Key takeaways

  • Florida has no AI Bill of Rights. SB 482 died in the House on March 13, 2026, and SB 2-D died in a House subcommittee on April 29, 2026. Any vendor or advisor who says otherwise is wrong.
  • The Florida Information Protection Act (section 501.171) is the law that most affects a Florida company using AI: if an AI tool, or an agent, exposes personal information, the breach notice duties apply. Notice is due as expeditiously as practicable and within 30 days.
  • The Florida Digital Bill of Rights applies to a controller only if it makes more than $1 billion in global gross annual revenue and meets one of three further tests (online advertising, smart speakers, or an app store). Most mid-size companies are outside it.
  • Brooke's Law (chapter 2025-133) is aimed at covered platforms and altered sexual depictions posted without consent. It is not a general AI compliance statute.
  • Lawyers have an existing baseline in Florida Bar Ethics Opinion 24-1. Regulated financial firms already have federal duties, such as SEC Regulation S-P, that apply to AI tools handling customer data.
  • Rules change quickly. Treat this as a map of where things stood on November 8, 2026, and confirm with counsel.

The bill that did not pass

In 2026 the Florida Legislature considered an "Artificial Intelligence Bill of Rights". It appeared first as Senate Bill 482 in the regular session. According to the Florida Senate's bill page, the committee substitute passed the Senate 35 to 2 on March 4, 2026, was sent to the House on March 5, and "died in Messages" on March 13, 2026, without further action.

The idea came back in a special session as Senate Bill 2‑D, with the same title. The Florida Senate's page for SB 2‑D shows it was filed on April 24, 2026, passed the Senate 37 to 1 on April 28, and died in the House Information Technology Budget and Policy Subcommittee on April 29. Both versions are dead. Nothing in either bill is law.

This matters because the proposals were widely reported, and some marketing material still describes them as if they were in force. Per the Senate's summary of SB 2‑D, its provisions would have covered topics such as telling users when they are talking to an AI, parental consent for minors using companion chatbots, and limits on government AI contracting. If you have seen a checklist that says your company must comply with the Florida AI Bill of Rights, it is describing a bill that did not pass. A new bill can be filed in a later session, so this can change.

What does apply: the Florida Information Protection Act

For most Florida businesses, the law with the most practical effect on AI use is not an AI law. It is the Florida Information Protection Act, section 501.171 of the Florida Statutes. It requires reasonable measures to protect personal information and sets the notice rules when that information is breached. An AI tool is one more place where personal information can leak: a chatbot that stores customer records, an agent with access to a shared drive, or an employee who pastes a client list into a public service.

We re-read the 2026 version of the statute on the Florida Senate's site for this article. Personal information is defined as a first name or initial and last name combined with certain data, such as a Social Security number, a government-issued identification number, a financial account or card number with its required code, medical history or diagnosis, a health insurance number, biometric data or geolocation. It also covers a username or email address together with a password or security answer that opens an online account. Information that is encrypted, secured or modified so that it is unusable is excluded.

The notice rules have these main parts. Individuals in Florida who were affected must be told as expeditiously as practicable and without unreasonable delay, and no later than 30 days after the breach is determined or there is reason to believe it occurred, subject to a written law-enforcement delay. A breach affecting 500 or more individuals in Florida must also be reported to the Department of Legal Affairs within the same 30 days. An entity can obtain 15 more days to notify individuals if it gives the Department written good cause within the first 30. When notice goes to more than 1,000 individuals at one time, the nationwide consumer reporting agencies must be told.

A third-party agent that holds data for you has its own duty: it must notify the covered entity as expeditiously as practicable and no later than 10 days after determining a breach. That matters for AI. If an AI vendor or an outside developer runs a tool on your data, your contract should say how quickly they tell you, and you stay liable if an agent fails to give proper notice on your behalf.

Penalties for violating the notice provisions are civil: up to $1,000 per day for the first 30 days, then $50,000 for each subsequent 30‑day period up to 180 days, with a total cap of $500,000 per breach, not per person. The statute states that it creates no private right of action. We cover the statute in more detail in our Florida breach checklist.

The practical lesson for AI is that the law cares about what happened to the data, not which technology caused it. Before you connect an AI tool to customer or employee records, know what it stores, where, and who at the vendor can see it. Our articles on private AI for sensitive data and on securing AI agents describe the controls.

The Florida Digital Bill of Rights: probably not you

Florida also has a privacy law that sounds broad and is narrow. In the statutory definitions, a "controller" must be a for-profit entity that does business in Florida, collects consumers' personal data, decides how and why it is processed, and makes "in excess of $1 billion in global gross annual revenues". It must also satisfy at least one more test: it derives 50 percent or more of its global gross annual revenue from the sale of online advertisements, it operates a consumer smart speaker and voice command service with an integrated virtual assistant, or it operates an app store or digital distribution platform offering at least 250,000 different software applications. Entities that control or are controlled by a controller are included.

That is the text of section 501.702(9) in the 2025 statutes on the Florida Senate site. A company that has to ask whether it qualifies almost certainly does not. If you are a vendor to one of these companies, though, expect their contracts to carry the obligations downstream. We did not verify the law's enforcement provisions or effective date for this article, so do not rely on us for those.

Brooke's Law: the AI statute that was enacted

The one AI-related statute we found that Florida enacted recently is House Bill 1161 of 2025, titled "Removal of Altered Sexual Depictions Posted without Consent", now chapter 2025-133, Laws of Florida. The Florida Senate's bill page lists the governor's approval and effective date as June 10, 2025. The bill defines a "covered platform" and requires such platforms to set up a process for removing altered sexual depictions of an identifiable person that were posted without that person's consent. Platforms that comply in good faith are immune from liability, and platforms that unreasonably fail to comply face remedies.

It is a narrow law about harmful synthetic images, aimed at platforms. It is not a general duty on a company that uses AI internally. We mention it so you can answer the question accurately if a customer or board member asks whether Florida has passed an AI law. There is one, and it is about something specific. We did not review whether other AI-related bills from 2024 to 2026, such as those on political advertising disclosures or insurance, became law, and we make no statement about them.

Courts and lawyers

For law firms, the baseline is Florida Bar Ethics Opinion 24-1, issued in January 2024. It applies the existing Rules of Professional Conduct to generative AI: lawyers must protect client confidentiality, supervise the output, charge fees properly and stay competent in the tools they use. It created no new duties. Our article on ABA Formal Opinion 512 and Florida Bar Opinion 24-1 explains how to turn it into a firm policy.

We saw reports that the Florida Supreme Court amended its rule on court filings, Rule 2.515, in 2026 to address AI-generated citations, and that the Florida Bar is considering a further advisory opinion on AI tools. We could not confirm either at a primary source, because the Bar's pages blocked automated access and the court notice we reached could not be read. We therefore do not describe what those changes say. If you file in Florida courts, ask your counsel to check the current rule text and any new Bar opinion.

Federal rules that already reach AI

Several federal rules apply to regulated firms whether or not Florida passes anything. They were not written for AI, but they apply to AI tools that touch the covered data. The clearest one in our existing coverage is SEC Regulation S-P, as amended in 2024. Covered institutions must have a written incident response program, notify affected individuals within 30 days when sensitive customer information was or is reasonably likely to have been accessed without authorization, oversee service providers and require them to notify the firm no later than 72 hours after becoming aware of a breach, and keep records. An AI vendor that processes customer information is a service provider for these purposes. Our Regulation S-P checklist covers the details and the compliance dates.

Banks and credit unions have their own incident-notice rules, covered in our article on 36‑hour and 72‑hour reporting. Health care providers and their business associates have the HIPAA Security Rule, covered in our HIPAA checklists. In each case the pattern is the same: the technology is new, the duty is old, and the question is whether you can show control over where regulated data goes. This article does not cover the rules of other regulators such as FINRA or the New York Department of Financial Services, which we have not reviewed here.

Government guidance is also worth reading even where it is not binding. The joint guidance Careful Adoption of Agentic AI Services from CISA, NSA and partner agencies in 2026 is advisory, but it signals what regulators and insurers will treat as reasonable practice. Our article on the OWASP agentic list summarizes it.

A practical position for a Florida company

Do not wait for an AI statute. Put the controls in place that every one of the rules above rewards.

  • Keep an inventory of AI tools, who uses them and what data they touch, including tools employees adopted on their own.
  • Write a one-page policy: approved tools, data that must never be entered into outside services, who approves new tools.
  • Check vendor contracts for data handling, retention, training on your data, subcontractors and breach notice timing. Ten days is the statutory outer limit for a third-party agent to tell you under Florida law, and shorter is better.
  • Keep logs that show what an AI tool or agent accessed, so that if something goes wrong you can answer the questions the 30-day clock demands.
  • Prefer private or self-hosted deployments for the most sensitive data.
  • Prepare a breach response plan that names AI tools as possible sources, and rehearse it.
  • Review the position every quarter. Bills will be filed again.

Our team helps Florida businesses build these controls as part of its cybersecurity work, and the free security assessment is a way to see where you stand. For questions about what the law requires of your business, talk to your own counsel.

Sources

This article is general information, not legal advice. It reflects the sources listed as of November 8, 2026. Statutes, bills and court rules change. Confirm your obligations with your own counsel. Last reviewed .

Keep reading

Need help with this?

We find out whether everything you run is safe from attackers, then we fix it.

Cybersecurity