North Carolina Doesn’t Have an AI Law. That Isn’t the Same as Being in the Clear.
On July 1 the state published an AI Strategic Roadmap: 17 goals across three priorities, produced by the AI Leadership Council the Governor created last year. If you own a business here, the useful thing to know is that none of it is a rule you have to follow.
That is worth stating precisely, because “North Carolina has no AI law” gets heard as “there is no exposure,” and those are two different claims. The first one is true. The second one is not.
What the state actually did
In September 2025, Governor Josh Stein signed Executive Order No. 24, “Advancing Trustworthy Artificial Intelligence That Benefits All North Carolinians.” It created an AI Leadership Council, an AI Accelerator inside the Department of Information Technology, and AI oversight teams inside state agencies. It sunsets on December 31, 2028. The July 2026 Roadmap is that council's output.
Both are aimed at state government. The council advises the Governor and state agencies. The Accelerator sits inside NCDIT. Cabinet agencies submit their AI use cases. The Roadmap talks about helping businesses adopt AI responsibly, and helping is what it does. It requires nothing of them.
One correction worth making, because the claim circulates: Executive Order No. 24 does not impose AI requirements on state contractors. It contains no procurement or vendor terms at all. If you bid on state work and you are wondering whether AI obligations attach, the answer is in your contract, not in the executive order.
And for precision's sake: North Carolina has enacted exactly one AI statute, and it is criminal law, not business regulation. Session Law 2024-37, signed July 8, 2024, extended the penalties for nonconsensual intimate images to AI-generated ones. It says nothing about how a business may use AI.
The law that does apply is older, and blunter
North Carolina's Unfair and Deceptive Trade Practices Act predates all of this and never mentions AI. It does not need to.
“Unfair methods of competition in or affecting commerce, and unfair or deceptive acts or practices in or affecting commerce, are declared unlawful.”
N.C.G.S. § 75-1.1(a)The teeth are one section over. § 75-16, “Civil action by person injured; treble damages,” gives an injured person a right of action and directs that “judgment shall be rendered in favor of the plaintiff and against the defendant for treble the amount fixed by the verdict.”
This distinction gets blurred constantly in write-ups of this topic, including ones that sound authoritative: the prohibition lives in § 75-1.1, and the private lawsuit and the tripling live in § 75-16. Together they mean nobody needs an AI-specific statute to sue you over AI. If a chatbot on your website tells a customer something untrue and they rely on it, the deception law is already there, and it multiplies by three.
One wrinkle, if you are a licensed professional
The Act carves out an exemption that matters to medical practices and law firms:
“For purposes of this section, ‘commerce’ includes all business activities, however denominated, but does not include professional services rendered by a member of a learned profession.”
N.C.G.S. § 75-1.1(b)Courts have read “learned profession” to cover physicians, attorneys, clergy and related fields. But it covers the rendering of professional services, not everything a practice does. Marketing, billing and intake are ordinarily business activities. Exactly where that line falls has been litigated repeatedly and is not obvious from the text.
So if you are licensed and you are counting on this exemption to cover an AI tool, that is a conversation with a North Carolina lawyer, not a thing to settle from a blog post. Including this one.
The pending bills: watch them, don't reorganize around them
The 2025–26 session produced a steady stream of AI bills: healthcare utilization review, chatbot regulation, deepfakes, data center power demand, AI instruction in schools. As of today, none has been enacted. The most recent omnibus attempt, House Bill 1161, “Omnibus Artificial Intelligence Protections,” was filed April 30, 2026, passed first reading on May 4, and has been in the Appropriations committee since.
The one closest to the finish line is House Bill 301, “Social Media & AI Safety.” It passed the House 106–6 and the Senate 48–0, but the two chambers passed different versions, and it went to a conference committee on June 24, 2026. It is aimed at K–12 schools rather than at businesses. It is worth knowing about mainly because near-unanimous votes are how a state's first real AI statute tends to arrive.
A great deal of writing in this space reports introduced bills as though they were rules. They are not. They also may become rules, which is why the honest posture is to watch rather than to restructure.
Other states can reach you anyway
Texas's Responsible Artificial Intelligence Governance Act took effect January 1, 2026. It applies based on conduct rather than company size: it reaches a person who promotes, advertises or conducts business in Texas, or who offers products or services to Texas residents. There is no small-business threshold in it.
Colorado replaced its own AI act in May 2026 with a narrower automated-decision-making law, and that one applies to employers doing business there regardless of headcount. Its effective dates and its enforcement are both still moving, so any specific number you read about it today deserves a second look.
The detail is not the point. The point is that “we're a small shop in Charlotte” does not settle the question if you sell across state lines.
If you run a law firm
The North Carolina State Bar adopted 2024 Formal Ethics Opinion 1, “Use of Artificial Intelligence in a Law Practice,” on November 1, 2024. It imposes no blanket ban on AI, and it does not let you hand off responsibility to the tool: the lawyer is fully responsible for the use and impact of AI in the client's case. Competence, confidentiality and supervision all still attach.
The North Carolina Bar Association made a related argument in January: a blanket ban tends to backfire, because it pushes people toward free consumer tools on personal devices, where the firm can no longer see where client data is going.
Four things worth doing this month
- Write down which AI tools are actually in use. Include the AI features inside software you already pay for. Most lists come back longer than expected.
- Ask each vendor, in writing, whether your inputs train their models. Verbal assurances are not useful later.
- Put a human between AI output and anything a customer sees or relies on. This is the control that would actually matter in a § 75-1.1 argument.
- Require out-of-band verification for wire transfers, payroll changes and password resets: a callback to a number you already had, not one in the message.
None of those require buying anything.
Where we sit on this
Box of Prompts builds AI systems for small businesses. A post about legal exposure from AI is exactly the sort of post that could be written to manufacture a reason to hire us, so it is worth saying plainly that it wasn't: none of the four steps above involve buying anything, and in our experience most businesses reading a piece like this need less AI than they have been told, not more.
Not legal advice
This is a summary of publicly available material, current as of August 9, 2026. It is not legal advice, it is not a substitute for it, and it does not create an attorney-client relationship. Statutes, bills and effective dates in this area are changing quickly. For your own situation, talk to a North Carolina attorney.
Sources
Every figure and citation here was checked against the primary document, not a summary of it. Tags mark who published each source and what interest they have.
- INDEPENDENTN.C.G.S. § 75-1.1 and § 75-16. North Carolina General Assembly, statutory text.
- INDEPENDENTExecutive Order No. 24 and the AI Strategic Roadmap announcement. Office of the Governor.
- INDEPENDENTHouse Bill 1161, House Bill 301, and House Bill 591 / Session Law 2024-37. North Carolina General Assembly bill histories.
- INDEPENDENTTexas HB 149 bill analysis. Texas Legislature, effective date and scope.
- INDEPENDENTColorado SB 26-189. Colorado General Assembly.
- INDEPENDENT2024 Formal Ethics Opinion 1. North Carolina State Bar, the profession's regulator.
- INDEPENDENT“Artificial Intelligence, Government, and the Law.” Kristi Nickodem, UNC School of Government, October 29, 2025.
- TRADE“Beyond the Ban.” Catherine Reach, NC Bar Association Center for Practice Management, January 13, 2026. A membership body writing for its own members.