Florida AI Regulations
Governor DeSantis backed an Artificial Intelligence Bill of Rights through the 2026 regular session and again through an April special session. The Senate passed it both times. The House refused to take it up both times. Florida therefore has no general AI governance obligation for private-sector deployers. The AI-specific law on the books is narrow and subject-matter-limited. The real Florida AI risk for most organizations is not a compliance statute — it is the Attorney General, who sued OpenAI on June 1, 2026 under the state's deceptive-practices act.
Last reviewed against primary sources: . AI legislation is moving quickly — statutes have been delayed, repealed and replaced mid-cycle. Verify against the linked primary sources before relying on any date here.
Where we work in Florida
TrustEdge serves organizations across Florida, including these markets.
In-Depth Analysis
Florida is the clearest case in the country of a state that tried twice to regulate AI and did not.
The Governor announced an Artificial Intelligence Bill of Rights in December 2025. It covered chatbot access for minors, AI disclosure, name-image-and-likeness protection, and restrictions on government AI contracts with vendors tied to foreign countries of concern. The Senate liked it. It passed 35-2 in the regular session and 37-1 in the special session. The House would not hear it either time, on the view that AI belongs to federal policy. That is where matters stand as of August 2026.
So a Florida buyer should be told plainly: there is no Florida analog to the Colorado, Texas, or Illinois regimes. No inventory duty. No impact assessment. No notice-and-explanation right. No human-review requirement.
The Florida Digital Bill of Rights is often cited as Florida's automated-decision law. It is not, in any practical sense. Its profiling opt-out binds controllers with more than $1 billion in global gross annual revenue that also sell online advertising at scale, operate a smart speaker, or run a large app store. That describes a handful of technology platforms. It does not describe a hospital system, a regional bank, or a state contractor.
What should actually change a Florida organization's behavior is enforcement posture rather than statute. The Attorney General sued OpenAI and its chief executive on June 1, 2026, pleading deceptive practices, product liability, and public nuisance. That theory does not need an AI statute. It needs a product that behaved differently from how it was marketed. Any organization deploying a customer-facing AI system in Florida — a triage chatbot, an intake assistant, an automated claims tool — is exposed to the same theory if its own claims about the system outrun its evidence.
The defensible position is documentation: what the system does, what it was tested against, what it was told not to do, and what a user was told about it.
Practical Implications for SMBs & Healthcare
If you operate only in Florida, you are almost certainly out of scope of every Florida AI provision on the books. Say that out loud in your governance program rather than manufacturing a Florida workstream.
The exception is multi-state operation. Florida is a permissive jurisdiction, so your binding obligations will come from Colorado, Illinois, Texas, the EU AI Act, or your sector regulator. Build to the strictest regime you actually touch and Florida takes care of itself.
Healthcare organizations in particular should note what did not pass. HB 281 would have restricted AI in clinical, counseling, and therapy services and it died in its first subcommittee. Your controls on clinical AI are driven by HIPAA, FDA device rules, medical-staff governance, and your own liability exposure — not by Florida law.
The real Florida-specific exposure is marketing claims. The Attorney General's theory against OpenAI is that the product was promoted while known risks were downplayed. That is a FDUTPA question, it applies to any business, and it is the one place where an AI deployment can create Florida legal risk today. Do not describe an AI system to Florida consumers or patients in terms your testing does not support.
Key Provisions
There is no Florida AI Act
Nothing in Florida law requires a private-sector organization to inventory AI systems, run impact assessments, disclose automated decision-making, provide human review of an adverse outcome, or notify consumers that they are interacting with AI. CS/SB 482 would have created parts of that framework. It passed the Senate 35-2 on March 4, 2026 and died in Messages on March 13, 2026. SB 2-D, the special-session version, passed the Senate 37-1 on April 28, 2026 and died in a House subcommittee the next day. House leadership took the position that AI should be regulated federally.
Florida Digital Bill of Rights — profiling opt-out, but a threshold almost nobody meets
The FDBR gives Florida consumers a right to opt out of "profiling in furtherance of a decision that produces a legal or similarly significant effect," where profiling means any form of solely automated processing used to evaluate or predict a person's economic situation, health, preferences, reliability, behavior, or location. That right binds only "controllers": for-profit entities with more than $1 billion in global gross annual revenue that also either derive over 50 percent of revenue from online advertising, operate a consumer smart speaker with a cloud virtual assistant, or run an app store with at least 250,000 applications. Three companies-worth of criteria, not a general business law. A separate consent requirement for processing sensitive data reaches more businesses than the controller provisions do.
Generative AI in political advertising — s. 106.145
Created by CS/HB 919 (2024) and effective July 1, 2024. A political advertisement, electioneering communication, or other miscellaneous advertisement that uses generative AI to depict a real person doing something that did not occur must carry the disclaimer "Created in whole or in part with the use of generative artificial intelligence (AI)." The duty attaches only where the content was created with intent to injure a candidate or deceive regarding a ballot issue. Violation is a first-degree misdemeanor. The Florida Elections Commission enforces through the s. 106.25 complaint process, with expedited hearing provisions.
Brooke's Law — 48-hour takedown of AI-altered sexual depictions
CS/CS/HB 1161 (2025) passed both chambers unanimously and was signed June 10, 2025 as chapter 2025-133, effective on approval. Covered platforms must establish and publicize a process for a victim to request removal of a sexually explicit depiction altered without consent, and must remove the material within 48 hours of a valid request. Non-compliance is treated as an unfair or deceptive practice. This is a hosting-platform duty, not an AI-development duty.
Attorney General enforcement is the live risk
On June 1, 2026 Attorney General James Uthmeier filed an 83-page civil complaint against five OpenAI entities and Sam Altman personally — the first state-led suit of its kind. The complaint pleads counts under the Florida Deceptive and Unfair Trade Practices Act alongside negligence, gross negligence, strict product liability, fraudulent misrepresentation, and public nuisance, and seeks civil penalties of up to $10,000 per violation, injunctive relief, damages, and disgorgement. A separate criminal investigation, announced April 21, 2026, concerns the Florida State University shooter's use of ChatGPT. The theory is consumer deception and product safety, not AI-specific regulation — which means it does not require an AI statute to work.
Sector bills that did not pass
SB 146 would have directed the Florida Digital Service to study state-agency AI use; it died in committee March 13, 2026. HB 281 would have restricted AI in psychological, clinical, counseling, and therapy services; it died in the Health Professions & Programs Subcommittee the same day. Florida has no statute governing AI in clinical care, utilization review, claims adjudication, or state-agency procurement. Healthcare and insurance organizations operating in Florida are governed by HIPAA, FDA, and existing insurance law — not by a Florida AI rule.
Data centers, not models
The one AI-adjacent thing that did pass in 2026 is CS/CS/SB 484, signed May 7, 2026 and effective July 1, 2026. It addresses large-load utility service and water permitting for large-scale data centers, preserves local land-use authority, and orders a study of data center construction and operations. It regulates the physical infrastructure. It does not regulate AI systems, models, or deployments.
Bills & Statutes
Artificial Intelligence Bill of Rights
Passed Senate 35-2 on March 4, 2026; died in Messages March 13, 2026. Not law
Read the primary source(opens in a new tab)Artificial Intelligence Bill of Rights
Passed Senate 37-1 on April 28, 2026; died in House Information Technology Budget & Policy Subcommittee April 29, 2026. Not law
Read the primary source(opens in a new tab)Florida Digital Bill of Rights
Signed June 6, 2023; most provisions effective July 1, 2024
Read the primary source(opens in a new tab)Artificial Intelligence Use in Political Advertising — creates s. 106.145, Fla. Stat.
Signed 2024; effective July 1, 2024
Read the primary source(opens in a new tab)Removal of Altered Sexual Depictions Posted without Consent ("Brooke's Law")
Signed June 10, 2025 as ch. 2025-133; effective on approval
Read the primary source(opens in a new tab)Use of Artificial Intelligence by State Agencies
Died in Governmental Oversight and Accountability Committee March 13, 2026. Not law
Read the primary source(opens in a new tab)Use of Artificial Intelligence in Psychological, Clinical, Counseling, and Therapy Services
Died in Health Professions & Programs Subcommittee March 13, 2026. Not law
Read the primary source(opens in a new tab)Data Centers
Signed May 7, 2026; effective July 1, 2026
Read the primary source(opens in a new tab)Applicability & Enforcement
Who It Applies To
No general AI obligation applies to private-sector deployers in Florida. The FDBR profiling opt-out reaches only for-profit controllers with over $1 billion in global gross annual revenue that also meet an advertising, smart-speaker, or app-store criterion. Section 106.145 reaches political advertisers using generative AI with intent to injure a candidate or deceive on a ballot issue. Brooke's Law reaches platforms hosting user-generated content. Everyone else deploying AI in Florida — hospitals, banks, law firms, state contractors — is outside any Florida AI statute today.
Enforcement
The Florida Department of Legal Affairs, in the Office of the Attorney General, enforces the Florida Digital Bill of Rights and the Brooke's Law takedown duty, and enforces the Florida Deceptive and Unfair Trade Practices Act generally. The FDBR allows a 45-day cure period after written notice, except for violations involving a known child. The Florida Elections Commission enforces the s. 106.145 political-advertising disclaimer. The FDBR expressly creates no private cause of action. The Attorney General has been the most active AI enforcer in the state, announcing a criminal investigation into OpenAI on April 21, 2026 and filing a civil suit against OpenAI and its CEO on June 1, 2026.
Penalties
Florida Digital Bill of Rights: civil penalties up to $50,000 per violation, tripled for a violation involving a Florida consumer who is a known child, failure to delete or correct personal data after an authenticated request, or continuing to sell or share personal data after an opt-out. Section 106.145: first-degree misdemeanor for omitting the required generative-AI disclaimer, plus civil penalties provided by law. Brooke's Law: non-compliance treated as an unfair or deceptive practice. The Attorney General's OpenAI complaint seeks FDUTPA civil penalties of up to $10,000 per violation, plus injunctive relief, damages, and disgorgement.
Recommended Compliance Actions
Steps organizations should consider to prepare for and comply with Florida's AI regulations.
- 1
Record the conclusion that Florida imposes no general AI compliance obligation, with the date and the primary sources. A documented "out of scope" finding is a governance artifact; an undocumented assumption is not.
- 2
Check the Florida Digital Bill of Rights threshold once and move on. Unless you exceed $1 billion in global gross annual revenue and meet the advertising, smart-speaker, or app-store criterion, the profiling opt-out does not reach you.
- 3
Review every public claim you make about an AI system deployed in Florida against what you have actually tested. FDUTPA reaches marketing statements regardless of whether an AI statute exists, and the Attorney General has shown he will use it.
- 4
If you host user-generated content, confirm you have a published removal request process and can act on a valid Brooke's Law request within 48 hours.
- 5
If you buy political or issue advertising, confirm your agency applies the s. 106.145 disclaimer where generative AI depicts a real person.
- 6
Adopt a voluntary framework — the NIST AI RMF or ISO/IEC 42001 — for the governance structure Florida does not mandate. Regulated-industry customers, insurers, and health-system procurement will ask for it long before Tallahassee does.
- 7
Watch the 2027 regular session. The Senate has passed an AI Bill of Rights twice by wide margins and the Governor is behind it. The only thing stopping it has been House leadership.
Related TrustEdge Services
As of September 14, 2026. We are not lawyers and this is not legal advice. It is the responsibility of consumers of this data that they verify the applicability and current ratified statutes and legal precedence with a qualified attorney licensed in the state or country they are researching.
Need Help with AI Compliance?
Our team helps organizations build compliance-first AI systems that meet current and emerging regulatory requirements.