What is AI regulation in Pennsylvania?
AI regulation: countries and regions
Pennsylvania has no single AI Act; it uses targeted laws and policies instead. For example, Act 125 of 2024 criminalises creating or sharing non‑consensual sexual or child abuse images with AI, and Act 35 of 2025 makes using AI-generated voices or images to defraud someone a felony. State agencies must follow a 2023 executive order on responsible AI use, but otherwise Pennsylvania relies on general consumer and privacy laws and pending sector-specific bills.
Reviewed by Jackie, Head of Learning & Development, Levellers · Last reviewed 18 June 2026
What this means
Pennsylvania's approach to AI regulation is narrow and focused on specific abuses. It has not created a comprehensive AI law covering all technologies. Instead it has enacted a few statutes targeting high-risk cases (deepfakes and fraud) and issued guidance for government use. Key laws include Act 125 of 2024 - which makes it a crime to produce or distribute non‑consensual sexual images or child sexual content by any means, including AI - and Act 35 of 2025 - which criminalises creating fake "digital likenesses" (audio or video) of a person to defraud or harm them.
Other uses of AI are governed by existing rules. For example, fraud and consumer protection statutes still apply to AI schemes, and industries like banking or healthcare follow their usual regulations. The state has also issued an Executive Order 2023-19 directing all agencies to use AI responsibly and transparently; this created a Generative AI Board and required measures like human oversight of AI tools. Pennsylvania legislators have proposed additional measures (such as bills requiring AI use disclosures or safety measures for children's chatbots), but none of those are law yet.
In short, Pennsylvania's AI policy currently means new criminal penalties for certain harmful AI content, plus administrative guidelines for agencies. Otherwise it relies on the legal framework for fraud, privacy, and consumer protection to cover most AI issues.
Why it matters
Pennsylvania's targeted AI laws carry serious penalties that organisations must not overlook. For instance, using AI to imitate someone's voice and scam a customer can lead to felony fraud charges. That matters for any business developing voice-cloning or image-generation tools or offering AI-driven services. Likewise, nonprofits and schools must avoid AI-generated explicit images involving minors or intimate partners, since the law treats these as criminal even if AI‑made.
On the other hand, Pennsylvania's approach means most AI development isn't regulated by new state rules - yet. Companies using AI still need to comply with general consumer protection, privacy and intellectual property laws. And any organisation working with state government should note the Executive Order's requirements: agencies must include human review and clear disclosure when deploying AI solutions. Finally, as federal AI guidelines and new state bills emerge, businesses and policymakers in Pennsylvania should stay aware, because more AI-specific rules (like requiring AI disclosure to consumers) may be adopted soon.
How it works
Criminal Laws for AI Misuse
Pennsylvania has added specific crimes to address malicious AI content. Act 125 of 2024 amends the Crimes Code (Titles 18 and 61) to forbid certain AI-generated sexual images. It is now illegal to create, distribute or possess explicit images of an intimate partner without their consent, and criminal to produce or share any AI-generated sexual depictions of minors. Violating these provisions can result in felony charges under Pennsylvania law.
Act 35 of 2025 (the "digital forgery" law) adds a new offense in Title 18: creating a forged digital likeness (an AI-generated image or recording of someone) with intent to defraud or injure is a third-degree felony. In practice, this means tricks like cloning a grandchild's voice to extort money are punishable under this statute. The law explicitly allows certain exceptions (e.g. for law enforcement or protected speech) and defenses if the perpetrator disclosed the forgery. The Pennsylvania Attorney General or local district attorneys can prosecute these crimes like any other fraud or impersonation under the criminal code.
State AI Governance and Policies
For public-sector AI use, Governor Shapiro issued Executive Order 2023-19 (Sept 2023) to ensure responsible adoption. This order created the Commonwealth's Generative AI Governing Board and set principles (accuracy, transparency, privacy and human oversight). For example, the Office of Administration now pilots AI tools (like ChatGPT Enterprise for state employees) under strict rules. A state "Artificial Intelligence Policy" (effective Jan 2026) requires agencies to keep humans in the loop, record AI prompts for audits, and disclose to citizens when they are interacting with an AI system.
These governance measures are internal to state agencies and do not impose direct duties on private companies. However, they illustrate Pennsylvania's emphasis on balance: it encourages innovation in government efficiency while mandating testing, bias checks, and clear communication. In practice, any contractor or partner working with the state on AI projects must follow these guidelines and be prepared for oversight by the Commonwealth's AI Board and Chief Information Officer.
Consumer Protection and Transparency
Currently Pennsylvania has no general law requiring businesses to flag AI-generated content or provide consumers AI-related rights. Existing consumer protection laws (like the Unfair Trade Practices Act) apply to false or deceptive business practices, but they are not AI-specific. However, several bills have been introduced. House Bill 1857 (2025) - still in committee - would force companies to disclose when a customer is dealing with AI (and allow a human appeal in high-stakes decisions). Senate Bill 1090 (2026) - passed by the state Senate - would require safety disclosures and parental permission for AI chatbots used by minors.
Another legislative effort (HB 2314, passed by the House in 2026) would create a public education campaign on AI, run by the Attorney General's office. While these proposals show Pennsylvania is considering broader steps, none have taken effect yet. For now, businesses should monitor these developments. In the absence of specific statutes, organizations relying on AI are guided by general duties: avoid fraud, protect privacy, and follow ethical AI standards.
Examples
AI voice scam targeting seniors: A fraudster uses AI to clone a grandchild's voice and tricks an elderly Pennsylvanian into sending money. Under the new digital forgery law (Act 35/2025), this scheme is a felony because it uses a fake AI-generated likeness to defraud someone. Law enforcement could charge the perpetrator for digital forgery.
School AI chatbot for teens: A school district rolls out an unmoderated AI chatbot for student counseling. If SB 1090 (Protecting Children from Harmful AI Chat Interactions) becomes law, the school must warn parents and allow students to opt-out, because the bill requires disclosures and safeguards for minors using AI chatbots. (Until then, standard child safety and privacy rules apply.)
Government hearing transcript: A state agency attempts to save money by having AI transcribe a public hearing without a human stenographer. The Fiscal Code amendment (Act 45 of 2025) explicitly forbids using AI alone for transcripts in administrative proceedings. The agency would violate this provision unless a certified human reporter is present.
Common misunderstandings
"Pennsylvania has an AI licensing board or a comprehensive AI law." No - Pennsylvania's laws only target specific abuses. There is no AI agency; instead, general laws and regulations apply in most cases.
"All deepfakes are now illegal in PA." Not exactly. The new law bans producing deepfake content for fraud or harassment (especially sexual images and CSAM). Parody, news, research or other AI uses without intent to harm are not made criminal by those statutes.
"Businesses must already disclose any use of AI." Not yet. A disclosure requirement was proposed (HB 1857), but as of now no law requires all companies to say "this is AI". It's only a best practice for trust, not a legal obligation (yet).
"State employees aren't allowed to use ChatGPT." False. Pennsylvania encourages agencies to use AI carefully. The Executive Order and AI policy actually allow ChatGPT use with oversight - the goal is to enhance government services responsibly. There's no blanket ban, only rules.
"PA's privacy laws govern all AI data." Not specifically. Pennsylvania relies on its general privacy and data breach laws for digital data. There is no special "AI data protection" law yet, so protections are the same as for other customer information.
Risks and boundaries
Pennsylvania's AI rules have strict but narrow scope. They do not cover, for example, algorithmic bias, automated hiring decisions, or AI healthcare advice. Any AI not falling under the new criminal provisions is governed by the usual sector laws - for instance, HIPAA still covers health data, and financial regulators oversee algorithms in banking. Users cannot assume any broad "AI license" or guarantee of AI ethics beyond these specific laws. Also, Pennsylvania cannot overrule any federal AI regulations or initiatives; it remains subject to U.S. law and policy on AI. Finally, note that pending bills and future amendments could change the landscape - for example, if SB 1090 or AI disclosure laws pass, new requirements will apply.
What to do next
Leaders in Pennsylvania should update compliance programs for the new AI laws immediately. Any company using AI-generated media must ensure it is not used for fraud or non-consensual imagery. Firms should train staff to recognize and prevent "deepfake" fraud schemes and adjust customer policies accordingly. They should also monitor legislation closely: if disclosure and child-safety bills become law, processes will need to change (e.g. labelling AI content, adding parental controls on products). For public sector managers, implement the Governor's AI guidelines: appoint oversight, retain AI records, and enforce human review for significant decisions. Proactively develop an AI policy (aligned with the PA Office of Administration's guidance) to mitigate risk. Finally, engage with stakeholders - join the national conversation on AI standards, and consider giving feedback to regulators. Staying ahead of both compliance and best practices will be key as Pennsylvania's AI framework evolves.
FAQs
Does Pennsylvania ban all AI-generated images or voices?
No. Pennsylvania's laws target specific harms. It is illegal to use AI to create fake intimate images or child sexual content without consent, or to impersonate someone for fraud. But AI-generated content for legitimate or protected uses (like parody or research) is not banned by these statutes.
Must my company tell customers when it uses AI?
Not at present. Pennsylvania has no general AI transparency law yet. A bill was introduced to require disclosure of AI use by businesses, but it has not become law. For now, disclosure is a best practice but not legally mandated in PA.
What if my business uses an AI chatbot that speaks to children?
Currently Pennsylvania has no specific rule banning chatbots for minors. However, the Senate passed SB 1090 (2026) which would impose age-checks and warnings for minors using AI chatbots. If that bill becomes law, you will need to comply. For now, general child protection and consumer safety laws apply.
How are these laws enforced, and by whom?
Criminal AI violations (deepfakes for fraud, CSAM, etc.) are handled by local district attorneys or the Attorney General under the state crimes code. The Attorney General's office also enforces consumer and privacy laws if an AI application involves deception or identity misuse. In practice, if a violation is reported or discovered, law enforcement investigates it as a felony offense.
Can state agencies use AI like ChatGPT for internal use?
Yes. Under the Executive Order and PA's AI policy, agencies may use AI tools but must do so under strict oversight. Agencies must ensure transparency and fairness (for example, marking AI-generated communications) and cannot rely solely on AI for critical decisions without human review.
Is there a penalty for misusing AI aside from criminal charges?
Apart from criminal prosecution under Acts 125/35, Pennsylvania doesn't impose additional AI-specific fines or civil penalties yet. However, misuse could trigger other legal consequences (e.g. civil liability, regulatory action) under existing laws - for example, defamation, harassment, or unfair practice laws could apply depending on the case.
Where does Pennsylvania's AI policy fit in the national context?
Pennsylvania's approach is more limited than some proposals (it has no broad AI oversight board or data privacy law). It aligns with the federal-state trend of addressing the riskiest AI uses first. On the national stage, the state cooperates with federal guidance and awaits any federal AI legislation; meanwhile, Pennsylvania coordinates with other states via the Joint State Government Commission and law enforcement networks to stay current on AI risks.
Sources
Pennsylvania Department of Education: Deep Fake Images and Sextortion (Acts 125 and 35) - Official overview of Acts 125 (2024) and 35 (2025) showing that making or sharing AI-generated intimate images without consent or creating AI sexual images of minors is a crime.
Governor's Office, Commonwealth of Pennsylvania: Shapiro Administration Leads the Way in Responsible, Ethical Use of AI - Press release describing Executive Order 2023-19 and a generative AI pilot, establishing PA's AI governance board and principles for government use.
Pennsylvania State Legislature: SB 1213 (2023) - Act 125 of 2024, Combating AI-Generated Child Pornography and Deepfakes - Legislative history of Act 125 (effective Oct 29, 2024) amending criminal statutes to ban dissemination or possession of AI-generated sexual images, including those involving minors.
Pennsylvania State Legislature: SB 649 (2025) - Act 35 of 2025, Digital Forgery Law - Legislative text of the Digital Forgery Act (Act 35/2025), which amends Title 18 to make it a third-degree felony to use AI to create fake likenesses to defraud or injure.
Pennsylvania State Legislature: HB 1857 (2025-2026) - AI Transparency in Services Act - Proposed legislation requiring businesses to disclose AI use and allow human review; provides the bill text and status (remains pending).
Office of Administration, Commonwealth of Pennsylvania: Artificial Intelligence Policy (January 2026) - Official state policy document for agency use of AI (effective Jan 2026) requiring human oversight, retention of AI inputs, and disclosure of AI use to citizens.
Joint State Government Commission (Pennsylvania General Assembly): Artificial Intelligence: Advisory Committee Recommendations (Jan 2026) - Legislative commission report summarizing Pennsylvania's AI laws, noting Act 125 (2024) on AI sexual content and Act 35 (2025) on digital forgery, plus the new AI stenography rule.
Pennsylvania House Republican Caucus: House Advances AI Public Education Campaign Legislation - Describes passage of HB 2314 (2025-2026) creating an AI public education campaign via the Attorney General, fulfilling a JSGC recommendation.