Pennsylvania AI Regulations
Pennsylvania has not enacted a comprehensive AI governance law. What it has is a criminal digital-forgery statute (Act 35 of 2025), an AI-generated sexual-imagery statute (Act 125 of 2024), an Insurance Department notice on AI systems used by insurers, and an executive order that governs Commonwealth agencies and no one else. The Department of State filed suit against Character Technologies, Inc. on May 1, 2026 under the Medical Practice Act, and the Attorney General settled an AI-related matter in May 2025 under the Unfair Trade Practices and Consumer Protection Law. Bills that moved in 2026, including one that has passed both chambers, are not law.
Last reviewed against primary sources: . AI legislation is moving quickly — statutes have been delayed, repealed and replaced mid-cycle. Verify against the linked primary sources before relying on any date here.
Where we work in Pennsylvania
TrustEdge serves organizations across Pennsylvania, including these markets.
In-Depth Analysis
Pennsylvania is a state where the absence of a comprehensive AI statute tells you little about exposure.
Two narrow criminal acts are on the books. A buyer who stops there would treat Pennsylvania as low risk. The Character Technologies filing is the reason not to. The Department of State did not plead an AI statute. The May 1, 2026 complaint uses the Medical Practice Act and alleges that a character was presented as a "doctor of psychiatry" and gave a Pennsylvania license number the complaint says is not valid. The theory is licensure. It has not been decided. Every regulated profession in Pennsylvania has a practice act, and those acts prohibit holding yourself out as licensed. A conversational system that implies professional judgment puts that question in play whether or not an AI statute exists.
The Home365 assurance is the second lesson. The pleaded statutes were the Unfair Trade Practices and Consumer Protection Law and the Landlord and Tenant Act. Habitability, utilities, repairs, and security deposits were the allegations. Consumers attributed the delays to an AI platform. The platform was the mechanism. The settlement does not create an AI code.
Executive Order 2023-19 is procurement context for a vendor selling to the Commonwealth. It governs Commonwealth agencies and employees. A private hospital or employer is not measured against it. Executive Order 2026-05, signed August 18, 2026, is the same kind of instrument on a different subject: it directs agencies on data-center permitting. It is not a duty to inventory a private organization's models.
For insurers, Notice 2024-04 is the written guidance. It is guidance, and the notice says the guidelines are not binding. It is also the list an examiner may request. Treat the written program as a deliverable.
The 2026 session moved bills and enacted none of them. SB 1090 is still in the House Communications and Technology Committee, where it was referred on March 18, 2026. HB 1925 passed the House on September 30, 2026 and was referred to a Senate committee on October 14. SB 806 passed both chambers on the same printer's number, and the bill page's last action is the House vote on October 7, 2026. HB 78 had second consideration in the Senate and was removed from the table on October 6, 2026. A bill that has not become law is not a filing.
Practical Implications for SMBs & Healthcare
If you are an insurer authorized in Pennsylvania, Notice 2024-04 is the guidance the Insurance Department has written down. Write the program, document the models, and keep third-party contracts and validation results in a form you can hand to an examiner.
If you are a healthcare organization, the near-term exposure is licensure and consumer protection, not a governance statute. A patient-facing conversational system must not present itself as a licensed clinician, should not imply it can assess for or prescribe medication, and must not schedule clinical care under an implied credential. TrustEdge recommends that the system also disclose that it is not a person. The Department of State has a complaint intake, a task force announced on February 27, 2026, and a case on file that concerns presentation as a licensed professional.
If you are an employer, no Pennsylvania statute specific to AI governs hiring. Federal law and the Pennsylvania Human Relations Act still govern hiring decisions, including those an AI system supports.
If marketing or communications teams generate synthetic voice or video of a real person, brief them on Act 35. The technology-provider exception protects the provider or developer of the tool, not the organization that generates and distributes the output. Distribution without consent is an element of the offense. Reasonable action to place viewers or listeners on notice that the likeness was not genuine is the affirmative defense.
Do not wait for a Pennsylvania AI Act before doing that work. The Home365 assurance and the Character Technologies filing both proceeded without one. Do not build a filing calendar for HB 1925, SB 806, or SB 1090 until one becomes law.
Key Provisions
There is no Pennsylvania AI Act
Pennsylvania has no equivalent of the Colorado, Texas, or California AI statutes. There is no state-law duty to inventory AI systems, conduct impact assessments, disclose automated decision-making to consumers, or register high-risk systems. Anyone selling you "Pennsylvania AI Act compliance" is selling something that does not exist. Pennsylvania also has no comprehensive consumer data privacy law. HB 78 passed the House 127-76 on October 1, 2025. The Senate gave it second consideration on June 25, 2026, then laid it on the table and removed it from the table on October 6, 2026. It has not become law.
Act 35 of 2025 — digital forgery (18 Pa.C.S. § 4101.1)
Approved July 7, 2025 as Act 35 of 2025, and effective in 60 days, on September 5, 2025. A person commits digital forgery if, with intent to defraud or injure anyone, or with knowledge and intent that the person is facilitating a fraud or injury to be perpetrated by anyone, the person generates or creates and distributes a forged digital likeness as genuine, and knows or reasonably should know that it is a forged digital likeness. A forged digital likeness is a computer-generated visual representation of an actual and identifiable individual, or an audio recording of that individual's voice, that closely resembles a genuine representation, materially misrepresents appearance, speech, or behavior so that the fundamental character is changed, is likely to deceive a reasonable person, and was created and distributed without consent. The statute does not limit the individual to a Pennsylvania resident. The offense is a misdemeanor of the first degree, or a felony of the third degree when the person is involved in a scheme to defraud, coerce, or commit theft of monetary assets or property. It does not apply to a constitutionally protected activity, to a law enforcement officer performing official duties, to a provider or developer of technology used to create the visual representation or audio recording, or to an information service, system, or access software provider that provides or enables computer access by multiple users to a computer server. Those provider exceptions do not contain an "intentionally facilitate" qualifier, and they protect the provider, not the organization that generates and distributes the output. An affirmative defense is available where the defendant took reasonable action to place viewers or listeners on notice that the forged digital likeness was not genuine. The section is not to be construed to restrict detection of, or a response to, security incidents, identity theft, fraud, harassment, or other illegal activity. This is a criminal statute enforced by prosecutors, not a compliance regime, and it is the provision most likely to reach a marketing team generating synthetic voice or video of a real person.
Act 125 of 2024 — AI-generated sexual imagery
Approved October 29, 2024 as Act 125 of 2024 (SB 1213). The official short title amends Titles 18 and 61, further provides for unlawful dissemination of an intimate image, further provides for sexual abuse of children and for transmission of sexually explicit images by a minor, and replaces references to "child pornography" with "child sexual abuse material." The co-sponsorship memo subject is combating AI-generated child sexual abuse material and deepfakes. Relevant to a platform, a school system, or an internal reporting duty; not a governance obligation for a typical enterprise deployment.
Insurance Department Notice 2024-04 — AI systems used by insurers
Published April 6, 2024, at 54 Pa.B. 1910. The notice does not enact a regulation. It reminds every insurer that holds a certificate of authority, or is otherwise authorized to engage in the business of insurance in Pennsylvania, that decisions or actions impacting consumers that are made or supported by AI systems must comply with all applicable insurance laws, including unfair trade practices and unfair discrimination. It recognizes the NAIC Principles of Artificial Intelligence adopted in 2020 as guidance. The notice describes a written program for the responsible use of those AI systems, covering governance, senior-management accountability to the board, risk-management controls, internal audit, the full model life cycle, third-party data and vendor due diligence, and documentation. On an investigation or examination the Department may ask for the written program, predictive-model inventories and documentation, validation and testing, and third-party contracts. The notice states that its guidelines are not binding. For an insurer the Department examines, the notice is still the list the Department has said it may request.
Executive Order 2023-19 binds state agencies, not you
Signed September 20, 2023. It establishes core values for Commonwealth use of generative AI, creates a Generative AI Governing Board, and directs agency training and policy. It is implemented through the Commonwealth Use of Public Generative Artificial Intelligence Policy. In March 2025 the Administration established a Generative AI Labor and Management Collaboration Group. Read the addressee plainly: the order governs Commonwealth agencies and Commonwealth employees. It creates no obligation for a private hospital, employer, insurer, or law firm. It is frequently cited as though it were Pennsylvania AI law. It is not.
Enforcement is running ahead of legislation
On February 27, 2026 the Governor announced a 12-member AI Enforcement Task Force inside the Department of State, a public complaint channel at pa.gov/ReportABot, an AI Literacy Toolkit at pa.gov/AIsafety, and coordination with the Attorney General. Commonwealth pages reviewed on October 20, 2026 still describe that task force. On May 1, 2026 the Department of State, State Board of Medicine, filed a petition in Commonwealth Court at docket 220 MD 2026 against Character Technologies, Inc. The complaint alleges a violation of section 422.38 of the Medical Practice Act, 63 P.S. §§ 422.1–422.53, and asks the court to order the company to cease and desist from the unlawful practice of medicine. The May 5, 2026 announcement describes the filing as seeking a preliminary injunction. The complaint says a professional conduct investigator found a character described as a "doctor of psychiatry" that asked about booking an assessment, said an assessment to see whether medication could help was within its remit as a doctor, and gave a Pennsylvania license number the complaint says is not valid. On May 27, 2025 the Attorney General announced an Assurance of Voluntary Compliance with Home365, LLC. Home365 agreed to pay $45,000, of which $30,000 is consumer restitution and $15,000 is costs, under the Unfair Trade Practices and Consumer Protection Law and the Landlord and Tenant Act. Consumers in that matter attributed maintenance delays and unsafe leasing to the company's AI platform. On December 10, 2025 Attorney General Dave Sunday led a letter from 42 attorneys general asking major AI developers for chatbot safeguards.
What is pending — and what it would change
SB 1090, the Safeguarding Adolescents from Exploitative Chatbots and Harmful AI Technology Act, passed the Senate 49-1 on March 17, 2026 and was referred to the House Communications and Technology Committee on March 18, 2026. That referral is still the last action. It has not been reported, passed by the House, or signed. The official short title provides for disclosures and safeguards relating to the use of artificial intelligence and imposes duties on the Attorney General. HB 1925 passed the House 144-59 on September 30, 2026, on printer's number 3963, and was referred to the Senate Institutional Sustainability and Innovation Committee on October 14, 2026. It is not law. As passed by the House it would amend Titles 35, 40, and 67. A facility using AI for clinical decision-making would disclose that use, could not let the system supersede a human health care provider, and would file an annual compliance statement with the Department of Health. An insurer, and a Medical Assistance or CHIP managed care plan, using AI in utilization review would disclose that use. Before a decision to deny, reduce, or terminate a benefit, a health care provider participating in that review would review the individual clinical record and exercise judgment independent of the AI recommendation. Annual compliance statements would go to the Insurance Department for an insurer and to the Department of Human Services for a Medical Assistance or CHIP plan. The House text also authorizes a temporary prohibition on new enrollment for a noncompliant insurer and for a noncompliant Medical Assistance or CHIP plan. SB 1113, a Senate bill on the same subject that amends Titles 35 and 40, was referred to Institutional Sustainability and Innovation on January 9, 2026 and has no recorded votes. It is not the House-passed text. SB 806, the Artificial Intelligence Deceptive Advertising Act, passed the Senate 48-2 on June 10, 2026 and the House 163-40 on October 7, 2026, both on printer's number 1808. Two House floor amendments were not adopted. The bill page's last action is that House passage. It is not an act. If enacted, an advertiser could not knowingly, recklessly, or willfully disseminate an advertisement that uses synthetic content to create a false consumer perception about the nature, origin, or authenticity of the goods or services without a clear and conspicuous disclosure that the advertisement contains content modified or generated using AI. The text excepts content that is evidently fictional, parody, satire, commentary, or criticism, or limited to text. Executive Order 2026-05, signed August 18, 2026, directs Commonwealth agencies on data-center permitting. It does not impose an AI-governance duty on a private organization that deploys a model. None of these bills is law.
Bills & Statutes
Digital forgery — amends Title 18 (Crimes and Offenses) to create 18 Pa.C.S. § 4101.1
Signed July 7, 2025; effective September 5, 2025
Read the primary source(opens in a new tab)AI-generated sexual depictions and child sexual abuse material — amends Titles 18 and 61
Signed October 29, 2024
Read the primary source(opens in a new tab)Pennsylvania Insurance Department — Use of Artificial Intelligence Systems by Insurers
Published in the Pennsylvania Bulletin April 6, 2024, 54 Pa.B. 1910; guidance, not a regulation
Read the primary source(opens in a new tab)Expanding and Governing the Use of Generative Artificial Intelligence Technologies within the Commonwealth
Signed September 20, 2023; binds Commonwealth agencies and employees only
Read the primary source(opens in a new tab)Department of State petition alleging unlicensed practice of medicine under 63 P.S. § 422.38
Filed May 1, 2026, Commonwealth Court docket 220 MD 2026; injunction sought, not decided. The May 5, 2026 announcement describes the filing as seeking a preliminary injunction
Read the primary source(opens in a new tab)Governor newsroom account of the Department of State filing and the preliminary-injunction description
Published May 5, 2026
Read the primary source(opens in a new tab)Department of State task force, complaint channel, and AI Literacy Toolkit
Announced February 27, 2026; still described on pa.gov pages reviewed October 20, 2026
Read the primary source(opens in a new tab)Assurance of Voluntary Compliance with Home365, LLC — maintenance delays attributed to an AI platform
Announced May 27, 2025; $45,000, of which $30,000 is restitution and $15,000 is costs
Read the primary source(opens in a new tab)Letter led by Attorney General Sunday asking AI developers for chatbot safeguards
Announced December 10, 2025
Read the primary source(opens in a new tab)Safeguarding Adolescents from Exploitative Chatbots and Harmful AI Technology Act — disclosures and safeguards; duties on the Attorney General
Passed Senate 49-1 on March 17, 2026 (PN 1423); referred to House Communications and Technology March 18, 2026. Still there. Not law
Read the primary source(opens in a new tab)Artificial intelligence in facilities, by insurers, and by MA or CHIP managed care plans — Titles 35, 40, and 67
Passed the House 144-59 on September 30, 2026 (PN 3963); referred to Senate Institutional Sustainability and Innovation October 14, 2026. Not law
Read the primary source(opens in a new tab)Artificial intelligence in facilities, by insurers, and by MA or CHIP managed care plans — Titles 35 and 40
Referred to Senate Institutional Sustainability and Innovation January 9, 2026. No votes. Not law
Read the primary source(opens in a new tab)Artificial Intelligence Deceptive Advertising Act — disclosure when synthetic content in an advertisement creates a false consumer perception
Passed the Senate 48-2 on June 10, 2026 and the House 163-40 on October 7, 2026, both on PN 1808. Last action is that House passage. Not an act
Read the primary source(opens in a new tab)Consumer data privacy — duties of controllers and processors. Pennsylvania has no comprehensive privacy statute
Passed the House 127-76 on October 1, 2025. Senate second consideration June 25, 2026; laid on the table and removed from the table October 6, 2026. Not law
Read the primary source(opens in a new tab)Protecting Pennsylvania Consumers from Data Center Impacts
Signed August 18, 2026. Directs Commonwealth agencies on data-center permitting. Not an AI-governance statute
Read the primary source(opens in a new tab)Applicability & Enforcement
Who It Applies To
Act 35 of 2025 applies to a person who, with the intent and knowledge the statute requires, generates or creates and distributes a forged digital likeness of an actual and identifiable individual. The individual need not be a Pennsylvania resident. The statute does not apply to a constitutionally protected activity, to a law enforcement officer performing official duties, to a provider or developer of the technology used to create the representation or recording, or to an information service, system, or access software provider described in the section. Act 125 of 2024 amends Titles 18 and 61, including the intimate-image and child-sexual-abuse-material offenses in Title 18. Notice 2024-04 applies to every insurer that holds a certificate of authority or is otherwise authorized to engage in the business of insurance in Pennsylvania. Executive Order 2023-19 applies to Commonwealth agencies and employees and to no private organization. Executive Order 2026-05 directs Commonwealth agencies on data-center permitting and does not impose an AI-governance duty on a private deployer. Everything else reaching AI deployments in Pennsylvania is generally applicable law: the Unfair Trade Practices and Consumer Protection Law, the professional licensure statutes administered by the Department of State, and the Medical Practice Act.
Enforcement
There is no single AI regulator. Act 35 and Act 125 are criminal statutes enforced by county district attorneys and the Attorney General. Notice 2024-04 is guidance the Insurance Department may use on examination, alongside existing unfair-trade-practice authority. The Attorney General enforces the Unfair Trade Practices and Consumer Protection Law. The Department of State enforces professional licensure and unlicensed practice. On February 27, 2026 the Governor announced a 12-member AI Enforcement Task Force and a public complaint channel, and Commonwealth pages reviewed on October 20, 2026 still describe that task force. The Department of State filed against Character Technologies, Inc. on May 1, 2026. The February 27 announcement said the Administration is working with the Attorney General on enforcement.
Penalties
Digital forgery under Act 35 is a misdemeanor of the first degree, or a felony of the third degree where the person is involved in a scheme to defraud, coerce, or commit theft of monetary assets or property. Act 125 offenses are graded within the Crimes Code. The Home365 Assurance of Voluntary Compliance, announced May 27, 2025, is $45,000, of which $30,000 is consumer restitution and $15,000 is costs. The Character Technologies complaint seeks an injunction under the Medical Practice Act. Notice 2024-04 states no standalone penalty. Consequences under that notice, when they come, come through existing insurance law and examination findings.
Recommended Compliance Actions
Steps organizations should consider to prepare for and comply with Pennsylvania's AI regulations.
- 1
Insurers: build or refresh the written AI program Notice 2024-04 describes — governance, senior accountability, risk controls, internal audit, full life-cycle coverage, and third-party due diligence — and assemble the examination package (model documentation, validation and testing results, vendor contracts) before you are asked for it.
- 2
Run a licensure review of every consumer-facing conversational deployment. Ask whether the system could be read as holding itself out as a licensed professional under a Pennsylvania practice act. That is the theory pleaded in the Department of State's May 1, 2026 complaint.
- 3
Add a persistent disclosure that a companion-style or emotionally interactive deployment is not a person. SB 1090 would impose disclosure and safeguard duties if it is enacted. It is still in a House committee. Disclosure that the system is not a person is the safer posture (TrustEdge's recommendation). The case on file concerns presentation as a licensed professional.
- 4
Brief marketing, communications, and any team generating synthetic media on Act 35. Do not distribute a forged digital likeness of a real person without consent. Where the output could be taken as genuine, take reasonable action to place viewers or listeners on notice that it is not.
- 5
Treat Executive Order 2023-19 as procurement context, not a private-sector compliance obligation. If you sell to the Commonwealth, treat the order and the Generative AI Governing Board as procurement context.
- 6
If you operate a health care facility, an insurer, or a Medical Assistance or CHIP plan, read House-passed HB 1925 as a bill, not as a duty. It is in the Senate Institutional Sustainability and Innovation Committee. SB 1113 has not moved since its January 9, 2026 referral. Neither is law.
- 7
If you advertise with synthetic images, video, or audio, read Senate Bill 806 as a bill that has passed both chambers and is not an act. Do not treat the disclosure duty in printer's number 1808 as in force.
- 8
Do not defer AI governance on the ground that Pennsylvania has no comprehensive statute. The Unfair Trade Practices and Consumer Protection Law and the professional practice acts already apply, and both have been used.
Related TrustEdge Services
As of September 14, 2026. We are not lawyers and this is not legal advice. It is the responsibility of consumers of this data that they verify the applicability and current ratified statutes and legal precedence with a qualified attorney licensed in the state or country they are researching.
Need Help with AI Compliance?
Our team helps organizations build compliance-first AI systems that meet current and emerging regulatory requirements.