Hintze Law’s Global AI Update provides a curated overview of key AI-related legal and regulatory updates. We spotlight new developments and emerging trends to help organizations that are developing, deploying, or relying on AI technologies stay ahead of what’s next.
Please also check out our latest Global Privacy Updates post.
If you’d like to receive email alerts for our blog posts, visit our blog page to sign up.
U.S. Updates
CA Governor Issues Executive Order Responding to Economic Disruption Due to AI
On May 21, 2026, California Governor Gavin Newsom announced a first-of-its-kind executive order targeted at responding to the impact of AI on California's workforce. The order is directed to various state agencies and appears designed to (1) mitigate further AI-caused worker disruption and (2) restore worker power resulting from past disruptions related to AI.
While this is the first state EO to address AI-caused worker disruption, it covers many of the same topics as the government-focused provisions in Connecticut's recent omnibus law (SB 5), such as providing resources for workers displaced by AI, incorporating AI as a possible cause in labor market analyses, and partnering with institutions of higher education to understand the harms and risks AI poses to the workplace.
The EO requires several reports, recommendations, and similar output from different state agencies by the end of 2026, so it is likely there will be follow-up legislative action based on those outputs over the next couple of years.
Colorado Advances Replacement for 2024 AI Act
On May 14, 2026, Colorado passed Senate Bill 26-189, which would repeal and replace the state’s existing 2024 AI Act.
The law narrows former concepts of “high-risk artificial intelligence system” and “algorithmic discrimination” to instead cover “automated decision-making technologies” (ADMT), defined broadly to include systems that process personal data to produce outputs such as predictions, classifications, rankings, or recommendations that influence decisions affecting individuals. Under the new law, these ADMT systems are regulated only when used in “consequential decisions,” including those related to employment, housing, education, lending, insurance, health care, and government services.
The law scales back certain obligations found in the original Act, including removing risk management and impact assessment requirements, while maintaining transparency obligations.
The bill also imposes distinct duties on developers and deployers. Developers must provide detailed disclosures regarding intended use, known risks, and training data, as well as instructions for appropriate use and oversight. The law maintains the requirement to retain compliance records for at least three years. Deployers are subject to disclosure obligations, recordkeeping requirements, and post-decision transparency where AI contributes to adverse outcomes.
Consumers are granted new rights, including the ability to correct inaccurate data and request meaningful human review of AI-influenced decisions. These requirements are subject to further attorney general rulemaking.
Enforcement authority remains with the Colorado Attorney General. The law will take effect on January 1, 2027.
Georgia New AI Companion Chatbot Law
On May 11, 2026, Georgia enacted SB 540, a law requiring operators of AI companion chatbots - systems designed to simulate ongoing, personalized human-like relationships - to disclose their AI nature to users at the start of each session and periodically throughout, implement parental controls and age verification, provide privacy tools, and adopt protocols for responding to suicidal ideation or self-harm.
The law carves out customer service bots, internal business tools, and educational applications, but contains no exemption for chatbots embedded within larger platforms.
The Attorney General may pursue civil penalties of up to $10,000 per knowing violation per affected user per day. The law takes effect July 1, 2027.
Iowa Expands Companion AI Chatbot Regulation
On May 3, 2026, Iowa passed Senate File 2417, a law regulating AI companion technologies. The law applies to operators providing conversational AI platforms—those accessible to the general public and that have the primary purpose of simulating human conversation and interaction through textual, visual, or aural communication.
Iowa’s law requires operators to inform users they are interacting with AI. The law also includes safety controls for known minors, parental controls for users under 13, and protocols for responding to user expressions of self-harm.
The attorney general has sole enforcement authority of the law, with no private right of action. The law takes effect on July 1, 2027
Hawaii Enacts Companion AI Disclosure and Safety Requirements
On May 6, 2026, the Hawaii legislature passed the Artificial Intelligence Disclosure and Safety Act (SB 3001, CD1). The bill is now awaiting the governor’s signature. The bill focuses on AI companion services and introduces both transparency and safety obligations.
If signed into law, operators would be required to clearly disclose that users are interacting with AI systems rather than human beings. Where the operator knows or reasonably believes a user is a minor, disclosures must be more prominent and frequent. Operators would also be required to implement protocols to respond to user expressions of self-harm or suicidal ideation, including directing users to crisis support services. AI systems would also be prohibited from representing themselves as licensed mental health professionals. Beginning January 1, 2028, operators will be required to submit annual reports detailing safety protocols and the number of crisis-related interventions.
Enforcement authority rests with the Hawaii Attorney General, and violations may result in civil penalties. The law does not provide a private right of action.
Nebraska Passes Companion AI Chatbot Law
On April 14, 2026, Nebraska passed the Conversational Artificial Intelligence Safety Act. The law mandates clear disclosure provisions, including specific transparency and safety requirements for interactions involving minors. Operators are required to establish protocols for responding to user expressions of self-harm. The law also prohibits chatbots from representing themselves as professional mental or behavioral health care providers.
The law takes effect on July 1, 2027, with enforcement handled by the Attorney General and civil penalties of at least $1,000 per violation.
Florida AG Opens Investigation into OpenAI/ChatGPT
On April 9, 2026, Florida Attorney General James Uthmeier announced that his office had opened a formal investigation into OpenAI and its product ChatGPT, stating that subpoenas to the company would be issued.
Uthmeier said the investigation was prompted by information indicating that ChatGPT may have been used by the perpetrator of a mass shooting at Florida State University. Uthmeier also cited additional concerns regarding child safety, alleged encouragement of self-harm, and questions about OpenAI's data practices and national security implications, especially regarding links to China.
Maryland Passes Algorithmic Pricing Bill
On April 28, 2026, Maryland passed into law HB 0895. The law will apply to “food retailers” (e.g., grocery stores) as well as “third-party deliver service providers” (e.g., consumer food delivery services).
Regulated entities will be subject to the following requirements for Maryland consumers:
No personalized pricing: Must not engage in “dynamic pricing” or otherwise use any “personal data” to set a higher price for tax-exempt food with respect to a given consumer.
“Dynamic pricing” means setting personalized prices for goods/services for a given consumer based on that consumer’s personal data.
“Personal data” has the same meaning as in MODPA.
Limited use of sensitive data: Must not use “protected class data” about a given consumer to offer, advertise, or sell consumer goods or services to that consumer, where doing so would have a detrimental effect to that consumer not experienced by others
“Protected class data” means “information about an individual or group of individuals that, alone or in combination, directly or by implication identifies a characteristic… legally protected from discrimination under [state or federal law].”
The law grants regulated entities a 45-day right to cure. Enforcement will be exclusive to the MD Division of Consumer Protection as a violation of the state’s consumer protection act. The bill takes effect on October 1, 2026.
Maine Moves to Limit AI in Mental Health Care
On April 13, 2026, Maine signed into law HP 1397, an act restricting use of AI in relation to therapy or psychotherapy services provided to Maine residents:
Only licensed professionals may use “Internet-based” AI to provide, advertise, or otherwise offer these services to the public.
Licensed professionals must not “allow” AI to make independent therapeutic decisions, directly interact with clients as part of therapeutic communications, or generate therapeutic recommendations or treatment plans that they do not review and approve. Additionally, licensed professionals may use AI for administrative support (e.g., billing) or supplementary support (e.g., taking notes) only if they:
1. Use AI in accordance with standards of practice and applicable law (including privacy laws),
2. “[M]aintain[] full responsibility for all interactions, outputs[,] and data use associated with the [AI] use,” and
3. If using for supplementary support, obtain the client’s informed consent, and record/transcribe the client’s sessions that use AI.
Clients cannot waive these requirements, and the law does not preclude PRAs based on a licensed professional’s use of AI. Rulemaking is required by the oversight boards for regulated professionals. This law takes effect July 14, 2026.
Vermont Governor Approves Bill on Neurological Rights and Use of AI Tech in Health
On May 18, 2026, Vermont signed into law H. 814, an act relating to neurological rights and the use of artificial intelligence technology in health and human services. The law provides for the recognition that each individual has neurological rights, including "mental and neural data privacy," “nondiscrimination in the development and application of neurotechnologies,” and protections to unauthorized neurotechnological interventions.
The law also modifies the membership of Vermont's AI Advisory Council and requires the Council to submit a written report about AI and neurological rights, including any statutory recommendations, by January 15, 2027.
X Fails to get Preliminary Injunction on AB 2013
On March 4, 2026, a US District Court denied, preliminary injunction against CA AB 2013 sought by xAI, the AI company developing X’s chatbot. The law requires developers of generative AI to make public disclosures about the training data behind their GenAI products.
The court found that xAI’s allegations that the disclosure requirement would force xAI to disclose valuable trade secrets to be vague, where xAI pointed to the value of secrecy in data sets, but did not “describe the subject matter of the trade secret with sufficient particularity” to distinguish xAI’s use from its competitors and warrant trade secret protection.
Senate Releases Draft of Trump America AI Act
On March 18, 2026, Senator Marsha Blackburn (R-MO) announced a draft bill titled the TRUMP AMERICA AI Act which is intended to establish a federal standard on AI and override state efforts on legislating AI.
Provisions under the proposed law cover youth online privacy and safety, AI property and likeliness rights, and AI innovation. The bill if enacted would preempt conflicting state laws but would allow state laws to provide greater protection for minors.
The bill has no private right of action and would be enforceable by the US AG and state AGs
National Policy Framework for AI
On March 20, 2026, the Trump White House announced its National Policy Framework for Artificial Intelligence. The framework addresses six key objectives:
"Protecting Children and Empowering Parents"
"Safeguarding and Strengthening American Communities"
"Respecting Intellectual Property Rights and Supporting Creators"
"Preventing Censorship and Protecting Free Speech"
"Enabling Innovation and Ensuring American AI Dominance"
"Educating Americans and Developing an AI-ready Workforce"
“Establishing a Federal Policy Framework, Preempting Cumbersome State AI Laws”
The press release emphasized the need for uniformity in AI regulation across the states, warning that “a patchwork of conflicting state laws would undermine American innovation and our ability to lead in the global AI race."
Additional AI Legislation Passed
In addition to the laws discussed above, the following laws have been enacted since our last update:
· New York S 8828 – Requiring transparency and safety requirements for AI frontier models
· Oregon SB 1546 - Regulating Companion Chatbots
· Tennessee SB 1580 – Prohibiting AI systems from being advertised or represented as qualified mental health professionals
· Washington HB 2225 – Regulating Companion Chatbots
· Washington HB 1170 – Requiring Transparency for AI Generated / Altered Content
· Washington SB 5395 – Requiring human responsibility and determination for medical necessity and authorization
· Washington SB 5886 – Protecting against forged digital likeness
· Washington SB 5105 – Prohibiting AI-generated sexually explicit depictions of minors
Global Updates
European Commission Publishes Guidelines for Use of GenAI in Research
On May 8, 2026, the European Commission announced updates to Guidelines on the European Research Area's use of GenAI in research. The guideline’s provisions for researchers, research organizations, and research funding organizations include:
Maintaining responsible for the integrity of scientific output
Using GenAI transparently
Refraining from substantially using GenAI in sensitive activities that could impact other researchers or organizations, such as peer review and evaluating research proposals
India Finalizes Amendments Targeting “Synthetic Information”
The Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Amendment Rules, 2026, have now entered into effect, updating India’s 2021 IT Rules. A key focus of the amendments is “synthetically generated information” (SGI)—content generated to appear real, authentic, or true, and that may be indistinguishable from real individuals or events.
The amendments introduce a structured compliance framework for intermediaries that enable the creation or dissemination of such content. Intermediaries are now required to notify users at least once every three months of their obligations relating to SGI. Where violations occur, intermediaries must take swift action, including removal of unlawful content within three hours of notice.
The rules also impose more prescriptive technical requirements. Platforms must deploy safeguards designed to prevent the creation and dissemination of unlawful SGI, while explicitly prohibiting certain high-risk categories. For permitted synthetic content, mandatory labeling and provenance requirements apply, including embedding of identifiers to signal that content is synthetic. In addition, the amendments include safeguards to prevent tampering with or removal of such labels and metadata—highlighting a growing regulatory emphasis on traceability and authenticity in AI-generated content.
U.K. ICO Focuses on AI and Automated Decision-Making in Recruitment
The U.K. Information Commissioner’s Office (ICO) continues to sharpen its focus on the use of AI and automated decision-making (ADM) in hiring. Between March 2025 and January 2026, the ICO engaged with more than 30 employers to better understand how automation is being used in recruitment decision-making.
In March 2026, the ICO published its findings in its report, Recruitment Rewired: An Update on the Fair and Responsible Use of Automation in Recruitment. The report outlines regulatory expectations for employers deploying AI tools in hiring processes, particularly around fairness, transparency, and accountability. ICO states in its report that recruitment remains a key enforcement priority, especially where automated systems materially influence hiring outcomes.
Pope Leo XIV Approves Interdicasterial AI Commission and Publishes Encyclical On AI
On May 12, 2026, Pope Leo approved the creation of a Interdicasterial Commission on Artificial Intelligence. The statement “serves as food for thought and does not intend to contradict work conducted in existing G7 groups such as the Hiroshima AI Process.”
On May 25, 2026, the Pope published his first encyclical, Magnifica humanitas: On Safeguarding the Human Person in the Time of Artificial Intelligence. Breaking tradition, the Pope was reported to attend the encyclical’s launch, along with one of the Anthropic co-founders.
The encyclical outlines the Catholic Church’s perspective on the care of human dignity in the era of AI, rooted in the Church’s principles of Social Doctrine, including the common good and social justice. From these principles, Pope Leo urges the discreditation of the assumption that “technical power automatically confers the right to govern,” maintaining as truth as a common good, and protecting freedom against dependencies and commercialization in the digital attention economy. The Pope notes that AI developers are called to embed “transparency, responsibility toward affected communities, and careful attention to ensuring that what is being cultivated is a genuine good” into their projects.
EU Institutions Move to Streamline AI Act Obligations
On May 7, 2026, the European Council and European Parliament reached a provisional agreement to streamline certain aspects of the EU AI Act as part of the broader Omnibus VII initiative.
The agreement proposes several targeted adjustments, including extending the timeline for the application of high-risk AI system obligations by up to 16 months. It also broadens certain regulatory exemptions previously available to small and medium-sized enterprises (SMEs), extending them to small mid-cap companies (SMCs). In limited circumstances, certain compliance obligations are reduced.
Additionally, the agreement expands allowances for processing sensitive personal data where necessary for bias detection and mitigation, reflecting a practical recognition of fairness challenges in AI systems. The role and powers of the EU AI Office are also reinforced.
The agreement remains subject to formal adoption by both institutions, which have indicated an intention to finalize the changes before August 2, 2026, when key provisions of the existing AI Act are set to take effect.
Hintze Law PLLC is a Chambers-ranked and Legal 500-recognized, boutique law firm that provides counseling exclusively on data protection including AI, privacy, and data security. Hintze attorneys and data consultants support technology, advertising, media, fintech, health, biotech, ecommerce, and mobile industries.