfakes (both signed July 2, 2025), and a 12-bill June 2026 healthcare package containing AI companion/chatbot safety, AI mental-healthcare restrictions, and an ambient AI scribe opt-out requirement. A comprehensive Colorado-style framework (S627) died in committee.

● Category: Spans Category 5 (Deepfake/Election) and a healthcare-AI cluster spanning three separate laws (companion chatbots, mental healthcare, and ambient clinical AI), the most healthcare-concentrated Tier 1 state in this tracker, plus a standing government AI Task Force.

● Key provisions:

○ The NCII deepfake law (H5046/S0136) updates Rhode Island's 2018 nonconsensual-intimate-image statute to cover AI-generated content.

○ The election law (H5872/S0816) requires disclosure of deceptive synthetic media in political ads within 90 days of an election, with satire/parody and broadcaster exemptions.

○ The AI companion/chatbot safety law (S2195/H7350, signed June 22, 2026) requires self-harm and suicide-crisis detection protocols, disclosure of non-human status at the start of a session and every three hours thereafter, and annual reports to the Attorney General beginning July 1, 2027.

○ A companion law (S2197/H7349) bars unlicensed AI-only mental healthcare and prohibits AI from simulating emotional attachment in companion or mental-health contexts. The ambient AI scribe law (H7538/S2570), part of the same three-bill package Gov. McKee signed June 22, 2026, requires providers to disclose AI note-taking during clinical visits, give patients a post-visit accuracy review, and let patients opt out.

● Enforcement: The AI companion/chatbot law is Attorney-General-enforced with civil penalties up to $15,000 per day, directed to suicide-prevention programs. The deepfake laws use existing criminal and civil frameworks; the ambient-scribe and mental-healthcare rules operate through healthcare licensing and consumer-protection channels.

● Timeline & amendments: Gov. McKee's Executive Order 24-06 created the state AI Task Force and produced an AI Action Plan (published January 26, 2026) → the NCII and election deepfake laws signed July 2, 2025 → a 12-bill healthcare legislation package passed June 11–12, 2026; Gov. McKee signed the ambient-scribe law, the mental-healthcare restriction, and the companion-chatbot safety law together as a three-bill AI package on June 22, 2026.

● Federal exposure: Not named in EO 14365. The enacted deepfake and healthcare-safety laws likely fall within the EO's public-safety and child-safety carve-outs; the failed comprehensive S627 would have carried materially higher preemption exposure had it passed.

Rhode Island's real distinction is how healthcare-concentrated its AI law is, three separate 2026 statutes (chatbot safety, mental-healthcare restrictions, ambient scribe disclosure) all regulate what happens inside the medical encounter itself, a narrower and more clinical focus than any other Tier 1 state.

Vermont

● Status: Enacted. Act 132 (2022, government AI governance), Act 161/H.878 (2024, NCII deepfakes), Act 75/S.23 (2026, election deepfakes), H.816 (2026, AI mental-health restrictions), and Act 145/S.71 (2026, comprehensive privacy law with automated-decision provisions, not effective until 2028), plus H.814 extending the state's AI Advisory Council through 2030.

● Category: Spans government AI governance (Act 132's Division of AI), Category 5 (Deepfake, Act 161, Act 75/S.23), Category 4 (Healthcare, H.816), and privacy/automated-decision-making (Act 145), genuine multi-domain breadth, run through two parallel governance bodies simultaneously.

● Key provisions:

○ Act 132 (2022) created a Division of Artificial Intelligence within the Agency of Digital Services and an AI Advisory Council, and required an inventory of state automated decision systems.

○ Act 161/H.878 (2024) added AI-generated deepfakes to Vermont's non-consensual-intimate-image statute. Act 75/S.23 (signed March 5, 2026, effective on passage) bars distributing deceptive synthetic media within 90 days before an election unless it carries a prescribed disclosure; knowing violations carry fines from $1,000 up to $15,000 with aggravating factors, and an affected candidate can seek an injunction.

○ H.816 (2026) bars AI systems from independently providing mental-health treatment, counseling, or therapy without a licensed professional's involvement, while letting licensed providers use AI-assisted tools they remain responsible for.

○ Act 145, the Vermont Data Privacy and Online Surveillance Act (S.71), grants consumers rights to access, correct, delete, and obtain their data, and to opt out of targeted advertising, data sales, and automated profiling, with mandatory data-protection assessments and honoring of universal opt-out signals. H.814 extends the AI Advisory Council through 2030 and directs it to study AI in healthcare, education, insurance, human services, and government.

● Enforcement: Act 145 is enforced exclusively by the Attorney General, no private right of action, with a temporary cure period through June 2029. H.816 operates through professional-licensing channels, directing regulators to recommend future standards for AI use within licensed professions. The deepfake laws use existing criminal and civil frameworks.

● Timeline & amendments: Act 132 effective 2022 → Act 161/H.878 effective 2024 → Act 75/S.23 signed March 5, 2026 → H.816 signed June 17, 2026 → Act 145/S.71 effective January 1, 2028 (cure period through June 2029) → H.814 (extending the AI Advisory Council to 2030) enacted 2026 → Gov. Scott's Executive Order 04-26 (May 18, 2026) separately established an AI Economic Task Force, chaired by Neale Lunderville, tasked with an AI-readiness framework and a small-business AI adoption toolkit within its first year. A comprehensive Colorado-style AI developer/deployer bill (H.710) died in the House Commerce Committee without a vote in 2024.

● Federal exposure: Not named in EO 14365. Vermont is repeatedly cited alongside Connecticut by analysts as a model for state AI-system inventories, given Act 132's early government-use framework.

Vermont runs two parallel AI-governance bodies at once, the AI Advisory Council under Act 132, now extended to 2030, and the brand-new AI Economic Task Force under Executive Order 04-26, an unusually thick institutional layer for a small state, on top of substantive deepfake, healthcare, and privacy statutes.

V. Tier 2: Short Entries

New Jersey

● Enacted: A3540/S2544 (P.L.2025, c.40), signed April 2, 2025. Makes producing or disseminating a deepfake in furtherance of another crime (harassment, election interference, child endangerment) a third-degree offense, up to 5 years and a $30,000 fine, plus a private right of action for victims.

● Pending: A3854/S1926 (AI hiring bias-audit bill, in committee); S4867 (broader worker-protection framework).

● Verdict: Not named in any federal action; Gov. Murphy publicly opposed EO 14365. One real law plus pending bills, correctly scoped for Tier 2.

Massachusetts

● Enacted: None comprehensive as of October 2026, though a frontier-AI bill is pending in conference: an earlier deepfake-election provision (HB 5100) was repealed effective February 1, 2025, and the operative framework had been an April 2024 AG advisory applying existing consumer-protection, civil-rights, and data-security law to AI.

● Pending: The Transparency in Frontier Artificial Intelligence Act, publicly endorsed by Anthropic, was cut from the House's economic-development bill (H.5576, “Mass Wins”) on July 6, 2026; the Senate then passed its own version with frontier-AI provisions in late July, and the House declined to concur. The bill has been in conference committee since July 30, 2026, with no conference report, enactment, or signature as of mid-October. Gov. Healey wrote to the conferees on September 17 urging independent safety reviews of the most powerful models and faster incident reporting.

● Verdict: If frontier-AI provisions survive conference and are signed, Massachusetts becomes the 4th frontier-AI state and would warrant reassessment toward Tier 1; as of October 2026 nothing has been enacted.

Montana

● Enacted: SB 25 (election-deepfake disclosure, up to $500 fine, preliminarily enjoined in September 2026 as to the plaintiffs in a First Amendment court challenge); HB 513 (name/voice/likeness rights against AI replicas,

ELVIS Act-style); HB 514 (AI intimate-image deepfakes); SB 212, the nation's first “Right to Compute” Act, a deregulatory measure subjecting government AI restrictions to strict scrutiny.

● Pending: No major pending bill identified.

● Verdict: Four laws, richer than a typical Tier 2 state, but three cluster around deepfakes and the fourth is a deregulatory outlier. Not named in any federal action; its light-touch posture aligns with the federal deregulatory push.

Minnesota

● Enacted: HF 1370 (2023), effective August 1, 2023, created three code sections at once: a criminal election-deepfake ban (§609.771), a criminal NCII-deepfake ban (§617.262), and a civil cause of action (§604.32).

● Pending: SF 1886 would add AI-disclosure duties with both AG enforcement (up to $5,000,000) and a private right of action ($1,000 statutory damages).

● Verdict: The most litigated law in this batch: X Corp. v. Ellison was stayed in December 2025 after a judge denied X's motion for judgment on the pleadings; an earlier Kohls challenge was rejected for lack of standing and affirmed by the Eighth Circuit. One statute, two domains, active litigation, correctly scoped for Tier 2. A separate 2026 AI nudification law (Minn. Stat. § 325E.91, effective August 1, 2026) is also in court: after a lower court let the law be enforced in early September, the Eighth Circuit granted xAI an injunction pending appeal in early October (reported), pausing enforcement while the appeal proceeds; reports do not say whether the order reaches beyond xAI.

Michigan

● Enacted: A 2023 election-deepfake package (HB 5141–5145, effective February 13, 2024) requiring AI disclaimers on political ads; HB 4047/4048 (2025), a civil-and-criminal intimate-deepfake law signed August 26, 2025.

● Pending: SB 760, the “LEAD for Kids Act” companion-chatbot bill, passed the Senate 20–17 in April 2026 and is pending in the House, AG Dana Nessel would be primary enforcer, with fines up to $50,000 and a parental private right of action.

● Verdict: Nessel has also been a leading voice in the multistate coalition opposing federal preemption. Two enacted domains plus a high-profile pending bill, correctly scoped for Tier 2.

Florida

● Enacted: HB 919 (2024, AI-disclosure disclaimers on political ads); “Brooke's Law” (HB 1161, 2025, 48-hour platform takedown for deepfake sexual images); HB 757 (2025, criminalizes AI-generated sexual depictions of identifiable people, including AI-generated CSAM).

● Pending: Gov. DeSantis's flagship comprehensive “AI Bill of Rights” (SB 482) passed the Senate 35–2 but died in the House in March 2026; a special-session revival was blocked by House Speaker Daniel Perez.

● Verdict: The bigger story is what failed, an intra-party fight between a governor pushing state AI regulation and a legislative leader deferring to Washington. Three narrow enacted laws plus a notable failure, correctly scoped for Tier 2.

Idaho

● Enacted: HB 664 (2024, “FAIR Elections Act,” synthetic-media disclosure in campaign communications, injunctive relief and damages); HB 575 (2024, non-consensual synthetic intimate media, effective July 1, 2024); Idaho Code §19-1910 (2019, pretrial risk-assessment algorithm transparency, pre-dates the generative-AI wave); SB 1297 (2026, “Conversational AI Safety Act,” signed March 31, 2026, Ch. 249, effective July 1, 2027).

● Pending: No major pending bill beyond SB 1297's phase-in.

● Verdict: Four enacted laws across four domains, elections, non-consensual imagery, criminal-justice algorithms, and chatbots, genuinely broad for a Tier 2 state and a defensible Tier 1 candidate if the tracker's threshold is applied generously.

Georgia

● Enacted: HB 993 (2024, covers AI/computer-generated CSAM, effective July 1, 2024); SB 540 (“Georgia Conversational Artificial Intelligence Safety Act,” signed May 11, 2026, effective July 1, 2027, notably has no carve-out for chatbots embedded in major platforms, AG-only, up to $10,000/violation); SB 444 (bars health-insurance coverage decisions based solely on AI, signed May 5, 2026, effective January 1, 2027).

● Pending: SB 9 (election-deepfake bill) died at Sine Die on April 3, 2026 after the Senate rejected the House's amended version, never signed.

● Verdict: Three enacted laws across three domains plus a notable failure and a substantial governance/study infrastructure (Georgia Technology Authority Office of AI, multiple legislative study committees), correctly Tier 2, borderline Tier 1.

Delaware

● Enacted: Delaware Personal Data Privacy Act (HB 154, 2023, effective January 1, 2025) includes profiling and automated-decision-making opt-out rights, with Global Privacy Control signal compliance required since January 1, 2026; HB 333 (2024, creates the Delaware Artificial Intelligence Commission, signed July 17, 2024, sunsets 10 years after enactment). HB 380, signed by Gov. Meyer on September 2, 2026, lowers the DPDPA's applicability threshold (to the lowest in the country), expands automated-profiling and sensitive-data obligations, and adds third-party contracting requirements, effective January 1, 2027.

● Pending: No major pending bill remains; HB 380 (see Enacted) resolved the state's main open item.

● Verdict: A comprehensive privacy law with real automated-decision-making teeth, now strengthened further by HB 380, plus a standing AI Commission; correctly scoped for Tier 2.

Hawaii

● Enacted: Act 191 (SB 2686, 2024, election-deepfake law), but permanently enjoined on January 30, 2026 in The Babylon Bee, LLC v. Lopez (D. Haw.), which held the law a content- and speaker-based restriction that fails strict scrutiny and is unconstitutionally vague. Gov. Green signed two new laws on July 14, 2026: SB 3001, the Artificial Intelligence Disclosure and Safety Act (chatbot child-safety, disclosure, and self-harm response protocols), and HB 2137, which creates new civil protections against harmful AI-generated digital imitations (deepfakes).

● Pending: No major pending bill remains; SB 3001 (see Enacted) resolved the state's main open item. Enforcement is AG/consumer-protection-based, with no private right of action and a $1,000,000 aggregate damages cap per operator.

● Verdict: No longer as thin as its litigation history suggests: alongside the struck-down Act 191, a leading First Amendment cautionary precedent, Hawaii now has two genuinely new 2026 laws on chatbot safety and AI deepfakes; correctly scoped for Tier 2.

Indiana

● Enacted: SB 150 (2024, creates an AI Task Force and state-agency AI inventory rules, chapter expires December 31, 2027); HB 1133 (2024, AI-disclosure requirement for political ads); HB 1271 (2026, bars health insurers from using AI as the sole basis to downcode a claim without human review, enacted March 4, 2026, effective July 1, 2026, up to $1,000/violation); HB 1296 (2025, requires K-12 school corporations to adopt AI policies, effective July 1, 2025).

● Pending: No major pending bill beyond continued Task Force reporting.

● Verdict: Four enacted laws across four domains, government AI, elections, healthcare, and education, correctly Tier 2, borderline Tier 1.

Iowa

● Enacted: HF 2240 (2024, criminalizes AI-generated CSAM and deepfake pornography); SF 2417 (2026, regulates “conversational AI services,” signed by Gov. Reynolds in early May 2026, effective July 1, 2026 with applicability from July 1, 2027, AG-only enforcement, no private right of action).

● Pending: No major pending bill identified beyond SF 2417's phase-in.

● Verdict: Two enacted laws across two domains, with the conversational-AI law among the first in the Midwest, correctly scoped for Tier 2.

Kentucky

● Enacted: SB 4 (2025, signed by Gov. Beshear March 24, 2025 with an emergency clause for immediate effect) creates an AI Governance Committee within the Commonwealth Office of Technology, requires state-agency AI disclosure and human oversight of consequential decisions, and gives candidates a cause of action over deceptive AI-manipulated campaign media within 45 days of an election.

● Pending: No major pending bill identified.

● Verdict: One comprehensive government-AI-plus-election-integrity framework across two domains, a substantial single law comparable to a rich Tier 2 entry, not yet a full private-sector deep-dive.

Louisiana

● Enacted: Act 457 of 2023 (sexual deepfakes involving minors, 5–20 years and up to $50,000); Act 142 of 2024/SB 6 (AI-created nude-image dissemination, effective August 1, 2024); Act 250 of 2025/HB 178 (first-in-nation AI-generated-evidence civil procedure law, signed June 11, 2025, effective August 1, 2025); Act 782 of 2026/HB 119, the “Ivy Daniels Act” (AI-CSAM possession plus school notice duties, effective August 1, 2026).

● Pending: None currently pending; two 2024 political-deepfake bills (SB 97, HB 154) were vetoed by Gov. Landry on First Amendment grounds.

● Verdict: Four enacted laws, including a genuinely first-in-nation AI-evidence statute, strong Tier 2, borderline Tier 1, though the laws cluster around deepfake-criminal territory rather than four fully distinct domains.

Maine

● Enacted: LD 1727 (“Act to Ensure Transparency in Consumer Transactions Involving Artificial Intelligence,” signed by Gov. Mills June 12, 2025, effective September 24, 2025, AG enforcement under the Unfair Trade Practices Act, up to $1,000/violation); LD 1944 (companion 2025 law extending Maine's non-consensual intimate-image statute to AI-generated content); LD 2082 (bars offering AI-only therapy or psychotherapy services unless delivered by a licensed professional, signed April 13, 2026, effective July 29, 2026).

● Pending: No major pending bill remains; LD 2082 (see Enacted) resolved the state's main open item.

● Verdict: Three enacted laws, with the chatbot-disclosure law among the first five states to enact one and the therapy restriction joining a small cluster of states (Illinois, Nevada) with nearly identical AI-therapy bans, correctly scoped for Tier 2.

Nebraska

● Enacted: LB 525 (“Conversational Artificial Intelligence Safety Act,” passed 49–0, signed April 14, 2026, effective July 1, 2027) requires chatbot operators to disclose non-human status, imposes heightened repeated disclosure and crisis-referral duties for minors, and bars any chatbot from claiming to provide professional mental-health care; AG-only enforcement, $1,000–$500,000 per operator, no private right of action. LB 77 (Ensuring Transparency in Prior Authorization Act, approved June 4, 2025) bars AI from being the sole basis for a healthcare utilization-review denial. LB 383 (2025) criminalizes AI-generated CSAM as a Class III felony, effective July 1, 2026.

● Pending: LB 642, a comprehensive Colorado-style Artificial Intelligence Consumer Protection Act, was introduced but stalled and did not pass.

● Verdict: Widely cited as the “Nebraska model” for chatbot legislation, other states (including Idaho) explicitly modeled their own laws on it, even though Nebraska signed slightly after Washington and Oregon. Three enacted laws across three domains, correctly Tier 2, near the top of the band given its national influence.

New Hampshire

● Enacted: HB 1432 (2024, effective January 1, 2025) makes creating or distributing a deepfake to harass, defame, or extort a Class B felony and creates a private right of action, enacted directly in response to the January 2024 robocall that mimicked President Biden's voice ahead of the NH primary. HB 1596 (2024, effective August 1, 2024) requires disclosure of deceptive AI in political ads within 90 days of an election, with a candidate's right to sue. HB 1688 (2024, effective July 1, 2024) bars state agencies from using AI to discriminate or conduct real-time biometric surveillance, and requires human review of irreversible AI decisions.

● Pending: No major pending bill identified.

● Verdict: Three enacted laws across three domains (criminal deepfakes with a private right of action, election deepfakes, government AI use), correctly Tier 2, notably the fastest state to legislate in direct response to a real-world AI harm event.

Pennsylvania

● Enacted: Act 125 of 2024 (signed October 2024) amended the intimate-image and child-sexual-abuse-material statutes to cover AI-generated depictions, with a civil action available to victims. Act 35 of 2025 (signed July 7, 2025, effective September 5, 2025) created the offense of “digital forgery” covering both video deepfakes and AI voice clones used to defraud or injure, a misdemeanor escalating to a felony when part of a broader fraud scheme.

● Pending: A frequently-miscited bill, HB 1663 (health-insurer AI disclosure), actually died in committee and is not law. Senate co-sponsorship memos preview future bills adding AI-generated intimate images to the invasion-of-privacy statute and criminalizing creation (not just dissemination) of AI sexual depictions. In October 2026 the General Assembly gave final approval to SB 806, an AI deceptive-advertising disclosure bill, sending it to Gov. Shapiro (Senate Democrats' Oct. 8 release; PN 1808, civil fine up to $3,000, effective 60 days after enactment); the General Assembly's bill history shows it presented to the Governor on October 21, 2026, with no governor action recorded yet.

● Verdict: Two enacted laws across two domains (intimate images/CSAM; deepfake and voice-clone fraud), correctly scoped for Tier 2, comparable to Idaho and Louisiana.

North Dakota

● Enacted: HB 1167 (2025) requires a disclaimer on political advertising that uses AI to impersonate a human's likeness or voice; it passed near-unanimously (House 90–0, Senate 46–0) and was filed with the Secretary of State on April 11, 2025. A separate 2025 law, signed by Gov. Armstrong on April 23, 2025, requires licensed physicians rather than AI systems to make prior-authorization decisions.

● Pending: No major pending bill identified.

● Verdict: Two enacted laws across two domains (elections, healthcare AI), at the low end of the Tier 2 band but real and multi-domain. Not named in any federal action.

Oklahoma

● Enacted: HB 3642 (2024), requested by AG Gentner Drummond, expanded the state's child-pornography statute to expressly include AI-generated CSAM, effective November 1, 2024. HB 1364 (2025), signed by Gov. Stitt, added AI-generated non-consensual intimate images to the revenge-porn statute, effective November 1, 2025.

● Pending: A long list of governance bills all died: an AI Bill of Rights (HB 3453), an AI Utilization Review Act (HB 3577), an election-deepfake bill (HB 3825), a state-agency AI inventory bill (HB 3828), and two 2025 comprehensive bills (HB 1899, HB 1916). A 2026 bill (HB 3299, ELVIS Act-style publicity rights plus political-ad disclosure) remains pending.

● Verdict: Two enacted laws, both confined to the same criminal sexual-content cluster, against a long list of failed governance and election bills, correctly scoped for Tier 2 on law count, though narrow in domain diversity.

South Carolina

● Enacted: Act 37 (H3058, signed May 12, 2025) makes AI deepfake intimate images a felony, up to 10 years and $10,000 for aggravated repeat offenses. Act 57 (S28) and Act 58 (S29), both ratified May 27, 2025 and championed by AG Alan Wilson, extend the state's child sexual abuse material and harmful-to-minors statutes to AI-generated and computer-morphed depictions of minors.

● Pending: An election-deepfake bill (H3517), introduced January 2025, has seen no action since referral to House Judiciary and is effectively dead, South Carolina entered the 2026 election cycle with no AI election law at all.

● Verdict: Three enacted laws, but all clustered in the NCII/CSAM/minor-protection space, a single subject area. Correctly scoped for Tier 2 on law count; would need a law outside that cluster (elections, employment, healthcare) to make a stronger case.

Wisconsin

● Enacted: 2023 Act 123 (AB 664, signed March 21, 2024) requires an AI-disclosure disclaimer on political ads, enforced by the state Ethics Commission with forfeitures up to $1,000 per violation. 2025 Act 34 (SB 33, signed by Gov. Evers October 3, 2025) criminalizes nonconsensual “synthetic intimate representations” as a Class I felony. 2023 Act 224 expanded child-pornography prohibitions to cover AI-generated “virtual child pornography.”

● Pending: none identified. AB 1068 (state-agency AI audits and staff-reduction goals) passed the Assembly in the 2023–24 session but died in the Senate; the 2025–26 bill with that number is reportedly an unrelated broadband measure.

● Verdict: Three enacted laws across election, NCII, and CSAM domains, but Wisconsin's real distinction is federal, not legislative: after EO 14365, Gov. Evers wrote directly to President Trump naming these laws and urging him to abandon efforts to preempt them, and AG Josh Kaul signaled Wisconsin might challenge federal preemption in court. Correctly scoped for Tier 2, with unusually high federal salience for a state this size.

VI. Tier 3: 50-State Summary Table

State	Category	Status	Effective Date	Notes
Alabama	Election Deepfake + CSAM + Health Insurance	Enacted (HB 172; Child Protection Act; SB 63)	Oct. 2024–Oct. 2026	SB 63 (2026) regulates AI in health-plan coverage decisions; HJR 51 created a study commission on AI and children’s internet safety (report due Nov. 1, 2026).
Alaska	CSAM	Enacted (HB 239, Ch. 9 SLA 26); SB 2 died	July 2026	HB 239 criminalizes AI-generated CSAM and became law without the governor’s signature (June 2026); SB 2 (election deepfakes, agency AI) died.
Arizona	Deepfake/Fraud + Healthcare + CSAM (Tier 1)	Enacted (SB 1359, HB 2394, SB 1295, HB 2678, HB 2175)	2024–2026	Active AG enforcement, incl. a Grok/xAI investigation, see Tier 1 profile.
Arkansas	Multi-domain, 5 laws in one session (Tier 1)	Enacted (Acts 159, 827, 848, 927, 977)	2025	Broadest single-session sweep in this tracker, see Tier 1 profile.
California	Frontier Transparency + Multi-domain, 20+ laws (Tier 1)	Enacted (SB 53, AB 853, + 18 others; more signed Sept. 2026)	Jan. 2026 (SB 53); phased through 2028	Broadest AI law portfolio of any state, see Tier 1 profile.
Colorado	Privacy-Adjacent ADM Rights (Tier 1)	Enacted (SB 26-189, HB 26-1263)	Jan. 1, 2027	Replaced its original comprehensive AI Act before that law ever took effect, see Tier 1 profile.
Connecticut	Modular Comprehensive, companion, frontier, employment, provenance (Tier 1)	Enacted (Public Act 26-15)	Oct. 2026–Oct. 2027 (phased)	Built as targeted pieces rather than one framework, see Tier 1 profile.
Delaware	Privacy/ADM + Government AI	Enacted (DPDPA, AI Commission, HB 380 signed Sept. 2, 2026)	Jan. 2025	HB 380 lowers the privacy law's thresholds and expands automated-profiling duties (effective Jan. 2027).
District of Columbia	None enacted	Stop Discrimination by Algorithms Act perennial, not passed	N/A	Mayor Bowser’s Feb. 2026 mandatory responsible-AI training for District employees and contractors (building on Mayor’s Order 2024-028) is the only binding action so far.
Florida	Deepfake/Election + NCII/CSAM	Enacted (HB 919, HB 1161, HB 757); SB 482 comprehensive bill died	2024–2025	Intra-party fight (Gov. DeSantis vs. House Speaker Perez) over the failed comprehensive bill.
Georgia	CSAM + Chatbot + Healthcare	Enacted (HB 993, SB 540, SB 444); SB 9 election bill died	2024–2027	Borderline Tier 1; large governance/study infrastructure behind it.
Hawaii	Election Deepfake (struck down) + Chatbot + Deepfake Civil Protections	Act 191 permanently enjoined; SB 3001 and HB 2137 signed July 14, 2026	N/A (enjoined)	Leading First Amendment cautionary precedent (Babylon Bee v. Lopez).
Idaho	Election + NCII + Chatbot + Criminal-justice algorithms	Enacted (HB 664, HB 575, §19-1910, SB 1297)	2019–2027	Four domains, borderline Tier 1.
Illinois	Frontier Transparency + Sector-Specific (Tier 1)	Enacted (SB 315, PA 103-804, PA 104-0054)	Jan. 2026–Jan. 2028 (phased)	Three separate laws across chatbot safety, employment, and therapy, see Tier 1 profile.
Indiana	Government AI + Election + Healthcare + Education	Enacted (SB 150, HB 1133, HB 1271, HB 1296)	2024–2026	Four domains, borderline Tier 1.
Iowa	CSAM + Chatbot	Enacted (HF 2240, SF 2417)	2024, 2026	Among the first Midwest conversational-AI laws.
Kansas	Government Security + CSAM/NCII	Enacted (HB 2313 foreign-AI-platform ban, SB 186; 2026: HB 2183, HB 2537, HB 2518)	2025–2026	The DeepSeek/foreign-AI ban aligns with federal policy, low preemption risk. AG Kobach is one of eight AGs suing OpenAI (Oct. 2026).
Kentucky	Government AI + Election Integrity	Enacted (SB 4)	Mar. 2025 (immediate, emergency clause)	Single comprehensive government-use-plus-election framework.
Louisiana	NCII/CSAM + AI-Generated Evidence	Enacted (Act 457, Act 142, Act 250, Act 782)	2023–2026	First-in-nation AI-generated-evidence civil procedure law.
Maine	Chatbot Disclosure + NCII + AI Therapy Ban	Enacted (LD 1727, LD 1944, LD 2082)	Sept. 2025	Among the first five states with a chatbot-disclosure law.
Maryland	Multi-domain, government, healthcare, deepfake, employment (Tier 1)	~10 laws enacted; HB 1331 comprehensive bill died (2025)	2020–2026	Broadest portfolio of any state outside the original Tier 1 group, see Tier 1 profile.
Massachusetts	None comprehensive enacted	AG advisory only; frontier AI bill in conference, not enacted	N/A	Thinnest record in this tracker; would become the 4th frontier-AI state if the provisions are enacted.
Michigan	Deepfake/Election + NCII	Enacted (HB 5141–5145, HB 4047/4048); SB 760 pending	2024–2025	AG Dana Nessel a leading multistate anti-preemption voice.
Minnesota	Deepfake/Election + NCII	Enacted (HF 1370); SF 1886 pending	Aug. 2023	The most litigated law in this tracker (X Corp. v. Ellison, stayed pending appeal); 2026 nudification law paused pending appeal by the Eighth Circuit (Oct. 2026).
Mississippi	Election Deepfake + Task Force	Enacted (SB 2577, SB 2426, HB 1723)	2024–2026	SB 2426 created an AI Regulation Task Force (2025); HB 1723 (2026) defines AI in statute. HB 1126 (2024) is a child online-safety law, not an AI law.
Missouri	None enacted	Omnibus deepfake bill passed House 145–3 but died; no AI law enacted in 2026 session	N/A	Senators warned the bill could risk roughly $900M in BEAD broadband funds under EO 14365. Gov. Kehoe’s EO 26-02 (Jan. 2026) directs a state-government AI framework.
Montana	Deepfake/Likeness + Deregulatory	Enacted (SB 25, HB 513, HB 514, SB 212)	2025	Nation's first “Right to Compute” Act; SB 25 was preliminarily enjoined for the plaintiffs in a First Amendment challenge (Sept. 2026).
Nebraska	Chatbot + Healthcare + CSAM	Enacted (LB 525, LB 77, LB 383); LB 642 comprehensive bill died	2025–2027	The “Nebraska model” widely copied by other states' chatbot laws.
Nevada	Restricted-Purposes, healthcare, deepfakes (Tier 1)	Enacted (AB 406, SB 213, SB 263, AB 73); SB 199 comprehensive bill failed	2025–2026	Comprehensive bill died in the Senate, see Tier 1 profile.
New Hampshire	Deepfake/Fraud + Election + Government AI (Tier 2)	Enacted (HB 1432, HB 1596, HB 1688)	2024–2025	Fastest state to legislate directly in response to a real AI harm event (the Biden robocall), see Tier 2 entry.
New Jersey	Deepfake/Election	Enacted (A3540/S2544); bias-audit bill pending	Apr. 2025	Includes a private right of action; Gov. Murphy publicly opposed EO 14365.
New Mexico	Election Deepfake	Enacted (HB 182)	May 2024	HB 141 (AI Accountability Act) was postponed indefinitely in 2026 and no 2026 AI enactment was found; AG Torrez announced a frontier-AI bill for 2027.
New York	Frontier Transparency + Deepfake/Likeness (Tier 1)	Enacted (RAISE Act + 10+ other laws)	Jan. 2027 (RAISE); various 2025–2026	Signed just 8 days after EO 14365, see Tier 1 profile.
North Carolina	CSAM + Government AI (executive order)	Enacted (Session Law 2024-37); EO 24 (AI Leadership Council)	Dec. 2024	A large slate of 2025 AI bills failed to pass; H 301 (Social Media & AI Safety) is stuck in conference and is not law.
North Dakota	Election + Healthcare	Enacted (HB 1167; 2025 physician-review law)	2025	Two domains, low end of the Tier 2 band.
Ohio	Government/Education AI	Enacted (HB 96 school-policy mandate)	Sept. 2025 (districts by July 2026)	First state to require K-12 AI-use policies; still no deepfake or CSAM law (SB 163 passed the Senate and is pending in the House).
Oklahoma	CSAM/NCII	Enacted (HB 3642, HB 1364)	2024–2025	Every governance and election-deepfake bill has died in committee.
Oregon	Deepfake/Election + Healthcare Title + Companion Chatbot (Tier 1)	Enacted (SB 1571, HB 2299, HB 2748, SB 1546)	2024–2027	First-in-nation ban on AI using the “nurse” title, see Tier 1 profile.
Pennsylvania	NCII/CSAM + Deepfake Fraud	Enacted (Act 125, Act 35)	2024–2025	HB 1663 (health-insurer AI bill) is often miscited as enacted, it actually died.
Rhode Island	Deepfake/Election + Healthcare AI cluster (Tier 1)	Enacted (5 laws); S627 comprehensive bill died	2025–2027	The most healthcare-concentrated Tier 1 state, see Tier 1 profile.
South Carolina	NCII/CSAM	Enacted (Act 37, Act 57, Act 58)	2025	No AI election law at all, H3517 stalled in committee.
South Dakota	Election Deepfake + CSAM/NCII	Enacted (SB 164, SB 41; 2024 AI-CSAM law)	2024–2026	SB 41 (2026) makes sexual deepfakes of non-consenting adults a felony.
Tennessee	Likeness/Voice + Healthcare + Frontier (Tier 1)	Enacted (ELVIS Act, Deepfake Images Act, SB 1580); HB 1898 died in Senate	2024–2027	The ELVIS Act is the national model other states' voice-cloning laws copy, see Tier 1 profile.
Texas	Restricted-Purposes Prohibition (Tier 1)	Enacted (TRAIGA / HB 149)	Jan. 2026	AG complaint portal now live (required by Sept. 1, 2026), see Tier 1 profile.
Utah	Sector-Specific Disclosure (Tier 1)	Enacted (SB 149, amended by SB 226/SB 332/HB 452)	May 2024; narrowed May 2025	Earliest mover, and the fastest to narrow its own law, see Tier 1 profile.
Vermont	Government AI + Deepfake + Healthcare + Privacy (Tier 1)	Enacted (Act 132, Act 161, Act 75, H.816, Act 145)	2022–2028 (phased)	Runs two parallel AI-governance bodies at once, see Tier 1 profile.
Virginia	None comprehensive (narrow laws only) (Tier 1)	HB 2094 vetoed; HB 1642, SB 84 and SB 394 enacted	July 2025; July 2026	Most 2026 AI bills tabled over fear of losing BEAD funding, see Tier 1 profile.
Washington	Deepfake/Likeness + Companion Chatbot + Healthcare AI (Tier 1)	Enacted (SB 5886, HB 2225, HB 1170, SB 5395)	June 2026–Feb. 2027	Includes a rare private right of action, see Tier 1 profile.
West Virginia	Study Commission only	Enacted (HB 5690 task force, extended by HB 3187)	2024, extended to 2027	The thinnest record in this tracker, no substantive regulation yet; no 2026 AI-specific law found.
Wisconsin	Election + NCII + CSAM	Enacted (Act 123, Act 34, Act 224)	2024–2025	Gov. Evers publicly opposed EO 14365, naming these laws directly.
Wyoming	CSAM/NCII + Enforcement Funding	Enacted (HB 102, SF 85)	2025–2026	A 2024 election-deepfake bill (SF 51) died in committee; HB 102 (signed Mar. 7, 2026, Ch. 91) created AI-CSAM and AI self-harm offenses.

VII. Cross-Cutting Trends

Two axes explain most of the variation across all 51 jurisdictions: political control predicts what kind of law a state passes and how it reacts to federal pressure; geography mostly predicts which states copied which bill, not shared values.

A. Political Control Predicts Law Type, Not Just Whether a Law Exists

Red-trifecta states (Texas, Tennessee, Arkansas, Oklahoma, Idaho, Montana, Kansas, and the Deep South bloc) cluster around narrow, criminal-law statutes, banning specific harmful uses rather than regulating AI as a category. Montana's “Right to Compute” Act is the purest expression of this instinct: an affirmative deregulatory right rather than a restriction.
Blue-trifecta states (California, New York, and Illinois, the only three states with frontier-AI transparency laws, plus Colorado, Connecticut, New Jersey, Maryland, Rhode Island, and Vermont) build broader regulatory frameworks instead.
Virginia is the cleanest natural experiment: the same comprehensive bill, HB 2094, was vetoed by a Republican governor citing business costs, then followed a year later by narrower bills signed under a Democratic successor. One state, one governor's seat, opposite outcomes.

B. Three Postures Toward Federal Pressure, Not a Simple Resist-or-Comply Split

Fight: Wisconsin's Gov. Evers wrote directly to President Trump naming the state's AI laws and refusing to retreat; New Jersey's Gov. Murphy publicly opposed the EO; Michigan AG Dana Nessel led a multistate coalition against it.
Fold: Virginia and Missouri legislators killed their own pending AI bills over fears of losing federal broadband funding, before a vote ever happened.
Collaborate: Tennessee's frontier-AI bill (HB 1898/SB 2171) was reportedly narrowed with White House input to fit EO 14365's child-safety carve-out, but even that version died in the Senate, so the collaboration produced a study directive rather than a law.
Florida shows the limits of a purely partisan read: Gov. DeSantis pushed for a comprehensive AI Bill of Rights, and his own House Speaker killed it on states'-rights grounds, an intra-party fight, not a partisan one.

C. Geography Predicts Copying, Not Shared Values

Washington and Oregon passed nearly parallel companion-chatbot laws, both with a private right of action, unusual nationally, within weeks of each other.
Idaho explicitly modeled its chatbot law on Nebraska's; Montana, Arkansas, and Washington all modeled their voice/likeness laws on Tennessee's ELVIS Act, four states with little else in common.
New England's small states (Connecticut, Vermont, Rhode Island, New Hampshire) are disproportionately active for their size.
The Midwest is the most internally inconsistent region: Illinois a national leader sitting next to Ohio (one law) and Missouri (zero enacted), a gap political control explains better than geography does.

D. Two Points of Near-Universal Consensus

Deepfake, NCII, and CSAM law is the closest thing to a 50-state consensus: present in nearly every state's law regardless of tier, the one category where red and blue states converge on similar substance even while diverging on everything else.
AG-only enforcement with no private right of action is the default enforcement model almost everywhere; Washington, Oregon, New Jersey, New Hampshire, and Rhode Island's chatbot law are the notable exceptions that give individuals a right to sue.

VIII. Emerging Issue: State and Local Response to AI Data Center Buildout

A parallel but distinct fight is unfolding alongside AI-decision regulation. As AI infrastructure buildout accelerates, states and localities are moving to pause, restrict, or litigate against data-center construction over energy, water, and grid-strain concerns. This is energy and land-use policy responding to AI growth, not AI governance in the same sense as the deepfake, chatbot-safety, and algorithmic-discrimination laws catalogued above.

A. The National Picture

More than 300 data-center bills have been filed across more than 30 states in 2026, at least 12 states have considered moratorium legislation, and more than 100 local moratoria have been adopted nationwide, per DLA Piper's July 2026 tracking.
Independent counts run higher: The Information and Heatmap News each put the number of jurisdictions banning or restricting data centers above 500, though both trackers are explicit that the figure blends outright bans with softer restrictions such as setbacks, noise limits, and water-use rules, many of them temporary.
Polling from Gallup and Heatmap finds roughly seven in ten Americans now oppose a data center being built near them, a bipartisan reaction driven by electricity costs, water use, and grid strain rather than AI safety concerns.

B. State-Level Actions

This is playing out differently in every state, from top-down state moratoria to county-by-county waves to states that are actively courting the industry. A representative sample:

New York

The Responsible Data Center Development Act (S10642/A11560) passed the legislature June 4, 2026, a one-year moratorium on state permits for large data centers, but awaits Governor Hochul's signature.
In the meantime, Hochul's Executive Order No. 62 (July 14, 2026) put a narrower moratorium into immediate effect: state environmental permits for data centers of 50 megawatts or more are held in abeyance until the Department of Public Service completes a Generic Environmental Impact Statement, expected to take up to a year, and unlike the pending legislation, the order does not grandfather projects already underway.
Together they represent the first statewide moratorium action of any kind in the country.

Texas

HB 2559 (2025), a companion to the state's 2023 local-preemption law, caps municipal development moratoriums at 180 days.
State Senator Paul Bettencourt has invoked it to pressure local governments directly, successfully pushing Hood County commissioners to reject a proposed moratorium in February 2026 and threatening a legal challenge to San Marcos's June 2026 zoning change that excludes data centers citywide, though land-use specialists note HB 2559's moratorium cap may not even reach a zoning ordinance.

New Jersey

More than 25 municipalities have banned data centers outright, and the backlash has already reached federal court.
National Land Developers sued Andover Township in July 2026 after the township reversed a zoning decision at a former airport site, and Hexa Builders LLC filed a $300 million suit against Monroe Township over an ordinance removing data centers as a permitted use.
New Jersey has no statewide moratorium; the fight there is playing out municipality by municipality, and increasingly in court.

Virginia

Virginia is both the industry's birthplace, Loudoun County's “Data Center Alley” holds the densest concentration of data centers on Earth, and the site of its sharpest local backlash.
In July 2026 the Loudoun County Board of Supervisors voted 6-1 to direct staff to draft a formal moratorium, even though the county's own attorney warned that outright moratoriums likely are not legal under Virginia's Dillon's Rule, which limits localities to powers the state expressly grants.
On September 15 the Board instead advanced a resolution to pause its final votes on legislative data center and substation applications for up to 12 months, retroactive to September 15, while leaving applications active through Planning Commission review; the Board was scheduled to consider the resolution at its October 20 meeting but deferred the vote to November 17 at the county attorney’s request (reported).
At least three other Virginia counties have already paused approvals through other means, and incoming Governor Spanberger has signaled support for requiring data centers to cover the cost of their own power. Several 2026 state bills would add siting restrictions, an excise tax, and energy-cost safeguards.

Georgia

Georgia's fight is playing out county by county rather than at the state level. Since March 2026, at least eight Georgia counties and cities, including Pike, Lamar, Troup, and Clayton counties and the city of LaGrange, have passed data center moratoria.
Newton County (home to Meta's Stanton Springs facility) and DeKalb County have repeatedly extended theirs amid resident complaints about water contamination and rising power bills.
Not every effort succeeds: DeKalb's commission voted unanimously in June 2026 to reject a proposed permanent zoning ordinance after residents said it did not go far enough.

Maine

Maine's legislature passed what would have been the country's first statewide data-center moratorium, only for Governor Janet Mills to veto it in April 2026.
A reminder that legislative passage and enactment are not the same thing, and a useful contrast to New York, where the governor acted through an executive order rather than waiting on the legislature.

Louisiana

Louisiana has taken the most welcoming posture in this section. It has backed Meta's Richland Parish “Hyperion” data center, whose committed investment has grown past $50 billion, with tax exemptions and infrastructure support.
Even as the project's registered water use would nearly double the parish's total withdrawals and Entergy seeks to avoid $237 million in local property taxes, state legislators have nonetheless filed roughly two dozen AI-related bills this session, most aimed at consumer protection rather than data-center siting itself.

Elsewhere

The pattern elsewhere is mostly local and mostly recent, spanning five more states:

xAI's Colossus supercomputer complex straddling Memphis, Tennessee and Southaven, Mississippi has drawn a federal Clean Air Act lawsuit from the NAACP over unpermitted gas turbines in historically Black neighborhoods, plus a separate class action from Southaven residents over noise.
Idaho’s Kootenai County enacted a 182-day emergency moratorium in 2025 over water and power concerns.
Kentucky’s Oldham County faces a threatened legal challenge over the zoning strategy used to site a data center.
Indiana’s Union Township drew over 1,000 residents to a single hearing opposing two proposed facilities.
Wisconsin has its own version of the Colossus noise dispute, a proposed class action against Microsoft's Fairwater Data Center in Mount Pleasant.

C. Litigation Flagged, Not Tracked

RCM Hill LLC's suit against Hill County, Texas is the most legally developed case so far: filed in May 2026 after the county adopted a moratorium, it sought over $100 million in damages and was dismissed with prejudice in July after the county rescinded the moratorium.
This case and the others noted above turn on zoning, land-use, and takings law, or on environmental permitting in the Memphis-area cases, rather than AI-system design or deployment, so they fall outside this tracker's and the companion Legal Case Tracker's defined scope. They are noted here for context only, not tracked as case entries.

IX. Key Dates to Watch

Dates below are as of October 21, 2026. Items marked “confirmed” were checked against a primary source; “reported” items rest on secondary reporting or an official snippet and should be rechecked before they are relied on.

October 26, 2026: Colorado Attorney General rulemaking hearing at 10:00 a.m. MT in Denver; written comments close at 11:59 p.m. MT, extended if the hearing continues (confirmed, coag.gov/ai).
November 1, 2026: Alabama’s Study Commission on Artificial Intelligence and Children’s Internet Safety (HJR 51) must file its final report (confirmed, enrolled resolution).
November 2026: New York DFS begins registering large frontier AI developers under the RAISE Act (confirmed, DFS release).
November 17, 2026: Loudoun County Board of Supervisors vote on the 12-month pause on data center applications, deferred from October 20 at the county attorney’s request (reported; see Section VIII).
Mid-November 2026: California’s expert guide on strengthening AI safety laws is due about two months after EO N-9-26 (Sept. 18); an Illinois special session is tentatively set for November 17–19 (reported).
Late November 2026: EO 14434 (Sept. 29) calls for a proposed legal definition within 60 days, around November 28.
December 31, 2026: Gov. Hochul’s deadline to sign or veto the AI bills awaiting action, including the FAIR News Act (reported).
January 1, 2027: New York’s RAISE Act, Illinois SB 315, and Colorado’s SB 26-189 and HB 26-1263 take effect (Colorado confirmed, coag.gov/ai); California’s 2026 AI statutes, including SB 574, take effect by default.
No set date: Massachusetts H.5576 remains in conference with no action since July 30 (confirmed, malegislature.gov); Pennsylvania SB 806 was sent to Gov. Shapiro on October 8 and was presented to Gov. Shapiro on October 21 and awaits his action (confirmed, palegis.us); New Jersey’s A 5089, A 5090 and A 5275 were discussed without votes at an October 19 committee hearing (reported); the Eighth Circuit and Montana cases continue.

Sources

Join CARE Mailing List

State AI Policy: A 50-State Tracker

Category 1: Comprehensive Cross-Sector Accountability

Category 2: Frontier / Foundation Model Transparency

Category 3: Restricted-Purposes Prohibition

Category 4: Sector-Specific

Category 5: Deepfake / Election / Likeness

Category 6: Privacy-Law-Adjacent ADM Rights

Category 7: Study Commission / No Binding Law

A. Executive Action

B. Congressional Attempts and Failures

C. State Responses

Colorado

California

Texas

Illinois

Utah

New York

Connecticut

Virginia

Washington

Oregon

Nevada

Maryland

Arizona

Arkansas

Tennessee

Rhode Island

Vermont

New Jersey

Massachusetts

Montana

Minnesota

Michigan

Florida

Idaho

Georgia

Delaware

Hawaii

Indiana

Iowa

Kentucky

Louisiana

Maine

Nebraska

New Hampshire

Pennsylvania

North Dakota

Oklahoma

South Carolina

Wisconsin

A. Political Control Predicts Law Type, Not Just Whether a Law Exists

B. Three Postures Toward Federal Pressure, Not a Simple Resist-or-Comply Split

C. Geography Predicts Copying, Not Shared Values

D. Two Points of Near-Universal Consensus

A. The National Picture

B. State-Level Actions

New York

Texas

New Jersey

Virginia

Georgia

Maine

Louisiana

Elsewhere

C. Litigation Flagged, Not Tracked

ARTICLE