State AI Laws Are Emerging: What US Businesses Need to Know

Artificial intelligence (AI) is becoming part of everyday business operations, from recruitment and customer service to fraud detection and marketing. As organizations embed AI into more processes, the rules governing its use are developing quickly.

The US does not have one comprehensive federal AI law, but that does not mean AI is unregulated. Across the country, states are initiating their own AI legislation and regulatory requirements. Lawmakers in all 50 states introduced over 1,200 AI bills in 2025 (passing 145 into law), and by mid-2026, over 80 additional new AI laws were enacted across 27 states.

For organizations operating across state lines, the practical question is no longer whether AI is regulated. It is which rules apply to each use of AI and whether the organization can demonstrate appropriate oversight.

Although state laws differ, they create several recurring areas of business exposure:

• Discrimination and bias: Businesses may be responsible for unfair outcomes when AI influences employment, housing, education, healthcare, insurance, or financial decisions.
• Consumer transparency: Organizations may need to disclose when they are interacting with AI or when an automated system influences an important decision.
• Human oversight: Businesses may need a person to review, explain, or reconsider certain automated decisions.
• Vendor accountability: Businesses using a third-party AI tool may need supplier documentation, which can include: describing its intended uses, the categories of data used to train it, known limitations, and instructions for appropriate use and human review. The documents required depend on the law and the tool’s use; buying the tool does not transfer the business’s own responsibilities to its supplier.

The same AI system may therefore face different obligations depending on its purpose and the location of the affected employee, applicant, or client. The following examples focus on requirements with practical implications for businesses. They are not a complete inventory; the NCSL Artificial Intelligence Legislation Database provides broader state-by-state tracking.

A clear pattern is emerging across state AI legislation: When technology is used to help make healthcare coverage or prior-authorization decisions, states are generally holding users accountable or requiring human review.

Alabama, Arizona, Georgia, Iowa, Maryland, Nebraska, and Washington have all passed laws that place limits on automated decision-making in healthcare or health insurance. The details vary, but the direction is similar. AI can support review processes, but it should not independently determine whether medically necessary care is denied, delayed or changed.

Alabama

Alabama’s SB 63, effective October 1, 2026, applies to health insurers using AI in coverage decisions. Insurers cannot rely exclusively on AI to deny or reduce coverage, and a qualified healthcare professional must make the adverse decision. The law also introduces requirements around disclosure and oversight of how the technology is used.

For insurers, this means being able to show where AI sits in the process, when a person takes over, and who is responsible for the final decision.

Arizona

Arizona has taken a similar approach, with HB 2175, but places the responsibility specifically on the medical director. From July 1, 2026, a medical director must individually review certain claim and prior-authorization denials based on medical necessity, and exercise independent medical judgment. The reviewer cannot simply accept an automated or other recommendation as the answer.

The practical issue for insurers is the handoff between an automated recommendation and the person making the decision. Records should make that distinction clear.

Georgia

Georgia’s SB 444 takes effect on January 1, 2027. AI can still be used in utilization review, including to automate tasks and support decision-making, but it cannot issue an adverse determination until the required human review has taken place. Where a clinical peer is involved, the technology cannot override that person’s judgment.

That puts the emphasis on workflow design. An organization should be able to demonstrate that the system cannot bypass the clinical review required before an adverse decision is released.

Iowa

Iowa HF 2635 also allows AI to assist with the initial review of prior-authorization requests. However, an AI-based system cannot be the sole basis for denying, delaying, or downgrading a request involving medical necessity.

Organizations using automated screening therefore need a clear route for cases to move from the system to the appropriate human reviewer.

Maryland

Maryland’s requirements go further than simply requiring human involvement. HB 820 applies to carriers, pharmacy benefit managers, and private review agents using AI, algorithms or other software in utilization review.

The technology must take the individual patient’s clinical circumstances into account rather than relying solely on group data, and it cannot replace the role of the healthcare professional in the determination process. The law also addresses discrimination and the accuracy and reliability of the tools being used.

For businesses, that makes ongoing oversight just as important as the original implementation. It is not enough to put a human at the end of the process if the system feeding that decision is not being appropriately monitored.

Nebraska

Nebraska LB 77 prevents an AI-based algorithm from being the sole basis for denying, delaying, or modifying healthcare services because of medical necessity. It also requires organizations to disclose when AI is being used in utilization review and gives regulators the ability to audit automated utilization-management systems.

That creates a stronger documentation requirement. Health carriers need to be prepared not only to explain a particular decision, but also to show regulators how the underlying system is being used.

Washington

Washington SB 5395 follows much the same principle. AI cannot be the sole means of denying, delaying, or modifying care, and a licensed professional must consider the patient’s individual clinical circumstances when making a medical-necessity decision. The law also sets expectations around how AI systems use clinical information and how they are assessed for discrimination.

Across these states, the common business question is therefore straightforward: Can the organization show where automated analysis ends and accountable human judgment begins?

For organizations already using management systems, ISO 42001 can provide a framework for defining AI roles, risks, controls, and oversight. ISO 27001 and ISO 9001 may also support related information-security, documented-information, and quality processes.

Connecticut and Illinois have focused specifically on how employers use AI when making decisions about people.

In both states, the issue is not simply whether an employer owns an AI tool. Recruitment platforms, HR software, and other third-party products can also bring automated decision-making into the employment process.

Connecticut

Connecticut is introducing more detailed requirements around automated employment decision technology. From October 1, 2027, Artificial Intelligence Responsibility and Transparency Act, enacted as Public Act 26-15, covered employers using these systems to make or substantially influence employment decisions must provide information to affected applicants or employees before the decision is made, including that the technology is being used and the purpose it serves.

The state is also requiring certain employers to disclose whether AI or another technological change contributed to particular mass layoffs from October 1, 2026.

For businesses operating across states, a shared inventory of employment-related AI is becoming increasingly useful. HR, legal, procurement, and IT need a common view of which systems are being used, what they influence, and what information is available from the supplier.

Illinois

Illinois Public Act 103-0804 took effect on January 1, 2026. It applies to AI used in areas including recruitment, hiring, promotion, training, discipline, and termination. Employers cannot use AI in a way that results in unlawful discrimination, and employees must receive notice when AI is being used for covered employment purposes. The law also restricts the use of ZIP codes as proxies for protected characteristics.

For employers, that means understanding what is happening inside the tools already being used by HR teams. A recruitment platform may contain automated scoring or recommendations even if the organization does not think of itself as having implemented an “AI system.”

Maine and Utah have both introduced requirements aimed at making it clearer when consumers are dealing with AI rather than a person.

Maine

Maine’s Public Law 2025, Chapter 294 focuses on AI chatbots used in trade or commerce. A business cannot use a chatbot in a way that could mislead a reasonable consumer into believing they are communicating with a human unless the consumer is told that they are not. A breach can fall under the state’s unfair trade practices framework.

This is less about putting a disclaimer somewhere in the terms and conditions, and more about the experience the customer actually has. Chatbot introductions, names, avatars, and wording should not give a misleading impression about who — or what — is responding.

Utah

Utah’s SB 226 also deals with transparency, but its requirements depend on the type of interaction.

For general consumer transactions, businesses using generative AI must disclose its use when a consumer clearly asks whether they are interacting with AI. Regulated professionals face stronger requirements for certain high-risk interactions, where disclosure must take place before the interaction begins.

The law also makes clear that using generative AI does not remove the business’s responsibility for conduct that would otherwise breach consumer-protection law.

For customer-facing AI, businesses should therefore decide in advance where disclosures are needed, how they will appear, and who takes over when a conversation needs human involvement.

California, Colorado, and Texas have taken a wider approach, covering automated systems used in significant decisions rather than limiting requirements to one sector.

California

California’s updated privacy regulations cover automated decision-making technology alongside risk assessments and cybersecurity audits. The rules from the California Privacy Protection Agency took effect on January 1, 2026, with requirements applying on a phased basis. They introduce consumer rights around certain uses of automated decision-making, including access and opt-out rights.

For businesses covered by California privacy law, this makes it important to know which systems influence significant decisions, what personal information they use, and whether the organization needs to provide notices or additional consumer controls.

Colorado

Colorado’s Automated Decision-Making Technology Act applies from January 1, 2027 and covers systems used to materially influence consequential decisions in areas including employment, education, housing, lending, insurance, and healthcare.

It also splits responsibilities between the company building the technology and the company using it. Developers must provide information about matters such as intended use, training-data categories, and known limitations, while businesses deploying covered technology have obligations around consumer notices and certain adverse decisions. Consumers can also request correction of inaccurate personal data and meaningful human review in specified circumstances.

This makes supplier management a central part of AI governance. A business may depend on its technology provider for information it needs to meet its own obligations, so those responsibilities should be understood before the system is put into use.

Texas: Broader AI rules alongside healthcare restrictions

Texas is slightly different because it has introduced both a broader AI framework and more targeted healthcare requirements.

The Texas Responsible Artificial Intelligence Governance Act, or TRAIGA, took effect on January 1, 2026. It establishes statewide rules for certain development and deployment of AI, including provisions dealing with unlawful discrimination and biometric information.

Texas has separately restricted the use of automated decision systems in health-insurance utilization review. Under SB 815, an automated decision system cannot make an adverse determination, wholly or partly, although AI can still be used for administrative support and fraud detection.

Another law, SB 1188, addresses specified uses of AI for diagnostic purposes and requires the healthcare practitioner using the technology to remain responsible for the clinical use of the system.

For businesses operating in Texas, it therefore makes more sense to look at AI by use case rather than apply one policy to everything. A biometric system, employment tool, customer-facing chatbot and healthcare decision system can create very different obligations.

Not every state law fits into one of the larger trends. Several states have targeted much narrower business issues.

Arkansas: Ownership of AI-generated work

Arkansas Act 927 deals with ownership of content and models created using generative AI. Subject to intellectual-property rights and contractual arrangements, the person providing the prompt generally owns generated content, while a person supplying data or input for model training can own the resulting trained model. The law also addresses work created by employees as part of their employment duties.

For businesses, this makes AI ownership a contract and policy issue as much as a technology issue. Employment, contractor, and supplier agreements should make clear what can be created using AI and who owns the result.

Montana: AI and critical infrastructure

Montana’s Right to Compute Act (SB 212) includes specific requirements for critical infrastructure controlled in whole or in part by AI.

Operators must be able to disable AI control and return to human control within a reasonable period, with risk-management, fallback, and continuity arrangements forming part of the approach. Montana law also calls for the AI risk-management policy to consider recognized frameworks and standards.

That is particularly relevant to organizations in areas such as energy, utilities, manufacturing, and other critical infrastructure, where AI governance is directly connected to operational resilience.

New York: Frontier AI developers

New York’s RAISE Act is aimed at large developers of powerful frontier AI models rather than the typical business using commercially available AI software.

Covered developers face requirements around safety and security frameworks, transparency and reporting of serious incidents.

For most organizations buying standard AI tools, the direct impact is therefore likely to be limited. Businesses developing or substantially modifying frontier models need to look much more closely at whether they fall within the law’s scope.

Oregon: How healthcare AI is presented

Oregon has addressed a much narrower issue: AI systems presenting themselves using protected nursing titles.

HB 2748 prohibits nonhuman entities, including AI agents, from using specified nursing titles and abbreviations.

Healthcare providers and technology companies offering patient-facing AI should therefore check product names, chatbot introductions, interfaces, and marketing material to make sure automated services are not presented as licensed nursing professionals.

The FRONTIER Act (Frontier Risk Oversight, National Transparency, Independent Evaluation, and Reporting Act), introduced in July 2026, is a bipartisan proposal aimed at the largest developers of advanced AI models. It would establish national risk-management, evaluation and reporting requirements, but it is not current law.

Businesses should not assume that one federal law will soon replace state requirements. In the near term, targeted federal proposals and sector-specific rules are likely to develop alongside state laws. A business that waits for national uniformity may be unprepared for obligations that already apply.

Not every law will apply to every organization. Businesses can focus their resources by building a repeatable process that identifies applicable requirements and produces evidence of oversight:

• Maintain an AI inventory so the business knows which tools are in use, their purpose, their users, and the people affected.
• Classify higher-risk uses so systems involved in employment, housing, finance, insurance, healthcare, or other consequential decisions receive greater scrutiny.
• Assess risks before deployment to identify potential discrimination, privacy, security, accuracy, and safety concerns early enough to address them.
• Assign accountable owners so notices, human review, incident response, and corrective actions do not fall between teams.
• Monitor performance and outcomes to detect model drift, adverse impacts, or uses that have moved beyond their approved purpose.
• Retain appropriate records to demonstrate how systems were evaluated, approved, and monitored.

Using ISO 42001 to support AI governance

ISO 42001 is an international management system standard for AI. It is not a substitute for legal advice, does not replace applicable laws, and does not guarantee compliance. It can, however, give organizations a repeatable approach for assigning responsibilities, assessing AI risks, setting controls, monitoring performance, and improving governance over time.

That consistency can be especially useful for businesses operating across multiple states. Instead of building an entirely separate program for each new law, an organization can maintain one core AI management system and adapt specific controls where state or sector requirements differ.

Want to strengthen your AI governance or prepare for ISO 42001 certification? Learn more and register your interest.