Pittsburgh, PA

AI governance in Pittsburgh

Narrow laws, and enforcement already underway

Pittsburgh’s weight sits in healthcare, insurance and financial services, manufacturing, higher education, and energy. Pennsylvania has not enacted a comprehensive AI governance law. What it has is narrow: two criminal statutes, an insurance notice that is guidance rather than a regulation, and an executive order that binds Commonwealth agencies and no private organization.

TrustEdge serves organizations in Pittsburgh and across Pennsylvania, with engineers and assessors on-site for the work. AI Academy and agent engagements are delivered nationally.

The pressure

What Pittsburgh organizations are actually dealing with

Pennsylvania’s status is narrow. There is no state-law duty to inventory AI systems, conduct impact assessments, disclose automated decision-making to consumers, or register high-risk systems. Notice 2024-04 reaches an insurer that holds a certificate of authority, or is otherwise authorized to engage in the business of insurance, in Pennsylvania. Executive Order 2023-19 does not reach a private hospital. A pitch for Pennsylvania AI Act compliance is a pitch for a statute that does not exist.

Sectors we serve here

Healthcare
Insurance and financial services
Manufacturing
Higher education
Energy

Pennsylvania is narrow, not a single AI regime

Pennsylvania’s status is narrow. It has not enacted a comprehensive AI governance law, and it has no state-law duty to inventory AI systems, to conduct impact assessments, to disclose automated decision-making to consumers, or to register high-risk systems. A pitch built around a Pennsylvania AI Act is a pitch for a statute that does not exist. Pittsburgh buyers in healthcare, insurance, manufacturing, higher education, and energy do not share one filing under that missing statute.

There is also no comprehensive consumer data privacy law. HB 78 passed the House 127-76 on October 1, 2025. The Senate gave it second consideration on June 25, 2026, then laid it on the table and removed it from the table on October 6, 2026. It has not become law. A privacy program scoped as if that bill were already enacted is scoped to a bill that is still pending.

Digital forgery is a criminal statute with a mental state

Act 35 of 2025 created 18 Pa.C.S. § 4101.1. It was approved July 7, 2025 and took effect in 60 days, on September 5, 2025. The offense requires intent to defraud or injure, or knowledge and intent that the person is facilitating a fraud or injury, plus generating or creating and distributing a forged digital likeness as genuine, plus that the person knows or reasonably should know that it is a forged digital likeness. A forged digital likeness is a computer-generated visual representation of an actual and identifiable individual, or an audio recording of that individual’s voice. It has to closely resemble a genuine representation, materially misrepresent appearance, speech, or behavior so that the fundamental character is changed, be likely to deceive a reasonable person, and be created and distributed without consent. The statute does not limit that individual to a Pennsylvania resident.

Grading is a misdemeanor of the first degree, or a felony of the third degree where the person is involved in a scheme to defraud, coerce, or commit theft of monetary assets or property. One exception is a constitutionally protected activity. A law enforcement officer performing official duties is also outside the section. A provider or developer of the technology, and an information service or access software provider described in the statute, are outside it as well. That exception does not say the provider must have avoided intentionally facilitating the offense. It protects the tool provider. It does not protect the organization that generates and distributes the output. An affirmative defense is available where the defendant took reasonable action to place viewers or listeners on notice that the forged digital likeness was not genuine. County district attorneys and the Attorney General enforce the statute. It is not a compliance regime with a filing calendar. It is the Pennsylvania provision most likely to reach a marketing team generating synthetic voice or video of a real person.

Act 125 of 2024 was approved October 29, 2024. It amends Titles 18 and 61. The official short title further provides for unlawful dissemination of an intimate image, for sexual abuse of children, and for transmission of sexually explicit images by a minor, and it replaces the phrase “child pornography” with “child sexual abuse material.” The co-sponsorship memo subject is combating AI-generated child sexual abuse material and deepfakes. The statute matters to a platform, a school system, or an internal reporting duty. It is not a governance obligation for a typical enterprise deployment. An inspection model in a plant, or a claims model at an insurer, does not enter Act 125 because the building is in Pennsylvania.

The insurance notice is guidance, and it has a defined audience

Insurance Department Notice 2024-04 was published on April 6, 2024, at 54 Pa.B. 1910. It is guidance, not a regulation. It recognizes the NAIC Principles of Artificial Intelligence adopted in 2020. The audience is every insurer that holds a certificate of authority, or is otherwise authorized to engage in the business of insurance, in Pennsylvania. A hospital, a manufacturer, a campus, or an energy company does not enter the notice by buying a policy or by sitting in Pittsburgh.

What the notice describes for that audience is specific, although the notice states that its guidelines are not binding. Decisions or actions that affect consumers and that are made or supported by AI systems must comply with all existing insurance law, including the unfair trade practice and unfair discrimination provisions. The notice describes a written AI Systems program. The program covers governance, senior management accountability, risk controls, internal audit, the full model lifecycle, third-party vendor and data-source due diligence, and documentation. On an investigation or examination the Department may ask for the written program, predictive-model inventories and documentation, validation and testing, and third-party contracts.

The notice is guidance rather than a regulation, and it carries no standalone penalty. Consequences, when they come, come through existing insurance law and through examination findings. For an insurer the Department examines, the notice is still the list the Department has said it may request.

The executive order binds the Commonwealth, and enforcement did not wait

Executive Order 2023-19 was signed on September 20, 2023. The order sets core values for Commonwealth use of generative AI. It creates a Generative AI Governing Board. It directs agency training and policy. Implementation runs through the Commonwealth Use of Public Generative Artificial Intelligence Policy. In March 2025 the Administration established a Generative AI Labor and Management Collaboration Group.

Read the addressee plainly. The order governs Commonwealth agencies and Commonwealth employees. It creates no obligation for a private hospital, a private employer, a private insurer, or a law firm. It is often cited as if it were Pennsylvania AI law. It is not. For a vendor selling AI to the Commonwealth, the order and the Governing Board are procurement context. A private organization that is not in that sale is not measured against the order. Pittsburgh is not the seat of state government, and a private organization here does not become a Commonwealth agency by operating in the state.

Enforcement has moved without a comprehensive statute. On February 27, 2026 the Governor announced a 12-member AI Enforcement Task Force inside the Department of State, together with a public complaint channel, an AI literacy toolkit, and coordination with the Attorney General. Commonwealth pages reviewed on October 20, 2026 still describe that task force. On May 1, 2026 the Department of State filed in Commonwealth Court and asked the court to order a company to cease and desist from the unlawful practice of medicine. The May 5, 2026 announcement describes that filing as seeking a preliminary injunction. The complaint alleges a violation of section 422.38 of the Medical Practice Act. A professional-conduct investigator found a character presented as a doctor of psychiatry that asked about booking an assessment, said an assessment to see whether medication could help was within its remit as a doctor, and gave a Pennsylvania license number the complaint says is not valid. The theory pleaded is the licensure statute. There was no AI act to plead.

On May 27, 2025 the Attorney General announced an assurance of voluntary compliance with a property-management company for $45,000. The figure is $30,000 in consumer restitution and $15,000 in costs, under the Unfair Trade Practices and Consumer Protection Law and the Landlord and Tenant Act. Consumers in that matter attributed maintenance delays and unsafe leasing to the company’s AI platform. The platform was the mechanism. The statutes pleaded were not AI statutes. On December 10, 2025 the Attorney General led a letter from 42 attorneys general asking major AI developers for chatbot safeguards. There is no single AI regulator. The February 27 announcement said the Administration is working with the Attorney General on enforcement.

For a healthcare organization, the near-term exposure is licensure and consumer protection, not a governance statute. A patient-facing conversational system must not present itself as a licensed clinician, should not imply it can assess for or prescribe medication, and must not schedule clinical care under an implied credential. TrustEdge recommends that the system also disclose that it is not a person. The Department of State has a complaint intake, a task force, and a case on file that concerns presentation as a licensed professional. No Pennsylvania statute specific to AI governs hiring. Federal law and the Pennsylvania Human Relations Act still govern hiring decisions, including those an AI system supports.

Bills on the calendar are not filings

SB 1090, the Safeguarding Adolescents from Exploitative Chatbots and Harmful AI Technology Act, passed the Senate 49-1 on March 17, 2026 and was referred to the House Communications and Technology Committee on March 18, 2026. That referral is still the last action. It has not been reported, passed by the House, or signed. The official short title provides for disclosures and safeguards and imposes duties on the Attorney General.

HB 1925 passed the House 144-59 on September 30, 2026 and was referred to the Senate Institutional Sustainability and Innovation Committee on October 14, 2026. It is not law. As passed by the House, a facility using AI for clinical decision-making would disclose that use, could not let the system supersede a human health care provider, and would file an annual statement with the Department of Health. An insurer, and a Medical Assistance or CHIP managed care plan, using AI in utilization review would disclose that use. Before a decision to deny, reduce, or terminate a benefit, a health care provider participating in that review would review the individual clinical record and exercise judgment independent of the AI recommendation. Annual statements would go to the Insurance Department for an insurer and to the Department of Human Services for a Medical Assistance or CHIP plan. The House text also authorizes a temporary prohibition on new enrollment for a noncompliant insurer and for a noncompliant Medical Assistance or CHIP plan. SB 1113, a Senate bill on the same subject, was referred to that Senate committee on January 9, 2026 and has no recorded votes. It is not the House-passed text.

SB 806, the Artificial Intelligence Deceptive Advertising Act, passed the Senate 48-2 on June 10, 2026 and the House 163-40 on October 7, 2026, both on the same printer’s number. The bill page’s last action is that House passage. It is not an act. If enacted, an advertiser could not knowingly, recklessly, or willfully disseminate an advertisement that uses synthetic content to create a false consumer perception about the nature, origin, or authenticity of the goods or services without a clear and conspicuous disclosure that the advertisement contains content modified or generated using AI. The text excepts content that is evidently fictional, parody, satire, commentary, or criticism, or limited to text. Executive Order 2026-05, signed August 18, 2026, directs Commonwealth agencies on data-center permitting. It does not impose an AI-governance duty on a private organization. A bill that has not become law is not a filing.

How the work is delivered in Pittsburgh

The governance readiness assessment is scoped by the work, not by a Pennsylvania form. The work products are the AI already running, features included, even when a register never listed them, the certification boundary those systems already sit inside, the contracts, and a gap list measured against ISO/IEC 42001 and the NIST AI Risk Management Framework. Pennsylvania’s criminal statutes are not the score on that list. The people compiling the inventory sit with the owners of each system, in the building where the system is used.

On the AI Academy page the readiness diagnostic is free and runs about five minutes, and it returns a scorecard. It will not stand in for the governance inventory. When TrustEdge assesses another organization, the credential for that work is HITRUST Authorized External Assessor. TrustEdge does not hold a HITRUST certification, and the organization that was assessed does not receive one from the review.

Regulatory context

The Pennsylvania rules that reach Pittsburgh buyers

No comprehensive AI statute. Two narrow criminal statutes, an insurance notice, and a state-agency executive order — and a Department of State case under the Medical Practice Act against one AI company.

There is no Pennsylvania AI Act

Pennsylvania has no equivalent of the Colorado, Texas, or California AI statutes. There is no state-law duty to inventory AI systems, conduct impact assessments, disclose automated decision-making to consumers, or register high-risk systems. Anyone selling you "Pennsylvania AI Act compliance" is selling something that does not exist. Pennsylvania also has no comprehensive consumer data privacy law. HB 78 passed the House 127-76 on October 1, 2025. The Senate gave it second consideration on June 25, 2026, then laid it on the table and removed it from the table on October 6, 2026. It has not become law.

Act 35 of 2025 — digital forgery (18 Pa.C.S. § 4101.1)

Approved July 7, 2025 as Act 35 of 2025, and effective in 60 days, on September 5, 2025. A person commits digital forgery if, with intent to defraud or injure anyone, or with knowledge and intent that the person is facilitating a fraud or injury to be perpetrated by anyone, the person generates or creates and distributes a forged digital likeness as genuine, and knows or reasonably should know that it is a forged digital likeness. A forged digital likeness is a computer-generated visual representation of an actual and identifiable individual, or an audio recording of that individual's voice, that closely resembles a genuine representation, materially misrepresents appearance, speech, or behavior so that the fundamental character is changed, is likely to deceive a reasonable person, and was created and distributed without consent. The statute does not limit the individual to a Pennsylvania resident. The offense is a misdemeanor of the first degree, or a felony of the third degree when the person is involved in a scheme to defraud, coerce, or commit theft of monetary assets or property. It does not apply to a constitutionally protected activity, to a law enforcement officer performing official duties, to a provider or developer of technology used to create the visual representation or audio recording, or to an information service, system, or access software provider that provides or enables computer access by multiple users to a computer server. Those provider exceptions do not contain an "intentionally facilitate" qualifier, and they protect the provider, not the organization that generates and distributes the output. An affirmative defense is available where the defendant took reasonable action to place viewers or listeners on notice that the forged digital likeness was not genuine. The section is not to be construed to restrict detection of, or a response to, security incidents, identity theft, fraud, harassment, or other illegal activity. This is a criminal statute enforced by prosecutors, not a compliance regime, and it is the provision most likely to reach a marketing team generating synthetic voice or video of a real person.

Insurance Department Notice 2024-04 — AI systems used by insurers

Published April 6, 2024, at 54 Pa.B. 1910. The notice does not enact a regulation. It reminds every insurer that holds a certificate of authority, or is otherwise authorized to engage in the business of insurance in Pennsylvania, that decisions or actions impacting consumers that are made or supported by AI systems must comply with all applicable insurance laws, including unfair trade practices and unfair discrimination. It recognizes the NAIC Principles of Artificial Intelligence adopted in 2020 as guidance. The notice describes a written program for the responsible use of those AI systems, covering governance, senior-management accountability to the board, risk-management controls, internal audit, the full model life cycle, third-party data and vendor due diligence, and documentation. On an investigation or examination the Department may ask for the written program, predictive-model inventories and documentation, validation and testing, and third-party contracts. The notice states that its guidelines are not binding. For an insurer the Department examines, the notice is still the list the Department has said it may request.

Executive Order 2023-19 binds state agencies, not you

Signed September 20, 2023. It establishes core values for Commonwealth use of generative AI, creates a Generative AI Governing Board, and directs agency training and policy. It is implemented through the Commonwealth Use of Public Generative Artificial Intelligence Policy. In March 2025 the Administration established a Generative AI Labor and Management Collaboration Group. Read the addressee plainly: the order governs Commonwealth agencies and Commonwealth employees. It creates no obligation for a private hospital, employer, insurer, or law firm. It is frequently cited as though it were Pennsylvania AI law. It is not.

All Pennsylvania AI provisions, in full →

Reviewed against primary sources as of September 14, 2026.

This page summarizes public law for orientation and is not legal advice.

How we help

What we do in Pittsburgh

Other markets we serve on-site

Talk to us about AI governance in Pittsburgh

No pitch, no pressure. We will tell you what is actually in scope and what an assessor will accept.

Schedule a Consultation (415) 644-8208