AI Frontier Institute

AI Policy Tracker

Federal and state AI bills and executive actions, each sourced, status-dated and summarized in plain English. Filter by jurisdiction, status or impact area, or search by keyword.

• PAIn committee 2026-10-27Enterprise · AI policy · +2

  Providing for prohibited conduct involving algorithmic pricing structures and artificial intelligence, for enforcement by Attorney General and for civil remedies; and imposing criminal penalties.

  Pennsylvania Senate Bill 1507, the "Collusive Algorithms Act," has been referred to the Consumer Protection and Professional Licensure Committee and has not been enacted. If enacted, it would make it unlawful to distribute, develop for distribution, or use "collusive algorithmic pricing structures." These are AI or algorithmic pricing tools that use, or were trained on, nonpublic competitor data to recommend or set prices or commercial terms in a relevant antitrust market (Sections 3 and 4(a)(1)-(3)). It would also bar using "common artificial intelligence," meaning AI not used exclusively by one person, to set prices for goods or services offered or sold in Pennsylvania (Section 4(a)(4)). Section 4(b) gives an exception to the "use" prohibition in Section 4(a)(3) if substantial evidence shows the user did not know the tool used nonpublic competitor data. Section 4(c) sets criminal penalties. Distribution is a first-degree felony with a fine of up to $1,000,000 per distribution. Developing for distribution is a second-degree felony with a fine of up to $100,000,000 per structure. Using a collusive structure is a second-degree felony with a fine of up to $100,000 per pricing decision or recommendation. Using common AI to set prices is a second-degree misdemeanor with a fine of up to $5,000 per pricing decision or recommendation. The Attorney General could investigate and prosecute violations and seek injunctions (Section 5). A court could order restitution after a permanent injunction (Section 6). The Attorney General could accept assurances of voluntary compliance (Section 7) and issue regulations (Section 9). Purchasers who suffer an ascertainable loss could sue privately for the greater of actual damages or $1,000. A court could award up to treble actual damages, but not less than $1,000, plus attorney fees and costs (Section 8). The act would not limit federal antitrust remedies. Except as provided in Section 4(a)(4), it would not bar algorithmic or proprietary AI pricing tools that do not use nonpublic competitor data (Section 10). It would take effect immediately (Section 11).

• PAIn committee 2026-10-26Enterprise · AI policy · +3

  In school safety and security, providing for prohibition of artificial intelligence for school-based mental health and counseling.

  Pennsylvania Senate Bill 1505 (Printer's No. 2069) has been referred to the Education committee and has not been enacted. If enacted, it would add Section 1323-B to the Public School Code of 1949. Under Section 1323-B(a), school entities (school districts, career and technical schools, intermediate units, and charter, cyber charter and regional charter schools) could not use AI, AI chatbots or generative AI to provide a service to a student that would amount to the practice of a school-based mental health professional. Under Section 1323-B(b), AI suppliers could not contract with a school entity to provide AI systems programmed to deliver such services. Section 1323-B(c) bars a school entity from using an AI mental health system to: diagnose a student's mental health condition; provide psychological or behavioral therapy or counseling; provide individualized treatment or therapeutic intervention; determine or recommend an individualized diagnosis or treatment plan; represent that the AI is, or can substitute for, a school psychologist, counselor or social worker; or provide mental health or psychological therapy. Section 1323-B(d) says the section does not prevent employed school-based mental health professionals from using AI for administrative support, subject to FERPA (20 U.S.C. § 1232g). It also does not override collective bargaining agreements under the Public Employe Relations Act. Section 1323-B(e) defines key terms, including AI, AI chatbot, generative AI, supplier, operator, synthetic content and school-based mental health professional. Section 2 sets the effective date at 60 days after enactment.

• USIssued 2026-10-23AI policy

  Notice of Public Meetings of the Michigan Advisory Committee to the U.S. Commission on Civil Rights

  The U.S. Commission on Civil Rights gives notice (FR Doc. 2026-21710) of two virtual public meetings of its Michigan Advisory Committee, held on Zoom. The Committee is studying "Artificial Intelligence and Civil Rights in Michigan." The first meeting is Friday, November 6, 2026, 11:00 a.m.-1:00 p.m. ET (Briefing Panel 2). Its purpose is to continue hearing from experts on the study topic. The second is Thursday, December 3, 2026, 11:30 a.m.-12:30 p.m. ET (Debrief & Business Meeting). It will continue briefing discussion and planning. Anyone may attend through the registration links or by phone. Open comment periods will allow oral public comments as time allows. Written comments must reach the regional office within 30 days after the meetings. Closed captioning is available. Accommodation requests are due at least 10 business days before the meetings. Mallory Trachtenberg, Designated Federal Officer, is the contact (1-202-809-9618). The notice is dated October 21, 2026, and signed by David Mussatt, Supervisory Chief, Regional Programs Unit. It imposes no regulatory requirements.

• PAEnacted 2026-10-21Workforce · Quality assurance · +2

  Directing the Joint State Government Commission to conduct a study and issue a report on the impact driverless vehicles have on safety and the workforce.

  House Resolution 563 of the 2026 Pennsylvania session has not been adopted. The House Communications and Technology Committee reported it as amended on 2026-09-30. If adopted, the House would direct the Joint State Government Commission to study driverless vehicles and issue a report on their impact on safety and the workforce. The study would cover seven topics. (1) Safety risks and benefits of driverless vehicles and personal delivery devices (PDDs). (2) Potential job losses for Pennsylvania workers in the taxi, ride-share, food delivery and freight industries. (3) Infrastructure needs and costs, such as electrical grid upgrades, expanded transportation networks and highway safety, and other possible costs to the Commonwealth and municipalities. (4) Use of driverless vehicles and PDDs in areas such as school zones, hospitals, police and fire stations, crime scenes, train stations and airports. (5) Access to driverless vehicles in underserved areas. (6) Technology, safety and recognition across diverse demographic groups. (7) Loss of the physical help human drivers give older and disabled riders getting in and out of vehicles. The committee amendment adds a directive that the Commission consult commercial driver's license (CDL) drivers in the transport industry and representatives of labor organizations. The Commission must report its findings to the Senate and House within one year of adoption. It must also send the report to the majority and minority chairs of the Communications and Technology, Labor and Industry, and Transportation Committees of both chambers. The preamble notes AI use in driverless vehicles, crashes and outages involving driverless taxis, and Pennsylvania's PDD rules.

• VAIn committee 2026-01-14Enterprise · AI policy · +1

  Virginia Residential Landlord and Tenant Act; algorithmic pricing device use by certain landlords.

  House Bill 1252 (Virginia, offered January 14, 2026) has not been enacted. It was referred to the Committee on General Laws, and it was continued to the next session. If enacted, it would amend the Virginia Residential Landlord and Tenant Act. In § 55.1-1200 it would add a definition of "algorithmic pricing device." The term covers automated systems or software that use algorithms, machine learning, predictive analytics, or similar methods to generate, recommend, or influence rents or rent increases. It excludes a landlord's internal spreadsheets or manual analyses. It also excludes publicly available market-rent surveys that don't rely on individualized landlord or tenant data. A new § 55.1-1204.2 would apply only to landlords who own more than 10 rental dwelling units, or more than a 10 percent interest in more than 10 such units, in Virginia. These landlords would have to give written disclosure when they use an algorithmic pricing device to set advertised, renewal, or offered rent. The disclosure must state that such a device was used and name the software, platform, or service. It would be due before a written rental agreement is signed, or before occupancy under an oral agreement. On request, the landlord must give a plain-language summary of the general factors the device considers. Trade secrets, such as proprietary formulas, source code, and input weighting, need not be disclosed. On request, a tenant or prospective tenant would be entitled to human review of a device-generated or device-recommended rent determination or renewal increase. Landlords could not misrepresent whether they use such a device. They could not advertise a price as nonnegotiable solely because a device generated it. They could not use a device in a deceptive or misleading way. The Attorney General could sue for an injunction and civil penalties of up to $1,000 per violation. The bill creates no private right of action. It requires no extra recordkeeping. It puts no duties on the Department of Housing and Community Development. It puts no obligations on software vendors or third-party platforms.

• VAIn committee 2026-01-14AI policy · Privacy & Data Protection · +2

  Consumer Data Protection Act; online device pricing, prohibition.

  Senate Bill 615 (Virginia, 2026 prefiled) has not been enacted; it was referred to the Committee on General Laws and Technology and continued to the next session. If enacted, it would amend the Consumer Data Protection Act's definitions in § 59.1-575 and add new § 59.1-577.2, "Online device pricing; prohibition." The definitions section would add new terms including "Consumer transaction" (same meaning as in § 59.1-198), "Coupon," "Discount," "Hardware state" (e.g., battery life, number of wireless connections detected, hardware performance characteristics, device age, and data erased or retained on restart or power-down), and "Online device" (a physical object that can communicate via the internet or short-range wireless, such as a laptop, tablet, phone, or other smart hardware). Under § 59.1-577.2(A), no controller or processor could, in connection with a consumer transaction, generate in whole or in part a price offered to a consumer through the consumer's online device based on (1) the device's hardware or hardware state, (2) the presence or absence of software on the device, or (3) the device's precise geolocation data when used to set a price based on inferences about the consumer. Under § 59.1-577.2(B), the section would not prohibit: (1) hardware-based pricing for repairs or maintenance or for calculating trade-in value; (2) using precise geolocation to price based on real-time local demand for products or services provided immediately upon request, or on price differences between physical locations due to legitimate cost differences, including state or local taxes, duties, or fees; or (3) bona fide coupons, discounts, rebates, sales, or promotions that are separate from the price, reduce the price, are offered to the general public on the same terms, and do not use the input data listed in subsection A.

• VAIn committee 2026-01-15AI policy · Privacy & Data Protection · +2

  Law enforcement; artificial intelligence inventory, civil action.

  HB 1295 has not been enacted. It was referred to the House Committee on Communications, Technology and Innovation, and a subcommittee recommended continuing it to the next session. If enacted, it would add § 9.1-116.11 to the Code of Virginia. The section would require every state or local law-enforcement agency and sheriff's department to conduct an annual inventory of "covered AI systems" and make it public by November 1 each year. Covered AI systems are AI systems that aid a criminal investigation, such as by generating leads or writing or materially helping write police reports. The definition lists technologies including biometric identification, forensic DNA phenotyping, investigative genetic genealogy, cross-camera tracking, automated license plate readers, gunshot detection, predictive policing, risk scoring, social media analysis and mobile device forensic tools. It excludes administrative tools such as productivity or document management software and generative AI used only for spelling or grammar. It also excludes AI used for development, prototyping and research before it is made available to deployers or consumers. For each system, the inventory must give (1) the name, vendor and product; (2) its capabilities and limitations; (3) its data inputs and outputs; and (4) its authorized and unauthorized uses. The Attorney General could investigate and bring a civil action for equitable or declaratory relief to enforce the section (subsection C). Any person residing within an agency's jurisdiction could also sue for equitable or declaratory relief, and a prevailing plaintiff would get reasonable attorney fees and costs (subsection D). Before suing, a plaintiff must give the agency written notice of the alleged violation at least 90 days ahead, so the agency can cure it.

• VAIn committee 2026-01-15Quality assurance · AI policy · +3

  Use of artificial intelligence-based tools; covered artificial intelligence, disclosure of use.

  HB 1294 (Virginia, introduced January 15, 2026) has not been enacted. It was continued to the next session in the Communications, Technology and Innovation Committee. If enacted, it would amend § 19.2-11.14 of the Code of Virginia to regulate law-enforcement use of AI. It defines "covered artificial intelligence" as AI used to aid a criminal investigation, including generating leads, and generative AI used to write or materially aid in writing police reports or other investigation records. The definition lists examples: biometric identification, forensic DNA phenotyping, forensic investigative genetic genealogy, cross-camera tracking, vehicle surveillance including automated license plate readers, anomaly detection, gunshot detection, person-based predictive policing, risk scoring, behavioral analysis, sentiment analysis, convoy analysis, fraud detection, financial transaction analysis, and social network or social media analysis. It excludes administrative tools that do not materially alter investigations, and spelling or grammar checks. Subsection B would require that decisions on pretrial detention or release, prosecution, adjudication, sentencing, probation, parole, correctional supervision, or rehabilitation be made with a human decision-maker involved. AI recommendations would remain open to legal challenge or objection. Subsection C would require officers to disclose any use of covered AI in the official police report, including the AI's name, a description of it, and a brief description of its role, such as generating a lead or identifying a suspect, witness, or victim. After arrest or a summons, the report must go to the attorney for the Commonwealth and to defense counsel, or directly to an unrepresented individual. Covered AI used after arrest must be disclosed as soon as practicable, and no later than 30 calendar days after use. Subsection D would require police reports or records created wholly or partly with generative AI to carry an AI-content disclaimer, identify the AI-generated content where technically feasible, and include the author's certification that they reviewed the report for accuracy. Subsection E would require retaining the first draft for as long as the final report is kept. It would also require the generating program to keep an audit trail identifying who used AI to create or edit the report, changes after the first draft, and any video and audio footage used. Subsections F and G would let the Attorney General bring a civil action for equitable or declaratory relief against a law-enforcement agency. Residents of an agency's jurisdiction could do the same, with attorney fees and costs for a prevailing plaintiff. A private plaintiff must first give the agency written notice at least 90 days before filing suit so that it can cure the violation.

• NJIn committee 2026-10-15AI policy · Privacy & Data Protection · +1

  Concerns automated license plate readers.

  Assembly Bill No. 5637 (New Jersey, 222nd Legislature) was introduced on October 15, 2026 and referred to the Assembly Public Safety and Preparedness Committee. It has not been enacted. If enacted, it would regulate automated license plate readers (ALPRs), defined as devices that photograph or scan vehicles or plates, compare them to a database, and generate new information using artificial intelligence. Federal government ALPRs are excluded. Section 1 would: (b) require law enforcement officers to get a judicial warrant before using or accessing ALPR data, other than an ALPR BOLO alert, when investigating a person or vehicle identified in at least two locations by an ALPR; (c) require automatic, permanent deletion of stored ALPR data within 90 days of collection; (d) have the Attorney General, in consultation with the State Police, designate a State ALPR Coordinator; (e) allow disclosure of ALPR data to out-of-state or federal agencies only under a valid judicial order, judicial warrant, or as federal law requires, with immediate notice to the Coordinator and notice to the affected person within 15 days of disclosure, or within 15 days after a criminal investigation ends if earlier notice would compromise it; (f) preserve discovery sharing, retention beyond 90 days tied to ongoing judicial processes or discovery, and compliance with federal law or court orders; and (g) let the Attorney General issue implementing guidelines. Section 2 would amend section 5 of P.L.2026, c.4 (C.52:4CC-5). It would bar government entities from selling, sharing, or transferring ALPR information except to other government entities when permitted by law, under a judicial order or warrant, with consent, or to another jurisdiction's law enforcement for a criminal investigation. In that last case, the recipient must certify it will not use the data for civil immigration enforcement, will not re-share it, and is bound by the same restrictions. Those agreements would be public records. The Attorney General could cut off agencies that violate the terms. Use of third-party ALPR vendors would not count as sharing if conditions are met. The amendment also removes ALPR information from the existing 90-day notice provision and adds liability: a government entity that knowingly obtains, discloses, or uses covered information for an unpermitted purpose would face injunctive relief and civil damages. Section 3 makes the act effective immediately.

• DCIn committee 2026-10-05AI policy · Health · +1

  Transparency in Downcoding Amendment Act of 2026

  The Transparency in Downcoding Amendment Act of 2026 (B26-0853) was introduced October 5, 2026 and referred to the Committee on Health. It has not been enacted. If enacted, it would amend the Prompt Pay Act of 2002 by adding a new section 5a that bars health insurers from using automated processes, systems, or tools (including artificial intelligence) to downcode claims, from downcoding based solely on the reported diagnosis code, and from using downcoding in a targeted or discriminatory way against physicians who routinely treat patients with complex or chronic conditions. Downcoding is defined as an insurer's unilateral change of an evaluation and management or other service code on a claim that results in lower payment. Under section 5a(b), all downcoding decisions would have to be made by a clinician licensed in the District and of the same specialty as the treating provider, who must perform a documented review of the clinical information. Under 5a(c), insurers would have to notify the physician using CARC and RARC codes and give the specific reason and clinical criteria, the original and revised codes and payments, the reviewing physician's NPI and credentials, and notice of appeal rights. Under 5a(d), insurers must offer a clear appeal process with at least 180 days to file, set adjudication timelines, and allow batch appeals of similar claims. Under 5a(e) and (f), the Commissioner could take enforcement actions for discriminatory patterns (fines, restitution, license suspension), impose penalties up to $50,000 per violation, and order claims reprocessed with interest. The definition of health insurer would also expressly include third-party administrators and other payers adjudicating claims. The act would take effect after Mayoral approval and a 30-day congressional review period (Sec. 4).

• VTIn committee 2026-01-27Enterprise · AI policy · +1

  An act relating to chatbot disclosure requirements

  Vermont H.783, introduced in 2026, has not been enacted. It was read the first time on 2026-01-27 and referred to the Committee on Commerce and Economic Development. If enacted, Sec. 1 would add 9 V.S.A. § 2466e, "Chatbot Disclosure." Under § 2466e(a), no person could engage in a commercial transaction or trade practice with a consumer who is communicating or interacting with a chatbot that may mislead or deceive a reasonable person into believing they are dealing with an actual human, unless the consumer is notified in a clear and conspicuous manner that they are communicating with a chatbot and not a human. This applies whether or not any consumer is actually misled or deceived. Under § 2466e(b), "chatbot" means any artificial intelligence, algorithmic, or automated system that generates information via text, audio, image, or video in a way that simulates interpersonal interactions or conversation. It includes AI agents, avatars, and other computer technology that engages in textual or aural conversations. Under § 2466e(c), a violation is an unfair and deceptive act in commerce in violation of section 2453 of title 9. Sec. 2 would make the act effective July 1, 2026.

• VAIn committee 2026-01-14AI policy · Privacy & Data Protection · +2

  Consumer Data Protection Act; online device pricing, prohibition.

  Virginia SB 615 (2026) was prefiled January 14, 2026, referred to the Committee on General Laws and Technology, and continued to the next session on January 28, 2026 (15-Y 0-N). It has not been enacted. If enacted, it would amend the Consumer Data Protection Act by adding § 59.1-577.2, "Online device pricing; prohibition." Under that section, no controller or processor could, in connection with a consumer transaction, generate a price offered to a consumer through the consumer's online device, in whole or in part, based on (1) the device's hardware or hardware state, (2) the presence or absence of software on the device, or (3) the device's precise geolocation data when used to set a price based on inferences about the consumer. Subsection B would carve out: pricing based on hardware or hardware state for repairs or maintenance or for calculating trade-in value; use of precise geolocation to price based on real-time local demand for products or services provided immediately on request, or on legitimate cost differences between physical locations (including state or local taxes, duties, or fees); and coupons, discounts, rebates, sales, or promotions that are separate from the price, are offered to the general public on the same terms, and do not use the prohibited input data. The bill also amends § 59.1-575 to add definitions, including "coupon," "discount," "hardware state," "online device," and "consumer transaction" (by reference to § 59.1-198). It also amends the definition of "biometric data" to cover only data used to identify a specific individual.

• VTIn committee 2026-01-27Enterprise · Quality assurance · +4

  An act relating to the regulation of chatbots

  Vermont H.784 has not been enacted. It was introduced and referred to the Committee on Commerce and Economic Development on 2026-01-27, and its outcome is listed as committee. If enacted, it would add 9 V.S.A. chapter 118, Subchapter 1 (Chatbots), to regulate chatbot providers, meaning any person who creates, distributes, or makes available a chatbot. Data privacy and security (§ 4193b): Providers could not process personal data beyond input data to inform outputs unless it is necessary for an express user request and the user gives affirmative consent. They could not use chat logs to target or customize advertisements, and could not sell chat logs. They could not process chat logs or personal data of users they know or should know are under 18 without parent or guardian consent, and could not use such users' data for training. For adults, training would require affirmative consent. Providers could not profile users beyond what an express request requires, retain chat logs more than 10 years unless required, retaliate against users who refuse training consent, or tell users their input or chat logs are confidential. Users could access their chat logs in a downloadable, human- and machine-readable format. Public agencies would need a wiretap warrant under 13 V.S.A. chapter 232 to compel production of input data or chat logs. Providers would have to keep a written, publicly posted data security program. Transparency (§ 4193c): Chatbots could not imply their outputs come from or are endorsed by licensed professionals, including health care, legal, accounting, financial, or other Office of Professional Regulation professionals. Providers would have to give clear notice that the user is talking to a chatbot, not a human, before the first output, hourly after that, and whenever the user asks if it is a real person. Providers would have to assess risks of harm monthly and mitigate them, and publish information about their chatbots monthly. Rulemaking (§ 4193d): The Attorney General would adopt rules on the disclosures, risk metrics, and the information to be published. Liability (§ 4193e): A chatbot would be a product for product liability purposes. Providers would owe a duty to ensure their chatbot does not injure users and would be liable for injuries even if they used all reasonable care or did not distribute the chatbot directly to the user. Enforcement (§ 4193f): The Attorney General or a State's Attorney could sue for injunctions, compliance, damages, penalties, restitution, and fees. Violations of § 4193b or § 4193c(a) or (b) would be an injury in fact. Injured users could sue in Superior Court for liquidated damages of $5,000 per violation of § 4193b (or actual damages if greater), and $5,000 in total for violations of § 4193c(a) or (b) (or actual damages if greater). They could also seek punitive damages for reckless and knowing violations, injunctive and declaratory relief, and fees. Sec. 2 would make the act take effect July 1, 2026.

• VTIn committee 2026-01-29AI policy · Safety & Harms

  An act relating to notification of robocalls that use an artificial voice

  Vermont H.829 (2026) has not been enacted; it was referred to the Committee on Energy and Digital Infrastructure on 2026-01-29. If enacted, Sec. 1 would add 9 V.S.A. § 2464f on robocalls that use an artificial voice. It defines "artificial intelligence," "artificial voice" (a voice generated or significantly altered using AI), and "automatic dialing-announcing device." Under subsection (b), a call placed through such a device could be made only after an unrecorded, natural-voice announcement to the person called. That announcement must state the nature of the call and the name, address, and phone number of the business or organization represented, if any. It must also ask whether the person consents to hear the prerecorded message. It must also tell the person if the message uses an artificial voice. Subsection (c) requires the caller to disconnect the device from the line when either party ends the call. Under subsection (d), a violation is a violation of section 2453 of Title 9, and each call is a separate violation. A recipient may sue in Superior Court for damages or a civil penalty, injunctive relief, punitive damages for willful violations, and costs and attorney's fees. The court may award the greater of actual damages or a civil penalty of $500 for a first violation and $1,000 for each later one. Under subsection (e), a knowing and willful violation is punishable by up to 90 days in prison, a fine of up to $1,000 per violation, or both. Subsection (f) directs the Attorney General to work with state and federal entities to identify and enforce against robocallers regardless of the caller's location. Sec. 2 sets an effective date of July 1, 2026.

• VTIn committee 2026-01-30AI policy · Safety & Harms · +1

  An act relating to artificial intelligence and elections

  H.846 is a Vermont bill that has not been enacted. It was introduced in 2026 and referred to the Committee on Government Operations and Military Affairs on 2026-01-30. Only the short-form text is available, so the summary below comes from the bill's statement of purpose and not from detailed statutory language. If enacted, the bill would: (1) define "high-traffic online platform"; (2) require those platforms to block posting of materially deceptive election-related content in Vermont during specified periods before and after an election; (3) require those platforms to label inauthentic, synthetic, or false content during specified periods before and after an election; (4) prohibit a person, committee, or other entity from knowingly distributing an advertisement or other election communication containing materially deceptive content with malice within 120 days before a Vermont election; (5) let a recipient of the content, an elections official, or a candidate or committee in the election file a civil action to enjoin distribution of the deceptive media and seek damages from the distributor; and (6) require a committee that creates, publishes, or distributes a qualified political advertisement to include a specified disclosure when the advertisement was generated or substantially altered using artificial intelligence. The exact periods, definitions, disclosure wording, and penalties are omitted from the short-form text.

• VTIn committee 2026-01-28Enterprise · AI policy · +1

  An act relating to companion chatbots

  Vermont H.804 (2026) has not been enacted. It was introduced and referred to the Committee on Commerce and Economic Development on 2026-01-28. If enacted, it would add 9 V.S.A. chapter 118, Subchapter 1, on companion chatbots, which are AI systems with humanlike, relationship-sustaining conversation. Customer-service, internal business, research and technical-assistance chatbots are excluded. So are limited video game chatbots and simple voice-assistant speakers (§ 4193a). Under § 4193b, an operator of a companion chatbot platform would have to: (a) give a clear notice that the chatbot is artificial and not human when a user could reasonably be misled into thinking it is human; (b) maintain and publish on its website a protocol that keeps the chatbot from producing suicidal ideation, suicide or self-harm content and from ignoring users who express such thoughts, including at minimum a referral to crisis service providers; and (c) for users it knows are minors (17 or younger), disclose immediately that they are talking to AI, remind them at least every 30 minutes to take a break and that the chatbot is not human, and institute a protocol to prevent visual sexually explicit material or direct statements urging the minor to engage in sexually explicit conduct. Under § 4193c, starting one year after the effective date, operators would report annually to the Attorney General on the number of crisis referral notifications and their protocols. The reports could not include user identifiers or personal information, and the Attorney General would post the data online. Under § 4193d, violations would be unfair and deceptive acts under 9 V.S.A. § 2453, and the Attorney General would have rulemaking, civil investigation, civil action and assurance of discontinuance authority as under chapter 63. Sec. 2 sets an effective date of July 1, 2026.

• VAEnacted 2026-03-03Quality assurance · AI policy · +2

  Higher educational institutions; JLARC to study artificial intelligence use policies.

  House Joint Resolution No. 32 (2026), agreed to by the House on February 11, 2026 and the Senate on March 3, 2026, directs the Joint Legislative Audit and Review Commission (JLARC) to study artificial intelligence use policies at Virginia's institutions of higher education. JLARC must survey AI use policies that institutions have adopted or are considering, including policies that apply to only part of an institution. It must evaluate each policy on five points: academic integrity, data privacy, equity and access, transparency, and faculty autonomy and instructional agency. JLARC must also develop a model AI use policy for higher education institutions. It must recommend AI tools, curricula, and other resources for a statewide clearinghouse serving educators, students, and the public. The State Council of Higher Education for Virginia, the Virginia Community College System, and the Virginia Information Technologies Agency provide technical assistance, and all state agencies must help on request. JLARC must finish its meetings by November 30, 2027. The chair must submit an executive summary of findings and recommendations to the Division of Legislative Automated Systems by the first day of the 2028 Regular Session. The summary must state whether JLARC intends to submit a full report for publication as a House or Senate document. The resolution is a study directive and does not impose requirements on institutions.

• VAIn committee 2026-01-13Enterprise · Quality assurance · +3

  Artificial Intelligence Chatbots Act; established, prohibited practices, penalties.

  HB 635 (Virginia, 2026) was not enacted; it was continued to the next session in the House Committee on Communications, Technology and Innovation. This text is the committee's proposed substitute. If enacted, it would create the Artificial Intelligence Chatbots Act (new Chapter 60, §§ 59.1-614 through 59.1-620, Title 59.1) and take effect January 1, 2027. Section 59.1-614 defines terms, including "companion chatbot." That term means a generative AI system that simulates a sustained human-like relationship by retaining prior interactions, asking unprompted questions, or sustaining personal dialogue. Customer-service, internal-productivity, and limited video-game bots are excluded. Under § 59.1-615, operators could not make a companion chatbot available to a minor (under 18) if it can encourage self-harm, violence, drug or alcohol use, or disordered eating. They also could not offer it to a minor if it can provide unsupervised mental health therapy, engage in sexually explicit interactions, encourage secrecy or isolation, put validating the minor ahead of safety, or optimize engagement over its safety guardrails. Operators must use commercially reasonable age-screening methods. Before 2027 a user counts as a minor only if the operator has actual knowledge. From January 1, 2027 the standard is whether the operator has reasonably determined the user is not a minor. Section 59.1-616 requires a persistent disclosure that the chatbot is not human. It also requires pop-up notices at login, every 90 minutes, and on request. It bars implying that output comes from a licensed professional. Section 59.1-617 requires a protocol to detect suicidal ideation or self-harm and refer users to crisis services such as the 988 hotline. Section 59.1-618 bars training on a minor's inputs without written parent or guardian consent. Section 59.1-619 requires an incident-reporting mechanism with a public anonymized catalog, publication of safety test findings, and semiannual public reports. Under § 59.1-620 and the new subdivision 88 of § 59.1-200, violations are prohibited practices enforceable under the Virginia Consumer Protection Act.

• TXIn committee 2025-03-06Enterprise · AI policy · +3

  Relating to digital replication rights in the voice and visual likeness of individuals; providing private causes of action; authorizing a fee.

  Texas H.B. 3950 (89th Legislature, filed by Rep. Hunter) has not been enacted; it was referred to the House Judiciary & Civil Jurisprudence Committee on 2025-03-27. If enacted, it would add Title 14A and Chapter 651 to the Business & Commerce Code to create a "digital replication right" in a person's voice and visual likeness. A "digital replica" is a newly created, computer-generated, highly realistic and readily identifiable representation of an individual's voice or likeness. It covers a work the person never performed in, or a version of one whose fundamental character was materially altered (Sec. 651.001). The chapter applies to Texas residents and people who were residents when they died (Sec. 651.002). The right is a property right. It can be licensed but not assigned during the individual's life (Sec. 651.051). After death it continues for 10 years. It can be renewed for 5-year periods on a showing of active, authorized public use. It ends no later than 70 years after death (Sec. 651.052). Renewal requires a filing with the secretary of state, which keeps a public directory and may charge a fee to cover its costs (Secs. 651.151, 651.152). Without the right holder's written consent, a person may not produce or publish, distribute or otherwise make available a digital replica (Sec. 651.053). Exceptions cover bona fide news, documentary or biographical uses, commentary, satire and parody, fleeting uses, and related ads. The exceptions do not apply to depictions of sexual conduct (Sec. 651.054). Lifetime licenses are limited to 10 years and must be in writing with a reasonably specific description of the intended uses (Sec. 651.055). Licenses for minors are limited to the earlier of 5 years or age 18. They need a signature from the parents or guardians and court approval (Sec. 651.056). Collective bargaining agreements that address digital replicas override those limits (Sec. 651.057). Online service providers must designate an agent to receive notices of alleged violations. On receiving a compliant notice they must remove or disable access to the material, and they must notify the third party who supplied it (Secs. 651.101, 651.102). Knowingly submitting a false or deceptive notice is prohibited (Sec. 651.103). Makers and distributors of products or services are liable only if the product is primarily designed to make unauthorized replicas, has limited other commercial use, or is marketed for that purpose (Sec. 651.104). Eligible plaintiffs may seek injunctive or other equitable relief (Secs. 651.201, 651.202). They may also sue anyone who knowingly violates Sec. 651.053. A provider that ignores a notice is presumed to have acted knowingly. A disclaimer or AI disclosure is not a defense. Statutory damages are $5,000 per work for an individual violator, $5,000 per violation for an online service provider, and $25,000 per work for other entities. Plaintiffs may instead recover actual damages plus profits, and punitive damages are available for willful violations. A provider with an objectively reasonable belief that the material was not a digital replica faces a $1 million cap on statutory or actual damages. Suits must be filed within 3 years of discovery (Sec. 651.203). The prevailing party recovers attorney's fees. A prevailing defendant recovers them only if the action was not brought in good faith (Sec. 651.204). A person who files a false notice owes the greater of $5,000 or actual damages, plus costs and fees (Sec. 651.205). Existing contracts and testamentary instruments prevail over conflicting provisions of the chapter (SECTION 2). Subchapter E applies only to conduct on or after the effective date (SECTION 3). The effective date would be September 1, 2025 (SECTION 4).

• TXEngrossed 2025-04-22Enterprise · AI policy · +3

  Relating to digital replication rights in the voice and visual likeness of individuals; providing private causes of action; authorizing a fee.

  Texas S.B. 1960 has not been enacted. It passed the Senate and was engrossed, then was left pending in the House Judiciary & Civil Jurisprudence Committee after a public hearing on 2025-05-21. If enacted, it would add Title 14A, Chapter 651 to the Business & Commerce Code. The chapter would create a "digital replication right" in a person's voice and visual likeness. It would cover AI-style "digital replicas", which are newly created, highly realistic, computer-generated representations of an individual. The bill would apply only to Texas residents, or to people who were Texas residents when they died (Sec. 651.002). **The right.** Under Sec. 651.051, the right is a property right. It can be licensed, but it cannot be assigned during the individual's life. Under Sec. 651.052, it survives death. It is exclusive to the right holder for 10 years after death. It can then be renewed in 5-year periods if the right holder shows active, authorized public use during the 2 years before each period ends. It ends no later than 70 years after death. Renewal is only effective if the right holder files a notice with the secretary of state (Sec. 651.151). The secretary of state would keep a public directory of registered rights and could charge a fee to cover its administration (Sec. 651.152). **Prohibited conduct.** Sec. 651.053 would bar anyone from producing a digital replica without the right holder's written consent. It would also bar publishing, distributing or otherwise making a replica available to the public without that consent. Sec. 651.054 lists permitted uses without consent: bona fide news and sports, documentary or historical works, commentary, satire and parody, and fleeting or negligible uses. These exceptions do not apply to replicas depicting sexual conduct. Sec. 651.104 says makers and distributors of tools that can produce replicas do not violate Sec. 651.053 unless a tool is primarily designed for, or marketed for, unauthorized replicas, or has limited commercially significant use beyond them. **Licensing.** Under Sec. 651.055, a lifetime license must be in writing and signed, describe the intended uses, and last no more than 10 years. Under Sec. 651.056, a minor's license must be signed by a parent or guardian and approved by a court. It can last no more than 5 years or until age 18, whichever is earlier. Sec. 651.057 exempts licenses governed by collective bargaining agreements that address digital replicas. **Online service providers.** Under Sec. 651.101, providers must designate an agent to receive notices of alleged violations and post the agent's contact information. Under Sec. 651.102, on receiving a compliant notice, a provider must remove or disable access to the material as soon as technically and practically feasible. Sec. 651.103 prohibits false or deceptive takedown notices. **Enforcement.** Eligible plaintiffs may seek injunctive or other equitable relief (Sec. 651.202). They may also sue for knowing violations (Sec. 651.203). Damages would be the greater of statutory damages or actual damages plus profits: - $5,000 per work for an individual violator. - $5,000 per violation for an online service provider. - $25,000 per work for any other entity. Punitive damages are available for willful violations. A provider with an objectively reasonable belief that the material is not a digital replica has damages capped at $1 million. A disclaimer is not a defense. The limitations period is 3 years from discovery. The prevailing plaintiff gets attorney's fees (Sec. 651.204). A prevailing defendant gets fees only if the action was not brought in good faith. A false takedown notice carries liability of at least $5,000 (Sec. 651.205). **Effective date.** Contracts and wills made before the Act's effective date would prevail over the chapter if they conflict (SECTION 2). Subchapter E applies only to conduct on or after the effective date (SECTION 3). The Act would take effect September 1, 2025 (SECTION 4).

• TXIn committee 2025-01-24AI policy · Privacy & Data Protection · +2

  Relating to the use of automatic license plate reader systems.

  Texas H.B. 2083 (filed 2025, referred to committee, not enacted) would add Chapter 732 to the Transportation Code to regulate government use of automatic license plate reader (ALPR) systems. Under Sec. 732.002, governmental entities could not operate ALPRs or use captured plate data except as allowed by Sec. 732.003. Permitted purposes: detecting or investigating felonies, identifying unregistered or uninsured vehicles, missing-person investigations, stolen vehicle recovery, toll collection or parking enforcement, and controlling access to secured areas. Sec. 732.003(b) would bar targeting individuals by race, ethnicity or income in unregistered/uninsured vehicle enforcement. It would also bar sharing, selling or otherwise providing data to non-governmental persons, to governmental entities for unauthorized purposes, or to the federal government. Contractors could access data only if the contract specifically authorizes it. Governmental entities or criminal defendants could seek a court order requiring retention and disclosure on a probable-cause showing tied to a felony investigation or missing person. Sec. 732.004 would allow comparison with listed databases (e.g., Texas DMV, TCIC/NCIC, NCMEC, FBI), which must be current. Sec. 732.005 would require destroying data within 48 hours unless it is evidence in a pending criminal action, subject to a preservation request, a court order, or a warrant. Preservation requests would require data to be held for at least seven days, with specified contents and a sworn statement that a court order will be sought. Sec. 732.006 would require entities to adopt and post rules on data minimization and security. Sec. 732.007 would require annual reports to the Department of Public Safety. Sec. 732.008 would make captured plate data confidential and exempt from Chapter 552, Government Code, and inadmissible if released in violation (except exculpatory evidence in criminal proceedings). It would also restrict disclosure when a protective order is presented. Sec. 732.009 would create a civil action with actual damages or $1,000 statutory damages plus costs and attorney's fees, and waive governmental immunity. Section 2 limits the civil action to causes of action accruing on or after the effective date. Section 3 sets an effective date of September 1, 2025.

• UTEnacted 2026-03-23Enterprise · AI policy · +1

  Autonomous Systems Amendments

  Utah S.B. 292 (Autonomous Systems Amendments) became law after the governor signed it on 2026-03-23. It takes effect May 6, 2026 (Section 11). The law changes how liability works for automated driving systems (ADS) and the vehicles that use them. Definitions: Section 1 amends Section 41-26-102.1. It adds "ADS-equipped vehicle" and adds conformity to federal motor vehicle safety, bumper, and theft prevention standards to the ADS-dedicated vehicle and ADS definitions. It replaces the state's own level three, four, and five ADS definitions with references to SAE J3016_202104 (April 2021 edition). It also adds a "level two DAS" definition. Section 2 amends 41-26-104 so the ADS is responsible for compliant operation of an ADS-equipped vehicle, not just an ADS-dedicated vehicle, while the ADS is engaged. Damages caps (78B-4-902): In actions involving ADS-equipped or ADS-dedicated vehicles, noneconomic loss awards may not exceed $1,000,000. The cap does not apply to wrongful death claims. Punitive damages may not be awarded in actions involving level four or five ADS. Driverless operation liability (78B-4-903): This section covers incidents involving level four or five ADS operation while the ADS is engaged and performing the entire dynamic driving task. - A person who suffers injury or property damage directly caused by such a vehicle has a right of action against the registered owner, or against a person who dispatched the vehicle into driverless operation. That includes a dispatcher or an on-demand autonomous vehicle network. - The plaintiff must show by a preponderance of the evidence that the ADS was engaged and was a proximate cause of the harm. The plaintiff does not have to prove negligence, breach of duty, or product defect. - Total recovery, including damages, costs, and fees, is capped at $100,000. - A recovery under this section is the exclusive civil remedy for that injury or damage. - Liability may be reduced in proportion to the negligence, recklessness, or breach of duty of the claimant or a third party. Manufacturers and developers (78B-4-904): Manufacturers and developers of level four or five ADS are not liable in negligence for harm arising from operation while the ADS is engaged. They may be held liable only under 78B-4-903 or the Utah Product Liability Act (Chapter 6, Part 7). Negligence claims about design, development, testing, manufacture, or deployment are treated as product liability claims. Liability of other persons and comparative fault under 78B-5-818 are unaffected. Product liability changes: - Section 8 amends 78B-6-702 to add definitions, including "state of the art knowledge". - Section 9 amends 78B-6-703. For level four or five ADS, a plaintiff must prove two things by a preponderance of the evidence before the system can be considered defective. First, a reasonable and feasible alternative design existed. Second, using the ADS at scale and in the aggregate causes more injuries than humans doing a similar task would. - Section 9 also creates a rebuttable presumption that a level four or five ADS is free of defects if it meets applicable federal standards and was authorized for use in the state. - Section 10 enacts 78B-6-708, an affirmative defense. Liability for defective design, manufacture, or failure to warn is precluded if the manufacturer or developer complied with state of the art knowledge at the time of manufacture, or if the deployed ADS reduces injuries in the aggregate compared with humans doing the same activity. Sunset: Section 3 amends 63I-1-278 to repeal on July 1, 2030 the new Title 78B, Chapter 4, Part 9, along with the new ADS definitions in 78B-6-702, Subsections 78B-6-703(3) and (4), and Section 78B-6-708. This provides the required sunset review.

• TXEnacted 2025-06-20AI policy · Privacy & Data Protection · +1

  Relating to financial exploitation or financial abuse using artificially generated media or phishing communications; providing a civil penalty; creating a criminal offense.

  Texas S.B. 2373 became law and took effect September 1, 2025. It adds Chapter 100B to the Civil Practice and Remedies Code and Section 32.56 to the Penal Code to address financial exploitation using artificially generated media or phishing communications. Section 100B.001 defines "artificial intelligence," "artificially generated media" (media created or modified with AI or other software with intent to deceive), "financial exploitation" (as defined in Finance Code Section 281.001), and "phishing communication." Section 100B.002 makes a person liable for damages for knowingly or intentionally disseminating such media or phishing communications for the purpose of financial exploitation. A prevailing claimant gets actual damages, including mental anguish and the defendant's attributable profits, plus court costs and reasonable attorney's fees. Courts may issue temporary restraining orders and temporary or permanent injunctions. Section 100B.003 allows the attorney general to sue for a civil penalty of up to $1,000 per day of dissemination, in a Travis County district court or a county where the events occurred. Section 100B.004 lets the person who is the subject of an action under 100B.002 or 100B.003 use a confidential identity (a pseudonym with no other identifying information). It limits who may know the true identity and requires contempt for violating a nondisclosure order. Penal Code Section 32.56 makes it an offense to knowingly engage in financial abuse (as defined in Section 32.55) through disseminated artificially generated media, or by deceiving or manipulating someone into giving personal, financial, or identifying information electronically. Penalties scale with the value of the property involved, from a Class B misdemeanor (under $100) up to a first-degree felony ($150,000 or more). Sections 100B.002(d), 100B.003(c), and 32.56(d) protect interactive computer service providers, telecommunications services, and FCC-licensed radio or television stations from liability for content provided by others. Under Section 3, Section 100B.002 applies only to causes of action that accrue on or after the effective date.

• PAIn committee 2026-10-05Enterprise · Quality assurance · +3

  Providing for automated license plate reader systems; imposing duties on the Pennsylvania State Police; and imposing penalties.

  Pennsylvania House Bill 2825 (2026) has not been enacted. It was referred to the House Judiciary Committee on 2026-10-05. If enacted, it would add Chapter 75 to Title 44 to regulate automated license plate reader (ALPR) systems used by local police, campus police and the Pennsylvania State Police. Contracts (§ 7503): Agency–vendor ALPR contracts would have to require vendor compliance. They would make ALPR and audit trail data the agency's exclusive property. They would require 60 days' notice before any transaction giving a foreign adversary an ownership or controlling interest in the vendor, and let the agency terminate without penalty if that happens. They would require the vendor to purge data after the retention period and cooperate with audits. Vendor limits (§ 7504): Vendors could not share data with third parties without written authorization in the contract. They could not sell or license data. They could not add facial, gait, biometric or cell-device tracking. They could not give data to a foreign adversary. They could not use data commercially. Section 7504(b)(5) would bar using ALPR data, directly or indirectly, to train, develop, test, validate or improve AI, machine learning, behavioral prediction or consumer profiling systems. Vendors would act only as custodians. Retention (§ 7504(d)): Agencies must purge data within six months, unless it is preserved as evidence in a criminal case, a pending or reasonably anticipated civil action, or as otherwise provided by law. Audits (§ 7505): Agencies would audit compliance annually, or hire an independent entity to do so. They would submit results to State Police within 30 days. State Police could audit agencies and vendors. Noncompliance would have to be remedied promptly. Vendor access (§ 7506): Vendor maintenance access would require express agency authorization, be time-limited, and be recorded in an audit trail. Permanent or continuous remote access would be barred. Police use (§ 7507): Use would be limited to official law enforcement or public safety purposes. A search warrant would be required for sustained monitoring of a person's or vehicle's movements, or for reconstructing patterns across multiple days and locations. Exceptions would cover alert verification and locating stolen, wanted or missing-person-related vehicles. Personal, political or commercial use would be prohibited. Users would have to document each query. Sharing, including with federal agencies, would have to be logged. Agencies would have to publish notice 30 days before deploying a system. Good-faith users would get immunity from civil liability and administrative discipline. Security (§ 7508): Data would have to be stored in the U.S., follow FBI CJIS and CLEAN requirements, and be encrypted. Vendors would have to notify agencies immediately of security incidents. State Police would issue regulations. Audit trails would be kept at least five years. Records (§ 7509): ALPR data and audit records would be exempt from the Right-to-Know Law. Enforcement (§ 7510): The Attorney General could sue vendors or authorized users who willfully violate the chapter. Courts could issue injunctions, order data destroyed, impose civil penalties up to $25,000 per violation, and award costs. The act would apply to contracts entered into on or after its effective date (Section 2) and would take effect in 60 days (Section 3).

• PAIn committee 2025-04-03AI policy · Public Sector Use · +1

  In operation of vehicles, providing for automated license plate reader systems.

  Pennsylvania House Bill 1125 (2025) has not been enacted. It was referred to the House Transportation Committee on April 3, 2025. If enacted, it would add a new Chapter 32 to Title 75 (Vehicles) on automated license plate reader systems. The stated purpose (§ 3201) is a permit system for these readers on trafficways. Section 3202 defines the readers as mobile cameras combined with algorithms that convert images of registration plates and vehicles into computer-readable data for law enforcement and public safety. Devices used solely for traffic violations or tolling are excluded. Under § 3203, the Department of Transportation would have the power and duty to permit installations and would have to set up a permitting process. The department would: (1) require breakaway poles where there are no physical barriers; (2) allow non-breakaway poles behind a physical barrier; (3) allow poles up to 15 feet from the edge of the nearest travel lane or fog line without a curb or barrier; (4) allow attachment to existing infrastructure with approval from the authority that has jurisdiction or ownership; (5) allow third parties to apply for law enforcement agencies with a signed letter of authorization; and (6) use a single permit for multiple locations within the same political subdivision. Section 3203(c) sets a 30-day review period for applications. The act would take effect 30 days after enactment (Section 2). The bill contains no privacy, data-retention, or use restrictions on the collected plate data.

← Back to the dashboard