Vermont’s H.814, an Act Relating to Neurological Rights and the Use of Artificial Intelligence Technology in Health and Human Services, passed the State Senate in concurrence with the House on 6 May 2026 and now sits with Governor Phil Scott. Rafael Yuste, the Columbia neuroscientist who has led global neurorights advocacy since the 2017 NeuroRights Initiative, called Vermont “the 9th territory in the world” with neural data legislation. The bill that actually passed is the 6-page House version. It recognises a right to mental and neural data privacy. It contains none of the enforcement mechanisms that were in the original 27-page draft.
Cut in committee, passed unmodified by the Senate
A House committee reduced H.814 from 27 pages to 6 pages in March 2026. Out went the consent rule that no person could collect or share an individual’s neural data without written informed consent. Out went the private right of action. Out went Attorney General enforcement authority and civil penalties of up to $10,000 per violation under Vermont’s Consumer Protection Act. Out went the mental health chatbot guardrails. Out went the operational definitions that gave the rest of the statute teeth.
The 6-page version retains a recognition of the right and a directive to study further regulation. The Senate accepted the House text unmodified on 6 May, which is what “passed in concurrence” means. The bill takes effect on 1 July 2026 if Scott signs.
What the count looks like at strict reading
Yuste’s list groups Chile, Rio Grande do Sul, Colorado, California, Montana, Alabama, Connecticut, Canada, and Vermont. The roster of jurisdictions that actually have neural data law on the books is shorter:
| Jurisdiction | Instrument | Status |
|---|---|---|
| Chile | 2021 constitutional amendment, 2023 Supreme Court ruling | In force |
| Rio Grande do Sul, Brazil | 2021 state constitutional amendment | In force |
| Colorado | SB 24-205, neural data added to “sensitive data” under the CPA | In force August 2025 |
| California | 2024 amendment to the California Consumer Privacy Act | In force |
| Montana | 2025 statute | In force |
| Connecticut | SB 1295, amends the CTDPA | Effective 1 July 2026 |
| Vermont | H.814 | Passed both chambers, awaiting Scott |
Alabama’s HB263 died sine die in 2025. Canada’s Bill C-27 lapsed when Parliament was prorogued in January 2025. Six jurisdictions have enacted neural data instruments today. Vermont becomes the seventh if Scott signs.
How Vermont stacks against the four US states with teeth
Colorado, California, Montana, and Connecticut each treat neural data as “sensitive data” under their existing comprehensive privacy laws. That import does the heavy lifting. Consent, sale, processing, and data-subject-rights obligations all flow from the underlying state regime. The Attorney General can bring enforcement actions and assess penalties, with the California Privacy Protection Agency carrying parallel authority in California. A BCI company processing the neural data of residents in those four states faces real compliance overhead.
Vermont’s H.814 as enacted contains none of that. The right is recognised. The obligations and the state authority to enforce them are not. A BCI company processing the neural data of Vermont residents has no new compliance overhead because of this statute.
The Dargentic Neurotechnology Report (Spring 2026) calls this dynamic the US “fifth passage” patchwork on Page 21. Every state takes its own path, and the bills lose enforcement substance as they move through committee. Vermont follows the pattern.
What to watch next
Governor Scott now has the bill. A signature is the base case. A veto would be the surprise outcome on a recognition-only statute that the legislature has already stripped of regulatory weight.
Massachusetts, Minnesota (SF 1240 with companion HF 1728), and Illinois have neural data bills under consideration. The structural question for the patchwork is whether they pass enforcement-equipped versions like Colorado, California, and Connecticut, or recognition-only versions like Vermont. The answer determines whether the patchwork starts creating real operating risk for BCI and consumer-neurotech companies that serve users across state lines, or whether it stays symbolic at the marginal additional state.
The European Union, South Korea’s K-Moonshot programme, and the United Kingdom’s Information Commissioner’s Office all have moves in flight that will determine how neural data is processed in those jurisdictions. None of them are constitutional or statutory recognitions in the Yuste mould. All of them are operational frameworks that BCI companies will have to live inside.
Sources: Vermont Legislature H.814 status page and BillTrack50 for the 6 May concurrence vote. Privacy Daily and the 9 April Senate witness testimony filing for the 6-page content. Yuste 6 May post on X.