Pennsylvania AI Legislation in 2026

The Pennsylvania Picture

Pennsylvania has chosen a targeted, harm-first posture rather than a single comprehensive AI statute, and I think that distinction matters for anyone building here. The two laws actually on the books, Act 35 of 2025 and Act 125 of 2024, are amendments to the Crimes Code. They do not regulate AI as a technology. They criminalize specific abuses of it: deepfakes used to defraud or injure, and AI-generated child sexual abuse material. This is the most enforceable kind of law because it slots into existing prosecutorial machinery, and the Attorney General has already brought charges under Act 125. If you build or deploy generative tools touching Pennsylvanians, your first compliance reality is criminal exposure for misuse of synthetic likenesses, not a licensing or registration regime.

The second pillar is executive, not legislative. Governor Shapiro's Executive Order 2023-19 and the OpenAI pilot established Pennsylvania as an early, deliberate adopter of generative AI inside its own government, governed by a board and a stated set of principles. The state is leading by procurement and practice rather than by mandate. For vendors, this is an opportunity signal as much as a compliance one. The Commonwealth is buying and scaling AI tools, and it is doing so under published expectations around accuracy, transparency, security, and human oversight. Aligning a product to those principles is closer to a go-to-market requirement than a legal one today, but it foreshadows where binding rules are heading.

Where Pennsylvania is going next is visible in the pending bills and the January 2026 advisory report. The sector most likely to see binding rules first is healthcare, through HB 1925 and the HB 2100 mental-health chatbot bill, both built around two recurring obligations: a human in the loop for consequential decisions, and transparency to the affected person. The HR 170 committee report reinforces the same themes at a state-wide level, recommending a Chief AI Officer, algorithmic impact assessments, annual bias audits, and advance notice to workers. None of this is law yet, and builders should not treat it as such, but the direction is consistent enough to design toward.

My practical guidance for builders is threefold. First, treat consent and provenance for any synthetic human likeness as non-negotiable now, because that exposure is already criminal and already being prosecuted. Second, if you operate in healthcare, insurance, or mental-health contexts, architect for a documented human decisionmaker and patient-facing disclosure of AI use ahead of HB 1925 and HB 2100, since those obligations are the clear floor Pennsylvania is converging on. Third, watch the Office of Administration and the Generative AI Governing Board, not just the General Assembly, because in Pennsylvania the operational expectations for AI are being set through state adoption and procurement before they are codified.