Alabama AI Laws: SB 63, Deepfakes and What's Next (2027)

As of November 2026, Alabama has not enacted a comprehensive AI law. Its AI statutes are narrow: SB 63 (Act 2026-589, Ala. Code 27-1-17.2) limits how health plans use AI in prior authorization, and HB 172 (Ala. Code 17-5-16.1) makes certain election deepfakes a crime.

This page covers Alabama state law, with one short note on the federal layer. Bill statuses are as shown on ALISON, the Legislature's site, on November 4, 2026. For how other states compare, see the US AI laws hub.

Alabama AI Laws at a Glance

SB 63 (Act 2026-589): AI in Health Insurance Prior Authorization

SB 63, sponsored by Senator Arthur Orr, passed the Senate on February 19, 2026 and the House on April 8, 2026. Governor Ivey approved it on April 16, 2026, and it took effect October 1, 2026.

The act defines artificial intelligence as "A machine-based system that may include software or physical hardware that performs tasks, based upon data set inputs, which require human-like perception, cognition, planning, learning, communication, or physical action and which is capable of improving performance based upon learned experience without significant human oversight toward influencing real or virtual environments."

Who is covered. A "health benefit plan provider" includes entities that issue, deliver or renew a health benefit plan, such as insurers, HMOs and nonprofit health care service plans, plus internal departments and outside contractors that perform utilization review. The term "health benefit plan" excludes accident-only, specified disease, individual hospital indemnity, credit, dental-only, Medicare supplement, long-term care, disability income and other limited benefit policies, and coverage supplemental to liability, workers' compensation or automobile medical payment insurance.

What it requires. A provider that uses AI to determine medical necessity on prior authorization requests must:

• Base determinations on the enrollee's medical history, clinical circumstances unique to the enrollee presented by the requesting provider, and additional clinical information that may be in the medical record.
• Certify annually to the Department of Insurance that the AI does not rely on a group dataset, is fairly and equitably applied, and does not discriminate in violation of state or federal law.
• Leave the decision to a person: a determination "to deny, delay, or modify a request for prior authorization based on medical necessity shall always be made by a licensed physician or other health care professional who is competent to evaluate any recommendation or conclusion of artificial intelligence."
• Make "prominent written disclosure regarding its use of artificial intelligence in utilization review in its policies and procedures." That disclosure sits in the provider's policies; the text does not call for individual notice to each patient.
• Review its AI use and outcomes periodically, and keep patient data from being used beyond its intended and stated purpose, consistent with HIPAA.

The attestation route. Subsection (c)(4) matters more than its length suggests. The requirements of subsection (b) and subsection (c) "shall be satisfied by an attestation by an authorized representative of the health benefit plan provider based on reasonable reliance upon internal policies, procedures, and third-party vendors."

Enforcement. The Department of Insurance may send notice of an alleged violation of subsection (b), and the provider must respond within 30 days. If the response is unsatisfactory, the department may hold a hearing and may impose a corrective plan.

For repeat violations of subsection (b), the department may impose an administrative fine of not more than $5,000, suspend or revoke the certificate of authority, or do both, in each case for a violation that occurred "with such frequency as to indicate a general business pattern or practice." The provider also reimburses the department's enforcement expenses. The section contains no private right of action.

What it does not do. The section's duties are written around prior authorization and utilization review, which it defines as the determination of prior authorization requests. It is not a general ban on insurers using AI, and it does not address claim denials outside that process.

Subsection (e) says the department "shall adopt rules to enforce this section." We found no such rule in a November 4, 2026 term search of the Alabama Administrative Monthly issues for April through October 2026, using artificial intelligence, utilization review and prior authorization.

Insurance Regulators and AI in Alabama

Many state insurance departments have adopted the National Association of Insurance Commissioners' model bulletin on AI, which states regulators' expectations under existing law. The NAIC's implementation list, status as of November 3, 2026, does not list Alabama. That list tracks the model bulletin only, so it does not show whether the department has addressed AI in some other document.

Alabama Deepfake Laws: HB 172 and HB 168

HB 172 (Act 2024-349) took effect October 1, 2024. Under Ala. Code 17-5-16.1, a person may not distribute materially deceptive media, or agree with another person to distribute it, if all of these apply: the person knows the media falsely represents a depicted individual; the distribution occurs within 90 days before an election; the person intends to harm the reputation or electoral prospects of a candidate and the distribution is reasonably likely to cause that result; and the person intends to change the voting patterns of electors and the distribution is reasonably likely to cause that result. The media must have been produced by artificial intelligence.

A violation is a Class A misdemeanor, and a second or subsequent conviction within five years is a Class D felony. The ban does not apply if the media carries a disclaimer that meets the statute's conditions, and the statute also has exceptions for certain distributors without actual knowledge, certain news coverage, and a narrow satire and parody exemption.

Separately from the crime, the Attorney General, a depicted individual, a candidate injured or likely to be injured, or an entity representing voters likely to be deceived, may seek a permanent injunction by proving by clear and convincing evidence that the defendant knew the media was false. If a plaintiff other than the Attorney General wins the injunction, the court may award costs and attorney fees.

HB 168 (Act 2024-98) amended Alabama's child sexual abuse material law. Ala. Code 13A-12-190 now defines the material as "Any visual depiction of an individual under 18 years of age engaged in any act of sexually explicit conduct, including a virtually indistinguishable depiction." A virtually indistinguishable depiction is "A visual depiction created, altered, or produced by digital, computer generated, or other means that a reasonable person would conclude is of an actual individual under 18 years of age engaged in sexually explicit conduct."

The same act names AI directly in two other places. Ala. Code 6-5-840(b) bars a civil action for steps taken to prevent, detect, report or respond to AI generation of this material, and Ala. Code 16-3-41(2) has local school boards put in their written policy "a prohibition of private, explicit, or pornographic images generated with artificial intelligence." See the Alabama deepfake laws page for the detail.

HJR 51: Alabama's Study Commission on AI and Children's Internet Safety

HJR 51 (Act 2026-218) created the Study Commission on Artificial Intelligence and Children's Internet Safety. The Senate adopted it on February 12, 2026, the House concurred on February 25, and the Governor approved it on March 10.

It is a joint resolution that creates a study body, so it puts no duty on any company. The commission's job is to study the effects of AI, social media and internet use on children, look at what other states are doing, and develop recommendations for potential legislation. Members include legislators, the Attorney General or a designee, and appointees from groups including TechNet, Voices for Alabama's Children and the Alabama Broadcasters Association.

The resolution required a report to the Legislature "no later than November 1, 2026," after which the commission dissolves on filing. ALISON's public reports list showed no report from this commission on November 4, 2026, and a web search found none, so we cannot say what it recommended or whether it has filed. News reports described hearings through July 2026.

Alabama's AI Council and Executive Order 738

Act 2021-344 (SB 78, approved May 6, 2021) established the Alabama Council on Advanced Technology and Artificial Intelligence, codified at Ala. Code 41-9-1100.

Governor Ivey signed Executive Order 738 on February 8, 2024. It created a task force to recommend policies for generative AI use in state executive-branch agencies, and required each agency to inventory its uses by May 1, 2024. The task force submitted its final report on November 30, 2024, and the Governor released it on March 25, 2025. An executive order directs state agencies. It does not regulate private companies.

The Office of Information Technology's Artificial Intelligence Governance Policy, effective January 31, 2025, applies to state employees, contractors and other users of state information systems.

Alabama AI Bills That Did Not Pass

Each bill below stopped short of passage, based on ALISON's record on November 4, 2026.

HB 329 (Act 2026-507) did pass. It concerns computer science courses, and its definition of computer science lists AI among "emerging technologies." It does not regulate AI.

AI in Hiring, Chatbots and Other Subjects in Alabama

We found no Alabama law on AI in hiring or employment, companion chatbots, AI labeling outside elections, or frontier AI safety. That negative rests on term searches of ALISON's bill records for the 2024, 2025 and 2026 regular sessions, using words including artificial intelligence, chatbot, algorithm, automated, generative and synthetic. A bill that uses none of those words would not surface. HB 351, a privacy act covered in the 2027 section below, addresses solely automated decisions, but its term consumer excludes an individual acting in a commercial or employment context.

AI Note-Takers and Alabama Recording Law

Whether an AI note-taker may record a meeting turns on recording consent, and this site classifies Alabama as a one-party consent state. See Alabama AI meeting recording laws.

Federal AI Policy and Alabama

As of November 4, 2026, we found no federal statute in the public laws of the 119th Congress that sets general rules for private AI systems or generally preempts state AI laws. In December 2025, Executive Order 14365 directed federal agencies to challenge or discourage state AI laws the administration views as conflicting with national policy, and called for a federal framework from Congress. The order itself does not declare any state law invalid.

See Trump's AI executive orders and state AI law preemption for what has happened since.

What Changes in Alabama AI Law in 2027

As of November 4, 2026, we found no law aimed specifically at AI scheduled to take effect in Alabama in 2027; we searched ALISON, the Legislature's site, for the 2024, 2025 and 2026 regular sessions. We did not search for bills prefiled for 2027.

One privacy law touches automated decisions. The Alabama Personal Data Protection Act (HB 351, Act 2026-552), approved April 16, 2026, takes effect May 1, 2027. It lets a consumer opt out of processing for "Profiling in furtherance of solely automated significant decisions concerning the consumer." A significant decision is one that results in a controller providing or denying credit or lending services, housing, insurance, education enrollment or opportunity, criminal justice, employment opportunity, health care service, or access to basic necessities such as food or water.

Its reach is limited. It applies to persons that conduct business in Alabama or produce products or services targeted to its residents and that either control or process the personal data of more than 25,000 consumers, not counting data processed solely to complete a payment, or derive more than 25 percent of gross revenue from selling personal data. It exempts, among others, political subdivisions and certain public boards and authorities, two-year and four-year colleges, businesses with fewer than 500 employees and nonprofits with fewer than 100 employees that do not sell personal data, certain financial institutions, and HIPAA covered entities and business associates. It also exempts categories of data, including protected health information, certain activity regulated by the Fair Credit Reporting Act, data regulated by the federal student privacy law FERPA, and data collected or processed to comply with or in accordance with state law.

The opt-out has limits of its own. The act says it does not restrict a controller's ability to provide a product or service a consumer specifically requested, perform a contract with the consumer, or take steps at the consumer's request before entering a contract. It also says that if a consumer opts out of data processing, "the covered entity is not required to provide a service that requires data processing."

The term consumer excludes an individual acting in a commercial or employment context, and the act exempts data processed or maintained by an individual applying to or employed by a controller, within that role, so it is not an AI hiring law. The Attorney General enforces it. After a notice of violation and 45 days to correct, the Attorney General may sue for an injunction, and a court may assess a civil penalty of up to $15,000 per violation.

Three things could still move:

• HJR 51 report. It was due by November 1, 2026, and filing is not confirmed. Any recommendation would still need a bill.
• SB 63 rules. Ala. Code 27-1-17.2(e) directs the Department of Insurance to adopt rules and sets no deadline. We found none in the Administrative Monthly issues we term-searched, through October 2026.
• New bills. The bills in the table above did not pass, so any return would need to be filed again.

More Alabama Laws

Explore other Alabama law topics on Recording Law:

• Alabama Recording Laws
• Alabama Data Privacy Laws
• Alabama Whistleblower Laws
• Alabama Background Check Laws
• Alabama Sexting Laws
• Alabama Deepfake Laws
• Alabama AI Meeting Recording Laws

Frequently Asked Questions

Does Alabama have an AI law?

Alabama has no comprehensive AI law as of November 2026, but it has narrow ones. SB 63 (Act 2026-589, Ala. Code 27-1-17.2) limits AI in health plan prior authorization and took effect October 1, 2026. HB 172 (Ala. Code 17-5-16.1) makes certain election deepfakes a crime. HB 168 reaches digitally created child sexual abuse material, and Act 2021-344 created a state AI council.

Can health insurers in Alabama use AI to deny claims?

Alabama's SB 63 is narrower than that question. It addresses prior authorization. A health benefit plan provider may use AI there, but a determination to deny, delay or modify a request based on medical necessity must always be made by a licensed physician or other health care professional competent to evaluate the AI's recommendation. Limited-benefit policies such as dental-only and Medicare supplement are excluded, and the section does not address claim denials outside prior authorization.

What is the penalty for violating Alabama's AI health insurance law?

The Alabama Department of Insurance enforces Ala. Code 27-1-17.2. After notice and a hearing it may impose a corrective plan. For repeat violations occurring with such frequency as to indicate a general business pattern or practice, it may impose a fine of not more than $5,000, suspend or revoke the certificate of authority, or do both. The section contains no private right of action.

Are deepfakes illegal in Alabama?

Certain ones are. Under HB 172, Ala. Code 17-5-16.1, distributing materially deceptive media is a crime only if the person knows it falsely represents a depicted individual, the distribution occurs within 90 days before an election, and the person intends both to harm a candidate's reputation or electoral prospects and to change voting patterns, with each result reasonably likely. It is a Class A misdemeanor, and a second or subsequent conviction within five years is a Class D felony. The media must have been produced by artificial intelligence, the ban does not apply to media that carries a qualifying disclaimer, and certain parties may also seek a permanent injunction.

Does Alabama regulate AI in hiring?

We found no Alabama law on AI in hiring or employment, based on term searches of the Legislature's bill records for the 2024, 2025 and 2026 regular sessions. A bill using none of the search words would not surface. The privacy act HB 351, which takes effect May 1, 2027, has an opt-out from profiling for solely automated significant decisions, but its term consumer excludes an individual acting in a commercial or employment context.

Does Alabama have a law on AI chatbots for kids?

Not as of November 4, 2026. HB 324 and HB 325, the 2026 chatbot bills, did not pass. HJR 51 created a study commission on AI and children's internet safety with a report due November 1, 2026, but it is a study body and does not regulate chatbots.

Will Alabama pass new AI laws in 2027?

We cannot predict that. As of November 4, 2026, we found no law aimed specifically at AI scheduled to take effect in Alabama in 2027, though a privacy act, HB 351, gives consumers an opt-out from profiling in furtherance of certain solely automated decisions from May 1, 2027. The HJR 51 commission's report may recommend legislation, but we did not find a filed report.