As State and Federal legislative sessions around the U.S. are in full swing, it’s worth checking what’s happening with AI regulatory trends.
A look back to the first attempts at AI legislation
But first an anecdote. I was a US Senate Judiciary Committee staffer in 2003 and drafted a data breach bill – S.1350. It was the Notification of Risk to Personal Data Act, drafted on behalf of California Senator Dianne Feinstein. It was the first effort by a member of Congress to translate California’s famed data breach law to Federal.
SB 1386 had been enacted earlier that Summer and required companies to notify California consumers if their sensitive personal information was breached. Twenty years later, after numerous stalled attempts, Congress still hasn’t enacted comprehensive Federal data breach legislation. Yet, all 50 states now have laws requiring private businesses to notify individuals of security breaches.
My takeaway. When it comes to regulating complex data issues, it’s tough to get legislation enacted and States often take the lead. I think we’re seeing this pattern play out again with AI legislation.
Paving the way: regulatory trends
According to Politico, more than 40 states are considering 400+ bills related to artificial intelligence. The International Association of Privacy Professionals (IAPP) has analyzed these bills and organized them into four broad categories. Targeting algorithmic discrimination, targeting the risks of automated employment decision-making, AI Bills of Rights, and establishing working groups.
Two states, Colorado and Connecticut, in particular, are at the forefront of considering general purpose regulations targeting AI discrimination.
- Colorado: On May 17th, Colorado Governor Jared Polis signed the Colorado Artificial Intelligence Act (SB 205), which puts general duties of care on AI developers to protect consumers from known or foreseeable risks of discrimination from high-risk AI systems. The law goes into effect on February 1, 2026.
- Connecticut: State Senator James Maroney proposed a bill, SB 2, to comprehensively regulate developers and users of AI systems, guide government use of these systems, and support AI workforce development. Taking a cue from European AI legislation, the bill focuses on AI discrimination risks in high stakes scenarios. The bill passed the State Senate, but facing a veto threat from Governor Ned Lamont, wasn’t enacted before the legislature closed on May 8th.
States enacted several other notable AI laws in 2024:
- The Utah legislature enacted S.B. 149, the Artificial Intelligence Policy Act. (signed March 13, 2024) It specifies that Utah’s consumer protection laws apply to generative AI. And, it requires businesses regulated by the Utah Division of Consumer Protection, if asked by a consumer, to disclose that the consumer is interacting with generative AI. Similarly, persons engaged in Utah regulated occupations (such as accountancy, dentistry, psychology) must prominently disclose if a customer is interacting with generative AI in their delivery of services.
- Indiana and West Virginia created AI Task Forces.
What’s next?
Don’t expect much more legislative action before the Presidential election. The high water mark is likely to be a legislative roadmap published on May 15 by the Bipartisan Senate AI Working Group. This proposal calls for increased funding for AI innovation, addressing deep fakes (focusing on elections and sensitive images), bias in AI, job training, and issues of bias. With the election coming, little more will happen with this proposal.
A big Federal law regulating AI won’t happen this year. And, barring some major scandal or technology blow-up, I wouldn’t bet on it happening soon.
