United States of America

Predictive analytics 

In the US, approximately 38.2% of major US police departments are using or piloting predictive policing  systems, which  ingest large volumes of historical crime data to forecast high-crime ‘hot spots’ and guide patrol allocation. These tools do not authorise arrests: they serve as human-reviewed leads.  For example, PredPol (now Geolitica) uses historical crime incident data (such as location, time, type) to forecast ‘hotspot boxes’: small geographic grid cells where crime is likely to occur during a given temporal window (e.g. that day or shift), allowing police to allocate more patrol presence or preventative resources to those boxes. In one publicly released dataset, Geolitica generated 23,631 predictions for Plainfield, New Jersey between 25 February and 18 December 2018. Out of those, fewer than 100 predictions matched an actual crime of the predicted type in the predicted box during the time window: the tool had a success rate of less than 0.5%. 

Prison Classification Systems apply risk-assessment tools to inform decisions about facility type, housing unit assignments, placement in general or special populations, and availability of programmes and services for incarcerated individuals. The Federal Bureau of Prisons uses the Prisoner Assessment Tool Targeting Estimated Risk and Needs (PATTERN) to track dynamic changes in risk and uniform earned time eligibility, along with Standardized Prisoner Assessment for Reduction in Criminality (13 domains) (SPARC-13) to identify programmatic and treatment needs. Most classification systems rely on risk-assessment tools originally designed to estimate post-release recidivism, though some have been modified for predicting prison misconduct. Correctional staff review risk assessments within established policies and procedures governing classification decisions. Deployment occurs as standard practice across federal and state prison systems, with tools integrated into regular classification and reclassification processes. 

Chicago’s Police Department previously used two predictive analytics systems: the 'Strategic Subject List’ (SSL) and the ‘Crime and Victimization Risk Model’ (CVRM), which were designed to predict the likelihood that an individual would become a ‘party to violence’ (PTV)—that is, the victim or offender in a shooting. The attributes used by the models to generate risk scores and tiers were:

1. incidents as a victim of shooting;
2. age at latest arrest;
3. incidents as a victim of aggravated battery or assault;
4. trend in involvement in crime incidents;
5. arrests for unauthorised use of a weapon;
6. violent incidents as an arrestee;
7. narcotics arrests; and
8. gang affiliation. 

The results of SSL were known as ‘risk scores’, while CVRM produced ‘risk tiers’, with higher scores or tiers indicating a greater risk of becoming PTV. Every individual arrested at least once within a four-year period prior to the model being built—regardless of whether they had a history of violence—received a risk score or tier. The Police Department decommissioned its PTV risk model programme on 1 November 2019 due to (among other reasons) unreliable risk scores and insufficient training.

The Los Angeles Police Department's (LAPD) Operation LASER (Los Angeles Strategic Extraction and Restoration) was audited by the LAPD in early 2019. LASER was a predictive policing and ‘chronic offender’ targeting programme. It used, for example, historical crime data, field interviews, gang membership, and arrest records to identify ‘hot spots’ and ‘chronic offenders’ and to assign risk scores. The LAPD shut down LASER after the audit.

The audit of Operation LASER by the LAPD in 2019 revealed significant inconsistencies in how individuals were selected and retained. Almost half of the 'chronic offenders' had zero or one arrest for violent crime, and almost 10% had no 'quality interactions' with police.  

Data review and analysis 

Cybercheck is an AI forensic tool, founded in 2016, that issues probabilistic reports to aid in suspect identification and crime scene analysis. The tool uses machine learning algorithms to analyse open-source intelligence data and link an individual’s ‘cyberDNA’ or digital signature, to a crime scene. In an Ohio homicide trial, Cybercheck’s founder testified that the tool’s  conclusions were 98.2% accurate, but provided no source for this value. The tool has been used in nearly 8,000 cases across 40 states and nearly 300 agencies, despite heavy criticism of its methodology.

Axon’s Draft One is a new software product that drafts high-quality police report narratives in seconds based on auto-transcribed body-worn camera audio. Axon found that, on average, U.S. police officers reportedly spend up to 40% of their time writing police reports and Draft One allegedly cuts that time in half.  The system takes an 'officer-in-the-loop' approach where Draft One generates report narratives based on body-worn camera audio, but these narratives cannot be submitted without officer review, editing and approval. Police have adopted Axon’s Draft One in Lafayette, Indiana; Tampa, Florida; and Campbell, California.

Facial recognition technology (FRT) employs computer vision algorithms that detect faces in images, extract quantitative templates, and compare similar scores between facial features. Federal agencies such as the FBI use FRT systems to identify perpetrators, victims, and witnesses as part of authorised criminal investigations. The FBI’s Next Generation Identification Interstate Photo System (NGI-IPS) incorporates data from 17 state agencies and two federal agencies, encompassing over 67 million arrest photos. Trained examiners independent of case teams must manually review FRT results, and agency policies prohibit using FRT results as sole proof of identity. Deployment varies significantly across jurisdictions, with some agencies prohibiting FRT use entirely while others permit broad application under different policy frameworks. 

Automated fingerprint identification systems (AFIS) are statistical or algorithmic tools that compare friction ridge patterns and minutiae features. These systems perform automated matching for ten-prints with minimal human oversight except when evidence will be used in prosecution. Latent print analysis typically requires human examiner review. Deployment of this technology is national through federal systems, as well as state and local AFIS networks.

Agencies also use automated licence plate recognition systems (ALPR), which are computer vision systems that capture and cross-reference licence plate data against law enforcement databases. Such systems have widespread use: almost all local law enforcement agencies have an LPR programme, as do many smaller agencies. Deployment occurs primarily at local levels with some agencies subscribing to commercial LPR services that operate networks of participating cameras.

Drug Classification Systems employ machine learning models that analyse chemical composition data to classify the geographic origin of seized drug samples, particularly heroin and cocaine. The Drug Enforcement Administration (DEA) uses these systems to detect anomalies in analysis and low-confidence results, providing intelligence about drug trafficking patterns and trends. Analysts review machine learning outputs for intelligence and investigative purposes, though these results are not currently used as evidence in court proceedings. Deployment remains limited to specialised federal forensic applications, primarily within DEA operations for understanding drug trafficking networks. 

Gunshot-detection systems like ShotSpotter deploy acoustic sensors across urban areas, listening for impulsive sounds that may be gunfire. The system uses algorithms and human verification to filter sounds, triangulate the approximate location, and generate alerts (often within seconds) to law enforcement dispatch centres.

In New York, the NYPD is launching a ‘Drone as First Responder’ programme that links ShotSpotter alerts to drone deployment: when a shooting is detected, a drone (piloted from a centralised operations centre) is sent to fly over the site and stream live video and telemetry back to officers en route. By contrast, the City of Chicago announced in February 2024 that it decommissioned the technology. It has been reported that the system has high rates of false positives: for example, a 2024 audit claims that roughly 87% of ShotSpotter alerts did not correspond to confirmed shootings. 

US authorities, including the Department of State and Homeland Security, have partnered with Palantir and Babel Street as part of US Immigration policy. These tools are capable of monitoring all persons located within the US, citizens and non-citizens alike. The AI tools supplied by Babel Street and Palantir will enable US authorities to identify people, track their behaviour and movements, and monitor their social media.

• Babel X: uses technology to gather large amounts of data from a single identifier, such as a person’s name, email or phone number. It has been tasked specifically with monitoring refugees and asylum seekers.
• ImmigrationOS: US Immigration and Customs Enforcement awarded Palantir a USD $30 million contract to aid its deportation efforts. In response, Palantir developed a new AI tool called ImmigrationOS, which: (a) streamlines decisions on who should be removed first, with priority given to “violent criminals” and visa overstays; (b) monitors “self-deportation” to confirm whether individuals are actually voluntarily leaving the US; (c) supports “immigration lifecycle management” which includes coordinating logistics for detentions, removals, and administrative follow-ups to minimise delay.

Prosecutors 

Case management 

‘PROSECUTORbyKarpel’ (PbK) is the most widely used prosecutor case-management system in the US. In August 2024, Karpel Solutions and NiCE announced a technology partnership to allow offices to pull digital evidence and AI features directly into case files. For example, users can manage documents, generate subpoenas, witness documents, or victim letters, and use eDiscovery or redaction tools. PbK claims to have streamlined over 600 large and small prosecutors' offices. 

Legal research, analysis and drafting support 

Generative AI tools such as ChatGPT, Claude, Gemini, and Westlaw AI are used by US prosecutors for summarising precedents, drafting motions, and generating legal research outlines. All outputs must be verified, and all hallucinations corrected by prosecutors, and compliance with professional ethics must be upheld (see below). These tools are broadly available within legal tech firms and some law offices, with early adoption in the criminal setting as at September 2025.

Evidence review and analysis 

Prosecutor offices in the US have used AI systems for evidence review and analysis. For example, NiCE Justice uses AI-automation for audio and video transcription and translation, optical character recognition software (for extracting text from images or scanned documents), object detection, analytics, and evidence ‘connection-finding’. This system has been used by, among others, the Calcasieu Parish (LA) District Attorney (since December 2024), and the Monterey County (CA) District Attorney (since December 2024). 

Courts 

Case management

Courts are using AI-enhanced reminder systems, such as Conferbot, which automate notifications to reduce failure-to-appear rates. 

Courts are also exploring AI for public-facing tools and access to justice. For example, chatbots or virtual assistants are used to help litigants understand procedural steps, check deadlines, or route them to forms. In Miami-Dade courts, ‘SANDI’ (Self-Held Assistant Navigator for Digital Interactions) is used to assist court users by helping them with case status, court forms, directions, and procedural questions. 

Risk-assessment 

US courts use AI-based risk-assessment tools in the pre-trial and sentencing stages of criminal litigation. 

Defence

Administrative support 

LegalServer is a case management system widely used by public defenders, integrating AI for document automation, optical-character-recognition-based (OCR-based, used to turn documents, images or handwritten/typed evidence into machine-readable text), and legal analytics. 

Legal research, analysis and drafting support 

As with prosecutors (discussed above), generative AI tools such as ChatGPT, Claude, Google Vertex AI, Gemini, and Westlaw AI are used by defence attorneys in the US for summarising precedents, drafting motions, and generating legal research outlines. All outputs must be verified by defence attorneys, hallucinations corrected, and compliance with professional ethics must be upheld (see below). These tools are broadly available within legal tech firms and some law offices, with early adoption in the criminal setting as at September 2025. 

'SentencingStats’ is a machine-learning platform that analyses federal sentencing data and generates statistical reports on likely sentencing outcomes based on historical trends. Federal defenders have begun using SentencingStats to support sentencing advocacy and mitigation efforts. By analysing trends in judicial decisions, attorneys can present data-backed arguments for reduced sentences, demonstrating disparities or inconsistencies in sentencing patterns. 

‘Casetext CoCounsel’ (Thomson Reuters) assists defence attorneys by conducting legal research, drafting motions, summarising discovery, and preparing deposition questions. The Miami-Dade County (Florida) Public Defender’s Office was the first public defender office in the US to integrate CoCounsel, providing 100 attorneys access to the AI research assistant. The tool significantly reduced legal research time and improved efficiency in drafting motions and trial preparation. Attorneys noted that CoCounsel helped generate cross-examination questions and identify overlooked case law. However, due to budget constraints, not all defenders received licenses. 

‘Westlaw Edge’ and ‘Lexis+AI’ are used to allow attorneys to quickly identify relevant caselaw, analyse opposing briefs, and draft legal arguments. Larger criminal defence firms and well-funded attorneys have integrated these tools to accelerate legal research and ensure comprehensive case preparation. AI-powered brief analysis features have been particularly useful for identifying missing citations and legal precedents.

Evidence review and analysis 

Public defenders increasingly use AI-driven tools such as JusticeText and Reduct.Video for AI-assisted speech-to-text and indexing evidence. Examples of tasks performed by these tools include transcribing police body-cam footage, or 911 (emergency) calls, and flagging key moments (such as a suspect’s request for counsel or being read their Miranda rights). Prosecutors manually review flagged transcripts and internal protocols to ensure there is no over-reliance, limiting the use of these tools to supportive functions. 

‘Relativity’ offers a broad, end-to-end e-discovery and investigation platform designed to manage diverse data types (such as text, email, chat, multimedia) across the entire litigation, from data collection and processing through review, analysis, and production. AI capabilities are integrated to enhance these core workflow stages. 

‘MateyAI’ is an AI tool that organises and analyses criminal eDiscovery, built specifically for criminal defence. 

Victims

Under US criminal procedure rules, victims do not have direct standing to control criminal proceedings because these cases are prosecuted by the government (State or federal). However, as of early 2026, victims of deepfakes, specifically non-consensual intimate imagery (NCII), have increased influence over the proceedings through passed legislation, such as the TAKE IT DOWN Act. Victims also have a private and civil right of action to sue under the DEFIANCE Act and many laws at the state level.

Case management

‘Generative-AI avatars’ (for scripted victim-impact videos) have been used to deliver emotional narratives in court. Some courts have issued rules, guidance or standing orders requiring disclosure of AI usage in documents or evidence, including when the AI-generated output is made available to the public (see below). One Arizona judge in May 2025 allowed a dead man to deliver his own victim statement via an AI avatar. Otherwise known as the ‘Pelkey Case’, a man was shot and killed and, when it was time for the killer to be sentenced, the victim impact statement was rendered by an AI-generated avatar that used the deceased’s face and voice. Though this marked the first time that a US court allowed an AI-generated victim to make this kind of statement, the judge in that case noted the AI nature of the impact statement, and the defendant’s attorney noted that the appeals court would likely weigh whether the judge improperly relied on the AI video when handing down the sentence. Within hours of the sentencing, the defendant’s attorney appealed the decision. As at March 2026, the judgment on appeal had not been delivered.

As at March 2026, no subsequent cases in the US legal system have used AI in a similar capacity.

TRAINING

Systematic and widespread training is not available to judges, prosecutors, or defence counsel to help them understand how AI tools work and their limitations. There are, however, ad hoc training sessions and seminars. 

For prosecutors in particular, the Association of Prosecuting Attorney has introduced the annual National Prosecutorial Data Summit, which provides prosecutors with training for using AI and analytics to improve case management, operational efficiency, and data-driven prosecution strategies.

REGULATION 

At the federal level, neither the Department of Justice nor the Administrative Office of the Courts has established comprehensive policies governing the use of AI in the courts. As at August 2025, there were also no state statutes that explicitly regulate the use of AI in criminal proceedings or courtroom decision-making. What exists instead are ABA opinions on the use of AI tools, standing orders issued by courts, and the enforcement of sanctions, and state-specific judicial policies, administrative rules, and guidance that govern AI use by judges, court staff, and attorneys.

Guidelines for practitioners

ABA Model Rules and Formal Opinions 512

In July 2024, the American Bar Association (ABA) Standing Committee on Ethics and Professional Responsibility published 'Formal Opinion 512 - Generative Artificial Intelligence Tools', which establishes the federal ethical rulebook for lawyers in the use of generative AI, construing new obligations under the existing ABA Model Rules of Professional Conduct.

ABA Formal Opinion 517 

In July 2025, the ABA made a further reference to generative AI in Formal Opinion 517 -  Discrimination in the Jury Selection Process concerning the prohibition against discrimination in Model Rule 8.4 (g). Because AI-assisted juror selection programmes can unknowingly apply ‘rankings in a manner that would constitute unlawful discrimination (e.g. based on the prospective jurors’ race or gender)’, lawyers should ‘conduct sufficient due diligence to acquire a general understanding of the methodology employed by the juror selection program’. 

Standing orders in federal courts 

A number of judges throughout the United States have issued standing orders governing the use of AI by attorneys who appear before them. Examples include the US District Court for the Northern District of California, Order Nos. 23-0903 (Judge Araceli Martinez-Olguin), which requires certification that lead trial counsel has verified the accuracy of AI-generated content, and 23-0933 (Magistrate Judge Peter H. Kang), which requires disclosure of AI usage in documents, identification of AI-generated evidence, and adherence to confidentiality. Other federal courts with orders concerning the use of artificial intelligence include: the District of Hawaii, the Northern District of Illinois, the Eastern District of Missouri, the District of New Jersey, the Southern District of New York, the Southern and Northern Districts of Ohio, the Western District of Oklahoma Bankruptcy Court, the Northern District of Texas Bankruptcy Court, the Northern District of California, the District of Colorado, and the Western District of North Carolina. 

Sanctions:

The courts have sanctioned lawyers relying on unverified authorities created by ChatGPT or similar tools. Federal courts can look to Rule 11 of the Federal Rules of Civil Procedure, which permits the imposition of ‘an appropriate sanction on any attorney, law firm, or party’ that violates the rule requiring them to certify that their contentions are warranted by existing law and the factual contentions will have evidentiary support.  

Fines are a common sanction as are costs orders requiring payment of the opposing party’s legal fees incurred when responding to court filings containing hallucinated case law. Courts have also struck out filings, removed lawyers from the case or suspended them from practice. See ‘Cases’ below for some examples of the sanctions imposed in federal and state courts.

State rules and guidance 

A number of states have adopted rules governing the use of AI in the courts. Examples include:

Delaware: In October 2024, the Delaware Supreme Court adopted an Interim Policy on the Use of GenAI by Judicial Officers and Court Personnel, which allowed limited AI use but required administrative approval of AI tools and prohibited delegating decision-making responsibilities to AI.

Illinois: In December 2024, the Illinois Supreme Court announced its Policy on Artificial Intelligence, which states “The use of AI by litigants, attorneys, judges, judicial clerks, research attorneys, and court staff providing similar support may be expected, should not be discouraged, and is authorized provided it complies with legal and ethical standards.” The Policy does not specifically require disclosure of AI use in a pleading.

California: In July 2025, the California Judicial Council, the policy-making body of the Californian courts, adopted a regulatory framework requiring courts that permit AI use to adopt policies by 15 December 2025, which must prohibit entry of confidential information into public AI systems and must require disclosure when AI-generated content is provided to the public.

New York: In October 2025, the New York Unified Court System released its first official policy on the use of artificial intelligence. The policy provides an overview of generative AI, establishes mandatory AI training for all New York Unified Court System judges and employees while setting best practice standards for AI tools. For example, the policy explains that AI could be used to assist in performing routine court work, like stylistic editing, document drafting, policy note taking or communications to the public, while cautioning the overreliance on AI, warning that AI is prone to "hallucinating" false Information and that AI programs cannot guarantee confidentiality.

Other state courts and state bar associations have also issued rules or guidance concerning the use of AI in courts. They include Florida, Michigan, New Jersey, and Pennsylvania. Additional states are likely to follow suit. For example, in July 2025, Georgia's Judicial AI Committee released recommendations, which included ‘establishing interim and eventually permanent policies governing the use of AI in Georgia’s judicial system’.

Criminal procedure rules 

Federal and state rules of procedure and evidence may also apply to the use of AI in court even if AI is not mentioned, For example, Federal Rules of Evidence 901(b)(1) and 901(b)(9) concern witness testimony and evidence describing a process or system that produces accurate results.

They govern authentication of AI evidence, requiring witness testimony and evidence describing processes that produce accurate results. In November 2024, the US Courts Advisory Committee proposed expanding Rule 901(b)(9) to require proponents of AI-generated outputs to produce evidence that outputs are 'reliable' and describe training data and software. However, on 2 May 2025, the US Judicial Conference’s Advisory Committee on Evidence Rules considered proposals to amend the Federal Rules and address AI-generated evidentiary challenges under Rule 901. The committee determined an amendment to Rule 901 was not necessary at this time without issuing public comment. Instead, the Advisory Committee created a new rule of evidence[MR1] , Rule 707 (“Machine Generated Evidence”), which is “designed to address concerns about the reliability of computer technologies that generate predictions or inferences from data.” As a result, AI and other machine-generated evidence at trial must either be offered with an expert witness to testify as to its reliability or subject to the same reliability standards as an expert witness.

Despite lack of federal guidance, states are (once again) taking the lead in developing new standards and frameworks to decide AI-generated evidentiary issues. For example, Louisiana revised the Louisiana Code of Civil Procedure Art. 371 to become the first statewide framework to address AI generated evidence by increasing an attorney’s role in verifying the authenticity of the evidence. Similarly, California’s Judicial Council Rule 10.430, enacted in July 2025, requires every state court to either ban generative AI or adopt a policy regulating the use of AI. New York state courts restrict attorneys to only use approved tools and systems by the court, while mandating additional training and disclosures regarding verification.

Data protection legislation

In the United States, there is no comprehensive federal data protection law. Rather, what exists is a collection of sector-specific federal statutes, including broad consumer protection authority vested in the Federal Trade Commission (‘FTC’). The FTC is the primary tool for privacy enforcement and can protect consumers against unfair or deceptive trade practices. Through recent legislation, like the TAKE IT DOWN Act, the FTC is now charged with enforcing Internet and social media platforms to remove the non-consensual publication of intimate visual depictions, including AI generated deepfakes.

At the state level, 29 states have enacted comprehensive consumer data privacy laws, which may also be relevant to the use of AI in criminal proceedings and the processing of any information by AI tools. For example:

California: The California Consumer Privacy Act gives California residents the right to know, delete, correct, opt-out of sale / sharing, and limit the use of sensitive personal information on a non-discriminatory basis. This act applies to for-profit businesses collecting California residents' personal information with over $25 million gross revenue.

Colorado: The Colorado Privacy Act was expanded in July 2025 to create specific protections for biometric identifiers and biometric data requiring entities collecting biometric data, such as facial mapping, fingerprints, voiceprints, to meet stringent notice and consent requirements if they use or intend to use the biometric data. In an effort to protect consumers, Colorado's law introduces a structured framework that protects individuals while guiding businesses toward the responsible use of a consumer's biometric information. This law applies to any businesses collecting biometric data from Colorado residents.

Connecticut: The Connecticut Data Privacy Act solidifies privacy obligations for businesses and mandates that businesses covered under the act to honor universal opt out preferences by Connecticut residents. The Act is enforced by the Attorney General. Of note, the act includes an exemption for political activities.

Delaware: The Delaware Personal Data Privacy Act grants Delaware residents rights over their personal data. Delaware's law only applies to personal data collected from "an individual who is a resident" of Delaware and exempts political subdivisions, entities, and any information or data regulation by certain other privacy laws.

Florida: The Florida Digital Bill of Rights is narrower than most other state laws because it only applies to companies with global annual revenues exceeding $1 billion. However, as it pertains to these companies, the law includes protections for consumers to opt-out of targeted advertising, sale of data, and profiling. Further, Florida's framework permits consumers to opt out of the collection of personal data obtained through the use of voice or facial recognition.

Illinois: The Illinois Biometric Information Privacy Act (‘BIPA’), enacted in 2008, is considered one of the most consequential state privacy laws in terms of litigation and consumer rights. The Illinois law requires opt-in written consent before collecting any biometric identifiers, including fingerprints, face geometry, and retinal scans. BIPA is currently the only state legislation that makes it unlawful for private companies to use facial recognition technology to identify and track people without their consent. Also, unlike most of its state counterparts, BIPA provides a private right of action for statutory damages.

Indiana: The Indiana Consumer Data Protection Act is similar to most other state data privacy laws with respect to exclusions and exemptions. For example, Indiana's law only applies to personal data collected from Indiana residents but requires opt-in consent for sensitive data. However, Indiana's law does not impose a ‘revenue threshold’ for entities, not including government entities, to be subject to their privacy obligations.

Iowa: The Iowa Consumer Data Protection Act is considered a weak data protection act as compared to its counterparts. For example, Iowa's law does not grant consumers the right to delete or correct data collected by third parties or to opt out of profiling. Iowa's law applies to businesses or persons conducting business in Iowa that either control or process personal data from at least 100,000 Iowan customers or derive over 50% of revenue from selling personal data of at least 25,000 Iowan customers.

Kentucky: The Kentucky Consumer Data Protection Act grants Kentucky residents the right to access, correct, delete, and port their personal data, along with opting out of targeted advertising, sales, or profiling. Kentucky's law requires applicable entities to provide consumers with a ‘reasonably accessible, clear, and meaningful’ privacy notice that includes the personal data processed, the purpose for processing the data, the types of third parties the controller may disclose the consumer's personal data to and why, and information on how consumers may securely and reliably exercise their rights to appeal the decision to disclose their personal data.

Maryland: The Maryland Online Data Protection Act imposes persons and businesses conducting business in Maryland certain obligations, which can only be enforced by Maryland's Attorney General. Consistent with many other state-consumer protection acts, Maryland's laws only apply to personal data that can be reasonably linked with an identifiable consumer. It further gives Maryland consumers the right to confirm whether a controller processes their personal data, correct inaccuracies, delete personal data provided by or obtained about the consumer, obtain a copy of such personal data as well as a list of third parties to which the data was disclosed to, and opt-out rights.

Minnesota: The Minnesota Consumer Data Privacy Act adopts the same framework as most other states but includes notable provisions, such as broader rights for Minnesota residents who are subject to profiling. Specifically, the Act allows consumers to opt out of profiling in furtherance of automated decisions that produce legal or similarly significant effects, including the right to question the result of the profiling, be informed of the reason that the profiling resulted in the decision, and review the personal data used in profiling.

Montana: The Montana Consumer Data Privacy Act is largely similar to the Colorado / Connecticut data protection laws. The Montana law gives Montana residents the right over their personal data, including the right to access, correct, delete, and/or opt out of data sales or targeting advertisements. In 2025, the Montana law was amended to lower the threshold, thereby affecting more businesses, and to remove the cure period, which previously allowed companies to fix violations within a 60-day period before penalties applied.

Nebraska: The Nebraska Data Privacy Act generally follows other state-privacy laws by allowing consumers the right to confirm whether their data is processed, to correct inaccuracies, delete personal data, obtain a copy of such data, or opt out of the targeted advertising. However, Nebraska's law uniquely applies to all entities that are not a ‘small business,’ regardless of revenue or the total number of consumers whose data is processed.

New Hampshire: The New Hampshire Privacy Act generally follows the typical state-privacy law template with entity and government level exemptions. Notably, the New Hampshire law provides for a higher civil penalty than most states - up to $10,000 per violation If the entity fails to cure their violation within the 60-day cure period.

New Jersey: The New Jersey Data Protection Act is notably broad in scope, applying to any entity that is not a ‘small business’ regardless of revenue thresholds so long as it processes data for at least 100,000 New Jersey consumers. In January 2026, New Jersey amended the data protection law to expand the definition of ‘de-Identified data’ but adds data and entity-level exemptions.

Oregon: The Oregon Consumer Privacy Act is largely similar to other consumer protection laws but has a larger scope for two key reasons. First, the law does not have a revenue threshold for entities or persons to be subject to the privacy obligations. Second, the law applies to all persons that ‘provide’ products or services to residents of Oregon - not just entities that ‘target’ products or services to Oregon residents. As a result, Oregon's law is considered one of the strongest data privacy laws passed to date. However, it does not provide for a private right of action.

Rhode Island: The Rhode Island Data Transparency and Privacy Protection Act grants consumers the right over their personal data and largely follows the framework of its state counterparts.

Tennessee: The Tennessee Information Protection Act enables consumers to confirm that a business has collected their personal data, obtain a copy of the information, and then request the inaccuracies be corrected. Tennessee's law is aligned with most other state-consumer and privacy protection initiatives. However, Tennessee's law notably contains an expansive carve out for ‘pseudonymous data’, meaning the law excludes "de-identified data," (i.e., data that cannot reasonably be linked to an identified natural personal.

Texas: The Texas Data Privacy and Security Act is largely similar to its state counterparts, but there are a few provisions that make Texas's law unique. For example, Texas's law requires companies to provide additional disclosures that the company may sell a consumer's personal biometric data. Further, following the attorney general's notification of a violation, the law requires an entity to notify the attorney general that the violation has been cured, to notify the consumer that their privacy violation was addressed, and to, if necessary, make internal policy changes to ensure the violation will not occur again. In addition to the data privacy law, Texas's Capture or Use of Biometric Identifier Act is a standalone biometric law that requires notice and consent to collect biometric data. Enforcement of this law is left to the state attorney general.

Utah: The Utah Consumer Privacy Act was one of the first states to provide consumers the right to their personal data. Recently, Utah amended the law to add correction rights, and Utah enacted the Digital Choice Act, which supplements their Consumer Privacy Act, to ensure individuals can access their complete personal data record from social media platforms .

Virginia: The Virginia Consumer Data Protection Act was one of the first acts that provided a state's residents with rights over their personal data and imposed privacy obligations on businesses. Virginia's law set up a framework that operated as a template used by many other states when drafting and enacting their own legislation.

Washington: Although Washington does not have a comprehensive consumer data protection law, Washington's Biometric Privacy Act prohibits enrolling biometric identifiers for a commercial purpose without notice and consent. Notably, the law does not include face geometry within the definition of ‘biometric identifier.’

Each enacted law contains carve outs exempting government entities, law enforcement, and criminal justice activities from their scope. For example, most privacy laws only apply to private companies, meaning that the police, TSA and immigration officers can still use facial recognition without consent in many states. Additionally, federal agencies are often exempt from state laws, especially if there is a ‘national security’ concern. This is notable because it limits the applicability of these laws on criminal proceedings against government entities.

Human rights

Constitutional due process standards could also be construed to regulate AI use. For instance, mass surveillance and predictive policing powered by AI test the protection against unreasonable searches enshrined in the Fourth Amendment to the US Constitution, while opaque, AI-driven risk assessments threaten the guarantees of equal protection and due process provided in the Fourteenth Amendment. International human rights instruments ratified by the United States may also be relevant, including fair trial and privacy guarantees in articles 14 and 17 of the International Covenant on Civil and Political Rights. 

Outlook

In January 2025, President Trump issued Executive Order 14179 entitled ‘Removing Barriers to American Leadership in Artificial Intelligence’ to establish the Trump Administration’s approach to AI policy with the stated goal of maintaining US leadership in AI by developing systems ‘free from ideological bias or engineered social agendas’ and removing barriers to American AI innovation. The order sets a policy to sustain and enhance America’s global AI dominance to ‘promote human flourishing, economic competitiveness, and national security’. President Trump also revoked President Biden’s 2023 ‘Executive Order on the Safe, Secure and Trustworthy Development and Use of Artificial Intelligence’ (Executive Order 14110), which had mandated transparency and agency bias audits, and required a review of policies, directives, and regulations issued under the revoked Executive Order 14110.

The action plan issued in July 2025 pursuant to the new Executive Order 14179 also emphasised deregulation, stating that AI-related federal funding should not go to states “with burdensome AI regulations that waste these funds” while acknowledging that the federal government “should also not interfere with states” rights to pass prudent laws that are not unduly restrictive to innovation.” Insofar as the legal system was concerned, the action plan referred to AI-generated media, such as deepfakes, which could be used as “fake evidence” to deny justice to the parties to litigation. The plan suggested that the federal administration give “the courts and law enforcement the tools they need to overcome these new challenges,” including by exploring “deepfake-related additions” to the Federal Rules of Evidence.

Despite this action plan, in May 2025, President Trump signed into law the bipartisan TAKE IT DOWN Act, which ‘criminalizes the publication of non-consensual intimate imagery, including AI-Generated Non-Consensual Intimate Imagery (‘NCII’), and requires social media and similar websites to have in place procedures to remove such content within 48 hours of notice from a victim.’ The TAKE IT DOWN Act, which is the first US law ‘to substantially regulate a certain type of AI-generated content,’ establishes a ‘reasonable person’ test for determining NCII, which when ‘viewed as a whole by a reasonable person, is indistinguishable from an authentic visual depiction of the individual.’ Further, the TAKE IT DOWN Act requires ‘covered platforms’ to comply with certain notice and takedown obligations with respect to NCII and deepfakes by 19 May 2026.

In the absence of comprehensive federal legislation, nearly every state has enacted general AI laws with many taking effect in 2026. These include, for example, the Colorado AI Act, which was enacted in May 2024 and regulates developers and deployers of ‘high-risk’ AI systems involved in ‘consequential decisions’ including in legal services, with a particular focus on preventing bias and discrimination. The Colorado AI Act will take effect on 30 June 2026. Other examples include additional AI legislation passed in California in September 2024, including its Generative AI Training Data Transparency Act, which requires developers to publish summaries of datasets used in training.

CASES

There is growing jurisprudence on the use of AI tools in court. Set out below are a selection of examples focussing on the risk of bias and discrimination posed by AI tools used by law enforcement and on the sanctioning of lawyers for relying on unchecked hallucinations generated by ChatGPT and similar tools.

Policing and identification cases

State v. Loomis (Wisconsin S. C., 2016): In this case, Eric Loomis pleaded guilty to attempting to flee a traffic officer and operating a motor vehicle without the owner’s consent. His pre-sentence investigation report included a COMPAS risk assessment (see above) that indicated that he presented a high risk of recidivism. The circuit court referenced the COMPAS risk score along with other sentencing factors in ruling out probation. Loomis argued that this violated his due process rights because: first, the proprietary nature of COMPAS prevented him from challenging its scientific validity; second, it violated his right to an individualised sentence by relying on group data; and finally, it improperly considered gender in sentencing. The Wisconsin Supreme Court held that if used properly with specific limitations and cautions, consideration of a COMPAS risk assessment at sentencing does not violate due process. But the court established strict limitations: risk scores may not be used ‘to determine whether an offender is incarcerated’, ‘to determine the severity of the sentence’, or as the determinative factor in deciding whether an offender can be supervised safely in the community. The court also required that any pre-sentence investigation report containing COMPAS include written advice about the tool’s limitations.

Williams v. City of Detroit (E.D. Mich. filed 2021): Robert Williams, a Black man, was wrongfully arrested by Detroit police in January 2020 after facial recognition technology incorrectly identified him as a shoplifter, making this the first publicly reported instance of a false face-recognition match leading to wrongful arrest in the United States. The case resulted in a groundbreaking settlement in June 2024 requiring the Detroit Police Department to implement strong policies constraining law enforcement’s use of facial recognition technology, including prohibiting arrests based solely on facial recognition results.

State of Ohio v. Black (C.A. 9th J.D. 2024): One high-profile case includes Adarus Black, who was sentenced to life imprisonment, based predominantly on Cybercheck data (see above). Defence attorneys argued that jurors would not have convicted Adarus Black without this AI evidence. While Adarus Black’s conviction was affirmed, this sparked investigations into the tool and its founder, and led to exclusion or withdrawal of AI-based evidence in several cases.

Privilege

In US v. Heppner (S.D.N.Y. 2026), Heppner pleaded not guilty to various grand jury charges regarding fraud, including falsifying corporate records and then asserting privilege over the documents he created using Claude, a publicly available generative AI platform. The Government submitted a motion to compel the AI generated documents, arguing that they were not protected by attorney-client privilege or the work product doctrine. The Court agreed, finding an AI user's communications were not protected by either privilege. The Court went on to explain that, when applying classic attorney-client privilege elements, AI generated documents could not be privileged because, first and foremost, ‘Claude is not an attorney’ and the documents could not be considered communications between Heppner and his attorney. Further, Claude's privacy policy states that users of Claude consent that Anthropic collects data inputted into Claude and any outputs from Claude, so the communications cannot be considered confidential. Finally, even if Claude were an attorney and the communications were privileged, Heppner did not use or communicate with Claude for the purpose of obtaining legal advice. Indeed, Claude explicitly disclaims that it is providing legal advice.

Misuse of AI in court filings

Lawyers relying on generative AI tools

Lawyers are being increasingly sanctioned for their reliance on unverified and false outputs from generative AI tools, often by way of payment of a fine.

An early civil case was Mata v. Avianca (S.D.N.Y. 2023), with judgment imposing sanctions delivered in June 2023. Lawyers filed submissions containing ‘non-existent judicial opinions with fake quotes and citations created by the artificial intelligence tool ChatGPT’. This error was exacerbated by their failure to verify submissions, and their continued defence of the fake material even under judicial scrutiny. During the court hearings, one of the lawyers admitted misunderstanding ChatGPT’s capabilities, stating: “I just never thought it could be made up.” Other issues in this case included subjective bad faith on the part of the lawyers, “acts of conscious avoidance and false and misleading statements to the Court,” and violations of procedural rules. These breaches led to a joint sanction of a fine of USD 5,000 against the lawyers and their firm. When faced down with AI-generated errors and misuse, Courts continue to impose sanctions.

More recently, in Noland v. Land of the Free, L.P. (Cal. Ct. App. 2025), a Los Angeles attorney was fined $10,000 for using ChatGPT to generate fake quotations in a state appeal - the largest fine in California State Court to date. Likewise, in Jordan v. Chi. Hous. Auth. (Ill. Cir. Ct. Dec. 5, 2025), an Illinois trial court sanctioned a legal team following a $24 million verdict against the defendant based on misconduct relating to the submission of false legal citation and factual misrepresentations in post-trial briefings. There, the Court noticed a ‘fictitious case’ and when the Court questioned the attorney regarding the case, the attorney admitted to using ChatGPT for drafting parts of the motion. After the Court noted 14 instances of misrepresented legal propositions, the court ultimately determined that a penalty of $59,500 was warranted, given the seriousness of the conduct, especially as in the post-trial motion context.

Fines continue to be imposed, sometimes in combination with other sanctions. In Lacey v. State Farm General Insurance Company (C.D. California 2025), two law firms representing the plaintiff were held jointly responsible for ‘“bogusAI-generated research” contained in a brief, which they failed to properly correct before re-submission despite explicit notice of the issues. The court regarded their conduct as “tantamount to bad faith,” imposing litigation sanctions including striking the plaintiff’s supplemental briefs, and financial payments totalling $31,100 to compensate the defence. And in Gauthier v. Goodyear Tire & Rubber Co (E.D. Tex. 2024), a lawyer used Anthropic’s Claude AI to produce a filing that used several non-existent quotations from real cases, and cited two cases that did not exist at all. He tried but failed to verify them through another legal AI tool, later compounding the error by not correcting his brief even after opposing counsel flagged the issues. The Western District of Texas imposed a $2,000 fine and also ordered the lawyer to complete a training course on generative AI.

Further sanctions include dismissal of the filing, striking lawyers from the case, or suspending them from practice. In Bevins v Colgate-Palmolive Co (E.D. Penn. 2025), a lawyer filed briefs containing fake cases. When questioned, he offered no explanation beyond asserting that they may have been the ‘“result and consequence of a tired, rather than fresh eyed, last proof reading of the filing.” The court found this unpersuasive, notified the relevant state and federal bars, struck the attorney’s appearance, required the attorney to inform his client about the sanction, and required the client to find new counsel if she wanted to refile after dismissal. In the case of In re Newsom (M.D. Florida 2024), a lawyer was suspended for one year on the recommendation of the Grievance Committee of the Middle District of Florida, after admitting that he “may have used artificial intelligence to draft the filing(s) but was not able to check the excerpts and citations.” More recently, in Flycatcher Corp. v. Affable Ave, LLC (S.D.N.Y. July 18, 2025), after the defendant's attorney submitted a brief with ‘sophisticated AI hallucination mechanisms,’ the court ordered the attorney to show cause as to why the brief with AI hallucinations should not be stricken entirely and why sanctions should not be imposed against him. In the attorney's submissions, the Court again caught a citation error, which upon a Google search revealed the quote to be from an article—not the cited case. Although mystified by the attorney's failure to verify the authenticity of his cited materials, the court reserved the issue of sanctions at this time. However, on 5 February 2026, the court ultimately decided to impose sanctions under Federal Rule of Civil Procedure 11 by striking the submission entirely and entering default judgment against the defendant.

Reliance on generative AI tools has also featured in criminal cases. In United States v. Michel (D.C. 2024), rapper Pras Michel’s lawyers asked an AI tool to write “a powerful, emotionally compelling closing argument” for his trial. Using the AI tool, Michel’s attorney’s trial closing erroneously attributed another artist’s lyrics to Pras Michel’s group. The court observed that Michel had not explained how the mistaken attribution of a song in the closing argument “resulted in prejudice,” and for this and other reasons denied his claim for ineffective assistance of counsel.

In J.G. v. New York City Department of Education (S.D.N.Y. 2024), the Cuddy Law Firm sought to justify its fees in multiple cases by relying on ChatGPT’s suggestions about lawyers’ rates. The U.S. District Court judge dismissed the arguments as ‘utterly and unusually unpersuasive’ because ‘treating ChatGPT’s conclusions as a useful gauge of the reasonable billing rate for the work of a lawyer with a particular background carrying out a bespoke assignment for a client in a niche practice area was misbegotten at the jump’.

Further, attorneys are not the only persons subject to fines and dismissal. In October 2025, two federal judges admitted to using AI in letters to the Administrative Office of the US Courts. After two federal judges blamed their “faulty rulings on the use of artificial intelligence tools by staff members.” This raises serious ethical concerns regarding the use of AI in final orders and judgments issued by the Courts.

Self-represented litigants relying on generative AI tools

Courts are also taking a stricter stance with self-represented litigants. In Ferris v. Amazon.com Services LLC (N.D. Mississippi 2025), William Ferris, a self-represented litigant, used GenAI to prepare filings containing fake and misleading case citations, and also for an oral statement to the court at a show-cause hearing. The court issued the following rebuke: