Which States Have Enacted AI-Specific Laws — and What Businesses Need to Know Now

By Heed AI Solutions

Artificial intelligence laws are no longer theoretical. As of 2024–2025, at least 38 U.S. states have enacted AI-specific legislation, with new bills passing every month. Some states have introduced comprehensive governance frameworks, while others have focused on deepfakes, hiring transparency, consumer protection, privacy, or AI impersonation.

If your organization operates in multiple states — or serves customers across state lines — you now face a patchwork of AI compliance obligations that directly affect HR, marketing, customer service, analytics, product development, and governance programs.

This guide provides a clear, state-by-state overview of where AI laws stand today, which states have passed what type of legislation, and how businesses should prepare.

Tier 1 — States With Comprehensive AI Laws

These states have enacted broad AI governance frameworks that meaningfully impact businesses across sectors.

California

California passed 18 AI-specific laws covering:

• Frontier model safety
• AI watermarking
• Healthcare AI quality
• Training-data transparency
• Deepfake penalties
• Education AI limits

Most provisions take effect between 2025–2028.

Colorado

Colorado’s SB 24-205 is one of the strictest AI laws in the country. It regulates “high-risk AI systems” used in hiring, credit, housing, insurance, and essential services.
Requires:

• Impact assessments
• Risk mitigation
• Incident reporting
• Disclosures for automated decisions
  Effective 2026.

Texas

Texas created a State AI Advisory Council, passed AI procurement rules, and enacted several generative-media and election-AI regulations.

Utah

The Utah AI Policy Act requires:

• Disclosure when AI interacts with a consumer
• Business documentation for automated systems
• Enforcement under consumer-protection rules

Virginia

While not branded “AI law,” Virginia’s privacy statutes restrict:

• Automated decision-making
• Profiling
• Data used for AI inference

These function as AI regulations in practice.

Nevada

Nevada has implemented broad AI-focused legislation including transparency, consumer protections, and political synthetic media standards.

Tier 2 — States With Sector-Specific AI Laws

These states don’t regulate AI broadly but have passed impactful laws governing hiring, healthcare, consumer privacy, biometrics, or synthetic media.

New York

• NYC Local Law 144 mandates independent audits of AI hiring tools.
• State deepfake and political-media laws require disclosure and restrict deceptive use.

Illinois

Home of BIPA, the nation’s strongest biometric law — central to facial-recognition and AI-analysis tools.
Also regulates AI in video interviews.

Washington

The Consumer Health Data Privacy Act (CHDPA) limits AI inference on sensitive health signals and impacts any AI tool touching wellness, biometrics, or health-related behavioral data.

Maryland, Massachusetts, Georgia, Minnesota, Tennessee, Florida, Arizona, Oregon

All have AI-specific statutes regulating:

• Impersonation
• Deepfakes
• Health-data inference
• Automated decision-making
• Hiring assessments
• AI-generated communications

These are among the most active states beyond the Tier 1 group.

Tier 3 — States With Election Deepfake & AI Impersonation Laws

More than 20 states have enacted laws targeting AI-generated political manipulation, including:

• Mandatory labeling of synthetic media
• Criminal penalties for deceptive deepfakes
• Election-advertising disclosures
• AI impersonation restrictions

These states include:
NH, ME, RI, NJ, PA, MI, OH, IA, MO, AR, MS, AL, LA, KY, WV, SC, GA, NC, FL, AZ, and more.

These laws matter for:

• Political campaigns
• Marketing agencies
• Content creators
• Social media teams
• Media and communications departments

States With No AI-Specific Laws (Yet)

As of 2024–2025, the following states have not enacted AI-specific legislation:
Wyoming, South Dakota, North Dakota, Nebraska, New Mexico, Alaska, Hawaii.

However, several of them have introduced bills expected to move forward in 2025.

Why This Matters for Businesses in Every State

AI compliance is no longer optional — especially for organizations deploying:

• AI-assisted hiring or screening
• Customer-facing chatbots
• Generative AI for marketing or communications
• Automated decision-making systems
• Biometric/voice analysis tools
• AI models trained on consumer data

Because each state is moving independently, companies must now navigate fragmented, multi-state governance obligations, including:

• Disclosure requirements
• Documentation & risk assessments
• Algorithmic audits
• Training-data transparency
• Synthetic media labeling
• Bias testing or impact reviews

A unified compliance approach is essential.

How Organizations Should Prepare (Practical Guidance)

1. Build an AI Governance Framework

Use ISO 42001 or NIST AI RMF as the foundation.
Document systems, risks, and controls.

2. Identify High-Risk Use Cases

Map where AI touches:

• Hiring
• Credit decisions
• Healthcare
• Insurance
• Consumer interactions
• Sensitive data processing

3. Implement Disclosure & Transparency Standards

Many states require businesses to tell consumers when AI is involved.

4. Audit Vendors & Third-Party AI Tools

You are accountable for the AI you deploy — even when it’s outsourced.

5. Update Policies for Synthetic Media & Marketing

Election deepfake laws reach beyond politics into general media integrity.

Want a State-Specific Analysis for Your Organization?

Heed AI Solutions works with SMBs, enterprises, healthcare groups, financial organizations, and government partners to implement safe, compliant, ROI-driven AI systems.

We can help your organization:

• Identify which state laws apply
• Build a unified AI governance program
• Conduct readiness assessments
• Deploy safe, compliant automation
• Train teams on proper usage
• Prepare for upcoming 2025–2026 regulations

Schedule a consultation:
📞 310-363-0826
🌐 HeedAISolutions.com