Delaware AI Legislation in 2026

The Delaware Picture

Delaware has not enacted a comprehensive, cross-sector AI statute, and builders should understand that distinction clearly. What Delaware has instead is a layered approach: a consumer privacy law that reaches AI through the back door, a set of narrow criminal and civil deepfake statutes, and an internal governance body for how the state itself uses AI. If you are deploying AI in Delaware in 2026, the binding obligations on you come almost entirely from the Delaware Personal Data Privacy Act, not from any law with artificial intelligence in its title.

The Personal Data Privacy Act, effective January 1, 2025, is the practical center of gravity. Any AI system that profiles consumers or drives solely automated decisions producing legal or similarly significant effects, such as eligibility, pricing, lending, housing, insurance, or employment-adjacent outcomes, triggers two concrete duties. First, consumers can opt out of that profiling, so you need a working opt-out mechanism and the engineering to honor it. Second, you must conduct and document a data protection assessment for high-risk processing before you deploy. Delaware's applicability threshold is notably lower than most peer states, capturing controllers handling the personal data of 35,000 or more consumers, which means mid-size companies that escaped California or Virginia obligations can still fall squarely within Delaware's reach.

On synthetic media, Delaware moved decisively in 2024. The Amelia Kramer Act and the election deepfake law were both signed October 9, 2024, putting criminal and civil liability behind nonconsensual sexual deepfakes and deceptive political deepfakes within 90 days of an election. For anyone building generative image, video, or voice tools, the operative takeaways are provenance and consent. The political deepfake law offers a safe harbor for clearly disclosed synthetic content, which signals where Delaware's regulatory expectations are heading: label your outputs, and build consent and disclosure into the product rather than bolting it on later.

My read for executives is this. Delaware is a watch-and-prepare jurisdiction, not yet a heavy-compliance one for general AI. The AI Commission, reinforced in 2025 and exploring an AI regulatory sandbox, is laying groundwork that could mature into broader rules. Treat the privacy-law profiling obligations as live and enforceable today, treat the deepfake statutes as hard criminal and civil lines, and treat the rest as a fast-moving roadmap. The companies that will be ready are the ones already documenting their automated decision systems, honoring opt-outs, and disclosing synthetic content as a default practice.