AI Laws in New Hampshire (NH)

New Hampshire remains in the "no dedicated AI law" cohort as of 2026-04-22 — new hampshire enacted its data privacy act (sb 255, 2024) plus narrow ai laws — restricting state-agency ai use (hb 1688, 2024) and criminalizing fraudulent deepfakes with a private right of action (hb 1432, effective 2025) — but no comprehensive private-sector ai statute. Operators across sectors in New Hampshire watch federal signals first.

Federal law still governs Cross-Sector AI in New Hampshire primarily through FTC Section 5 (15 USC 45) and NIST AI RMF 1.0. Adjacent federal authorities include Gramm-Leach-Bliley Act (GLBA) / NIST Cybersecurity Framework (15 U.S.C. § 6801-6809; NIST CSF 2.0); General Data Protection Regulation (GDPR) (for EU users) (EU Regulation 2016/679); Section 508 / ADA Title III (Digital Accessibility) (29 U.S.C. § 794(d); 42 U.S.C. § 12181). Gramm-Leach-Bliley Act (GLBA) / NIST Cybersecurity Framework (enforced by Federal Trade Commission; NIST) applies to saas platforms handling personal/financial data via ai must implement nist csf security standards: identify, protect, detect, respond, recover. Penalty exposure: ftc civil penalties up to $100,000/violation; private litigation for data breaches. FTC Operation AI Comply (Sep 2024) targeted five companies across sectors.

The practical effect for New Hampshire operators: AI compliance risk is driven by federal agencies first, with New Hampshire Attorney General acting on UDAP residual authority only when consumer harm surfaces.

Three neighboring regimes create compounding exposure: Vermont (H.341 — oversight of high-risk / 'inherently dangerous' AI systems (proposed), penalty TBD), Maine (LD 1727 — Transparency in Consumer Transactions Involving AI (10 M.R.S. §1500-DD), penalty Enforced as a violation of the Maine Unfair Trade Practices Act), and New York (NYC Local Law 144 — automated employment decision tools, penalty $500-$1,500 per violation (LL144)). Multi-state Cross-Sector operators headquartered in New Hampshire default to the strictest stack.

The federal and neighboring-state framework that governs your AI operations. Cross-Sector operators in New Hampshire operate under a federal-dominant framework anchored by FTC Section 5 (15 USC 45) and NIST AI RMF 1.0, with adjacent authorities Gramm-Leach-Bliley Act (GLBA) / NIST Cybersecurity Framework (15 U.S.C. § 6801-6809; NIST CSF 2.0); General Data Protection Regulation (GDPR) (for EU users) (EU Regulation 2016/679); Section 508 / ADA Title III (Digital Accessibility) (29 U.S.C. § 794(d); 42 U.S.C. § 12181). FTC Operation AI Comply (Sep 2024) targeted five companies across sectors. The practical risk they have to price in is cross-sector FTC Section 5 exposure and state UDAP liability, and the bellwether signal to monitor is NIST AI RMF 1.0 (Jan 2023) is cited as the federal baseline across 30+ agency guidance documents. Vermont -- H.341 — oversight of high-risk / 'inherently dangerous' AI systems (proposed) sets the de-facto regional floor. New Hampshire enacted its Data Privacy Act (SB 255, 2024) plus narrow AI laws — restricting state-agency AI use (HB 1688, 2024) and criminalizing fraudulent deepfakes with a private right of action (HB 1432, effective 2025) — but no comprehensive private-sector AI statute. Use this as a starting point; sector pages on this site go deeper into industry-specific obligations.

The enforcement surface for Cross-Sector centres on FTC, CFPB, State Attorneys General, and the statute operators most often under-document is General Data Protection Regulation (GDPR) (for EU users) (EU Regulation 2016/679) — a gap that surfaces in cross-sector FTC Section 5 exposure disputes. Build an evidence binder covering AI inventory, risk-tier register, incident-response runbook, and board-level AI risk report. Treat NIST AI RMF 1.0 (Jan 2023) is cited as the federal baseline across 30+ agency guidance documents as your leading indicator and escalate when the signal shifts.

With 11-50 employees you can justify a half-time compliance lead and part-time external counsel on retainer. Small-stage Cross-Sector operators should deploy a named compliance lead, formal AI inventory, quarterly bias spot-checks, and a documented escalation path, with semi-annual internal audit with annual external review and ownership resting with a designated AI compliance lead reporting to the CEO. small-business budgets ($50K-$250K) justify a compliance lead plus a GRC tool such as Credo AI, Fairly, or Holistic AI. For Cross-Sector specifically, the sharpest exposure to manage is cross-sector FTC Section 5 exposure and state UDAP liability. Given New Hampshire's concentration in financial technology, healthcare, and higher education, FinTech underwriting models and university-admissions algorithms deserve priority in your AI inventory.

Verified 2026-04-22. See https://www.gencourt.state.nh.us/ for the New Hampshire Attorney General public record on New Hampshire AI policy.