Four days ago, this column counted 78 chatbot bills alive in 27 states. Since then, Washington’s governor signed two AI safety bills, Oregon’s chatbot law took effect with teeth that let individuals sue, Idaho wrapped its session with four AI bills signed, and Georgia sent three to the governor’s desk before the session clock ran out.
That’s the American side. Across the Atlantic, something uglier is happening. The European Commission’s “Digital Omnibus” package—pitched as simplification—is being called out by Amnesty International as an “unprecedented rollback of rights” that could gut the AI Act and GDPR to feed data to AI companies.
The count stands at 1,561 AI-related bills introduced in 45 states for 2026. That already surpasses the total for all of 2024.
Washington: Two Bills, One Signing Ceremony
Governor Bob Ferguson signed HB 2225 and HB 1170 on March 24 before a crowd of parents, advocates, and lawmakers in Olympia.
HB 2225 — the Chatbot Safety Act — requires operators to disclose that users are talking to an AI, not a human. When operators know the user is a minor, they must block sexually explicit content and manipulative engagement techniques. The bill mandates suicide and self-harm intervention protocols for all users, regardless of age.
HB 1170 — the AI Disclosure Act — requires anyone publishing content substantially modified by generative AI to embed provenance data through watermarks or metadata. Ferguson requested this bill specifically to combat AI-generated misinformation.
HB 2225 takes effect January 1, 2027. HB 1170 takes effect January 1, 2028. Washington also passed SB 5395, restricting AI use in health insurance claim decisions—part of the nationwide wave of healthcare AI bills.
Oregon: The Right to Sue
Oregon’s SB 1546 is being called the toughest chatbot law in the country, and the reason is one provision: a private right of action.
Most state AI laws rely on attorney general enforcement. Oregon lets individuals sue chatbot operators directly for damages. That changes the economics entirely. Companies can sometimes delay or negotiate with a state AG. They can’t ignore a class-action lawsuit.
The law requires operators to disclose that users are interacting with AI, maintain documented safety protocols, and actively intervene when conversations signal suicidal ideation or self-harm. For minors, platforms must issue repeated disclosures, block sexually explicit content, and avoid features designed to create emotional dependency or drive prolonged engagement.
Governor Tina Kotek signed it. It takes effect January 1, 2027.
The private right of action is the part industry lobbyists fought hardest against. It’s also the part that makes this law matter. Without it, enforcement depends on a state AG with limited resources. With it, every user harmed by a chatbot becomes a potential plaintiff.
Idaho: Four Bills, Session Over
Idaho’s legislative session ended with four AI bills signed into law:
| Bill | What It Does |
|---|---|
| SB 1297 | Conversational AI Safety Act — chatbot disclosure and safety requirements |
| SB 1227 | Generative AI rules for public education (passed 26-8, 62-6) |
| HB 542 | Anti-addictive social media protections |
| HB 727 | Adds synthetic media to video voyeurism statutes |
Idaho isn’t typically a tech-regulation state. When even deep-red legislatures are passing AI safety bills with bipartisan margins, the political calculus has shifted.
Georgia: Three Bills, Clock’s Up
Georgia’s session ended April 6 with three AI bills on Governor Brian Kemp’s desk:
SB 540 stands out nationally. The chatbot disclosure and child safety bill requires reminders every three hours that the user is talking to a machine—every hour for minors. Critically, there’s no carve-out for chatbots embedded in larger platforms. Meta and Google would need to comply.
SB 444 bans insurance companies from basing coverage decisions solely on AI systems. SR 789 creates a study committee on AI’s broader societal impact.
Whether Kemp signs them remains to be seen. But the bills passing both chambers in a conservative state with no opposition tells you where the consensus is heading.
The EU’s Quiet Rollback
While American states are ratcheting up regulation, Europe is moving in the opposite direction—and doing it under the banner of “simplification.”
The European Commission’s Digital Omnibus package proposes sweeping changes to the AI Act, GDPR, Digital Services Act, and Digital Markets Act. Amnesty International published a blistering analysis this week calling it “an unprecedented rollback of rights online.”
Here’s what the Omnibus actually does:
- Redefines personal data. Pseudonymized data would no longer automatically count as personal data under GDPR if the holder can’t “reasonably” re-identify individuals. Privacy advocates say this is a backdoor for tech companies to harvest more data for AI training.
- Delays AI Act enforcement. Companies may no longer need to publicly disclose risk assessments for high-risk AI systems, making external accountability harder.
- Weakens oversight. Proposed changes reduce reporting obligations for companies, making it more difficult for regulators and civil society to challenge harmful AI deployments.
The timing is pointed. The AI Act’s high-risk provisions take effect August 2, 2026. The Omnibus is moving through the legislative process right now. If adopted, it would soften enforcement mechanisms before they even kick in.
The Jacques Delors Centre, a centrist EU policy think tank, warned the Omnibus is “heading in the wrong direction”—arguing it trades citizen protections for corporate competitiveness in a way that damages trust in European institutions.
This is worth watching. The EU AI Act was supposed to be the global template for responsible AI regulation. If Europe waters it down four months before full enforcement, the signal to other governments is clear: the tech lobby wins even when the law passes.
The Scorecard Since April 4
Signed into Law
| Bill | State | What It Does |
|---|---|---|
| HB 2225 | Washington | Chatbot safety, minor protections, self-harm protocols |
| HB 1170 | Washington | AI-generated content disclosure and watermarking |
| SB 1546 | Oregon | Chatbot safety with private right of action |
| SB 1297 | Idaho | Conversational AI Safety Act |
| SB 1227 | Idaho | Generative AI rules for public education |
| HB 542 | Idaho | Anti-addictive social media protections |
| HB 727 | Idaho | Synthetic media added to video voyeurism laws |
Awaiting Governor’s Signature
| Bill | State | What It Does |
|---|---|---|
| SB 540 | Georgia | Chatbot disclosure, hourly reminders for minors |
| SB 444 | Georgia | Bans AI-only insurance coverage decisions |
| SR 789 | Georgia | AI societal impact study committee |
International
| Development | Region | What It Does |
|---|---|---|
| Digital Omnibus | EU | Proposes weakening AI Act, GDPR before August enforcement |
| AI Act high-risk deadline | EU | Full enforcement begins August 2, 2026 |
What This Means
Two trends are colliding. In the US, states are legislating faster than the federal government can preempt them. The DOJ’s AI Litigation Task Force still hasn’t filed a single suit against a state AI law. Congress hasn’t passed preemption legislation. The White House’s National Policy Framework is a recommendation, not a statute.
Meanwhile, the chatbot bill wave is turning into a chatbot law wave. Oregon, Washington, Idaho, and Tennessee have all signed bills in the last two weeks. Georgia is likely next. The template is converging: disclosure requirements, minor protections, self-harm protocols, and increasingly, private rights of action.
In Europe, the opposite is happening. The institution that wrote the world’s most comprehensive AI law is now taking a hacksaw to it before companies even have to comply. The Digital Omnibus isn’t simplification. It’s capitulation.
What to Watch
Idaho’s session is over. Georgia’s is over. The next deadlines: Nebraska adjourns April 17 with a chatbot safety bill (LB 1185) still alive. California has dozens of AI bills in committee, including SB 867 (banning companion chatbots in children’s toys) and AB 1898 (workplace AI surveillance notice).
The EU’s Digital Omnibus will face votes in the European Parliament in coming months. If the GDPR changes survive, the practical effect is more personal data flowing into AI training pipelines—exactly what the original regulation was designed to prevent.
And the DOJ task force remains conspicuously silent. Every week it doesn’t file a suit, another state signs a law. At some point, preemption becomes mathematically impossible.