Every state AI bill passed in the 2026 session, as of July 31, 2026. Click a state for its bills; filter by topic. Statute coding — who each bill binds, what duties it creates, and how much work carries between states — is in progress and will feed the cost model.
Dataset: passed AI legislation, 2026 session (as of 7/31/2026). A few bills have passed one chamber but are not yet enacted — the toggle filters them out. Live status, votes, and links via LegiScan (CC BY 4.0).
A few quick questions. We’ll estimate what today’s patchwork of state AI laws costs a company like yours — and how differently that burden lands on a startup than on a giant.
What are you building?
Pick whatever fits — you can choose more than one.
Which areas does your product touch?
The most common regulated categories — many laws don’t fit neatly, so pick what’s closest. The full set is on the State Law Explorer.
Where do you operate?
Your home state always applies; selling nationally exposes you to every state’s version. Click the map to pick a single state.
How big is your company?
Pick the closest — you’ll still see how the burden compares across every size.
Your estimated compliance cost
Every company faces the same laws, but the work barely grows with size while revenue races ahead — a rounding error for the biggest, a real tax on the smallest. Bars are cost as a share of revenue over 5 years.
New state AI laws land often — we track them so you don’t have to.
Years of recurring compliance cost to include; one-time build costs are counted once regardless. Duties marked per release (model documentation, provenance integration) repeat their legal and engineering work with every model release.
There is no federal AI standard today — but the state laws share a core: one-time work plus the requirements every state sets identically. A company builds that core once no matter how many states regulate (and it’s what a single federal rule would have asked for). That shared core — worth ≈— under current settings — is not counted; only state-by-state divergence is.
Most-likely hours for the average AI model to satisfy each duty; the low/high range scales with your edits. Initial values are estimates pending citation to published burden figures.
By default the model uses each family’s statute-derived reuse (shown next to each family above); the slider applies only when you override.
| Bill | State | Requirement family | Binds | Key parameters | Exposure if violated | Status |
|---|
Every input is auditable: the coded dataset with quoted statutory sources ships in the repo (data/bills.js, full records in coding/).
What the terms mean and how the pieces fit together — duties, parameters, reuse, and the shared baseline. Every value described here is auditable in the repo.
| Term | Definition |
|---|---|
| Category | Who a law binds: company (enters the estimate), criminal (binds individuals), public-sector (binds the state), education (binds schools). Only company laws are counted by default. |
| Requirement family | A group of laws that demand the same kind of thing across states (chatbot safeguards, insurance decisions, …). Reuse and the shared baseline are computed within a family. |
| Duty | A unit of work a law demands (build a crisis protocol, run an annual audit). Each duty carries hour estimates — legal and engineering once, operations per year. Duties drive cost. |
| Parameter | A concrete setting a statute picks (age limit 18, notice in 90 days). Parameters never add cost directly; they measure how much states agree. Every coded value is anchored to a quoted provision. |
| Reuse | The share of parameters two states set to the same value, averaged across state pairs in a family. Each later state pays only (1 − reuse) of a fresh build. |
| Shared baseline | The core the state laws have in common: one-time work plus the parameters every state sets identically. A company builds it once no matter how many states regulate — and it is what a single federal standard would have required — so it is never counted. Only state-by-state divergence is. |
| Statutory exposure | The penalty a law itself states for violations (amount, unit, enforcer, cure period). Reported as fact next to each bill; never added to the cost estimate. |
| Time horizon | How many years of recurring (operations) costs are counted. One-time costs are unaffected. |
| Monte Carlo | The model runs 4,000 seeded simulations with duty hours drawn from their ranges, plus a shared error factor across all draws. Results are the spread: conservative p10, central p50, upper p90. |
Default hours are for the average AI model and editable under Advanced on the Cost Model tab. Format: legal / engineering (one-time) · operations (per year).
All parameters, grouped by requirement family. Values are the fixed choices the
coding protocol allows; required/yes parameters are coded only when the
statute imposes them — silence is omitted, never coded as “no”. Full coding rules in
CODING.md.
chatbot-safeguards| Parameter | Values | What it captures |
|---|---|---|
scope | companion · all-chatbots | Which conversational AI the law covers |
ageFocus | minors · all-users | Whose protection the duties target |
aiDisclosure | session-start · periodic · on-request | When the bot must reveal it is AI |
crisisProtocol | required | Self-harm detection and referral protocol mandated |
breakReminders | required | Usage-break reminders mandated |
parentalTools | required | Parent/guardian controls mandated |
engagementLimits | required | Limits on engagement-maximizing design (rewards, streaks) |
contentSafeguards | required | Technical guardrails against prohibited content or interactions |
ageThreshold | number | Age below which a user counts as a minor |
mental-health-practice| Parameter | Values | What it captures |
|---|---|---|
aiTherapyRule | ban · supervised · disclosure-only | How AI may participate in therapy |
consentRequired | yes | Written client consent required for AI use |
scope | psychotherapy · all-clinical | Covered practice area |
insurance-adm| Parameter | Values | What it captures |
|---|---|---|
humanReview | required-final · required-appeal | Where a licensed human must make the decision |
decisionsCovered | denials · prior-auth · all | Which insurance decisions the law reaches |
disclosure | required | AI use must be disclosed |
aiSoleBasis | prohibited | AI alone may not be the basis of a decision |
appealDays | number | Days allowed to appeal a decision |
adm-governance| Parameter | Values | What it captures |
|---|---|---|
covers | developers · deployers · both | Who bears the obligations |
trigger | consequential-decisions · high-risk-listed | Which AI uses activate the law |
assessment | pre-deployment · annual · none | Impact-assessment cadence |
consumerNotice | required | Consumers must be told AI was used |
appealRight | required | Right to appeal an automated decision |
optOut | required | Right to opt out of automated decisions |
frontier-safety| Parameter | Values | What it captures |
|---|---|---|
threshold | compute · cost · capability | What defines a covered frontier model |
safetyFramework | required | Published safety framework mandated |
incidentReporting | required | Safety incidents must be reported to the state |
thirdPartyAudit | required | Independent compliance audit mandated |
whistleblower | protected | Employee disclosures protected from retaliation |
provenance-transparency| Parameter | Values | What it captures |
|---|---|---|
watermark | required | Provenance data embedded in AI output |
detectionTool | required | Public AI-detection tool must be provided |
disclosureTrigger | all-genai · av-only · on-request | Which content the duty covers |
userThreshold | number | Monthly users above which the duty applies |
likeness-rights| Parameter | Values | What it captures |
|---|---|---|
consentRequired | yes | Consent needed to publish a digital imitation |
coveredSubjects | performers · all-persons · deceased | Whose likeness is protected |
postmortemYears | number | Years the right survives death |
ai-crimes| Parameter | Values | What it captures |
|---|---|---|
prohibition | ncii · csam · election-deepfakes · impersonation-fraud · suicide-encouragement | The conduct criminalized |
coveredSubjects | minors · all-persons | Whose depiction/harm is covered |
electionWindowDays | number | Days before an election the ban applies |
election-disclosure| Parameter | Values | What it captures |
|---|---|---|
disclosure | required | AI content in political communications must be labeled |
scope | ads · robocalls · all-communications | Which communications are covered |
windowDays | number | Days before an election the duty applies |
pricing-competition| Parameter | Values | What it captures |
|---|---|---|
prohibition | surveillance-pricing · price-coordination | The pricing practice restricted |
disclosure | required | Algorithmic pricing must be disclosed |
privacy-data| Parameter | Values | What it captures |
|---|---|---|
admOptOut | required | Consumers may opt out of automated decisions |
profilingAssessment | required | Assessments required for profiling |
minorsFocus | yes | The law's protections target minors |
registration | required | Covered entities must register with the state |
workforce| Parameter | Values | What it captures |
|---|---|---|
retaliationProtection | yes | Workers protected for refusing/reporting AI use |
noticeRequired | yes | Workers must be notified about AI use |
healthcare-clinical| Parameter | Values | What it captures |
|---|---|---|
aiPracticeRule | ban · disclosure · supervision | How AI may participate in care |
scope | licensure · treatment · all | Which part of practice is covered |
professional-services| Parameter | Values | What it captures |
|---|---|---|
aiRule | ban · disclosure · supervision | How AI may be used in the profession |
profession | short text | The profession covered |
public-sector| Parameter | Values | What it captures |
|---|---|---|
inventory | one-time · annual | AI system inventory cadence |
procurementRules | required | AI procurement rules mandated |
assessment | required | Impact assessments of agency AI |
program | short text | Program, board, or study the law creates |
education-k12| Parameter | Values | What it captures |
|---|---|---|
curriculum | required | AI/computer-science curriculum mandated |
policyRequired | yes | Schools must adopt an AI policy |
trainingRequired | yes | Staff training mandated |
graduationReq | yes | Graduation requirement created |
definitions-onlyNo parameters — these laws define terms and impose nothing comparable.
data-centers| Parameter | Values | What it captures |
|---|---|---|
scope | short text | The infrastructure provision the law touches |