March 26, 2026

TOP LINE

Thirty state-level AI and privacy developments landed in the past 24 hours, with no single federal action dominating the picture. The clearest pattern: states are moving simultaneously on AI transparency obligations, third-party auditing infrastructure, and sector-specific rules for health care and minors. Legal and policy teams managing multi-state compliance portfolios face the most immediate pressure.

KEY DEVELOPMENTS

Virginia institutionalizes third-party AI auditing. The Virginia House passed both SB384 (99-0) and a Senate substitute for HB797 (84-14), each establishing formal frameworks for independent AI verification organizations. The unanimity on SB384 is notable — it suggests broad bipartisan comfort with auditing infrastructure as a regulatory instrument, even where direct AI liability rules remain contested. Practitioners should note that if Virginia's model gains traction, organizations deploying high-risk AI may face pressure to engage certified verification bodies as a practical compliance step, not merely a voluntary one. Watch level: PREPARE (AI developers, enterprise AI deployers, audit and compliance service providers)

Washington's AI content disclosure bill reaches the Governor. HB1170, requiring disclosure when content is AI-generated or AI-modified, has been delivered to the Governor for signature or veto. Washington would join a growing roster of states imposing affirmative AI labeling obligations — a compliance consideration distinct from, and potentially in tension with, federal preemption arguments that have not yet been resolved. Content platforms and publishers operating in Washington should begin scoping disclosure workflows now rather than waiting for signature. Watch level: PREPARE (technology platforms, digital publishers, content operations teams)

Colorado advances health care AI bill; Vermont introduces neurorights protections. Colorado's HB1139 passed its House Second Reading with amendments, continuing the state's sector-specific AI push following SB205. Separately, Vermont's H0814 — a neurorights bill regulating AI in health and human services — has received a favorable committee recommendation. These two bills represent distinct regulatory theories: Colorado targets clinical tool accountability; Vermont targets cognitive liberty as a protected interest. Health care AI developers operating across multiple states should treat the combination as a signal that sector-specific obligations are proliferating faster than any single model law. Watch level: PREPARE (health AI developers, clinical decision-support operators, digital health counsel)

New York's training data transparency bills advance to third reading. Both S06955 (Senate) and A06578 (Assembly) — companion versions of the Artificial Intelligence Training Data Transparency Act — have reached third reading, requiring generative AI developers to publicly disclose training data information. Reaching third reading in both chambers simultaneously raises the question of whether New York is positioning for passage this session. If enacted, the obligations would fall directly on developers, not deployers, and would add New York to a short list of jurisdictions attempting to regulate the AI development pipeline itself. Watch level: PREPARE (generative AI developers, model providers, IP and copyright counsel)

Washington's high-risk AI bill stalls; Oregon's HB4103 dies in committee. Washington's HB2157, targeting high-risk AI systems, has been placed in the House Rules 'X' file, effectively shelving it for this session. Oregon's HB4103 similarly expired without a floor vote. These outcomes warrant monitoring alongside the states where bills are advancing: the picture is not uniformly permissive or uniformly restrictive. The practical implication is that patchwork risk — obligations varying sharply by state — remains the operative compliance environment. Watch level: MONITOR (AI governance leads tracking state legislative cycles)

FORWARD LOOK

Washington's HB1170 is the most time-sensitive item pending executive action; the Governor's decision will determine whether Washington joins the AI disclosure compliance tier. Utah's HB0450 (privacy amendments) and HB0320 (AI Policy Office restructuring) are both at the Governor's desk and may resolve within days. Virginia's paired auditing bills await final disposition — the question of whether the Governor signs both, one, or neither will shape whether Virginia's verification framework takes effect as drafted. Colorado's HB1139 moves to Senate, where amendment dynamics from the House floor may shift further.