Delaware AI legislation tracker

The AIC draft: what is actually on paper?

A targeted boundary for healthcare AI

H.B. 191, signed April 23, 2026, amended Delaware professional-licensing law to bar a nonhuman entity—including an AI agent—from being licensed for professional nursing, advanced-practice registered nursing, practical nursing or physician-assistant practice; being certified to practice medicine; or using specified professional titles and abbreviations. It does not prohibit every healthcare AI application: administrative, scheduling, documentation and other bounded support functions still require their own privacy, safety, professional-practice and consumer-law analysis. See the official H.B. 191 record and enacted session law.

Enacted measures that created the policy pathway

Adjacent law: privacy and automated decisions

H.B. 380 is not the AIC Act. It is an enacted amendment to the Delaware Personal Data Privacy Act (DPDPA), relevant because automated systems may process personal information, infer sensitive attributes or influence significant decisions involving employment, housing, credit, education, health care and essential services.

• Coverage: the final engrossed text reduces the general data-processing threshold from 35,000 to 10,000 consumers, and the alternative threshold from 10,000 to 5,000 consumers where the controller derives more than 20% of gross revenue from selling personal data.
• Consumer opt-out: § 12D-104 gives consumers an opt-out right for profiling in furtherance of solely automated decisions that produce legal or similarly significant effects.
• Assessments: § 12D-108 separately requires an impact assessment when a controller engages in profiling in furtherance of automated decisions with legal or similarly significant effects. The required analysis covers intended use, benefits, foreseeable risks, mitigations, inputs and outputs, performance limitations, transparency and post-deployment safeguards. The assessment clause does not repeat the word “solely.”
• Sensitive data: the final text expands the definition to include inferences used to reveal or identify protected categories, and adds categories such as neural data, certain financial credentials and government ID numbers.
• Employment-context data: the existing exclusion for data collected in an employment, agent or contractor relationship is narrowed: profiling and reports addressed by § 12D-106(f) remain covered.
• Reports and adverse action: where a controller provides a report to a third party for a decision with legal or similarly significant effects concerning a Delaware resident, the amended law adds contract, notice, data-source and human-review provisions.
• Third parties: it adds binding contract terms and due-diligence requirements when personal data is disclosed to third parties.

H.B. 380 was signed September 2, 2026 and takes effect January 1, 2027. The final engrossed text—not the original bill synopsis—is the source for the 10,000 / 5,000 thresholds and the changes to profiling, sensitive data and third-party obligations. Read the final engrossed text.

What to watch next

• Whether the Delaware AI Commission resolves its outstanding questions and formally transmits a proposal.
• Whether the 2027 General Assembly receives a filed bill, and whether the introduced version differs from the June draft.
• Whether the state publishes committee membership, application rules, capital minimums, risk criteria and public reporting standards.
• What Delaware provides in response to the House Oversight Committee’s October 26 request, due November 9, 2026.

Primary sources: Delaware General Assembly bill records for H.J.R. 7, H.B. 380 and H.B. 381; June 2 AIC draft bill; Delaware Code; Delaware Public Media, October 30, 2026. See Sources & methodology.