Alabama — Federal AI Profile + State AI Laws (HB 161 NCII deepfakes 2024; HB 168 AI-CSAM 2024; HB 172 election deepfakes 2024; SB 63 AI health-coverage determinations, eff Oct 2026): AI Compliance Requirements

Alabama enacted three AI-specific criminal statutes in 2024, all signed by Gov. Kay Ivey and all effective October 1, 2024, each binding private parties. (1) HB 161 ("creating a private image") amends Ala. Code § 13A-6-240 to criminalize creating/recording/altering nonconsensual intimate imagery, expressly including depictions that are "artificially generated" (deepfakes) — Class A misdemeanor, Class C felony on a subsequent conviction, with safe harbors for ISPs/platforms/cloud providers and technology developers. (2) HB 168 (Alabama Child Protection Act of 2024) adds a "virtually indistinguishable depiction" definition covering CSAM "created, altered, or produced by digital, computer generated, or other means" — Class A felony (production), Class B (dissemination/possession-with-intent), Class C (possession), plus a civil cause of action and a State Board of Education school-policy mandate. (3) HB 172 criminalizes distributing AI-generated "materially deceptive media" of a candidate within 90 days of an election without a disclaimer — first offense Class A misdemeanor, subsequent Class D felony, enforced by the Attorney General with civil injunctive remedies available to depicted candidates. Counsel should confirm the exact enrolled-text language, felony classes, the Oct 1, 2024 effective dates, and the HB 172 act number (reported as Act 2024-349) against the enacted text. legal_review_pending.

Alabama SB 63 (signed by Gov. Ivey 2026-04-17, effective 2026-10-01) regulates health-insurer use of AI in coverage determinations: (1) an insurer may not rely solely on AI/an automated system for an adverse determination — a qualified clinician must review it; (2) the insurer must provide "prominent written disclosure" to affected parties whenever AI is used at any point in the coverage-determination process; (3) determinations must be based on the individual member's medical history and clinical circumstances, not group-level data alone; (4) the insurer must certify annually to the Alabama Department of Insurance that its AI systems do not discriminate against any subscriber group or enrollee in violation of state or federal law. Enforced by the Alabama DOI. Applies to health insurers and their AI/utilization-review vendors operating in Alabama. legal_review_pending.

FTC Act § 5 prohibits unfair or deceptive acts by businesses, including AI systems. Prohibited conduct: (1) AI that makes false or misleading claims about products/services. (2) AI-driven dark patterns that manipulate consumer decisions. (3) Algorithmic pricing that the FTC deems unfair. (4) AI that makes biased recommendations without disclosure. Compliance: document AI output review processes, ensure AI marketing claims are truthful, implement human review for consequential AI outputs. Cite: FTC Policy Statement on AI (2022), FTC Report on AI in Commerce (2024).

Any AI system used in Alabama hiring, promotion, performance evaluation, or firing must comply with Title VII (race, color, religion, sex, national origin), ADA (disability), ADEA (age 40+), and GINA. Key obligations: (1) Test AI hiring tools for disparate impact before deployment. (2) Provide reasonable accommodations if AI screening disadvantages applicants with disabilities. (3) Maintain audit records of AI-driven employment decisions. Cite: EEOC v. iTutorGroup (2022, first EEOC lawsuit over AI recruitment age bias); EEOC Technical Assistance: AI and the ADA (2022).

AI-based credit, employment, tenant screening, or insurance decisions that are adverse must comply with FCRA. Obligations: (1) Adverse action notices must state the specific reasons for AI-driven adverse decisions — "AI model output" or "algorithm score" is insufficient under CFPB Circular 2022-03. (2) Applicants have the right to obtain a free copy of their consumer report used in the AI decision. (3) AI vendors used in credit decisioning are "consumer reporting agencies" under certain conditions — audit vendor agreements. Cite: CFPB Circular 2022-03 (2022); CFPB supervisory guidance on AI model risk (2024).

AI systems directed to children under 13 or with actual knowledge of processing children's data must comply with COPPA: obtain verifiable parental consent before collecting personal data, implement COPPA-compliant data retention and deletion, and not condition participation on more data than necessary. Educational AI systems in Alabama's K-12 schools must comply with both COPPA and FERPA. Cite: FTC COPPA Rule (16 CFR Part 312); FTC enforcement action against Epic Games (2023, $275M COPPA penalty).

Alabama has no enacted COMPREHENSIVE/horizontal private-sector AI law, but does have four targeted ones (HB 161, HB 168, HB 172, SB 63 — see above). A 2026 chatbot-age-verification bill, HB 324, stalled in House Judiciary Committee. Monitor alison.legislature.state.al.us for AI bills each legislative session (March–May). The Alabama AG (ago.alabama.gov) may issue AI guidance under Deceptive Trade Practices Act authority. Alabama Senate Commerce Committee and House Technology Committee are the relevant committees.