AI Legislation

Overview

Artificial intelligence (AI) is reshaping how businesses operate, how health care is delivered, and how employees are managed, and state legislatures are racing to keep pace.

In the absence of a federal framework, states have enacted AI legislation reflecting sharply different priorities: some have focused on broad consumer transparency, requiring businesses to disclose when automated decision-making affects people's lives, while others have targeted specific sectors such as health care coverage decisions and employment practices. For businesses operating across state lines, the result is a patchwork of disclosure requirements, bias prohibitions, sector-specific mandates, and compliance deadlines that can vary by jurisdiction and change without warning.

Epstein Becker Green monitors this landscape continuously, organizing enacted state AI legislation across three policy domains: omnibus consumer and transparency laws, health care and life sciences regulations, and employment and workforce mandates. The goal is straightforward: to help clients understand not only which laws exist today, but also which obligations may already apply to their operations.

The AI Enacted Laws Map was developed by Eleanor Chung, Jean-Claude Velasquez, and Julia Thayer, with research and drafting support from Robyn Rebollo and Alicia Madeiros (Research & Knowledge Services).

The State-by-State AI Law Landscape

The interactive map below tracks all enacted state AI legislation across the three policy domains and is updated as new laws are signed. Click any highlighted state to read bill summaries, passage dates, and links to Epstein Becker Green analysis.

How the Map Organizes AI Legislation

State AI legislation does not fit neatly into a single regulatory bucket. Epstein Becker Green organizes enacted bills into three categories that reflect the primary policy domains where AI regulation is taking hold:

Omnibus

Omnibus AI statutes take a broad approach, imposing transparency, disclosure, risk assessment, and accountability requirements that apply across industries and use cases. These laws often require businesses to notify consumers when AI or automated decision-making is involved in consequential decisions, mandate documentation of training data and model behavior, and establish liability frameworks for AI-caused harms.

Health Care & Life Sciences

Health care has emerged as one of the most active arenas for AI regulation, driven by concern that automated systems could influence clinical and coverage decisions without adequate human oversight. Enacted laws in this category address prior authorization processes, prohibiting AI from serving as the sole basis for coverage denials; AI-generated patient communications, requiring disclosure and human access; and the use of AI in clinical settings, including standards for algorithmic transparency and non-discrimination.

Employment, Labor & Workforce

A growing body of state law governs how employers may use AI in hiring, performance evaluation, and workforce management. These laws typically require advance disclosure to applicants and employees when automated decision-making tools are used, prohibit the use of AI in ways that produce discriminatory outcomes under existing civil rights frameworks, and, in some states, impose auditing and reporting requirements on employers.

Frequently Asked Questions About AI Legislation

The following questions and answers are provided for general informational purposes only and do not constitute legal advice. Laws vary by jurisdiction and are subject to change.

Does federal law preempt state AI laws?

Not in any comprehensive way. Congress has not enacted a general federal AI law, so there is no overarching framework to preempt the growing body of state regulation. Some narrow federal laws address AI-adjacent issues, but they do not preempt state AI statutes. Until Congress acts, businesses must comply with each applicable state's requirements independently, even where those requirements conflict or overlap.

Do these laws apply to my business if we just use AI tools rather than build them?

In most cases, yes. The majority of state AI laws impose obligations on businesses that deploy or use AI in their operations, not just on the companies that develop the underlying technology. If your business uses an AI tool to screen job applicants, generate patient communications, make coverage decisions, or interact with consumers, you may already have disclosure, documentation, or human-oversight obligations under the laws of the states where you operate. The fact that a third party built the tool does not transfer your compliance responsibility.

Which states have the most AI laws?

California, Utah, Colorado, New York, Texas, and Illinois have enacted the most AI-related bills. California leads by volume, with laws spanning frontier areas such as model transparency, health care communications, and AI liability. Utah has built a layered consumer disclosure framework across multiple sessions. Colorado's AI Act imposes risk-based obligations on developers and deployers. Illinois was among the earliest movers, passing the first U.S. law regulating the use of AI in job interviews in 2019.

What triggers a disclosure obligation under state AI law?

Most state AI disclosure obligations require businesses to notify the individuals their AI systems affect, such as consumers, job applicants, employees, or patients. What triggers that obligation varies by state and context: some laws focus on consumer-facing interactions where a person may not realize they are engaging with AI rather than a human; others are triggered when AI is used to inform a consequential decision affecting someone's employment, health coverage, or access to services; and others apply to any deployment of a generative AI system above a certain scale. The required content of the disclosure and the penalties for noncompliance vary by state, making a jurisdiction-by-jurisdiction review essential for any business deploying AI at scale.

Are health insurers and employers in the same regulatory bucket?

No, and the distinction matters. Laws targeting health insurers focus primarily on prior authorization, prohibiting AI from serving as the sole basis for coverage denials and requiring human review of AI-assisted determinations. Laws targeting employers focus on hiring and performance evaluation, requiring disclosure when automated tools are used and prohibiting discriminatory outcomes. A company that is both a large employer and a self-insured health plan administrator may face obligations under both sets of laws simultaneously.

Talk to an Epstein Becker Green Attorney

The regulatory environment for AI is evolving faster than most compliance calendars can keep up with. To understand how these laws apply to your business, or to prepare for what is coming, contact an Epstein Becker Green attorney today.