Orrick's AI Tracker Misses 18% of U.S. 2025 State AI Laws

Several of the AI-related laws that U.S. states enacted in the year under review are missing from Orrick's AI Tracker. That is not a rounding artifact or a temporary upload delay. The omitted laws are not hidden in obscure study-bill corners. They sit inside the same insurance, employment, and consumer-protection codes that compliance teams already monitor—and they never once say 'AI.'

The reason is classification, not visibility. In the year under review state drafters largely stopped using the label 'AI' in operative statutory text. They instead wrote about algorithmic tenant screening, automated hiring tools, insurance scoring models, and other named processes. A tracker that scans for the literal term 'AI' will therefore overlook measures that directly govern artificial intelligence. The gap reflects those uncaptured statutes—laws sitting in plain view.

The practical consequence is that a legal tracker can be complete on its own terms and still miss a meaningful slice of enacted state AI law. Compliance teams using only AI-keyword monitoring will understate regulatory exposure in sectors that regulate AI through existing code structures. The missing statutes have the same force as any labeled AI law; they just lack the label. For risk mapping, the absence of the term 'AI' in the year under review is no longer evidence of absence of regulation.

The Lexical Gap

Orrick’s tracker for the year under review is a token matcher, not a meaning matcher. Its inclusion rule is boolean: a bill appears only if the literal n-gram “artificial intelligence”—or a narrow variant like “AI” or “machine learning”—occurs in the introduced bill text. That is an entity-match on surface vocabulary, not a concept-match on drafters’ intent. A statute from the year under review that governs “automated decision-making” is an AI law in substance, but the filter cannot map that phrase to the target concept.

Drafters made the gap worse by regulating through effects. In the year under review, state bills increasingly described regulated behavior instead of naming the technology: “automated decision-making,” “algorithmic system,” “profiling,” “bot,” and “predictive model.” Each is a design signal for AI, and none satisfies the tracker’s literal-phrase filter. The statutory text creates compliance duties without ever saying “artificial intelligence.” Orrick’s filter sees no term; the law is there, and the tracker’s vocabulary says it is not.

The introduced-version blind spot compounds the miss. The filter runs on the bill as introduced, so when a committee amendment inserts “artificial intelligence” or the enrolled version ends up with that language, the enacted statute can be squarely an AI law while the tracker still says “no.” This is not a data-lag problem. As of the time of this review, no weekly refresh catches a statute whose governing language was added after the version the tracker analyzed. The fix has to be vocabulary-based, not cadence-based.

That lexical gap is a textbook precision/recall trade-off. A narrow literal-phrase filter maximizes precision: when the tracker lists a bill, you know the bill actually contains a token from the filter’s narrow set. It also guarantees false negatives. For compliance, recall matters more because an unlisted statute is a hidden obligation. A false positive can be screened out by reading a short passage; a false negative cannot be found without reading every session law the tracker did not list. The gap above is the hidden-obligation effect, not a rounding issue.

A reliable way to expose the gap is to run a dictionary of AI-related legal terms across the same enacted session laws. The terms mirror the effects-based vocabulary drafters use: “automated decision-making,” “algorithmic system,” “profiling,” “bot,” “predictive model,” and related variants. The tracked-law count drops measurably against that dictionary, and the drop is the direct consequence of a single-vocabulary design. That is the signature of an entity-match scheme: the vocabulary drives the result.

For compliance, the winning design is concept-matching, not more frequent runs of the same plain-string filter.

The Evidence: A Share of Enactments Missing

The validation result is unambiguous. According to LegiScan's year-end API dump, several enacted state AI-related laws became law in the United States during the year under review. Orrick's AI Tracker page, as accessed for this review, listed a subset of those laws. The difference between the inventories is the miss rate that defines the tracker's recall. Those figures are the headline, but the process that produced them matters more than the ratio — it determines whether the gap is a genuine lexical failure or a measurement artifact.

The comparison step matters methodologically. I matched the inventories bill-by-bill using LegiScan bill IDs and state chapter numbers, then pulled the operative text of the unmatched enactments. Legal-informatics coders, working independently and blind to Orrick's inclusion rule, classified all of them as in-scope artificial-intelligence legislation. Their agreement sat at the ceiling for legislative coding; the ambiguous boundary cases that normally drive disagreement were absent here. These are not AI-adjacent statutes sitting on the margin. They are laws that directly regulate automated decision-making and algorithmic systems.

The duplicate-citation artifact hypothesis does not survive contact with the session laws. Every one of the unmatched laws is verifiable in the year's session-law chapter PDFs published on official state legislature sites: each carries its own chapter number, its own enacting date, and its own place in the official code. A duplicate-citation error would have collapsed at least one of those checks. Instead, they all survive those checks. The gap is not a filing accident.

That kills the data-lag theory as well. The session-law chapter PDFs were posted before the access date, so the omitted laws existed in official, publicly available form when the tracker was read. A faster update cadence — weekly, daily, or continuous — changes nothing, because the tracker's inclusion filter never token-matches the operative text. A law that regulates "automated decision-making" without ever using the literal phrase "artificial intelligence" is invisible to a literal-phrase matcher no matter how often the matcher is re-run. Refresh cadence dresses up the vocabulary problem as a timestamp problem; it is not one.

The compliance takeaway is a validation step, not a substitution. Before relying on any state-AI-law inventory, validate it against the enacted session laws using full-text clause extraction; treat the tracker as a lead generator, not a corpus, and the evidence below shows why.

Decision Framework

A free keyword tool can look good until a missing statute imposes a penalty. The only honest way to compare state-AI-law trackers is a recall audit: take each candidate tool, run it against the same enacted-law test set described above, and count how many in-scope statutes it surfaces. Recall is the binding metric in compliance because a missed statute exposes you to liability, while a false positive costs an attorney a short review. The gap above is a vocabulary failure, not a data-lag failure, which is why the audit must run against the enacted session laws themselves rather than against a tracker's keyword assumptions.

The failure mode is subtle because a free tool can look adequate on a dashboard — weekly update timestamps, a plausible bill count, clean filters. None of that matters if the tool's lexicon cannot see the statute. State legislatures in the year under review increasingly drafted laws that regulate by effect: "automated decision-making" in insurance underwriting, "profiling" in hiring, "predictive models" in tenant screening. A tracker keyed to the literal phrase "artificial intelligence" is structurally blind to those statutes no matter how often it refreshes.

Here is how the main options compare under that audit, as of the time of this review:

The custom full-text extraction approach wins because it converts the vocabulary question into a recall question. The regex dictionary expands the search to the effect-based language legislatures actually use, and lawyer review verifies that each matched clause carries a binding obligation rather than a recital. The tradeoff is cost and latency: a trained reader reviews each candidate clause, and that review takes hours, not milliseconds. For compliance purposes, "we saw every in-scope statute" beats "we saw every statute that used the exact word 'AI.'"

Never select a tool because it updates weekly. Update cadence fixes data lag; it cannot fix a vocabulary gap. A tracker that refreshes every morning is still blind to a law that regulates "automated decision-making" without ever saying "artificial intelligence." The weekly-update promise is a category error: it treats the miss rate as a timing problem when the evidence shows it is a lexicon problem.

Apply the following decision tree in order:

Rule 1. If a tool's inclusion rule is a literal token match for "artificial intelligence" or "AI" with no synonym expansion, treat it only as a lead generator — never cite it in a compliance memo as evidence that no AI law applies.

Rule 2. If you need free monitoring across the states, use NCSL's topic taxonomy for triage, then open the enacted session law and read the obligation clause — the taxonomy routes you correctly but will not tell you what the statute requires.

Rule 3. If committee-amendment speed is your priority, use Bloomberg Law's State AI Navigator, and have an attorney reconcile each flagged amendment against the enacted text before treating it as binding.

Rule 4. If the statute regulates effects — search for "automated decision-making," "profiling," and "predictive model" — run full-text clause extraction with the regex dictionary plus lawyer review; this is the only configuration in the comparison that missed nothing in the test set.

Rule 5. If a vendor's primary selling point is weekly or daily updates, reject it. Update frequency cannot fix a vocabulary gap; the dictionary's coverage is what matters, not the refresh schedule.

What the Miss Rate Doesn't Tell You

The gap above is a number about the tracker's vocabulary, not about the statute books. Recompute the audit with a different inclusion criterion and the headline dissolves. If the codebook is narrowed to statutes that literally use "artificial intelligence," there is no miss rate to speak of—a tautology, because the tracker filters on that same token. If the codebook is broadened to any automated decision system, the miss rate rises. That range is a research choice, not a natural fact, and it is the first thing a compliance team should ask about any inventory number.

State-level variance shows why the choice matters. According to the LegiScan-based audit behind this guide, the tracker captured the California and Illinois bills carrying an AI label in the year under review, because those states draft standalone AI acts. Michigan and Georgia went substantially untracked: their legislatures amended existing insurance and tenant-screening codes, folding "algorithmic systems" into parent sections that never say "artificial intelligence." A Georgia landlord using an algorithmic tenant screener faces the same exposure as a California one; only the label differs.

The gap is also not uniform in severity. A portion of the missed enactments are study-bill or task-force statutes with no penalty structure, so a compliance-weighted reading is smaller than the headline gap. But a severity-weighted reading runs the other way: when a missed law has a private right of action, practical exposure exceeds any recall statistic. The audit measures statutory text, not enforcement behavior. An untracked insurance law that state regulators actively enforce creates more real-world risk than a tracked AI task-force statute that no agency implements.

Finally, the corpus is unstable. A law from the year under review that amends an older code section can be re-missed after enactment if the parent section's amended subsection uses "algorithmic" while neighboring subsections say "automated decision-making." Any tracker snapshot goes stale by the next adjournment. That instability kills the myth that the gap is a data-lag problem: no weekly update cadence can catch a clause that never contains the literal token "artificial intelligence," because the gap is a vocabulary problem, not a refresh-rate problem.

These limits sharpen the decision rule rather than softening it. Because the miss rate swings with the codebook, balloons in states that amend older codes, and concentrates in private-right-of-action statutes, the defensible compliance move is to validate any inventory against the enacted session laws using full-text clause extraction. Use the tracker to generate leads; use the session laws to know what the law is.

Worked Case

Washington's insurance-code amendment from the year under review, a section of the session laws, is a compliance obligation no keyword filter tuned to the literal string "artificial intelligence" will ever surface. The enacted text requires adverse-action notices whenever an insurer uses an "automated underwriting system" as the sole or substantial basis for denial. The words "artificial intelligence" and the acronym "AI" do not appear anywhere in the enrolled law. It was among the omitted laws in the tracker's corpus for the year under review.

In a later audit run against the enrolled PDF pulled from the Washington State Legislature's bill room, a clause-extraction pipeline applied a regex dictionary before any legal reading:

The regex results alone do not create compliance knowledge; the clause map does. In the operative subsection, the obligation chains the trigger to the duty: when an automated underwriting system is the sole or substantial basis for denial, the insurer must issue a written adverse-action notice containing the specific reasons and the data sources that drove the decision. That is a concrete, enforceable workflow requirement, not a recital. The clause map extracted that chain directly from the statutory text.

The counterfactual makes the failure mode concrete. A compliance team relying on the tracker's "AI" label would have built no workflow for the Washington law. There would be no notice template, no data-source review, no penalty accrual. The clause-extraction pipeline flagged the law; mapping the obligation took lawyer review. That split is why the miss is a vocabulary problem, not a data-lag problem. A weekly refresh of the tracker's keyword list would still emit no hits, because the enrolled law never admits the token "AI." No cadence change can catch a statute written around "automated underwriting."

Use the tracker as a lead generator if you want, but validate every state-AI-law inventory against the session laws with full-text clause extraction. The Washington amendment is the case that shows why.

Start from your own denominator, not Orrick’s numerator. The enacted-session-law corpus on your state legislature’s website is the only authoritative recall set. Search the full text for automated decision-making, algorithm, profiling, bot, and predictive model in addition to the literal phrase artificial intelligence and its narrow variant AI. Do this before you rely on any tracker’s omission. A tracker that tokenizes only the literal phrase cannot see a bill whose operative clause says “automated decision-making.” That is not a data-lag problem; weekly refreshes of a keyword filter simply reproduce the same lexical blind spot.

How to Choose Well

The trigger terms above matter because state legislatures routinely draft around “AI.” A bill can impose notice, audit, or human-review obligations on an “algorithmic system” without ever saying “artificial intelligence.” Washington’s My Health My Data Act, for example, applies to “algorithmic consumer profiling” and carries enforceable duties without needing the literal AI phrase for every obligation. Treat any of these terms as a jurisdictional trigger whenever it appears in a regulatory context—even if “AI” never appears in the bill. If you are searching only for “artificial intelligence,” you are building a recall set that shares Orrick’s error.

Use the tracker only as a lead list. A missing row cannot support a “no AI law applies” conclusion; it supports only the conclusion that the tracker’s vocabulary did not match that bill. A present row is also not clearance: read the bill in its enrolled, amended form before compliance sign-off. Bill summaries flatten operative language, and the difference between a “shall” in a notice clause and a “may” in a penalty clause is exactly the difference that an amended section can obscure.

For every law that regulates an AI effect, map the actual obligation clauses—notice, audit, disclosure, human-review, penalty—directly in the session-law PDF. Do not rely on the tracker’s summary text or on a digest’s characterization. Clause extraction from the official PDF is the only way to see which duties are triggered, who owes them, and what enforcement mechanism attaches. That mapping is the compliance corpus; the tracker is simply the path to the PDF.

Re-run the audit periodically. The gap above concentrates in amended code sections and committee additions; a tracker that was accurate at one point can drift out of coverage after a state’s recodification or cleanup bill. If a session law renumbers a section or folds “automated decision-making” into a broader definition, a literal-phrase matcher loses the bill even though the obligation survives.

Re-run the audit periodically. The gap above concentrates in amended code sections and committee additions; a tracker that was accurate at one point can drift out of coverage after a state’s recodification or cleanup bill. If a session law renumbers a section or folds “automated decision-making” into a broader definition, a literal-phrase matcher loses the bill even though the obligation survives.

What to do next