State legislatures are regulating AI through a mix of deepfake rules, provenance mandates, chatbot safeguards, employment-related disclosure requirements and broader automated decision-making frameworks. Utah, Iowa, Connecticut and Colorado each advanced significant measures in recent weeks, and together they signal the growing influence of state AI-specific laws – despite opposition from the White House.
Utah: Deepfake Restrictions and Provenance Obligations
Utah enacted H.B. 276, Artificial Intelligence Modifications, which creates both the Digital Voyeurism Prevention Act and the Digital Content Provenance Standards Act. The law targets non-consensual counterfeit intimate images and imposes consent verification, notice and takedown, and civil liability obligations on generation services and platforms. It also requires large online platforms to detect compliant system provenance data, provide users a way to inspect that provenance information and avoid stripping compliant provenance or digital signatures where technically feasible. The statute separately requires certain generative AI systems and capture devices to include latent disclosures tied to content authenticity, origin or modification history.
For businesses, Utah is important because it goes beyond generic “AI disclosure” language and starts to look like a technical traceability regime. Companies that generate or host image, video or audio content should review whether they can preserve provenance metadata, find it through the user interface and support takedown workflows for non-consensual synthetic media.
Iowa: Chatbot Safety for Minors
Iowa signed S.F. 2417 on May 2, 2026. The statute regulates “conversational AI services” and requires operators to clearly and conspicuously tell minor account holders they are interacting with AI. It also bars reward mechanics designed to drive unpredictable engagement and requires reasonable measures to prevent minor users from being exposed to sexually explicit material or from being told to engage in sexually explicit conduct.
The Iowa law is narrower than Utah’s provenance framework, but it is still meaningful because it focuses on the design of chatbot experiences, especially for minors. That makes disclosure architecture, engagement mechanics and safety filtering part of the legal review, not just the product review.
Connecticut: A Broad Omnibus AI Law
Connecticut’s legislature passed S.B. 5 on May 1, 2026, and Governor Ned Lamont intends to sign it. The measure is one of the broadest state AI bills yet, with provisions affecting subscription-based AI disclosures, frontier model developers, automated employment-related decision processes, AI companions and synthetic digital content. Unless otherwise specified, the law takes effect on Oct. 1, 2026, and most provisions are enforced by the Connecticut Attorney General under the Connecticut Unfair Trade Practices Act.
The employment provisions are especially notable. Deployers of automated employment-related decision processes must provide written notice to workers or applicants when they are interacting with such a system, disclose the purpose of the system and the nature of the decision, and provide additional post-decision information if the outcome is adverse. The bill also requires developers to supply deployers with the information needed to comply. Connecticut additionally imposes companion-bot safety obligations, including self-harm and violence detection protocols and notice requirements, and requires synthetic digital content to be marked and detectable as synthetic when first encountered by consumers.
Colorado: The AI Act Rewrite Is Now Moving Forward
Colorado has now enacted S.B. 26-189, Automated Decision-Making Technology, which rewrites the state’s original AI law. The Colorado General Assembly’s bill page lists a “Signed Act” version dated May 14, 2026. The effective date of this law is Jan. 1, 2027.
The revised bill shifts the original law away from a more expansive disclosure and risk framework (similar to the EU AI Act) and toward a narrower transparency model for automated decision-making technology used in consequential decisions. Under the bill summary, developers of covered automated decision-making technology must provide deployers with technical documentation describing intended uses, training data categories, limitations and human review instructions. Deployers must give consumers clear notice at the point of interaction, provide a plain-language explanation after an adverse consequential decision and offer meaningful human review and reconsideration. The bill also requires record retention of three years, authorizes Attorney General enforcement under the Colorado Consumer Protection Act and treats violations as deceptive trade practices.
Colorado remains especially important because it was the first state to adopt a comprehensive AI law, and this rewrite shows how quickly that framework has already been narrowed and reworked.
Summary
Taken together, these developments point to four recurring compliance themes: provenance and watermarking, consumer-facing chatbot disclosures, employment-related AI notices and explanations and tighter controls on AI interactions involving minors. Companies that use or supply AI systems across multiple states should assume that state-specific obligations will continue to diverge and should build compliance workflows that can adapt by jurisdiction rather than relying on one national policy.
Our Artificial Intelligence Industry Team tracks AI regulations throughout the country. If you have questions or concerns about AI-related matters, please reach out to attorney Brendan M. Palfreyman at (315) 214-2161 and bpalfreyman@harrisbeachmurtha.com, or the Harris Beach Murtha attorney with whom you most frequently work.
This alert is not a substitute for advice of counsel on specific legal issues.
Harris Beach Murtha’s lawyers and consultants practice from offices throughout Connecticut in Bantam, Hartford, New Haven and Stamford; New York State in Albany, Binghamton, Buffalo, Ithaca, New York City, Niagara Falls, Rochester, Saratoga Springs, Syracuse, Long Island and White Plains; as well as in Boston, Massachusetts, and Newark, New Jersey.