Regulatory Trends in AI

Regulatory Trends in AI Informed
AI generated image from Midjourney

As State and Federal legislative sessions around the U.S. are in full swing, it’s worth checking what’s happening with AI legislation.

A look back to the first attempts at AI legislation

But first an anecdote.  When I was a US Senate Judiciary Committee staffer in 2003, I drafted a data breach bill S.1350, the Notification of Risk to Personal Data Act, on behalf of California Senator Dianne Feinstein. The bill was the first effort by a member of Congress to translate to the Federal system, California’s famed data breach law, SB 1386.  

SB 1386 had just been enacted earlier that Summer and required companies to notify California consumers if their sensitive personal information was breached. Twenty years later, and after numerous stalled attempts, Congress still has not enacted a comprehensive Federal data breach legislation. Yet, all 50 states now have laws requiring private businesses to notify individuals of security breaches. 

My takeaway. When it comes to regulating complex data issues, it’s tough to get legislation enacted and States often take the lead. I think we’re seeing this pattern play out again with AI legislation.

Paving the way: regulatory trends

According to Politico, more than 40 states are considering 400+ bills related to artificial intelligence. The International Association of Privacy Professionals (IAPP) has analyzed these bills and organized them into four broad categories: bills targeting algorithmic discrimination, bills targeting the risks of automated employment decision-making, AI Bills of Rights, and bills establishing working groups.

Two states, Colorado and Connecticut, in particular, are at the forefront of considering general purpose regulations targeting AI discrimination.

  • Colorado: On May 17th, Colorado Governor Jared Polis signed the Colorado Artificial Intelligence Act (SB 205), which puts general duties of care on AI developers to protect consumers from known or foreseeable risks of discrimination from high-risk AI systems. The law goes into effect on February 1, 2026.
  • Connecticut: State Senator James Maroney proposed a bill, SB 2, to comprehensively regulate developers and users of AI systems, guide government use of these systems, and support AI workforce development. Taking a cue from European AI legislation, the bill focuses on AI discrimination risks in high stakes scenarios. The bill passed the State Senate, but facing a veto threat from Governor Ned Lamont, did not get enacted before the legislature closed on May 8th. 

States enacted several other notable AI laws in 2024: 

  • The Utah legislature enacted S.B. 149, the Artificial Intelligence Policy Act. (signed March 13, 2024) It specifies that Utah’s consumer protection laws apply to generative AI. And, it requires businesses regulated by the Utah Division of Consumer Protection, if asked by a consumer, to disclose that the consumer is interacting with generative AI. Similarly, persons engaged in Utah regulated occupations (such as accountancy, dentistry, psychology) must prominently disclose if a customer is interacting with generative AI in their delivery of services. 
  • Indiana and West Virginia created AI Task Forces.

What’s next?

Don’t expect much more legislative action before the Presidential election. The high water mark is likely to be a legislative roadmap published on May 15 by the Bipartisan Senate AI Working Group. This proposal calls for increased funding for AI innovation, addressing deep fakes (focusing on elections and sensitive images), bias in AI, job training, and issues of bias. With the election coming, little more will happen with this proposal.

A big Federal law regulating AI won’t happen this year. And barring some major scandal or technology blow-up, I wouldn’t bet on it happening soon.

author avatar
Tom Oscherwitz VP of Legal
Tom Oscherwitz is Informed’s VP of Legal and Regulatory Advisor.  He has over 25 years of experience as a senior government regulator (CFPB, U.S. Senate) and as a fintech legal executive working at the intersection of consumer data, analytics, and regulatory policy.

Upcoming Webinar: Crossing the chasm into the new digital world: The impact of AI and automation in creating a fully digital auto ecosystem