March 24, 2026

TOP LINE

Today's dominant story is the acceleration of state-level AI and privacy legislation across the U.S., with a notable concentration in health care AI, third-party auditing infrastructure, and training data transparency. Virginia's unanimous House passage of SB384 and the 84-14 vote on HB797 — both establishing frameworks for independent AI verification organizations — represent the clearest signal yet that states are moving to institutionalize external audit mechanisms as a structural governance tool. In-house counsel, AI governance leads, and product teams operating across multiple U.S. states face a compounding patchwork that now spans health AI, consumer AI, companion AI, deepfakes, and data provenance disclosure.

KEY DEVELOPMENTS

Virginia's dual passage of SB384 and HB797 — the first unanimous, the second 84-14 — establishes a statutory framework for independent AI verification organizations (IVOs) and signals that third-party auditing is becoming an institutionalized compliance mechanism rather than a voluntary best practice. California's SB813 pursues a parallel structure under its AI Standards and Safety Commission, currently held at the Assembly desk. Ohio's HB628 takes a licensing approach for AI risk mitigation organizations. Taken together, these three states suggest an emerging model: AI accountability through credentialed intermediaries, not just direct regulatory mandates. The practical question for AI developers and deployers is whether their current audit and assessment relationships will qualify under forthcoming IVO definitions. Watch level: PREPARE (AI developers, AI auditors and assessors, enterprise compliance teams)

Colorado's HB1139 passed second reading with amendments, targeting AI governance specifically in health care, while Vermont's H0814 advances neurological rights protections for AI use in health and human services. These two bills reflect distinct but complementary regulatory vectors: HB1139 addresses operational AI risk in clinical settings, while H0814 reaches into cognitive liberty and mental data — a narrower but more novel legal category. Colorado has already enacted SB205 on high-risk AI; HB1139 suggests the legislature is now building a health-specific layer on top of that foundation. Teams deploying AI in clinical decision support, patient communication, or mental health services in either state should treat these as active compliance risks, not background noise. Watch level: PREPARE (health AI developers, clinical decision support operators, digital health platforms)

Washington State's HB1170, requiring disclosure when content is AI-generated or AI-modified, has been delivered to the governor for signature or veto. This is the most immediate near-term action item in today's briefing: if signed, it creates an affirmative consumer-facing disclosure obligation for AI-generated content in Washington. Separately, HB2157 — Washington's high-risk AI systems bill — has been shelved in the House Rules 'X' file for this session, removing one significant regulatory risk for the current cycle. The contrast between HB1170's momentum and HB2157's stall suggests Washington's legislature is more aligned on transparency requirements than on broader AI risk regulation. Watch level: ACT NOW pending signature (digital content operators, marketing and media teams, AI product developers targeting Washington consumers)

New York's S06955 and companion Assembly bill A06578 — both the Artificial Intelligence Training Data Transparency Act — have each advanced to third reading, requiring developers of generative AI models to publicly disclose training data sourcing on their websites. The simultaneous bicameral progression raises the probability of eventual passage, though the bills have not yet cleared their respective chambers. If enacted, this would impose a supply-chain disclosure obligation on foundation model developers and fine-tuners operating in or serving New York, a market too large to geo-fence. Practitioners should note that "publicly disclose on website" is a specific, auditable requirement distinct from regulatory filing or confidential reporting — it would effectively make training data provenance a public accountability matter. Watch level: PREPARE (generative AI developers, foundation model operators, AI product counsel)

Oregon's passage of SB1546 — the first state law specifically targeting AI companion products — creates a new compliance category for teams operating social or relational AI systems. Oregon's HB4103, a broader AI regulation bill, died in committee at session end, leaving SB1546 as Oregon's primary AI-specific enactment this cycle. Wyoming's enactment of HB0102 criminalizing AI-generated deepfakes exploiting minors adds to an already dense state-law landscape on synthetic media. Platform governance teams should note that Wyoming and Oregon now have distinct, active AI statutes requiring product-level compliance review, separate from federal frameworks. Watch level: ACT NOW (AI companion platform operators in Oregon); PREPARE (content platforms and social media operators in Wyoming)

FORWARD LOOK

Gubernatorial action on Washington's HB1170 and Utah's HB0320 and HB0450 is the next concrete procedural threshold to track, with no public signing timeline confirmed for any of the three. Virginia's SB384 and HB797 require monitoring for final enrollment and effective dates before IVO compliance obligations crystallize. Colorado's HB1139 still faces additional legislative stages, and its amendment history suggests the final scope of health AI obligations remains unsettled. The New York training data transparency bills bear watching for committee votes in the opposite chamber; simultaneous bicameral third-reading status is a meaningful indicator of legislative intent, though passage is not assured.