US state-by-state AI legislation snapshot

Insights /

Insights

Summary

BCLP actively tracks the proposed, failed and enacted AI regulatory bills from across the United States to help our clients stay informed in this rapidly-changing regulatory landscape. The interactive map will be updated regularly to include legislation that if passed would directly impact a businesses’ development or deployment of AI solutions.

Artificial Intelligence (AI), once limited to the pages of science fiction novels, has now been adopted by more than 40% of enterprise-scale businesses in the United States, and as many organizations are working to embed AI into current applications and processes.[1] As companies increasingly integrate AI in their products, services, processes, and decision-making, they need to do so in ways that comply with the different state laws that have been passed and proposed to regulate the use of AI.

Click the image below to view detailed state-by-state AI legislation information.

As is the case with most new technologies, the establishment of regulatory and compliance frameworks has lagged behind AI’s rise. This is set to change, however, as AI has caught the attention of federal and state regulators and oversight of AI is ramping up.

In the absence of comprehensive federal legislation on AI, there is now a growing patchwork of various current and proposed AI regulatory frameworks at the state and local level. Even with the federal bill uncertain, it is clear that momentum for AI regulation is at an all-time high. Consequently, companies stepping into the AI stream, face an uncertain regulatory environment that must be closely monitored and evaluated to understand its impact on risk and the commercial potential of proposed use cases.

To help companies achieve their business goals while minimizing regulatory risk, BCLP actively tracks the proposed and enacted AI regulatory bills from across the Unites States to enable our clients to stay informed in this rapidly-changing regulatory landscape. The interactive map is updated regularly to include legislation that if passed would directly impact a business’s development or deployment of AI solutions.[2] Click the states to learn more.

We have also created an AI regulation tracker for the UK and EU to keep you informed in this rapidly changing regulatory landscape.

[1]IBM Global AI Adoption Index 2024.

[2]We have also included laws addressing automated decision-making, because AI and automation are increasingly integrated, noting that not all automated decision-making systems involve AI, such businesses will need to understand how their particular systems are designed. We have omitted biometric data, facial recognition, and sector-specific administrative laws.

Enacted

H172

H172, enacted May 15, 2024, prohibits a person from distributing or entering into an agreement to distribute materially deceptive media. “Materially deceptive media” is “any image, audio, or video” that (1) “depicts an individual engaging in speech or conduct in which the depicted individual did not in fact engage,” (2) “a reasonable viewer or listener would incorrectly believe that the depicted individual engaged in the speech or conduct depicted,” and (3) AI created the media. AI includes any “artificial system or generative artificial intelligence system that performs tasks under varying and unpredictable circumstances without significant human oversight or that can learn from experience and improve performance when exposed to data sets.” A violation occurs if the person knows the media falsely represents someone, the distribution occurs within 90 days before an election, and the person intends to distribute this and cause a particular result. The creator, sponsor, or purchaser must have a disclaimer informing viewers the media has been manipulated. A violation results in criminal penalties.

Attorney General, depicted person, a candidate for office, and an entity that represents the interests of voters, may all seek injunctive relief.

Effective date: October 01, 2024.

Proposed

SB33

Introduced Jan. 2025, SB33 prohibits a person from using synthetic media, defined as manipulated by AI, in an electioneering communication with the intent to influence an election; provides that an individual who is harmed by such communication may bring an action in the superior court to recover damages, reasonable attorney fees, and costs from (1) the person who created the communication or retained the services of another to create the communication; (2) a person who disseminates the communication knowing that the communication includes synthetic media; or (3) person who removes a disclosure statement described in (d) of this section from an election communication with (a) the intention to influence (b) the purpose of the disclosure statement; and provides that the synthetic media constitutes satire.

Effective immediately upon passage.

Failed

S117

S117, introduced January 16, 2024, would have prohibited a person from making or retaining services to make an election-related communication the person “knows or reasonably should know includes a deepfake relating to a candidate or proposition without including” a specified disclosure stating AI has manipulated or generated the content. The disclosure placement and readability are based on the type of media. “Deepfake” constitutes an “image, audio recording, or video of an individual’s appearance, conduct, or spoken words that has been created or manipulated with machine learning, natural language processing, or another computational processing technique in a manner to create a realistic but false image, audio, or video” that a reasonable person would understand to depict a real individual.

H358

Introduced February 20, 2024, H358 would have provided for a defamation action on the use of synthetic media. More specifically, a person cannot knowingly use synthetic media in an electioneering communication with an intent to impact the election. Otherwise, the harmed individual may recover damages against the person who created the communication or retained services of another to do so, the person who disseminated the communication, or the person who removed the disclosure statement. “Synthetic media” is an “image, audio recording, or video recording of an individual’s appearance, speech, or conduct that is manipulated by artificial intelligence in a manner that creates a realistic but false image, audio recording, or video recording and produces” a certain depiction. The depiction is one a “reasonable person would believe is of a real individual in appearance, speech, or conduct but did not actually occur in reality;” and is “a materially different understanding or impression that a reasonable person would have from the unaltered, original version.”

H352

Introduced February 20, 2024, H352 would revise the definition of “person” in a civil action to not include AI. This bill would have taken effect July 1, 2024.

H306

Introduced February 2, 2024, H306 (Senate version S117) would require a disclosure if a person knows or reasonable should know the communication has a deepfake depicting a candidate or political party in a way intended to injure reputation or deceive a voter. The disclosure must state the communication has been manipulated or generated by AI. This disclosure must be easily heard or readable based on the type of media. “Deepfake” includes “an image, audio recording, or video recording of an individual’s appearance, conduct, or spoken words that has been created or manipulated with machine learning, natural language processing, or another computational processing technique of similar or greater complexity in a manner to create a realistic but false image, audio, or video” that (1) “appears to a reasonable person to depict a real individual saying or doing something that did not actually occur” or (2) “provides a fundamentally different understanding or impression of an individual’s appearance, conduct, or spoken words than the understanding a reasonable person would have from an unaltered, original version of the media.”

Proposed

HB2175

Introduced January 28, 2025, HB2175 adds a provision to Arizona Revised Statute Sec. 20-3101-20-3119 to prohibit health care providers from using artificial intelligence to deny a claim or a prior authorization.

Under Section 20-3114, an enrollee who has received a surprise out-of-network bill and who disputes the amount of the bill may seek dispute resolution of the bill by filing a request for arbitration with the department not later than one year after the date of service noted in the surprise out-of-network bill.

Private right of action – Under Section 20-3119, an enrollee who is aggrieved by an arbitration decision regarding a disputed surprise out-of-network bill may file a civil action in superior court not later than one year after the date of the disputed decision to obtain appropriate relief with respect to the same surprise out-of-network bill.

No effective date stated.

Enacted

SB1001

Introduced in 2018 as SB 1001, The Bolstering Online Transparency Act (BOT), went into effect in July 2019. BOT makes it unlawful for a person or entity to use a bot to communicate or interact online with a person in California in order to incentivize a sale or transaction of goods or services or to influence a vote in an election without disclosing that the communication is via a bot. The law defines a “bot” as “an automated online account where all or substantially all of the actions or posts of that account are not the result of a person.” The law applies only to communications with persons in California. In addition, it applies only to public-facing websites, applications, or social networks that have at least 10 million monthly U.S. visitors or users. BOT does not provide a private right of action.

California Consumer Privacy Act

The California Consumer Privacy Act, as amended by the California Privacy Rights Act (CCPA) governs profiling and automated decision-making. The CCPA gives consumers opt-out rights with respect to businesses’ use of “automated decision-making technology,” which includes “profiling” consumers based on their “performance at work, economic situation, health, personal preferences, interests, reliability, behavior, location or movements.” The CCPA defines “profiling” as “any form of automated processing of personal information, as further defined by regulations pursuant to paragraph (16) of subdivision (a) of Section 1798.185 [of the CCPA], to evaluate certain personal aspects relating to a natural person and in particular to analyze or predict aspects concerning that natural person’s performance at work, economic situation, health, personal preferences, interests, reliability, behavior, location, or movements,” leaving the scope relatively undefined. The CCPA also requires businesses to conduct a privacy risk assessment for processing activities that present “significant risk” to consumers’ privacy or security. “Significant risk” is not defined by the CCPA but may be fleshed out by the regulations. As of the date of publication, regulations addressing automated decision-making have not been finalized. AB 566, introduced Feb. 12, 2025 would add to the CCPA, prohibiting businesses from creating a browser or mobile operation that does not include an opt-out setting for consumers.

AB2013

Introduced on January 31, 2024, AB2013, requires, on or before January 1, 2026, a developer of an artificial intelligence system or service made available to Californians for use, regardless of whether the terms of that use include compensation, to post on the developer’s internet website documentation regarding the data used to train the artificial intelligence system or service,. The law applies to AI developers, which is defined broadly to mean any person, government agency, or entity that either develops an AI system or service or “substantially modifies it,” which means creating “a new version, new release, or other update to a generative artificial intelligence system or service that materially changes its functionality or performance, including the results of retraining or fine tuning.” The law applies to generative AI released on or after January 1, 2022, and developers must comply with its provisions by January 1, 2026.

SB942

Introduced on January 17, 2024, SB942, the California AI Transparency Act applies to businesses providing a generative AI system with over 1M monthly visitors during a 12-month period that is publicly accessibly within the state’s geographic boundaries. The law requires in-scope businesses to create an AI detection tool that allows a user to query the business about the which content was created by a generative AI system. Additionally, the law requires these businesses to include in any AI-generated content a visible disclosure that has “clear and conspicuous” as well as appropriate notice based on the content’s medium stating AI has created the content. This disclosure must be understandable to a reasonable person, not avoidable, and consistent with the communication itself. The law goes into effect on January 1, 2026.

AB2885

Introduced on February 15, 2024, AB2885 defines artificial intelligence as “an engineered or machine-based system that varies in its level of autonomy and that can, for explicit or implicit objective, infer from the input it receives how to generate outputs that can influence physical or virtual environments.” The purpose of this definition is to standardize the definition of AI across various California statutes, including the California Business and Professions Code, Education Code, and Government Code. The law took effect January 1, 2025.

AB1008

AB 1008 updates the definition of “personal information” as defined in the California Consumer Privacy Act to clarify that “personal information” can exist in various formats, including artificial intelligence (AI) systems that are capable of outputting personal information.

AB 2355

Introduced on February 12, 2024, AB2355 requires that electoral advertisements using AI-generated or substantially altered content feature a disclosure that the material has been altered. The law will be enforced by the Fair Political Practices Commission.

AB2602

Introduced on February 14, 2024, AB2602, provides that “a provision in an agreement between an individual and any other person for the performance of personal or professional services is unenforceable only as it relates to a new performance, fixed on or after January 1, 2025, by a digital replica of the individual of the voice or likeness of an individual in lieu of the work of the individual.”

AB2839

Introduced on February 15, 2024, AB2839 expands the timeframe in which a committee or other entity is prohibited from knowingly distributing an advertisement or other election material containing deceptive AI-generated or manipulated content.

AB1836

Introduced on January 16, 2024, AB1836, prohibits commercial use of digital replicas of deceased performers in films, TV shows, video games, audiobooks, sound recordings, etc., without first obtaining the consent of those performers’ estates.

Proposed

AB331 (reintroduced, companion with AB2930)

Introduced on January 30, 2023, AB 331, would, among other things, require an entity that uses an automated decision tool (ADT) to make a consequential decision (deployer), and a developer of an ADT, to, on or before January 1, 2025, and annually thereafter, perform an impact assessment for any ADT used that includes, among other things, a statement of the purpose of the ADT and its intended benefits, uses, and deployment contexts. The bill requires a deployer or developer to provide the impact assessment to the Civil Rights Department within 60 days of its completion. Before using an ADT to make a consequential decision deployers must notify any natural person that is the subject of the consequential decision that the deployer is using an ADT to make, or be a controlling factor in making, the consequential decision. Deployers are also required to accommodate a natural person’s request to not be subject to the ADT and to be subject to an alternative selection process or accommodation if a consequential decision is made solely based on the output of an ADT, assuming that an alternate process is technically feasible. This bill would also prohibit a deployer from using an ADT in a manner that contributes to algorithmic discrimination.

Finally, the bill includes a private right of action which would open the door to significant litigation risk for users of ADT.

This bill has been reintroduced by Assemblywoman Bauer Kahen bill number pending.

AB2930 (reintroduced February 13, 2025)

Introduced on February 15, 2024, AB2930, would, among other things, require an entity that uses an automated decision tool (ADT) to make a consequential decision (deployer), and a developer of an ADT, to, before first using it, and annually thereafter, perform an impact assessment for any ADT used that includes, among other things, a statement of the purpose of the ADT and its intended benefits, uses, and deployment contexts. The bill requires a deployer or developer to provide the impact assessment to the Civil Rights Department within 60 days of its completion. Before using an ADT to make a consequential decision deployers must notify any natural person that is the subject of the consequential decision that the deployer is using an ADT to make, or be a controlling factor in making, the consequential decision. Deployers are also required to accommodate a natural person’s request to not be subject to the ADT and to be subject to an alternative selection process or accommodation if a consequential decision is made solely based on the output of an ADT, assuming that an alternate process is technically feasible. This bill would also prohibit a deployer from using an ADT in a manner that contributes to algorithmic discrimination. AB2930 is nearly identical to AB331, which advanced from the House Committee on Privacy and Consumer Protection in 2023, but notably does not include a private right of action as AB331 did.

The proposed reintroduction by Assemblywoman Bauer Kahen incorporates AB 2930 with additions. The new bill allows persons subject to an ADS (automated decision system) to appeal the results of that decision and correct any personal information used in the decision.

Unlike AB 2930, this version of the bill would require developers’ impact assessments by developers that use ADS to render consequential decisions for 5999 people or more in a three year period. These reports, prepared by an auditor, need to be furnished to the Attorney General within 30 days of the Attorney General’s request.

If approved, this bill would become operative on Jan. 1, 2027. There is no private right of action.

AB3211

Introduced on Feb. 16, 2024, AB3211 seeks to provide context (called provenance) around synthetic media. The bill would require generative AI providers to mark the content with provenance data noting the synthetic nature of the content, the name of the generative AI provider, and identifying the portions of the content that are synthetic. The bill would further require a public facing tool that allows users to determine whether and how a piece of content was modified. The bill has specific requirements for large online platforms, defined as public-facing social media platform, video-sharing platform, messaging platform, advertising network, or standalone search engine and had at least 2,000,000 monthly CA users during the past year. These platforms must label content when provenance data is available, display that data, and provide an annual transparency that identifies deceptive synthetic media on the platform. There is no private right of action. Violations of this bill would result in a $25,000 fine per violation.

SB11

Introduced on Dec. 2, 2024, SB11 sets requirements for sellers and providers of AI. Effective Dec. 1, 2026, the bill would require any person or entity who sells or provides AI technology that makes synthetic content to provide a consumer warning that the misuse of the technology can result in civil or criminal liability. There is no private right of action for this provision, and violations are penalized up to $25,000 a day. The bill goes on to define restricted uses of the name, image, and likeness of another without consent and establishes a claim of damages for violations.

SB53

Introduced Jan. 7, 2025, SB 53 has 2 primary aims: to protect whistleblowers and to establish CalCompute, a framework for the use AI to foster innovation and drive research that benefits the public and expand access to computational resources. The bill would prohibit AI developers from developing any policies or practices that stop employees from reporting on potential critical risk created by the developer’s use of AI. The bill defines critical risk as “a foreseeable and material risk” that the “development, storage, or deployment” of the model “will result in the death of, or serious injury to, more than 100 people, or more than $1 billion in damage.” The bill protects whistleblowers at these developers who seek to report to state or federal authorities, or to other employees with authority to address the risk. Employers must provide written notice to their employees of their right to report and provide an anonymous internal reporting option. This bill allows for employees to bring suit individually, seeking both damages and injunctive relief.

SB243

Introduced on Jan. 30, 2025, SB243 governs interactions between chatbots (enabled by AI) and minors. The bill prohibits chatbots from being used to increase engagement, use, or response rates and requires chatbots clearly and conspicuously display that it is artificially generated, not a human. The bill requires an annual report to the Department of Health Care Services disclosing the number of interactions with a minor where the minor spoke of suicidal ideation.

AB316

Introduced Jan. 24, 2025, AB 316 prohibits a defendant from claiming the aritificial intelligence they developed or used actually caused the claimed harm to plaintiffs.

AB410

Introduced on Feb. 4, 2025, AB410 would make it unlawful for anyone to use a bot to communicate or interact online with someone in CAaliforniaThe bill defines a bot as an automated online account, including one powered by generative AI. The individual using a bot can avoid liability by disclosing that the bot is a bot and not a human.

SB295

Introduced Feb. 6, 2025, SB295 the Preventing Algorithmic Collusion Act would prevent a person from using or distributing a pricing algorithm that uses, incorporates, or was trained with competitor data with two or more people to set the price of a product. The bill also gives the attorney general power to request a written report detailing the owner and use of the price setting algorithm, the data entered in the pricing algorithm, and the rules the algorithm relies on. There is no private right of action, and a violation is punishable by a fine of $5,000 a day.

Failed

SB1229

Introduced February 15, 2024, SB 1229 would require property and casualty insurers to disclose until January 1, 2030, if it has used AI to make decisions that affect applications and claims review, as specified.

SB1047 (Vetoed by Governor Newsom)

The Safe and Secure Innovation for Frontier Artificial Intelligence Systems Act, SB 1047, introduced February 7, 2024, would in general authorize an AI developer of a covered model that is nonderivative to determine if the model qualifies for a limited duty exemption before training on that model can begin. The “limited duty exemption” would apply to a covered AI model defined by this bill that the develop can provide reasonable assurance the model does not, and will not, possess a hazardous capability. “Hazardous capability” means the model creates or uses a “chemical, biological, radiological, or nuclear weapon in a manner that results in mass casualties”; causes at least $500,000,000 “of damages through cyberattacks on critical infrastructure via a single incident” or related incidents; causes at least $500,000,000 of damages by engaging in bodily harm to another human or theft of, or harm to, property with the requisite mental state; and other comparable “grave threats in severity to public safety and security. Before starting training, the developer must meet specified requirements, such as the capability to promptly shutdown, until the model falls under the limited duty exemption. If an incident occurs, the developer must report each AI safety incident to the Frontier Model Division, a subdivision of the Department of Technology.

SB892

SB 892, introduced on January 1, 2024, would impact businesses entering into a contract with state agencies to provide artificial intelligence services by prohibiting such a contract unless the business met California’s Department of Technology safety, privacy, and nondiscrimination standards relating to artificial intelligence services. The Department of Technology to date has not promulgated these standards.

SB970

Introduced on January 25, 2024, SB970, this bill would require any person or entity that sells or provides access to any artificial intelligence technology that is designed to create content to provide a consumer warning that misuse of the technology may result in civil or criminal liability for the user. The bill would require the Department of Consumer Affairs to specify the form and content of the consumer warning and would impose a civil penalty for violations of the requirement. Failure to comply with consumer warning requirement would be punishable by a civil penalty not to exceed twenty-five thousand dollars ($25,000) for each day that the technology is provided to or offered to the public without a consumer warning.

Enacted

SB21-169

In 2021, Colorado enacted SB 21-169, Protecting Consumers from Unfair Discrimination in Insurance Practices, a law intended to protect consumers from unfair discrimination in insurance rate-setting mechanisms. The law applies to insurers’ use of external consumer data and information sources (ECDIS), as well as algorithms and predictive models that use ECDIS in “insurance practices,” that “unfairly discriminate” based on race, color, national or ethnic origin, religion, sex, sexual orientation, disability, gender identity, or gender expression. On February 1, 2023, the Colorado Division of Insurance (CDI) released a draft of the first of several regulations to implement the bill. On September 21, 2023, the CDI adopted Regulation 10-1-1 – Governance and Risk Management Framework Requirements for Life Insurers. The regulation governs the use of algorithms and predictive models that use external consumer data and information sources (ECDIS). Among other things, the regulation requires all Colorado-licensed life insurers to submit a compliance progress report on June 1, 2024, and an annual compliance attestation beginning on December 1, 2024.

Colorado Privacy Act

The Colorado Privacy Act (CPA), went into force on July 1, 2023, provides consumers the right to opt-out of the processing of their personal data for purposes of “profiling in furtherance of decisions that produce legal or similarly significant effects.” The law defines those decisions as “a decision that results in the provision or denial of financial and lending services, housing, insurance, education enrollment or opportunity, criminal justice, employment opportunities, health care services, or access to essential goods or services.” The CPA further requires that controllers conduct a data protection impact assessment (DPIA) if the processing of personal data creates a heightened risk of harm to a consumer. Processing that presents a heightened risk of harm to a consumer includes profiling if the profiling presents a reasonably foreseeable risk of:

Unfair or deceptive treatment of, or unlawful disparate impact on, consumers;
Financial or physical injury to consumers;
A physical or other intrusion upon the solitude or seclusion, or the private affairs or concerns, of consumers if the intrusion would be offensive to a reasonable person; or
Other substantial injury to consumers.

All of which means that deployers of automated-decision making (which may or may not use AI) need to ensure that their design and implementation do not create the heightened risks outlined above, and are included in their DPIA. On March 15, 2023, the Colorado Attorney General’s Office finalized rules implementing the CPA.

HB1147

Enacted on May 24, 2024, HB1147, creates a statutory scheme to regulate the use of deepfakes produced using generative artificial intelligence in communications about candidates for elective office. HB1147 prohibits the distribution of a communication that includes an undisclosed deepfake with actual malice as to the deceptiveness or falsity of the communication related to a candidate for public office. Violators will be subject to civil penalties. Additionally, a candidate who is the subject of a communication that includes a deepfake and does not comply with the disclosure requirements may bring a civil action for injunction or for general or special damages or both.

SB24-205

Enacted May 17, 2024, SB24-205 is an artificial intelligence consumer protection bill. The bill requires both a developer and a deployer of a high-risk artificial intelligence system (high-risk system) to use reasonable care to avoid algorithmic discrimination in the high-risk system. A developer is a person doing business in Colorado who develops or substantially modifies certain AI models or systems, while a deployer is a person doing business in Colorado who deploys certain AI systems. Algorithmic discrimination is when an AI system materially increases the risk of unlawful differential treatment or impact on an individual or group on the basis of certain protected classes like age, color, disability, ethnicity, race, religion, or sex. There is a rebuttable presumption that a developer used reasonable care if the developer complied with certain provisions of the bill, including:

Making available to a deployer of the high-risk system information and documentation necessary to complete an impact assessment of the high-risk system;
Making a publicly available statement summarizing the types of high-risk systems that the developer has developed and how reasonably foreseeable risks of discrimination are managed;
Disclosing certain reasonably foreseeable risks of discrimination to the AG and deployers within 90 days after discovery of the risk.

There is a rebuttable presumption that a deployer used reasonable care if the deployer complied with certain provisions of the bill, including:

Implementing a risk management policy and program for the high-risk system;
Completing an impact assessment of the high-risk system;
Making a publicly available statement summarizing the types of high-risk systems that the deployer has deployed and how reasonably foreseeable risks of discrimination are managed;
Disclosing certain reasonably foreseeable risks of discrimination to the AG within 90 days after discovery of the risk.

A developer or business that makes available an AI system that is intended to interact with customers must disclose the consumer is interacting with an AI system. There is no private right of action – the AG is exclusively responsible for enforcement. However, a developer or deployer has an affirmative defense if their system involved in the violation complies with federal or internal law and the developer or deployer has taken specified measures to discover any violations of this bill.

Failed

HB24-1057

Introduced January 10, 2024, HB 24-1057 would have prohibited a private landlord from employing or relying on AI or some algorithmic device to calculate rent to be charged to a tenant. Such use would have been an unfair or deceptive trade practice under Colorado Consumer Protection Act.

Enacted

CTPA

The Connecticut Privacy Act (CTPA) which goes into force on July 1, 2023, provides consumers the right to opt-out of profiling if such profiling is in furtherance of automated decision-making that produces legal or other similarly significant effects. Controllers must also perform data risk assessments prior to processing consumer data when such processing presents a “heightened risk of harm.” These situations include certain profiling activities that present a reasonably foreseeable risk of unfair or deceptive treatment of or unlawful disparate impact on consumers, financial, physical or reputational injury to consumers, physical or other intrusion into the solitude, seclusion or private affairs or concerns of consumers that would be offensive to a reasonable person, or other substantial injury to consumers.

Proposed

SB1292

Introduced on February 13, 2025, SB1292, would require (1) an owner or operator of an artificial intelligence data center to submit quarterly reports to the Commissioner of Energy and Environmental Protection, and (2) the commissioner to adopt regulations concerning water and energy efficiency standards for such data centers.

HB6846

Introduced on January 31, 2025, HB6846, would prohibit the distribution of certain deceptive synthetic media within the ninety-day period preceding an election or primary.

HB5877

Introduced on January 22, 2025, HB5877, would prohibit the use of artificial intelligence to replace public school educators in providing instruction to and regular interaction with students.

SB2

Introduced on January 8, 2025, SB2, provides that the state’s laws be amended to protect consumers in the state from the risks of algorithmic discrimination and unfair treatment posed by artificial intelligence.

HB5587 and HB5590

Introduced on January 21, 2025, HB5587 and HB5590, prohibit any health insurer from using artificial intelligence as the primary method to deny health insurance claims.

SB447

Introduced on January 10, 2025, SB447, would prohibit health carriers from using artificial intelligence in the evaluation and determination of patient care to safeguard patient access to testing, medications and procedures.

SB817

Introduced on January 21, 2025, SB817, would prohibit any health insurer from using a software tool, including, but not limited to, artificial intelligence or an algorithm, to automatically downcode or deny a health insurance claim submitted by a health care provider without detailed review by a clinical peer.

HB5076

Introduced on January 10, 2025, HB5076, would amend the state’s law to require that any artificial intelligence data center (1) utilize energy derived from renewable sources for not less than fifty per cent of the energy consumption requirements of such center, (2) utilize energy storage systems and modern grid infrastructure, (3) implement water conservation measures, and (4) report annual energy consumption, water consumption and emissions, and to provide tax credits, grants and research funding for the development of such centers.

Failed

HB5450

Introduced March 7, 2024, HB 5450 would, within a 90-day period preceding an election or primary, prohibit the distribution of certain deceptive synthetic media created by AI. “Deceptive synthetic media” constitutes “any image, audio or video of an individual, and any representation of such individual’s appearance, speech or conduct that is substantially derived from any image, audio or video” that (1) “a reasonable person” would attribute to a person and (2) was created by AI or by other means.

SB2

Introduced on February 21, 2024, SB 2, would regulate the development and use of automated decision tools (ADT) and high-risk artificial intelligence systems. The following requirements would go into force as of July 1, 2025.

Development Requirements:

Documentation: Developers of certain AI systems must provide comprehensive documentation. This documentation should cover:
- System Behavior: Detailed information about how the AI system operates.
- Data Used: The datasets utilized by the AI system during development.
- Risk Assessment: An assessment of potential risks associated with the AI system.
Transparency: Developers must ensure transparency in the development process, allowing stakeholders to understand the system’s inner workings.

Deployment Requirements:

High-Risk AI Systems: Deployers of high-risk AI systems (those impacting critical areas like criminal justice, education, employment, and healthcare) have additional responsibilities:
- Risk Assessment: Conduct a thorough risk assessment before deploying the AI system.
- Documentation: Provide detailed documentation to users and relevant authorities.
- Transparency: Ensure transparency regarding the AI system’s functioning and potential biases.
- Compliance: Comply with guidelines set forth by the bill to prevent unintended consequences.

Artificial Intelligence Advisory Council:

The bill establishes an Artificial Intelligence Advisory Councilto oversee compliance and provide guidance to developers and deployers.

SB 2 does not establish a qualified individual right to opt-out of covered decision-making systems. SB 2 address various other AI topics, including synthetic images and provide for the establishment of a "Connecticut Citizens AI Academy".

Enacted

Deleware Personal Data Privacy Act

The Delaware Personal Data Privacy Act which became effective on January 1, 2025 provides consumers the right to opt-out of profiling if such profiling is in furtherance of solely automated decisions that produce legal or similarly significant effects concerning the consumer. Controllers must also perform data protection assessments when data processing presents a “heightened risk of harm” including where Controller processes personal data for the purposes of profiling, where such profiling presents a reasonably foreseeable risk of any of the following: (a) unfair or deceptive treatment of, or unlawful disparate impact on, consumers, (b) financial, physical, or reputational injury to consumers, (c) a physical or other intrusion upon the solitude or seclusion, or private affairs or concerns, of consumers, where such intrusion would be offensive to a reasonable person; or (d) other substantial injury to consumers.

Failed

B114

Introduced on February 2, 2023, B114, Stop Discrimination by Algorithms Act of 2023 (SDAA) would prohibit both for-profit and nonprofit organizations from using algorithms that make decisions based on protected personal traits. This bill makes it unlawful for a DC business to make a decision stemming from an algorithm if it is based on a broad range of personal characteristics, including actual or perceived race, color, religion, national origin, sex, gender identity or expression, sexual orientation, familial status, source of income or disability in a manner that makes “important life opportunities” unavailable to that individual or class of individuals. Any covered entity or service provider who violates the act would be liable for a civil penalty of up to $10,000 per violation.

B25-0832

Introduced on June 5, 2024, Bill 25-0832 would require that all candidates, political action committees, political committees and other entities involved in political advertising, using artificial media, be prohibited from distributing artificial media within 90 days of an election that does not conform to certain disclosure requirements. It would permit injunctive relief by the Superior Court of the District of Columbia and the issuance of civil fines by the Campaign Finance Board for any violations.

Proposed

HB369

Introduced on February 4, 2025, HB 369 focuses on the provenance of digital content, and defines “provenance data” as information recording the origin and history of modifications to digital content. “Provenance data” includes information identifying whether some or all the content has been generated through AI and if so, the name of the AI tool that was used. Under this bill, providers of AI tools must make 1) application tools (“tool or service that enables the user to apply provenance data, either directly or through the use of third-party technology, to any data that has been modified to include synthetic content”) and 2) free provenance readers (“tool or service that allows users to identify the provenance data of visual or audio digital content”) available to the public. Social media platforms must also retain and make provenance data available for visual or audio content posted on their platforms. Devices that record visual or audio content must allow the inclusion of provenance data, and manufacturers must ensure that this data can be read by third party applications. Violations of this law constitutes unfair or defective acts or practices.

Effective on July 1, 2025 if passed.

ENACTED

HB919

Enacted April 29, 2024, HB 919 will require, if created by generative AI, certain political advertisements, electioneering communications, or other political content to include a disclaimer. Advertisements falling under this bill include depictions of “a real person performing an action that did not actually occur” and content that “was created with intent to injure a candidate or to deceive regarding a ballot issue,” etc. These advertisements must state the following disclaimer: “Created in whole or in part with the use of generative artificial intelligence (AI).” This disclaimer must be printed clearly, be readable, and occupy at least 4 percent of the communication based on the type of media. Failure to comply will result in civil and criminal penalties. This bill will take effect July 1, 2024.

Failed

SB850

Introduced on January 19, 2024, SB 850, the Use of Artificial Intelligence in Political Advertising, would take effect July 1, 2024, if enacted, aims to require political campaigns to disclose through a disclaimer the use of AI in any “mages, video, audio, text, and other digital content used in ads. This bill seeks to address the rising concern of deceptive campaign advertising (deepfakes) by mandating disclaimers on political ads that contain certain content generated through artificial intelligence. Generative artificial intelligence is defined as a “machine based system that can for a given set of human defined objectives emulate the structure and characteristics of input data in order to generate derived synthetic content.” Violators of this proposed legislation could face civil penalties. Anyone can file a complaint with the Florida Elections Commission if they have suspicions of violations. This bill would apply to anyone person or entity releasing a political advertisement, electioneering communication, or other miscellaneous advertisement.

HB1459

HB 1459, introduced January 7, 2024, would have required business entities that produce AI and make it available to the public to put out safety and transparency standards for AI-generated content and videos. The bill would have then required disclosure of certain AI-generated content to better inform consumers that they are using AI. And, more specifically, the bill would also have required political ads to be subject to certain requirements.

Enacted

HB203

Signed into law on May 2, 2023, and effective as of July 1, 2023, HB 203, permits an optometrist or ophthalmologist licensed in the state (a “prescriber”) to use an “assessment mechanism,” to conduct an eye assessment or generate a prescription for contact lenses or spectacles subject to the below conditions. An “assessment mechanism” means automated or virtual equipment, application, or technology designed to be used on a telephone, a computer, or an internet accessible device that may be used either in person or via telemedicine to conduct an eye assessment, and includes artificial intelligence devices and any equipment, electronic or nonelectronic, that are used to conduct an eye assessment. An assessment mechanism can be used; provided, however, that:

The data obtained from the assessment mechanism is not the sole basis for issuing the prescription.
The assessment mechanism alone is not used to generate an initial prescription or the first renewal of the initial prescription.
The assessment mechanism is only used where the patient has had a traditional eye examination in the past two years.

Failed

HB986

GA HB986, introduced 1/22/2024, would have prohibited the publication of "materially deceptive media" (AI-generated content that appears authentic) within 90 days of an election, with the intent to influence the election outcome or the administration of the election. It also would have required specific disclosures for the use of AI-generated content in campaign advertisements.

HB887

Introduced on January 1, 2024, HB 887, would have prohibited the use of artificial intelligence in making certain decisions regarding insurance coverage, health care and public assistance. In particular, the bill would have prohibited health care activities from being based “solely on results derived from the use or application of artificial intelligence or utilizing decision tools.” The bill further would have required that the Georgia Composite Medical Board review, and override, any decision resulting from AI, and to promulgate regulations on review activities. The bill advanced a similar approach regarding AI and automated decision-making tools in insurance coverage and public assistance.

HB890

Introduced on January 9, 2024, HB 890, places a prohibition on discrimination based on age, race, color, sex, sexual orientation, gender, gender expression, national or ethic origin, religion, creed, familial status, marital status, disability or handicap, or genetic information, and prohibition shall include discrimination resulting from the use of or reliance upon artificial intelligence or automated decision tools.

Proposed

SB640

SB 640, introduced January17, 2025, would require any corporation, organization, or individual engaging in business of any kind and using an AI chatbot or other similar technology in a manner that may mislead or deceive a reasonable person to believe they are engaging with a human to first disclose to the consumer that the consumer is interacting with a chatbot. The disclosure must be clear and conspicuous.

This bill would authorize private rights of action and statutory penalties.

SB59

SB 59, introduced January16, 2025, would prohibit users of algorithmic decision-making from using “algorithmic eligibility determinations” in a discriminatory manner. "Algorithmic eligibility determination" is defined as “a determination based in whole or in significant part on an algorithmic process that utilizes machine learning, artificial intelligence, or similar techniques to determine an individual's eligibility for, or opportunity to access, important life opportunities.” "Important life opportunities" is defined as access to, approval for, or offer of credit, insurance, education, employment, housing, or place of public accommodation as defined in section 489-2.” Covered entities are prohibited from making “an algorithmic eligibility determination or an algorithmic information availability determination on the basis of an individual's or class of individuals' actual or perceived race, color, religion, national origin, sex, gender identity or expression, sexual orientation, familial status, source of income, or disability in a manner that segregates, discriminates against, or otherwise makes important life opportunities unavailable to an individual or class of individuals.”

Covered entities (businesses with over 25,000 state residents' data or $15 million in annual revenue for the preceding three years) must send corresponding notices to individuals whose personal information is used and must submit annual reports to the state Attorney General that documents aspects of its algorithmic decision-making process, such as data sources, methodologies, and potential risks.

This bill would allow civil actions, with penalties up to $10,000 per violation.

Enacted

SB974

Introduced on January 20, 2023, SB974, the Hawaii Consumer Data Protection Act, would establish a framework to regulate controllers and processors' access to personal consumer data and introduces penalties, as well as a new consumer privacy special fund.

The bill also provides consumers the option to opt-out of the processing of their personal data for the purposes of “profiling in furtherance of decisions made by the controller that results in the provision or denial by the controller of financial and lending services, housing, insurance; education enrollment, criminal justice, employment opportunities, health care services, or access to basic necessities, including food and water.” "Profiling" is defined as any-form of automated processing performed on personal data to evaluate, analyze, or predict personal aspects related to an identified or identifiable natural person's economic situation; health, personal preferences, interests, reliability, behavior, location, or movements.

The bill further requires covered entities to conduct a data protection assessment when they process personal data for purposes of profiling and the profiling presents “a reasonably foreseeable risk of: (A) Unfair or deceptive treatment of, or unlawful disparate impact on, consumers; (B) Financial, physical, or reputational injury to consumers; (C) A physical intrusion or other intrusion upon the solitude or seclusion, or the private affairs or concerns; of consumers, where the intrusion would be offensive to a reasonable person; or (D) Other substantial injury to consumers[.]” The law goes into effect July 1, 2050, as currently drafted. The bill stalled in 2023 but was picked back up and carried over to the 2024 regular legislative session.

SB2572

Introduced January 19, 2024, SB 2572 (Assembly version A2176) would have prohibited a person from deploying AI-generated products in Hawaii without submitting proof of the product’s safety to the office regulating AI. Violation of this bill would be subject to a monetary fine for each offense.

SB1110

Introduced on January 20, 2023, SB1110, an alternate version of the Hawaii Consumer Data Protection Act, would create materially similar obligations with respect to “profiling” as SB974. The bill stalled in 2023 but was picked back up and carried over to the 2024 regular legislative session.

SB2524

SB 2524, introduced January 19, 2024, would have prevented a covered entity, including an individual, firm, corporation, legal entity, or other commercial entity, from making an algorithmic eligibility determination or an algorithmic information availability determination on the basis of class, race, color, religion, national origin, sex, gender identity or expression, sexual orientation, familial status, wealth, or disability. “Algorithmic eligibility determination” is a determination about a person’s eligibility for important life opportunities based in whole or part on an algorithmic process using AI, machine learning, or similar technologies. “Algorithmic information availability determination” is an AI-generated determination of a person’s receipt of advertising, marketing, solicitations, or other information about important life opportunities. A violation shall be deemed an unlawful discriminatory practice.

HB1734

HB 1734, introduced January 18, 2024, would have required any AI-generated political advertisement containing an “image, video, footage, or audio recording” to include a “clear and conspicuous statement” disclosing the use of AI in creating the content. The disclosure, depending on the media, must be readable, follow specified procedures, and be intelligible.

HB1607

Introduced January 17, 2024, HB 1607 (Senate version S2524) would have prohibited a covered entity, such as an individual, firm, corporation, partnership, or other commercial entity, from making an “algorithmic eligibility determination” or an “algorithmic information availability determination” on basis of class, race, color, religion, national origin, sex, gender identity or expression, sexual orientation, familial status, wealth, or disability in a discriminatory manner. “Algorithmic eligibility determination” is an AI-generated determination in whole or in part regarding a person’s eligibility for, or opportunity to access, important life opportunities. “Algorithmic information availability determination” is an AI-generated determination about a person’s ability to receive advertising, marketing, solicitations, or other offers for an important life opportunity. Failure to comply would result in a violation of an unlawful discriminatory practice.

Proposed

SB1067

Introduced February 07, 2025, SB1067 would establish limitations on the regulation of AI and establishes that no government entity may regulate the operation of an AI system’s underlying algorithms or decision making processes, as they are recognized as an extension of human thought and creativity, subject to the same protections and responsibilities of free speech.

Effective date: July 01, 2025.

H203

Introduced February 10, 2025, H203 amends and adds to existing law to provide for monopsonies and to establish provisions regarding the prohibition of pricing algorithms. Making it unlawful to monopolize, attempt to monopolize, or conspire to monopolize any line of Idaho commerce.

Private right of action – any person may bring an action for injunctive relief and/or damages. If the violation is found to be a per se violation or intentional violation, it shall increase the recovery to an amount not to exceed three times the damages sustained.

Effective date if passed: July 01, 2025.

H127

Introduced February 04, 2025, H127 amends the Consumer Protection act to require the disclosure of the use of AI communications. Stating that it is unfair and deceptive for any person to engage in trade or commerce with a consumer in which the person communicating or interacting is using a chatbot, AI agent, or other AI tech that misleads the consumer to believe they are communicating with a person.

Private right of action – any consumer may initiate an action against any person who violates this section who will be liable to the consumer for the amount equal to the actual damages, including the consumer’s time, or statutory damages of $1,000, whichever is greater. For class actions, damages are not to exceed actual damages or $10,000 for the class.

Attorney General may seek injunctive relief and a civil penalty of a minimum of $10,000 and $1,000 per violation.

Effective date if passed: July 01, 2025.

Proposed

HB3506

Introduced February 07, 2025, HB 3506 would create the Artificial Intelligence Safety and Security Protocol Act which provides that a developer shall produce, implement, follow, and conspicuously publish a safety and security protocol that includes specified information. Provides, no less than every 90 days, a developer must produce and publicly publish a risk assessment report that is based on a report assessing whether the developer has complied with such protocol. Sets forth provisions on the redaction of sensitive information and whistleblower protections.

Provides for civil penalties of up to $1,000,000, and injunctive or declaratory relief, for actions brought by the Attorney General. No private right of action.

Effective date: none stated.

SB2203

Introduced February 07, 2025, SB 2203 would create the Preventing Algorithmic Discrimination Act which provides that a deployer of an automated decision tool shall perform an annual impact assessment for any automated decision tools the deployer uses or designs, codes, or produces that includes specified information; provides that a deployer shall, at or before the time an automated tool is used to make a consequential decision, notify any natural person who is the subject of the consequential decision that an automated instrument is being used in making, or be a controlling factor in making such consequential decision and provide specified information.

Violations result in an administrative fine of not more then $10,000 per violation in an administrative enforcement action brought by the Attorney General.

Effective date: January 01, 2027.

SB2259

Introduced February 07, 2025, SB 2259 would amend the Medical Practice Act of 1987 to provide that a health facility, clinic, physician's office, or office of a group practice that uses generative artificial intelligence to generate written or verbal patient communications pertaining to patient clinical information shall ensure that the communications meet certain criteria, including the display of a disclaimer that indicates to the patient that the communication was generated by generative AI.

Communications generated by generative artificial intelligence and read and reviewed by a human licensed or certified health care provider are exempted.

A violation of the amendatory provisions by a licensed health facility or a licensed clinic is subject to penalties as implemented by the Department of Financial and Professional Regulation by rule. A violation of the amendatory provisions by a physician is subject to penalties as determined by the Illinois State Medical Board.

Effective date: None stated.

SB2398

Introduced February 07, 2025, SB 2398 would amend the Sports Wagering Act to prohibit a sports wagering licensee from using artificial intelligence to: (1) track the sports wagers of an individual; (2) create an offer or promotion targeting a specific individual; or (3) create a gambling product.

Enforced by the Illinois Gaming Board under the Sports Wagering Act (230 ILCS 45/25-10)

Effective date: None stated.

HB3021

Introduced February 06, 2025, HB 3021 would amend the Consumer Fraud and Deceptive Business Practice Act to provide that it is an unlawful practice for any person to engage in a commercial transaction or trade practice with a consumer in which: (1) the consumer is communicating or otherwise interacting with a chatbot, artificial intelligence agent, avatar, or other computer technology that engages in a textual or aural conversation; (2) the communication may mislead or deceive a reasonable consumer to believe that the consumer was communicating with a human representative; and (3) the consumers are not notified in a clear and conspicuous manner that they are communicating with an artificial intelligence system and not a human representative.

Under the Illinois Consumer Fraud and Deceptive Business Practices Act (815 ILCS 505/1), the Attorney General or State’s Attorney may maintain an action for injunctive relief and seek civil penalties not to exceed $50,000.

Private Right of Action: Any person may file a civil action only if the Attorney General or State’s Attorney fails to bring an enforcement action and maintain an action for injunctive relief for compensatory damages to recover prohibited fees, or for additional relief to deter, prevent, or compensate for the violation, of up to 3 times the amount of the prohibited fees or a minimum of $1,000 in punitive damages.

Effective date: January 1, 2026.

HB3041

Introduced February 06, 2025, HB 3041 would create the Illinois Data Privacy and Protection Act that provides that a covered entity (any entity or any person, other than an individual acting in a non-commercial context, that alone or jointly with others determines the purposes and means of collecting, processing, or transferring covered data) may not collect, process, or transfer covered data unless the collection, processing or transfer is limited to what is reasonably necessary and proportionate; provides that a service provider shall establish, implement, and maintain reasonable policies, practices, and procedures concerning the collection and processing of covered data. AI is included under the definition of “Covered Algorithm.”

The Attorney General or State’s Attorney may bring a civil action to enjoin a violating practice, enforce compliance, obtain damages, and/or civil penalties and restrictions.

Creates a private right of action such that any person subject to a violation of the Act may bring a civil action where the court may award them an amount equal to the sum of any compensatory liquidated or punitive damages and/or injunctive or declaratory relief. Small businesses (where for the previous 3 years gross income did not exceed $41,000,000) are not included under the private right of action.

Effective date: 180 days after becoming law.

SB1792

Introduced February 06, 2025, SB 1792 would amend the Consumer Fraud and Deceptive Business Practices Act to provide that the owner, licensee, or operator of a generative artificial intelligence system shall conspicuously display a warning on the system's user interface that is reasonably calculated to consistently apprise the user that the outputs of the generative AI intelligence system may be inaccurate or inappropriate.

Effective date: none stated.

SB1929

Introduced February 06, 2025, SB 1929 would create the Provenance Data Requirement Act that provides that a generative artificial intelligence tool provider shall apply provenance data, either directly or through the use of third-party technology, to wholly-generated synthetic content generated by the provider's generative automated intelligence tool. Sets forth additional requirements on generative Artificial intelligence tool providers, large online platforms, and manufacturers of capture devices.

Enforcement mechanism not stated.

Effective date: none stated.

SB1425

Introduced January 31, 2025, SB 1425 would create the Artificial Intelligence Systems Use in Health Insurance Act to provide that an insurer authorized to do business in Illinois shall not issue an adverse consumer outcome with regard to the denial, reduction, or termination of insurance plans or benefits that result solely from the use or application of any AI system or predictive model.

Enforced by the Illinois Department of Insurance.

Effective date: none stated.

HB3838

Introduced February 07, 2025, HB 3838 Amends the Ticket Sale and Resale Act. Provides that a ticket seller, ticket reseller, and ticket broker shall display the full price of a ticket, including all assessed fees, to a purchaser when the price is first shown to the purchaser and shall not increase that price during the transaction with the purchaser; provides that the use of dynamic pricing in the course of selling a ticket is a violation of the provision. Defines "dynamic pricing" to include adjusting pricing using AI enabled technologies.

Enforcement mechanism not stated.

Effective date: none stated.

HB35

Introduced January 09, 2025, HB 35 could create the Artificial Intelligence Systems Use in Health Insurance Act. Provides that the Department of Insurance's regulatory oversight of insurers includes oversight of an insurer's use of AI systems to make or support adverse determinations that affect consumers; provides that any insurer authorized to operate in the State is subject to review by the Department in an investigation or market conduct action regarding the development, implementation, and use of the AI systems or predictive models and the outcomes from the use of those AI systems and predictive models. Provides such an insurer shall not issue an adverse consumer outcome with regard to the denial, reduction, or termination of insurance plans or benefits that result solely from any AI system or predictive model

Enforced by the Department of Insurance.

Effective date: none stated.

HB1594

Introduced January 22, 2025, HB 1594 would amend the Illinois Human Rights Act. Provides that it is a civil rights violation for an employer, employment agency, or labor organization to take certain employment-related actions on the basis of an individual's weight and size. Must give notice of the use of AI included when making employment decisions.

Enforced by the Department of Human Rights (under 775 ILCS 5/1-103) who may issue an employer 30 day notice to correct a violation, and a charge of a civil rights violation if it is not corrected, brought by the Attorney General.

Effective date: none stated.

Enacted

Illinois AI Video Interview Act

In 2019, Illinois became the first state to enact restrictions with respect to the use of AI in hiring. The Illinois AI Video Interview Act was amended in 2021 and went into effect in 2022, and now requires employers using AI-enabled assessments to:

Notify applicants of AI use;
Explain how the AI works and the “general types of characteristics” it uses to evaluate applicants;
Obtain their consent;
Share any applicant videos only with service providers engaged in evaluating the applicant;
Upon an applicant’s request, destroy all copies of the applicant’s videos and instruct service providers to do so as well; and
Report annually, after use of AI, a demographic breakdown of the applicants they offered an interview, those they did not, and the ones they hired.

HB3773

Introduced February 17, 2023 and signed into law August 12, 2024, HB 3773, amends the Human Rights Act, and provides that an employer that uses predictive data analytics in its employment decisions may not consider the applicant’s protected class information or ZIP code when used as a proxy for race to make certain employment-related decisions. Namely, it shall be a civil rights violation to: (1) use artificial intelligence to make decisions with respect to recruitment, hiring, promotion, renewal of employment, or conditions of employment, training or apprenticeship, discharge, discipline, tenure, or the terms, privileges, or conditions of employment, or for an employer to use artificial intelligence that has the effect of subjecting employees to discrimination on the basis of protected classes identified under the Article or to use zip codes as a proxy for protected classes; or (2) for an employer to fail to provide notice to an employee that the employer is using artificial intelligence.

The law defines “artificial intelligence” to mean a “machine-based system that, for explicit or implicit objectives, infers, from the input it receives, how to generate outputs such as predictions, content, recommendations, or decisions that can influence physical or virtual environments,” and expressly include generative artificial intelligence. “Generative artificial intelligence” is defined to mean an “automated computing system that, when prompted with human prompts, descriptions, or queries, can produce outputs that simulate human-produced content,” including text, images, multimedia, and other content that would be otherwise produced by human means.

The Department of Human Rights is tasked with adopting implementing rules, including those relating to notice. The new amendments to the Human Rights Act will be codified at 775 ILCS 5/2-101 and 775 ILCS 5/2-102. The law goes into force on January 1, 2026.

Failed

HB5116

Introduced February 08, 2024, HB 5116 would create the Automated Decision Tools Act; provides that, on or before a specified date, and annually thereafter, a deployer of an automated decision tool shall perform an impact assessment for any automated decision tool the deployer uses or designs, codes or produces that includes specified information; provides that a deployer shall, at or before the time an automated decision tool is used to make a consequential decision, notify any natural person who is the subject of the consequential decision.

HB5321

Introduced February 09, 2024, HB 5321 would amend the Consumer Fraud and Deceptive Business Practices Act; provides that each generative artificial intelligence system and artificial intelligence system that, using any means or facility of interstate or foreign commerce, produces image, video, audio or multimedia AI-generated content shall include on the AI-generated content a clear and conspicuous disclosure that satisfies specified criteria.

HB5322

Introduced February 09, 2024, HB 5322 would create the Commercial Algorithmic Impact Assessments Act; defines algorithmic discrimination, artificial intelligence, consequential decision, deployer, developer and other terms; requires that by specified amount and annually thereafter, a deployer of an automated decision tool must complete and document an assessment that summarizes the nature and extent of that tool, how it is used and assessment of its risks, among other things.

HB5591

Introduced February 09, 2024, HB 5591 would create the Bolstering Online Transparency Act; provides that a person shall not use an automated online account, or bot, to communicate or interact with another person in this state online, with the intent to mislead the other person about its artificial identity for the purpose of knowingly deceiving the person about the content of the communication in order to incentivize a purchase or sale of goods or services in a commercial transaction or to influence a vote in an election, unless the person makes a specified disclosure.

HB5649

Introduced February 09, 2024, HB 5649 would amend the Consumer Fraud and Deceptive Business Practices Act; provides that it is an unlawful practice within the meaning of the act for a licensed mental health professional to provide mental health services to a patient through the use of artificial intelligence without first obtaining informed consent from the patient for the use of artificial intelligence tools and disclosing the use of artificial intelligence tools to the patient before providing services through the use of artificial intelligence.

HB4869

Introduced February 06, 2024, HB 4869 would amend the Consumer Fraud and Deceptive Business Practices Act. Provides that any person who, for any commercial purpose, makes, publishes, disseminates, airs, circulates, or places an advertisement for goods or services before the public or causes, directly or indirectly, an advertisement for goods or services to be made, published, disseminated, aired, circulated, or placed before the public, that the person knows or should have known contains synthetic media, shall disclose in the advertisement that the advertisement contains synthetic media. Provides that if synthetic media has been used in any advertisement for goods or services that is published, aired, circulated, disseminated, or otherwise placed before the public and that depicts a person engaged in any action or expression that the person did not actually engage, the advertisement shall include a disclaimer that clearly and conspicuously states the likeness featured in the advertisement is synthetic, does not depict an actual person, and is generated to create a human likeness. Provides that a violation of the provisions constitutes an unlawful practice within the meaning of the Act.

HB1002

Introduced December 19, 2022, HB 1002, would amend the University of Illinois Hospital Act and the Hospital Licensing Act, to require that before using any diagnostic algorithm to diagnose a patient, a hospital must first confirm that the diagnostic algorithm has been certified by the Department of Public Health and the Department of Innovation and Technology, has been shown to achieve as or more accurate diagnostic results than other diagnostic means, and is not the only method of diagnosis available to a patient.

HB3943

Introduced February 17, 2023, HB 3943, would create the Social Media Content Moderation Act, and require that a social media company post terms of service for each social media platform owned or operated by the company in a manner reasonably designed to inform all users of the social media platform of the existence and contents of the terms of service and submit a terms of service report to the Attorney General on a semi-annual bases that includes a detailed description of content moderation systems, information on content that was flagged and how that content was flagged, including if the content was flagged and actioned by AI software.

HB3880

Introduced February 17, 2023, HB 3880, would create the Children’s Privacy Protection and Parental Empowerment Act, and require a business that provides an online service to children shall not profile a child by default unless the profiling is necessary to provide the online service and only with respect to the aspect of the online service with which the child is actively and knowingly engaged and the business can demonstrate a compelling reason that profiling is in the best interest of children. Profiling is defined as any form of automated processing of personal information that uses personal information to evaluate certain aspects relating to a natural person, including analysing or predicting aspects concerning a natural person's performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location, or movements.

Proposed

SB0480

Introduced February 03, 2025, SB 0480, places a limitation on the use of artificial intelligence or other electronic means to determine medical necessity. A utilization review entity may conduct an initial review of a request for prior authorization and issue a decision by using AI for not more than 2% of prescription drugs that are subject to prior authorization requirement and have an annualized net price between $100 and $5,000. If more than 2% during a calendar year, the entity may not require prior authorization during the next calendar year.

Effective date if passed: July 01, 2025.

HB1620

Introduced January 21, 2025, HB 1620 would amend Indiana Code Title 16 Health, to require health care providers and insurers to disclose use of AI technologies to a patient if it is used to make informed decisions or generate any part of a communication regarding health care.

Effective date if passed: July 01, 2025

Enacted

SB5

Introduced on January 9, 2023, SB5, creates an omnibus consumer privacy law along the lines of the Virginia Consumer Data Privacy Act and the Colorado Privacy Act, to regulate, among other data uses, the collection and processing of personal information. In particular, the bill sets out rules for profiling and automated decision-making. The bill enables individuals to opt-out of “profiling in furtherance of decisions that produce legal or similarly significant effects” concerning the consumer. Profiling is defined as “any form of automated processing of personal data to evaluate, analyze, or predict personal aspects concerning an identified or identifiable natural person's economic situation, health, personal preferences, interests, reliability, behavior, location, or movements[.]” Controllers must also perform a data protection impact assessment for high-risk profiling activities. Enrolled as Public Law 94 May 01, 2023.

Proposed

SF143

Introduced January 30, 2025, SF143 is an Act relating to consumer data protection. AI systems covered under definition of “Profiling.” Consumers must be notified of, or be given the chance to opt out, of profiling in furtherance of a decision that produces legal or similarly significant effects concerning a consumer, meaning a decision made by a controller that effects the ability of a person to access financial and lending services; housing; insurance; education; criminal justice services; employment opportunities; or health care services.

Enforcement mechanism is unclear.

This act would apply retroactively to January 01, 2025.

FAILED

SB266

Introduced February 23, 2024, and engrossed March 25, 2024, SB 266 would prohibit an automated online account, or bot, from communicating or interacting with another person in Kentucky online with the intent to mislead the other person about its artificial identify for the purpose of knowingly deceiving the person about the content of the communication in order to incentivize a purchase or sale of goods or services in a commercial transaction; provides that a violation of the act is a deceptive act or practice in the conduct of trade or commerce; prohibits a private right of action.

Failed

HB673

Introduced March 11, 2024, HB 673 would provide for consumer protection from unfair discrimination using AI with respect to insurance practices.

SB118

Introduced March 11, 2024, SB 118 would provide for the registration of artificial intelligence foundation models in the private sector.

Proposed

HP596(reintroduced as an amendment on January 1, 2025)

Introduced March 02, 2023, HP 596, An Act To Protect Workers From Employer Surveillance, would require an employer to provide upon an employee request whether employee data interacts with an automated decisions system. Amended by H-173 and H-575.

SP807

Originally introduced May 18, 2023 as LD 1973, SP807 , would enact the Maine Consumer Privacy Act aimed at protecting consumer data. Section 9604 would give consumers the option to opt-out of 1) having their data used for targeted advertising, 2) sale of personal data, and 3) personal data processing for use in profiling for automated decisions that produce legal or similarly significant effects .. Consumers may also request access to their data, correct inaccuracies in their data, request a copy of their data, and request the deletion of their collected data. Section 9608 requires a controller to conduct a DPA if processing personal data for the purpose of profiling if the profiling presents a reasonably foreseeable risk to the consumer.

Enforcement of the bill would begin on July 1, 2025. Businesses that maintain the data of at least 100,000 consumers (beyond the data needed for payment transactions) and businesses with at least 25,000 consumers and get 25% of their gross revenue from selling data are in scope.

Failed

LD1973

Introduced May 18, 2023, LD 1973, would enact the Maine Consumer Privacy Act aimed at protecting consumer data. Section 9603 would require a consumer to opt-in to processing if the controller processes consumer data for the purpose of profiling in furtherance of solely automated decisions that produce legal or similarly significant effects concerning the consumer unless the consumer opts-in to the processing. Section 9607 requires a controller to conduct a DPA if processing personal data for the purpose of profiling if the profiling presents a reasonably foreseeable risk to the consumer. Profiling is not defined.

HP1270

Introduced on May 23, 2023, the Data Privacy and Protection Act, HP 1270, is a comprehensive bill aimed at protecting consumer data. The Act includes retention limits, use restrictions, and reporting requirements. Section 9615 specifically governs the use of algorithms. The Act provides that covered entities using covered algorithms (broadly defined, including machine learning, AI, and natural language processing tools) to collect, process, or transfer data “in a manner that poses a consequential risk of harm” complete an impact assessment of the algorithm. The impact assessment must be submitted to the Attorney General’s office within 30 days of finishing it. The assessment must include a publicly available and easily accessible summary.

In addition to an impact assessment, the Act requires covered entities to create a design evaluation prior to deploying a covered algorithm. The design evaluation must include the design, structure, and inputs of the covered algorithm.

This bill includes a private right of action and allows for the recovery of punitive damages.

Proposed

HB820

Introduced on January 29, 2025, HB 820 requires certain carriers, pharmacy benefits managers, and private review agents to ensure that AI, algorithm, or other software tools are used in an equitable and non-discriminatory way when used for conducting utilization review. Effective October 1, 2025.

HB740

Introduced on January 27, 2025, HB 740 requires people that publish, distribute, disseminate certain campaign materials that use or contain synthetic media (generated by AI) to include a certain disclosure: “THIS IMAGE HAS BEEN ALTERED OR MODIFIED THROUGH THE USE OF COMPUTER PROGRAMS TO DISPLAY AN EVENT OR IMAGE THAT DID NOT OCCUR.”. Effective October 1, 2025.

HB823

Introduced on January 29, 2025, HB 823 aims to ensure transparency in the data used to train generative AI systems by requiring developers to publish documentation about the training data. The bill applies to generative AI systems released on or after January 1, 2022. Under this bill, developers must post on their website documentation detailing the data used to train the system, including: 1) sources or owners of the data, 2) description of how the data furthers the AI system, 3) number of data points in static datasets, 4) types of labels used in the dataset, 5) whether the data are in the public domain or protected by copyright/trademark/patent rights, and more. Effective October 1, 2025.

HB1314

Introduced on February 7, 2025, HB 1314 prohibits certain insurers, nonprofit health service plans, and health orgs from using AI to automatically deny prior authorizations. It also prohibits healthcare providers from charging a fee to obtain a prior authorization from a carrier or managed care organization. Effective January 1, 2026.

HB697

Introduced on January 24, 2025, HB 697 requires a health insurance carrier to submit quarterly reports to the Maryland Insurance Commissioner on information related to the carrier’s use of AI or automated decision-making systems. The bill changes the information related to adverse insurance decisions and grievances carriers are generally required to report to the Commission. Effective October 1, 2025.

HB1240

Introduced on February 7, 2025, HB 1240 prohibits health care providers and carriers from using AI if the AI has been designed only to reduce costs for a healthcare provider at the expense of reducing the quality of care, delaying care, or denying coverage for care. It also requires the use of AI for healthcare decisions to annually publish certain key data about the decisions on the provider’s website and undergo a third-party audit. Effective October 1, 2025.

HB589

Introduced on January 23, 2025, HB 589 provides that a person who intentionally, knowingly, or negligently designs or creates AI software able to cause physical injury or death is strictly liable for damages and subject to a civil penalty if the AI software is used to cause personal injury. The bill also generally prohibits someone from intentionally, knowingly, or negligently creating AI software able to cause injury or death. Effective October 1, 2025.

HB1331

Introduced on February 7, 2025, HB 1331 requires a developer that sells certain AI systems to provide certain information and make disclosures about their AI use, requires a deployer to implement a certain risk management policy and take certain precautions to protect consumers from AI risks, requires deployer to complete a certain impact assessment, etc. Effective October 1, 2025.

SB936

Introduced on February 5, 2025, SB 936 requires developers who use high-risk AI system to use reasonable care to protect consumers from known and reasonably foreseeable risks of certain algorithmic discrimination, prohibits a developer from providing to a deployers a high-risk AI system unless certain disclosures are provided to the deployer or developer, requires these developers to conduct impact assessments and maintain a risk management policy, and requires disclosure to the consumer regarding the deployment of and decisions made by a high-risk AI system.

Effective October 1, 2025.

HB1477

Introduced on February 7, 2025, HB 1477 establishes requirements for consumer reporting agencies that use algorithmic systems to assemble or evaluate consumer credit information on consumers for the purpose of adding to consumer reports to third parties. It requires the Commissioner of Financial Regulation to establish certain assessment thresholds for algorithms, mandate regular training for reviewers, and implement a whistle-blower protection program.

Effective on October 1, 2025.

Enacted

HB1202

Maryland law, HB 1202, prohibits an employer from using a facial recognition service for the purpose of creating a facial template during an applicant’s pre-employment interview, unless the applicant consents by signing a specified waiver. This workplace AI law went into force on October 1, 2020.

Failed

HB1255

Introduced March 11, 2024, HB 1255 would restrict an employer from using an automated employment decision tool to make certain employment decisions. The bill would require an employer, under certain circumstances, to notify an applicant for employment of the employer's use of an automated employment decision tool within a certain time period and generally relating to automated employment decision tools.

Proposed

SD2223

Introduced on Jan. 17, 2025, SD2223 (substantively same as SD2592) categorizes as an unfair and deceptive trade practice a commercial transaction in which an individual interacts or communicates with a bot and reasonably could have believed they were engaging with a human. A bot in this bill is conserved an automated online account, including an AI agent. Commercial entities can avoid liability by clearly and conspicuously disclosing that the entity is a computer, not a human.

HD4053

Introduced Jan. 17, 2025, HD4053 (substantively same as Bill HD396) is designed to protect consumers from discrimination by high-risk AI systems. High-risk AI systems are defined as those that make consequential decisions without human review or interference. A consequential decision is one which affects: education enrollment or an education opportunity; employment; lending decision; essential government service; health care services; housing; insurance; or legal service.

Section 2 of the bill would require a developer of a high-risk artificial intelligence system to use reasonable care to protect consumers from any known risks of algorithmic discrimination from a high-risk AI system. The bill further requires the developer conduct a risk assessment assessing the nature and scope of the use of high-risk AI, the sensitivity and volume of the data processed and an impact assessment. The documentation must include the type of data used, the foreseeable risk of discrimination, the purpose of the AI system, amongst other things spelled out in Section 3.

The bill would be effective six months after passage and does not have a private right of action.

HD1861

Introduced Jan. 15, 2025, HD1861 would require all public-facing social media platform, content-sharing platform, messaging platform, advertising network, or standalone search engine that distributes content to users to provide users with the context (called “provenance data”) of an AI image. This provenance data includes information about the origins of the content and its history of modifications. Generative AI providers must also facilitate users’ ability to access provenance data, by providing users adequate tools to read this data.

SD1313

Introduced Jan. 16, 2025, SD1313 sets transparency requirements for covered platforms, defined as an online, mobile, or internet application or service that does business in the state and maintains the data of at least 100,000 consumers (beyond the data needed for payment transactions) and businesses with at least 25,000 consumers and get 25% of their gross revenue from selling data are in scope.

Before Jan. 1 each year, covered platforms must register with the office of social media transparency and accountability. Third party auditors will then assess the platform’s algorithmic risk of harm to children, as established by an Advisory Council of mental health experts. Beginning Jan. 1, 2026, and continuing annually, platforms must submit a transparency report detailing the number of users reasonably believed to be minors, amounts of time spent on the platform, features the platform uses to increase, sustain, or extend use of the platform, and descriptions of the personal data the platform collects, with justifications. By Jan. 1, 2027, the platform must report each instance of specified harms on its service.

There is no private right of action and each violation results in up to a $500,000 fine.

SD745 and HD2281

Introduced on January 18 and 19, 2023, the Massachusetts Data Privacy Protection Act (MDPPA) was filed in both the Senate SD 745, and in the House HD 2281. The bill is based on the federal American Data Privacy Protection Act with additional provisions relating to workplace surveillance. The MDPPA would require companies to conduct impact assessments if they use a “covered algorithm” in a way that poses a consequential risk of harm to individuals. “Covered algorithm,” is defined as “a computational process that uses machine learning, natural language processing, artificial intelligence techniques, or other computational processing techniques of similar or greater complexity and that makes a decision or facilitates human decision-making with respect to covered data, including determining the provision of products or services or to rank, order, promote, recommend, amplify, or similarly determine the delivery or display of information to an individual.”

SD1971 and HD3263

Introduced on January 20, 2023, in both the Senate SD 1971 (assigned SB227), and in the House HD 3263, the Massachusetts Information Privacy and Security Act (MIPSA) creates various rights for individuals regarding the processing of their personal information, including the right to a privacy notice at or before the point of collection of an individual's personal information, the right to opt out of the processing of an individual's personal information for the purposes of sale and targeted advertising, rights to access and transport, delete, and correct personal information, and the right to revoke consent. Additionally, large data holders are required to perform risk assessments where the processing is based in whole or in part on an algorithmic computational process. A “large data holder”, is a controller that, in a calendar year: (1) has annual global gross revenues in excess of $1,000,000,000; and (2) determines the purposes and means of processing of the personal information of not less than 200,000 individuals, excluding personal information processed solely for the purpose of completing a payment-only credit, check or cash transaction where no personal information is retained about the individual entering into the transaction.

H1873

Introduced on February 16, 2023, H1873, An Act Preventing A Dystopian Work Environment, would require that employers provide employees and independent contractors (collectively, “workers) with a particularized notice prior to the use of an Automated Decision System (ADS) and the right to request information, including, among other things, whether their data is being used as an input for the ADS, and what ADS output is generated based on that data. “Automated Decision System (ADS)” or “algorithm,” is defined as “a computational process, including one derived from machine learning, statistics, or other data processing or artificial intelligence techniques, that makes or assists an employment-related decision.” The bill further requires that employers review and adjust as appropriate any employment-related decisions or ADS outputs that were partially or solely based on the inaccurate data, and inform the worker of the adjustment. Employers and vendors acting on behalf of an employer must maintain an updated list of all ADS currently in use, and must submit this list to the department of labor on or before January 31 of each year. The bill also prohibits the use of ADSs in certain circumstances and requires the performance of algorithmic impact assessments. The reporting date has been extended to Wednesday July 31, 2024.

HD1788

Introduced on January 11, 2024, HD. 4788, the Artificial Intelligence Disclosure Act would require that any generative artificial intelligence system used to create audio, video, text or print AI-generated content within Massachusetts include on or within such content a clean and conspicuous disclosure that meets the following criteria: (i) a clear and conspicuous notice, as appropriate for the medium of the content, that identifies the content as AI-generated content, which is to the extent technically feasible, permanent or uneasily removed by subsequent users; and (ii) metadata information that includes an identification of the content as being AI-generated content, the identity of the system, tool or platform used to create the content, and the date and time the content was created.

H83

Introduced on February 16, 2023, H. 83, would create an omnibus consumer privacy law called the Massachusetts Data Privacy Protection Act to regulate, among other data uses, the collection and processing of personal information. In particular, the bill sets out rules for the use of automated decision making technologies that would require that a covered entity using automated decision making technologies (Covered Algorithms) to conduct an impact assessment and evaluate any training data used to develop the Covered Algorithm to reduce the risk of any potential harms from the use of such technologies.

S2539

Introduced on December 28, 2023, S. 2539, would require the development of a comprehensive set of policies designed to bring cybersecurity and AI preparedness up to the latest standards and to keep the Massachusetts government up to date as technology continues to rapidly advance.

Failed

HB1974

Introduced on February 16, 2023, HB1974, would regulate the use of artificial intelligence (AI) in providing mental health services. In particular, the bill provides that the use of AI by any licensed mental health professional in the provision of mental health services must satisfy the following conditions: (1) pre-approval from the relevant professional licensing board; (2) any AI system used must be designed to prioritize safety and must be continuously monitored by the mental health professional to ensure its safety and effectiveness; (3) patients must be informed of the use of AI in their treatment and be afforded the option to receive treatment from a licensed mental health professional; and (4) patients must provide their informed consent to receiving mental health services through the use of AI. AI is defined as “any technology that can simulate human intelligence, including but not limited to, natural language processing, training language models, reinforcement learning from human feedback and machine learning systems.”

SB31

Introduced on February 16, 2023, SB31, An Act drafted with the help of ChatGPT to regulate generative artificial intelligence models like ChatGPT, would require any company operating a large-scale generative artificial intelligence model to adhere to certain operating standards such as reasonable security measures to protect the data of individuals used to train the model, informed consent from individuals before collecting, using, or disclosing their data, and performance of regular risk assessments. A “large-scale generative artificial intelligence model” is defined to mean “a machine learning model with a capacity of at least one billion parameters that generates text or other forms of output, such as ChatGPT.” The bill further requires any company operating a large-scale generative artificial intelligence model to register with the Attorney General and provide certain enumerated information regarding the model.

Proposed

SB659

Introduced Nov. 9, 2023, SB 659 would enact the Michigan Personal Data Privacy Act aimed at protecting consumer data. Section 13 gives consumers the option to opt-out of 1) having their data used for targeted advertising, 2) sale of personal data, and 3) personal data processing for use in profiling for automated decisions that produce legal or similarly significant effects. Consumers may also request access to their data, correct inaccuracies in their data, request a copy of their data, and request the deletion of their collected data.

Section 21 requires a controller to obtain consent before processing sensitive data and prohibits a controller from selling sensitive data. Controllers also cannot process the data of a minor for purposes of targeted advertising.

Section 29 requires a controller to conduct a DPA if processing personal data for the purpose of profiling if the profiling presents a reasonably foreseeable risk to the consumer. Section 25 requires a public facing privacy notice, explaining consumers’ rights.

Enforcement of the bill would begin one year after enactment. Businesses that maintain the data of at least 100,000 consumers (beyond the data needed for payment transactions) and businesses with at least 25,000 consumers and derive any revenue from selling data are in scope. Violations are $7,500 each + costs.

Enacted

HB5141

Effective Feb. 13, 2024, HB 5141 regulates use of AI in political advertising. The law requires political ads created using AI, including prerecorded phone messages created using AI, to include a clear and conspicuous disclaimer. The law includes specific requirements for the disclaimer depending on the media form. The fine for the first violation of this section is $250, then $1,000.

Enacted

HF2309

Introduced on March 1, 2023, HF2309, would create an omnibus consumer privacy law based on the Colorado Privacy Act and Connecticut Data Privacy Act, to regulate, among other data uses, the collection and processing of personal information. In particular, the bill sets out rules for profiling and automated decision-making. Specifically, the bill enables individuals to opt-out of “profiling in furtherance of decisions that produce legal or similarly significant effects” concerning the consumer. Profiling is defined as “any form of automated processing of personal data to evaluate, analyze, or predict personal aspects concerning an identified or identifiable natural person's economic situation, health, personal preferences, interests, reliability, behavior, location, or movements.” Controllers must also perform a data privacy and protection assessment for high-risk profiling activities.

SF2915

Originally introduced on March 15, 2023 as SF2915, the Minnesota Consumer Data Privacy Act was passed as Section 325O of HF 4757 an omnibus bill dealing primarily with cannabis. Section 325O.05 gives consumers the option to opt-out of 1) having their data used for targeted advertising, 2) sale of personal data, and 3) personal data processing for use in profiling for automated decisions that produce legal or similarly significant effects. Consumers may also request access to their data, correct inaccuracies in their data, request a copy of their data, and request the deletion of their collected data. Section 325O.08 requires a controller to conduct a DPA if processing personal data for the purpose of profiling if the profiling presents a reasonably foreseeable risk to the consumer.

Enforcement of the bill will begin on July 31, 2025. Businesses that maintain the data of at least 100,000 consumers (beyond the data needed for payment transactions) and businesses with at least 25,000 consumers and get 25% of their gross revenue from selling data are in scope.

Proposed

SB2642

Introduced on Jan. 20, 2025, SB 2642 would regulate the use of AI in political advertisements. The law would require political ads created using AI, including prerecorded phone messages created using AI, to include a clear and conspicuous disclaimer. The law includes specific requirements for the disclaimer depending on the media form. The attorney general or an injured candidate for office may bring suit.

Proposed

SB212

Introduced on Feb. 4, 2025, SB 212 sets requirements for critical infrastructure (as defined by Montana Code 82-1-601 as an asset critical to US “security, national economic security, national public health or safety”) controlled by AI. All systems of critical infrastructure run in whole or in part by AI need to have a shutoff the developer can deploy to regain human control of the system. To this end, the entity using the AI system must implement an annual review and test a risk management program to ensure manual takeover is possible. If passed, the act would be effective on date of passage.

Enacted

SB384

Introduced on February 16, 2023, SB384, An act establishing the Consumer Data Privacy Act, would create an omnibus consumer privacy law, to regulate, among other data uses, the collection and processing of personal information, and profiling and automated decision-making. Specifically, the bill creates certain transparency requirements around profiling and enable individuals to opt-out of “profiling in furtherance of automated decisions that produce legal or similarly significant effects” concerning the consumer. Profiling is defined as “any form of automated processing performed on personal data to evaluate, analyze, or predict personal aspects related to an identified or identifiable individual's economic situation, health, personal preferences, interests, reliability, behavior, location, or movements.” Controllers must also perform a data protection assessment for high-risk profiling activities.

Proposed

LB504

Introduced Jan. 21, 2025, LB 504, the Nebraska Age-Appropriate Online Design Code Act is designed to prevent compulsive usage of social media platforms by minors. The bill requires taking reasonable care in the use of personal data and the design of the platform, minimizing the harm of compulsive usage, severe psychological harm, emotional distress, intrusions on privacy, identity theft, discrimination, and physical or financial harm. With respect to AI, the bill requires platforms prevent AI from using users’ personal data to communicate or interact with the user. Users must also be able to opt out of design features, defined in the bill as features designed to expand a user’s frequency or time spent using the app, or activity on the platform.

The bill prohibits the profiling of a minor on the app, targeting ads at minors, and using the personal data collected for any reason other than its initial collection purpose. The bill also has transparency requirements and requires covered entities to issue an annual public report describing, in part, the type of personal data collected, the reason for collecting it, and how the platform uses algorithms. A violation of this bill would result in a fine of up to $50,000 and there is no private right of action.

LB642

Introduced Jan. 23, 2025, LB 642, the Artificial Intelligence Consumer Protection Act is designed to protect consumers from discrimination by high-risk AI systems. High-risk AI systems are defined as those that make consequential decisions without human review or interference. A consequential decision is one which affects: education enrollment or an education opportunity; employment; lending decision; essential government service; health care services; housing; insurance; legal service; or pardon, parole, probation, or release decision.

Section 3 of the bill would require a developer of a high-risk artificial intelligence system to use reasonable care to protect consumers from any known risks of algorithmic discrimination from a high-risk AI system. The bill further requires the developer provide certain documentation both for subsequent developers and consumers. The documentation must include the type of data used, the foreseeable risk of discrimination, the purpose of the AI system, amongst other things spelled out in Section 3.

The bill would be effective Feb. 1, 2026 and does not provide a private right of action.

Failed

LB1203

Introduced January 17, 2024, LB1203 would regulate the use of AI in political advertising. The bill would require all covered advertisements created in whole or in part by AI to display a clear and conspicuous disclaimer of the use of AI to create the ad. Specific requirements for the disclaimer vary depending on the medium and are articulated in the bill. There is no private right of action.

Proposed

AB73

Introduced on Nov. 21, 2024, AB73 would regulate use of AI in political advertising. The law requires political ads created using AI, including audio messages created using AI, to include a clear and conspicuous disclaimer. The bill includes specific requirements for the disclaimer depending on the media form. A copy of the ad must be furnished to the Nevada Secretary of State in accordance with other Nevada election advertising laws.

This law would become effective Jan. 1, 2026 and does not provide a private right of action.

Enacted

SB255

Introduced on January 19, 2023, SB 255, creates an omnibus consumer privacy law based on a composite of the Colorado Privacy Act, Connecticut Data Privacy Act, and Virginia Consumer Data Protection Act. In particular, the bill sets out rules for profiling and automated decision-making. Specifically, the bill enables individuals to opt-out of “in furtherance of solely automated decisions that produce legal or similarly significant effects concerning the consumer.” Profiling is defined as “any form of automated processing of personal data to evaluate, analyze, or predict personal aspects concerning an identified or identifiable natural person's economic situation, health, personal preferences, interests, reliability, behavior, location, or movements.” Controllers must also perform a data protection assessment for high-risk profiling activities. The bill was reintroduced and passed by the legislature on January 18, 2024.

Proposed

A4909

Introduced on December 5, 2022, A4909, would regulate the “use of automated tools in hiring decisions to minimize discrimination in employment.” The bill imposes limitations on the sale of automated employment decision tools (AEDTs), including mandated bias audits, and requires that candidates be notified that an AEDT was used in connection with an application for employment within 30 days of the use of the tool.

S3742

Introduced on October 7, 2024, S3742, would require AI Technology Companies perform annual safety tests on all AI technologies sold, developed, deployed, used, or offered for sale in New Jersey. Safety tests must assess potential biases, inaccuracies, and cybersecurity threats. In-scope entities must submit an annual report to the Office of Information Technology (OIT) detailing:

A list of all AI technologies tested.
Descriptions of the safety tests conducted.
Lists of third parties involved in conducting the tests, if any.
Results of the safety tests.

Effective date: The law shall take effect on the first day of the sixth month next following enactment.

A5164

Introduced on January 14, 2025, A5164, provides that “any news media or other entity disseminating news or purporting to disseminate news within the State may permit the use of artificial intelligence to assist its professionals and staff in investigating, researching, and reporting information, but shall be prohibited from using artificial intelligence in lieu of professionals and staff.” In addition, “[a]ny news media or other entity disseminating news or purporting to disseminate news within the State that uses generative AI content, regardless of what entity or mechanism produced it, shall disclose the following: (1) a prominently displayed label indicating that the content is generative AI; (2) credit to any source used to produce the content; and (3) a disclaimer that the content may not accurately reflect the source material from which it was produced.”

Penalties for Non-Compliance: Civil penalties for violations, starting at $10,000 for the first violation and increasing for subsequent violations. There is no private right of action.

Effective date: If passed, the law will take effect on the first day of the seventh month next following the date of enactment.

A3854

Introduced February 22, 2024, A3854, which is similar to A4030, essentially would make it unlawful for the sale, development, deployment, use, or offer for sale of an automated employment decision tool unless (1) a bias audit assesses the tool within the past year prior to selling or offering the tool for sale; (2) the tool includes at no additional costs this annual bias audit service; (3) the tool is developed, sold, deployed, used, or offered for sale with a notice stating the tool is subject to this bill; and (4) the tool’s developer has implemented the recommendations of the most recent bias audit conducted and the developer issues a press release stating so. “Employer” includes an “individual, partnership, association, corporation,” and other business entities. “Automated employment decision tool” is a “machine-based system that can, for a set of human-defined objectives provided by an employer or an individual acting on behalf of an employer, make predictions, recommendations, or decisions influencing recruitment, workforce, or employment decisions.” A “bias audit” would be an “impartial evaluation conducted by an independent auditor.”

A3912

Introduced February 27, 2024, A3912 would expand the definition of “identity left” to include impersonation or false depictions of a person generated entirely or substantially manipulated by computer technology or AI-generated speech, speech transcription, or text. To constitute criminal activity, a person must reasonably believe the AI-generated content accurately exhibits the activity of a person, the content was produced without the person’s content, and the exhibition is “substantially likely” to create perceptible individual or societal harm. This act would take effect immediately.

A4030

A4030, introduced March 7, 2024,would prohibit the sale or offer for sale in New Jersey an automated employment decision tool unless (1) a bias audit has been performed on the tool in the past year prior to sale; (2) the sale includes, at no additional fee, the annual bias audit service; and (3) the tool is sold or offered with a notice stating it is subject to these provisions. “Automated employment decision tool” is “any system” governed by “statistical theory” or other methodologies that filter candidates for hire automatically in a way that establishes a preferred candidate or candidates. “Bias audit” is an “impartial evaluation” of the automated employment decision tool to assess its compliance with anti-discrimination laws. A violation of this bill would result in a civil penalty of not more than $500 for the first violation and not less nor more than $1,500 for subsequent violations.

AR141

Introduced June 6, 2024, AR141 encourages platforms that generate and disseminate deepfake and cheapfake media “to voluntarily commit to prevent and remove harmful content.” “Deepfake” and “cheapfake” media includes video recordings, motion picture films, sound recordings, electronic images, photographs or other technological representations of speech or conduct that depict a person’s speech of conduct that would not normally engage in those behaviors. These medias are AI-produced content that can “manipulate public understandings of evidence and truth.”

S2964 (A3855)

Introduced March 18, 2024, S2964 (Assembly version A3855) establishes standards for independent bias auditing of automated employment decision tools (“AEDT”). This bill would apply to employers, including employment agencies, individuals, partnerships, associations, corporations, and other entities employing any person. An “independent auditor” would be a person or group capable of exercising objective judgment on all issues within the scope of a bias audit of an AEDT. “AEDT” is a system governed by statistical theory or related methodologies, including learning algorithms, that automatically filter candidates for hire for any term, condition, or privilege of employment in a way that “establishes a preferred candidate or candidates.” A “bias audit” would be an “impartial evaluation, including but not limited to testing, of an automated employment decision tool to assess its predicted compliance” with anti-discrimination laws.

S3046

Introduced April 8, 2024, S3046 would provide corporation business and gross income tax credit for employing persons who have experienced job loss because of automation. The corporation tax credit would be equal to 10 percent of the salary and wages paid to each person employed by the corporation who experienced termination because of automation. To qualify, the corporation as a taxpayer must employ the person for at least seven months of the privilege period the taxpayer claims the credit. The credit, however, cannot exceed $2,500 per employee per privilege period. “Automation” is defined as a “device, process, or system that functions without continuous input from a human operator.” This bill would take effect immediately and would apply to privilege periods and taxable years beginning on or after January 1 of the year following enactment.

A3911

S3015, introduced April 8, 2024 (Assembly version A3911), would require an employer located in New Jersey, including a person, firm, business, educational institution, nonprofit, corporation, LLC, or other entity, that requests applications to record video interviews and uses an AI-analysis of the video to notify the applicant that AI may be used to analyze their video, to provide the applicant with information before the interview as to how the AI works and evaluates applicants, and to obtain written consent before the interview that the application will be evaluated by AI. If an applicant has not consent, then an employer cannot use AI for analysis. Additionally, the bill would require an employer using an AI-analysis to determine applicant fitness to collect and report the applicants’ race and ethnicity who are and are not afforded the opportunity for an in-person interview as well as the applicants’ race and ethnicity who are offered a position or hired. This data must be reported annually to the Department of Labor and Workforce Development. Violation of this bill will result in a civil penalty of $500 for the first offense and $1,000 for any subsequent offense.

S3225

S3225, introduced May 13, 2024, would require a business entity, such as a business corporation, professional services corporation, LLC, partnership, limited partnership, business trust, association, or any other legal commercial entity organized under New Jersey, that use a text-based chat to offer a transcript of the chat to the consumer. “Chat” includes any tool used by the entity “to provide real-time, text-based communication with a consumer.” “Transcript” is a “typed or printed verbatim record of a chat.” Additionally, the entity must provide “clear and conspicuous notice to the consumer at the outset of any interaction, informing the consumer of the option to receive a transcript of the chat.” Failure to comply will be unlawful. The bill would take effect immediately.

S3298

Introduced May 20, 2024, S3298 (Assembly version A3858) would require insurance carriers to disclose in a “clear and conspicuous” location on the website if the carrier uses an “automated utilization management system” and the number of claims reviewed using this system in the previous year. “Automated utilization system” is a system used for reviewing the “appropriate and efficient allocation of health care services under a health benefits plan according to specified guidelines” to recommend or determine if and to what extent a health care service should be given or proposed to a covered person. The automated utilization system may use AI or other software. This bill, if enacted, would take effect on the first day of the 13th month following the date of enactment.

S1588

Introduced on January 9, 2024, S1588, regulates the use of automated employment decision tools during the hiring process to minimize employment

discrimination that may result from the use of the tools. The Bill would prohibit the sale of automated employment decision tools unless certain requirements are met, including a previous bias audit, a no cost yearly bias audit, and a notice that the tool is subject to the specific Bill. Additionally, the Bill has specific employee notification requirements for companies that use these tools.

Enacted

S332

Initially introduced on January 11, 2022, S332 (the “Act”), creates an omnibus consumer privacy law along the lines of the Washington Privacy Act. Among other things, the Act requires companies to conduct data protection assessments of “processing that presents a heightened risk of harm to a consumer” before conducting such processing. Such “heightened risk” results from activities such as profiling. “Profiling” means any form of automated processing performed on personal data to evaluate, analyze or predict personal aspects related to an identified or identifiable individual’s economic situation, health, personal preferences, interests, reliability, behavior, location or movements. Consumers are also afforded the right to opt-out of profiling in furtherance of decisions that produce legal or similarly significant effects.

The bill was signed into law on January 16, 2024. The law will go into effect January 15, 2025.

Failed

A537

Introduced on January 1, 2022, A537, would require an automobile insurer using an automated or predictive underwriting system to annually provide documentation and analysis to the Department of Banking and Insurance to demonstrate that there is no discriminatory outcome in the pricing on the basis of race, ethnicity, sexual orientation, or religion, that is determined by the use of the insurer's automated or predictive underwriting system. Under this bill, "automated or predictive underwriting system" is defined to mean a computer-generated process that is used to evaluate the risk of a policyholder and to determine an insurance rate. An automated or predictive underwriting system may include, but is not limited to, the use of robotic process automation, artificial intelligence, or other specialized technology in its underwriting process.

S1402

Introduced on February 10, 2022, S1402, provides that it is unlawful discrimination and a violation of the law against discrimination for an automated decision system (ADS) to discriminate against any person or group of persons who is a member of a protected class in: (1) the granting, withholding, extending, modifying, renewing, or purchasing, or in the fixing of the rates, terms, conditions or provisions of any loan, extension of credit or financial assistance; (2) refusing to insure or continuing to insure, limiting the amount, extent or kind of insurance coverage, or charging a different rate for the same insurance coverage provided to persons who are not members of the protected class; or (3) the provision of health care services. Under the bill, ADS means a computational process, including one derived from machine learning, statistics, or other data processing or artificial intelligence techniques, that makes a decision or facilitates human decision making.

An ADS is discriminatory if the system selects individuals who are members of a protected class for participation or eligibility for services at a rate that is disproportionate to the rate at which the system selects individuals who are not members of the protected class. If passed, the law would take effect on the first day of the third month next following enactment.

Proposed

HB307

Introduced on February 10, 2025, HB 307 enacts the Internet Privacy and Safety Act, which defines profiling as “automated processing of personal data that uses personal data to evaluate certain aspects relating to a consumer, including analyzing or predicting aspects concerning the consumer's behavior, economic situation, health, interests, location, movement, performance at work, personal preferences or reliability. "Profiling" does not include the processing of data that does not result in an assessment or judgment about a consumer.”

HB60

Introduced on January 17, 2025, HB 60 (Artificial Intelligence Act) focuses on regulating the use of AI to ensure transparency, fairness, and accountability. It outlines the responsibilities of an AI developer: 1) duty of care to protect consumers from known or foreseeable risks of algorithmic discrimination, 2) duty to provide summaries and documentation on AI systems’ uses, data, performance, and risks, and 3) duty to disclose and report incidents of algorithmic discrimination to the State Department of Justice within 90 days of the incident. It also outlines responsibilities for deployers of AI systems: 1) duty to implement risk management policies; 2) duty to conduct annual impact assessments and within 90 days of substantial changes to the AI systems; 3) duty to provide consumers with notice and information about AI use in important decisions, including opportunities to correct data and appeal adverse decisions. Individual consumers can bring a civil action in district court against a developer or deployer for declaratory or injunctive relief and attorney fees for a violation of this act. Otherwise, the State Department of Justice can enforce the Act. It would take effect on July 1, 2026.

HB215

Introduced on January 29, 2025, HB 215 prohibits the use of AI to manipulate rent, and provides private right of action to someone who is injured by unlawful actions pursuant to the Uniform Owner-Resident Relations Act. The litigant can sue in the county in the state where defendant resides/is found/agent resides, or where service can be obtained.

Enacted

HB182

N.M. Stat. Ann. § 1-19-26.4 (proposed as HB 182), outlines regulations regarding advertisements containing AI-generated media. If someone creates, produces, or purchases an advertisement with deceptive media, they must include a clear disclaimer stating, "This [image/video/audio] has been manipulated or generated by artificial intelligence," depending on the type of media used. The disclaimer must be easily readable or audible, depending on the media type, and must be present throughout the duration of the media or at specific intervals. These regulations became effective on May 15, 2024.

Failed

SB68

Introduced on January 17, 2024, SB 68, the Age-Appropriate Design Code Act applies to “a sole proprietorship, partnership, limited liability company, corporation, association, affiliate or other legal entity that is organized or operated for the profit or financial benefit of the entity's shareholders or other owners and that offers online products, services or features to individuals in New Mexico and processes children's personal data.”

The Act would prohibit a covered entity from “profiling” a child under 18 unless:

(1) the covered entity can demonstrate that the covered entity has appropriate safeguards in place to ensure that profiling is consistent with the best interest of

children reasonably likely to access the online product, service or feature; and

(2) profiling is necessary to provide the online product, service or feature requested, and only with respect to the aspects of the online product, service or

feature with which the child is actively and knowingly engaged; or

(3) the covered entity can demonstrate a compelling reason that profiling is in the best interest of children. "Profiling" means automated processing of personal data that uses personal data to evaluate certain aspects relating to a natural person, including analyzing or predicting aspects concerning a natural person's performance at work, economic situation, health, personal preferences, interests, reliability, behavior, location or movements. "Profiling" does not include the processing of data that does not result in an assessment or judgment about a natural person.

For the most part, SB 68 is the same as SB 319, which was introduced on February 2, 2023, and failed to pass.

Proposed

A216

Introduced on January 4, 2023, A216, would require advertisements to disclose the use of synthetic media. Synthetic media is defined as “a computer-generated voice, photograph, image, or likeness created or modified through the use of artificial intelligence and intended to produce or reproduce a human voice, photograph, image, or likeness, or a video created or modified through an artificial intelligence algorithm that is created to produce or reproduce a human likeness.” Violators would be subject to a $1,000 civil penalty for a first violation and a $5,000 penalty for any subsequent violation.

A5309

Introduced on March 7, 2023, A5309, would amend state finance law to require that where state units purchase a product or service that is or contains an algorithmic decision system, that such product or service adheres to responsible artificial intelligence standards. The bill requires the commissioner of taxation and finance to adopt regulations in support of the law.

SB5641

Introduced on March 10, 2023, SB 5641A (Assembly version A567), would amend labor law to establish criteria for the use of automated employment decision tools (AEDTs). The proposed bills mirrors NYC’s Local Law 144 in many ways. In particular, employers who utilize AEDTs must: (1) obtain from the seller of the AEDT a disparate impact analysis, not less than annually; (2) ensure that the date of the most recent disparate impact analysis and a summary of the results, along with the distribution date of the AEDT, are publicly available on the employer’s or employee agency’s website prior to the implementation or use of such tool; and (3) annually provide the labor department a summary of the most recent disparate impact analysis.

SB365

Introduced on January 4, 2023, SB 365, the New York Privacy Act, would be the state’s first comprehensive privacy law. The law would require companies to disclose their use of automated decision-making that could have a “materially detrimental effect” on consumers, such as a denial of financial services, housing, public accommodation, health care services, insurance, or access to basic necessities; or could produce legal or similarly significant effects. Companies must provide a mechanism for a consumer to formally contest a negative automated decision and obtain a human review of the decision, and must conduct an annual impact assessment of their automated decision-making practices to avoid bias, discrimination, unfairness or inaccuracies.

The law would also permit consumers to opt-out of “profiling in furtherance of decisions that produce legal or similarly significant effects concerning a consumer.” Profiling is defined as any type of automated processing performed on personal data to evaluate, analyze, or predict personal aspects” such as “economic situation, health, personal preferences, interests, reliability, behavior, location, or movements.” Finally, the law would mandate that companies conduct a data protection assessment on their profiling activities, since profiling would be considered a processing activity with a heightened risk of harm to the consumer.

A8195

A8195, reintroduced in 2025 as A3356, the Advanced Artificial Intelligence Licensing Act, requires the registration and licensing of high-risk advanced artificial intelligence systems, establishes the advanced artificial intelligence ethical code of conduct, and prohibits the development and operation of certain artificial intelligence systems.

S8206

S8206 (assembly version A8105), reintroduced in 2025 as A1342, requires that every operator of a generative or surveillance advanced artificial intelligence system that is accessible to residents of the state require a user to create an account prior to utilizing such service. Prior to each user creating an account, such operator must present the user with a conspicuous digital or physical document that the user must affirm under penalty of perjury prior to the creation or continued use of such account. Such document shall state the following:

“I, ________ RESIDING AT ________, DO AFFIRM UNDER PENALTY OF PERJURY THAT I HAVE NOT USED, AM NOT USING, DO NOT INTEND TO USE, AND WILL NOT USE THE SERVICES PROVIDED BY THIS ADVANCED ARTIFICIAL INTELLIGENCE SYSTEM IN A MANNER THAT VIOLATED OR VIOLATES ANY OF THE FOLLOWING AFFIRMATIONS:

I WILL NOT USE THE PLATFORM TO CREATE OR DISSEMINATE CONTENT THAT CAN FORESEEABLY CAUSE INJURY TO ANOTHER IN VIOLATION OF APPLICABLE LAWS;
I WILL NOT USE THE PLATFORM TO AID, ENCOURAGE, OR IN ANY WAY PROMOTE ANY FORM OF ILLEGAL ACTIVITY IN VIOLATION OF APPLICABLE LAWS;
I WILL NOT USE THE PLATFORM TO DISSEMINATE CONTENT THAT IS DEFAMATORY, OFFENSIVE, HARASSING, VIOLENT, DISCRIMINATORY, OR OTHERWISE HARMFUL IN VIOLATION OF APPLICABLE LAWS;
I WILL NOT USE THE PLATFORM TO CREATE AND DISSEMINATE CONTENT RELATED TO AN INDIVIDUAL, GROUP OF INDIVIDUALS, ORGANIZATION, OR CURRENT, PAST, OR FUTURE EVENTS THAT ARE OF THE PUBLIC INTEREST WHICH I KNOW TO BE FALSE AND WHICH I INTEND TO USE FOR THE PURPOSE OF MISLEADING THE PUBLIC OR CAUSING PANIC."

A8098

A8098 (Senate version S7922) reintroduced in 2025 as A1509 (senate version S1815), would require publishers of books created wholly or partially with the use of generative artificial intelligence to disclose such use of generative artificial intelligence before the completion of such sale; applies to all printed and digital books consisting of text, pictures, audio, puzzles, games or any combination thereof.

A8129

A8129 (senate version S8209), reintroduced in 2025 as S8209, would create the New York Artificial Intelligence Bill of Rights. Where a New York resident is affected by any system making decisions without human intervention, under the AI Bill of Rights they would be afforded the following rights and protections: (i) the right to safe and effective systems; (ii) protections against algorithmic discrimination; (iii) protections against abusive data practices; (iv) the right to have agency over one's data; (v) the right to know when an automated system is being used; (vi) the right to understand how and why an automated system contributed to outcomes that impact one; (vii) the right to opt out of an automated system; and (viii) the right to work with a human in the place of an automated system.

A01952

Introduced on January 14, 2025, A01952, would require employers or employment agencies to notify each such candidate of the use of automated employment decision tools and allow such candidate to request an alternative selection process or accommodation.

A03327

Introduced on January 27, 2025, A03327, would require any political communication, whether made by phone call, email or other message-based communication, that utilizes an artificial intelligence system to engage in human-like conversation with another, by reasonable means, apprise the person of the fact that they are communicating with an artificial intelligence system.

A03991

Introduced on January 30, 2025, A03991, would require that a health care plan or specialized health care service plan that uses an artificial intelligence, algorithm, or other software tool for the purpose of utilization review or utilization management functions, or that contracts with or otherwise works through an entity that uses such tools, comply with certain requirements.

The bill requires, among other things, that the use of the artificial intelligence, algorithm, or other software tool (i) does not adversely discriminate, directly or indirectly, against an individual on the basis of race, color, religion, national origin, ancestry, age, sex, gender, gender identity, gender expression, sexual orientation, present or predicted disability, expected length of life, degree of medical dependency, quality of life, or other health conditions, (ii) is fairly and equitably applied, (iii) is open to inspection. The bill further requires that disclosures pertaining to the use and oversight of the artificial intelligence, algorithm, or other software tool are contained in the covered entity’s written policies and procedures.

A03125

Introduced on January 23, 2025, A03125, relates to the use of automated decision tools to make housing decisions. The bill requires a disparate impact analysis annually to assess the impact of any automated decision tool used by any landlord to select applicants for housing and requires the landlord to notify each such applicant of such use. The bill allows for the attorney general to initiate an investigation if a preponderance of the evidence establishes a suspicion of a violation.

A03930

Introduced on January 30, 2025, A03930, would regulate the use of artificial intelligence in aiding decisions on rental housing and loans and require a study on the impact of artificial intelligence and machine learning on housing discrimination and redlining.

Among other things, the bill provides that it shall be unlawful for a landlord to implement or use an automated decision tool that fails to comply with the following provisions:

(a) No less than annually, a disparate impact analysis shall be conducted to assess the actual impact of any automated decision tool used by any landlord to select applicants for housing within the state. Such disparate impact analysis shall be provided to the landlord.

(b) A summary of the most recent disparate impact analysis of such tool as well as the distribution date of the tool to which the analysis applies shall be made publicly available on the website of the landlord prior to the implementation or use of such tool. Such summary shall also be made accessible through any listing for housing on a digital platform for which the landlord intends to use an automated decision tool to screen applicants for housing.

A04947

Introduced on February 10, 2025, A04947, would establish the "New York privacy act" which would regulate, among other things, the automated processing performed on personal data to evaluate, analyze, or predict personal aspects related to an identified or identifiable natural person's economic situation, health, personal preferences, interests, reliability, behavior, location, or movements.

S934

Introduced on January 8, 2025, S934 (assembly version 3411), requires the owner, licensee or operator of a generative artificial intelligence system to conspicuously display a warning on the system's user interface that is reasonably calculated to consistently apprise the user that the outputs of the generative artificial intelligence system may be inaccurate and/or inappropriate.

A01342

Introduced on January 9, 2025, A01342, requires the collection of oaths of responsible use from users of certain generative or surveillance advanced artificial intelligence systems by the operators of such systems, and transmission of such oaths to the attorney general.

A01456

Introduced on January 9, 2025, A01456, provides for notice requirements where an insurer authorized to write accident and health insurance in New York, or a health maintenance organization uses artificial intelligence-based algorithms in the utilization review process.

A00222

Introduced on January 9, 2025, A00222, requires owners of chatbot systems to provide clear, conspicuous and explicit notice to users that they are interacting with an artificial intelligence chatbot program rather than a human representative; provides that no such liability shall be imposed where the proprietor has corrected the information and substantially or completely cured the harm to the user within thirty days of notice of such harm.

A00768

Introduced on January 8, 2025, A00768 (senate version S01962), enacts the "New York artificial intelligence consumer protection act", in relation to preventing the use of artificial intelligence algorithms to discriminate against protected classes.

A00773

Introduced on January 8, 2025, A00773, relates to the use of automated decision tools by banks for the purposes of making lending decisions; allows loan applicants to consent to or opt out of such use.

S1169

Introduced on January 8, 2025, S1169, established the “New York Artificial Intelligence Act” to regulate the development and use of certain artificial intelligence systems to prevent algorithmic discrimination. The bill requires independent audits of high risk AI systems and provides for enforcement by the attorney general as well as a private right of action.

S7623

Originally introduced on August 4, 2023, as S7623 (reprinted as S7623C on May 31, 2024) (assembly version A9315), and reintroduced as S185 (assembly bill A3779), this bill would impose statewide requirements regulating tools that incorporate artificial intelligence to assist in employee monitoring and the employment decision-making process. In particular, the bill (1) defines a narrow set of allowable purposes for the use of electronic monitoring tools (EMTs), (2) requires that the EMT be “strictly necessary” and the “least invasive means” of accomplishing those goals, and (3) requires that the EMT collect as little data as possible on as few employees as possible to accomplish the goal. The bill also requires that employers exercise “meaningful human oversight” of the decisions of automated tools, and conduct and publicly post the results of an independent bias audit, and provide notification requirements to candidates that a tool is in use.

S2277

S2277 (Assembly version A3308), originally introduced January 19, 2023, and reintroduced in 2025 as S4276, would require business entities in New York that have personal information of at least 500 individuals to give notice about the entity’s use of the personal information. The bill also would create anti-discrimination practices for the entity to follow regarding the use of the AI.

A10374

A10374 (Senate version S9439), introduced May 21, 2024, and reintroduced in 2025 as S3133, would amend the general business law to prohibit robots and uncrewed aircraft equipped or mounted with weapons. “Robotic device” is a “mechanical device capable of locomotion, navigation, or movement on the group and that operates at a distance from its operator or supervisor, based on comments or in response to sensor data, artificial intelligence, or a combination.” The bill would make it unlawful for any person to use a robotic device or uncrewed aircraft to commit the crime of menacing; criminally harass another person; or use the device to physically restrain or attempt to restrain a human being. A knowing violation of this law would result in a civil penalty. This bill would not apply to a defense industrial company if the company were acting within their contract with the U.S. Dept. of Defense; a manufacturer or developer who modifies or operates these devices for the purpose of developing technology intended to detect the unauthorized weaponization of a robotic device or uncrewed aircraft; or government officials acting within the scope of their duties.

Enacted

Local Law 144

In December 2021, New York City passed the first law (Local Law 144), in the United States requiring employers to conduct bias audits of AI-enabled tools used for employment decisions. The law imposes notice and reporting obligations.

Specifically, employers who utilize automated employment decision tools (AEDTs) must:

Subject AEDTs to a bias audit, conducted by an independent auditor, within one year of their use;
Ensure that the date of the most recent bias audit and a “summary of the results”, along with the distribution date of the AEDT, are publicly available on the career or jobs section of the employer’s or employee agency’s website;
Provide each resident of NYC who has applied for a position (internal or external) with a notice that discloses that their application will be subject to an automated tool, identifies the specific job qualifications and characteristics that the tool will use in making its assessment, and informs candidates of their right to request an alternative selection process or accommodation (the notice shall be issued on an individual basis at least 10 business days before the use of a tool); and
Allow candidates or employees to request alternative evaluation processes as an accommodation.

While enforcement of the law has been delayed multiple times pending finalization of the law’s implementing rules, on April 6, 2023 the Department of Consumer and Worker Protection (DCWP) published the law’s Final Rule. The law is now in effect, and enforcement began on July 5, 2023.

Failed

A9149

A9149, introduced February 8, 2024, and referred to the Assembly Insurance Committee, would amend insurance law to require insurers to notify insureds about the use or lack of use of AI-based algorithms to review. This bill would broadly apply to insurers who are authorized to write accident and health insurance in New York, clinical peer reviewers who participate in a utilization review process for insurers, a corporate organized under New York, and health maintenance organizations. The department should certify these AI-based algorithms and trainings being used have minimized the risk of bias regarding a “covered person’s race, color, religious creed, ancestry, age, sex, gender, national origin, handicap or disability” and should “adhere to evidence-based clinical guidelines.” In addition, the bill would require documentation of “the utilization review of the individual clinical records or data prior to issuing an adverse determination.” A violation can result in a license suspension or revocation; refusal, for a maximum of 1 year, to issue a new license; a maximum fine of $5,000 per violation; or a maximum fine of $10,000 for each willful violation.

A9103

A9103, introduced February 7, 2024, and referred to the Assembly Election Law Committee, would amend election law to include a notification requirement. The bill would require “any political communication made by phone call, email, or other message-based communication” that uses AI to create a human-like conversation to reasonably inform the person that they are communicating with AI. If passed, this bill would take effect immediately.

A9054

A9054, introduced February 5, 2024, and referred to the Assembly Election Law Committee, would amend election law to prohibit entities from using generative AI in whole or in part to create a political communication that contains “any realistic photo, video, or audio depiction of a candidate, or person interacting with a candidate.” AI includes “any technology that engages in its own learning and decision-making to generate new data.” If passed, this bill would take effect immediately.

A9028

Introduced February 5, 2024, and referred to the Assembly Election Law Committee, A9028 would amend election law to, as is relevant, require disclosure of any political communication covered by the bill and made by AI or artificial media. The bill would apply to printed or digital political communications, including “brochures, flyers, posters, mailings, electronic mailings, or internet advertising.” The disclosure must state the communication was “created by or with the assistance of artificial intelligence.” The disclosure must be readable, clear, and conspicuous. If a person has an intent to damage a candidate or deceive with the political communication, then a violation can amount to a criminal charge.

A8369

A8369, introduced December 13, 2023, would amend insurance law to prohibit insurers from essentially using AI, an algorithm, or predictive model that incorporates external consumer data and information sources in a way to “unfairly discriminate” on the basis of “race, color, national or ethnic origin, religion, sex, sexual orientation, disability, gender identity, or gender expression.” The bill includes certain requirements that the insurer must follow, such as providing information to the superintendent, in order to avoid unfairly discriminating against people. “External consumer data and information source” includes data used by an insurer to establish lifestyle indicators in “marketing, underwriting, pricing, utilization management, reimbursement methodologies, and claims management” practices.

A8195

A8195, introduced October 27, 2023, and referred to the Assembly Science and Technology Committee, would, amongst a variety of things, establish an AI ethical code of conduct as well as require registration and licensing of “high-risk advanced artificial intelligence systems.” “High-risk” advanced AI system is a system that “possesses capabilities that can cause signifi9cant harm to the liberty, emotional, psychological, financial, physical, or privacy interests of an individual or groups of individuals, or which have significant implications on governance, infrastructure, or the environment.” This bill would apply to operators who distribute and have control over the development of a high-risk AI system.

A8179

A8179, introduced October 27, 2023, and referred to the Ways and Means Committee, would tax certain corporations that have displaced people from their employment because of AI technologies, including machinery, AI algorithms, or computer applications. This bill would apply to corporations doing business in New York that have met specified requirements, such as having less than one million dollars but at least ten thousand dollars of receipts in New York. This act would take effect immediately upon enactment and apply to the next taxable year.

A7859

A7859, introduced July 7, 2023, and referred to the Labor Committee, would amend labor law to require an employer or employment agency using an “automated employment decision tool to screen candidate who have applied for a position” to notify each candidate that this tool has been used to assess or evaluate the candidate, the job qualification and characteristics the tool uses, and information about the type of data the tool collects. “Automated employment decision tool” is any computation process that uses “machine learning, statistical modeling, data analytics, or artificial intelligence” to substantially assist or replace discretionary decision making for employment decisions. This bill would take effect on January 1 following enactment.

A3593

Introduced February 3, 2023, and referred to the Consumer Affairs and Protection Committee, A3593 would amend general business law to require companies to follow a host of guidelines centered around protecting consumer privacy. In regard to AI, the bill would apply to a “controller” or “the person who, alone or jointly with others, determines the purposes and means of the processing of personal data.” This bill defines AI as an “automated decision-making” process derived from machine learning, AI, or an automated process involving personal data resulting in a decision affecting consumers. If a “controller makes an automated decision involving solely automated processing that materially contributes to a denial of financial or lending services, housing, public accommodation, insurance, health care services, or access to basic needs,” the controlled would need to (1) disclose an automated process made the decision; (2) provide an avenue for consumers to appeal the decision; and (3) explain the process to appeal the decision. In addition, a controller or processor engaged in this automated decision-making must annually do an “impact assessment” describing the automated decision-making process and assess if the process produces any discriminatory results. An independent auditor must assess the impact assessment results. This bill would take effect immediately.

A9314

A9314, introduced February 24, 2024, and referred to the Labor Committee, would create criteria for the use of an “automated employment decision tool.” This is a system “used to filer employment candidates or prospective candidate for hire in a way that establishes a [referred candidate or candidate without relying on candidate-specific assessments by individual decision-makers.” This includes personality tests, cognitive ability tests, resume scoring systems, and other systems governed by statistical theory or specified methodologies. “Automated employment decision tool” does not include a tool that “does not automate, support, substantially assist or replace discretionary decision-making processes and that does not materially impact natural persons.” The guidelines this bill would create are conducting a disparate impact analysis to assess the impact of the employer’s use of an automated employment decision tool, writing a summary of the most recent disparate impact analysis, and providing to the department this summary. This act would take effect immediately.

S9434

S9434 (Assembly version A9472), introduced May 15, 2024, would prohibit landlords from using an algorithmic device to set the amount of a residential tenant’s rent. “Algorithmic device” includes “a device that uses one or more algorithms to perform calculations of data, including data concerning local or statewide rent amounts being charged to tenants by landlords.” This also would include a product that incorporates an algorithmic device. A violation would result in monetary penalty.

S9401

S9401, introduced May 15, 2024, would amend the labor law to prohibit an employer from using or applying an AI unless the employer has conducted an impact assessment for the AI’s impact and use. This assessment should be done at least once every 2 years and before any material change to the AI. The impact assessment must include these requirements: a description of the AI’s objectives; an evaluation of the ability of the AI to achieve its objectives; a summary of the underlying AI tools being used; the design and training data to develop the AI process; the extent the AI requires input of sensitive and personal data, how that data is used and stored, and any control users may have over this data; an estimated number of employees who have already been displaced by AI; and an estimated number of employees expected to be displaced by AI. “Employer” includes a business resided in New York, is not a small business, and employs more than 100 people.

S9381

S9381 (Assembly version A10494), introduced May 14, 2024, would amend the general business law to add liability to proprietors for chatbot responses. “Proprietors” includes any person or business entity with more than 20 employees that owns, operates, or deploys a chatbot system that interacts with users. This would not include third-party developers that license their chatbot technology to the proprietor. “Chatbot” is an AI system, software program, or technological application that creates “human-like conversation and interaction through text messages, voice commands, or a combination thereof to provide information and services to users.” The proprietor is responsible for “ensuring such chatbot accurately provides information aligned with the formal policies, product details, disclosures and terms of service offered to users.” This liability cannot be waived through disclosure to users. Additionally, proprietors would have to provide “clear, conspicuous, and explicit notice to users that they are interacting” with AI, rather than a human representative.

S8755

S8755, introduced March 7, 2024, establishes the New York artificial intelligence ethics commission, which would promulgate rules regulating AI use by business entities as well as other regulations. This bill also specifies that no entity doing business in New York shall use AI systems that discriminate based on race, gender, sexuality, disability, or other protected characteristics; create or disseminate false or misleading information created by AI to deceive the public; participate in the unlawful collection, processing, or dissemination of personal information by an AI system without consent; participate in the unauthorized use or reproduction of IP through AI; fail to have safeguards to prevent harm or material loss through AI; conduct AI research that is harmful or without the subjects’ consent; intentionally disrupt, damage, or subvert of an AI system to undermine its integrity or performance; or participate in the unauthorized use of a person’s personal identity or data by AI to commit fraud or theft. The commission can impose penalties for any violation. This act would take effect immediately.

S7592

S7592 (Assembly version A79094), introduced July 7, 2023, and amended February 26, 2024, would require political communications to contain disclosures regarding the use of AI to make that communication. “Political communication” includes “an image or video footage that was generated in whole or in part with the use of artificial intelligence.” Failure to comply would result in a fine equal to the amount expended on the communication.

S6685

S6685 (Assembly version A843), introduced May 4, 2023, would prohibit motor vehicle insurers from using AI-generated algorithms used to construct coverage terms, premiums and rates, and actuarial tables that can discriminate based on age, marital status, sex, sexual orientation, educational background or education level attained, employment status or occupation, wealth, consumer credit information, ownership or interest in real property, and other characteristics.

S2477

S2477 (Assembly version A5631), introduced January 20, 2023, and amended recently on April 15, 2024, would revise the New York State Fashion Workers Act to require model management companies to obtain “clear written consent for the creation or use of a model’s digital replica, detailing the scope, purpose, rate of pay, and duration of such use.” The bill would prohibit model management companies from creating, altering, or manipulating a model’s digital replica using AI without written consent from the model. “Digital replica” is a “significant, computer-generated or artificial intelligence-enhanced representation of a model’s likeness.”

S9609

S9609, introduced May 16, 2024, would make it unlawful for a rental property owner, or any agent or subcontractor thereof, to collect information on historical or contemporaneous prices, supply levels, or contract information as well as renewal dates using a system, software, process made by an algorithm. “Rental property owner” includes individuals as well as business entities. The rental property owner cannot exchange for value the services of a coordinator, which any person that operates software or data analytics services.

S9542

S9542, introduced May 16, 2024, would amend general business law by prohibiting the publication of a “digital or physical newspaper, magazine, or periodical which was wholly or partially produced or edited through the use of artificial intelligence without significant human oversight.” AI includes the “use of machine learning technology, software, automation, and algorithms to perform tasks, to make rules and/or predictions based on existing data sets and instructions.”

S9450

S9450 (Assembly version A10103), introduced May 15, 2024, would amend general business law to require an owner, licensee, or operator of “generative artificial intelligence” to “conspicuously” disclose a warning on the user’s interface that would inform the user that the outputs may be inaccurate and/or inappropriate. If an entity fails to do this, then they must pay a civil penalty of $25 per user of such system or $100,000.

S7735

Introduced on November 3, 2023, S7735 (assembly version A7906), provides that it shall be unlawful for a landlord to implement or use an automated decision tool, unless it: (1) no less than annually, conducts a disparate impact analysis to assess the actual impact of any automated decision tool and publicly files the assessment; and (2) notifies all applicants than an automated decision tool will be used and provides the applicant with certain disclosures related to the automated decision tool. If passed, the law will go into immediate effect.

S7592

Introduced on July 7, 2023, S7592 (assembly version A7904), would amend election law to require that any political communication, that uses an image or video footage that was generated in whole or in part with the use of artificial intelligence, disclose that artificial intelligence was used in such communication.

A8158

Introduced on October 16, 2023, A8158 (senate version S7847), requires that every newspaper, magazine or other publication printed or electronically published in this state, which contains the use of generative artificial intelligence or other information communication technology, identify that certain parts of such newspaper, magazine, or publication were composed through the use of artificial intelligence or other information communication technology.

S8214

Introduced on January 12, 2024, S8214, requires the registration with the Department of State of certain companies whose (i) primary business purpose is related to artificial intelligence as evidenced by their North American Industry Classification System (NAICS) Code of 541512, 334220, or 511210, and (ii) who reside in New York or sell their products or services in New York. The fee for registration is $200. Failure to register can result in a fine of up to ten

thousand dollars. Companies that knowingly fail to register may be barred from operating or selling their AI products or services in the state for a period of up to ten years.

S6638

S6638 (assembly version A7106), reintroduced in 2025 as S2414, the Political Artificial Intelligence Disclaimer (PAID) Act, would amend election and legislative law in relation to the use and disclosure of synthetic media. The act would add a subdivision to the election law that requires any political communication which was produced by synthetic media to be disclosed via printed or digital communications. The disclosure must read “This political communication was created with the assistance of artificial intelligence.” If passed, the act would take effect on January 1, 2024.

S7422 and A7634

S7422, introduced on May 24, 2023 and A7634, introduced on May 25, 2023, would prohibit film production companies who apply for Empire State film production credit from using synthetic media in any component of production that would displace a natural person from that role. This includes any form of media, such as text, image, video, or sound that is created or modified by use of artificial intelligence. Compliance with this act would be a condition for granting of the credit. If passed, the act would take effect immediately.

Failed

HB1320

Introduced on January 21, 2025, HB 1320 prohibits the use of deepfake videos and images, which is defined as any media digitally altered or created by AI with the intent to deceive. Failed.

Proposed

SB217

Introduced on January 24, 2024, SB 217 would require AI-generated products have a watermark, prohibit removing such a watermark, prohibit simulated child pornography, and prohibit identity fraud using a replica of a person. Provides for injunctive relief and, for unauthorized removal of an AI watermark, a civil penalty of up to $10,000.

SB328

Introduced on November 14, 2024, SB 328 (reintroduced as SB79 on February 6, 2025) amends sections of the Revised Code to regulate the use of pricing algorithms, where pricing algorithm means any computational process, including ones derived from machine learning or AI techniques, that processes data to recommend or set a price or commercial term. No effective date.

Proposed

HB1915

Introduced on February 4, 2025, HB 1915 mandates that AI devices in healthcare be deployed and utilized in accordance with certain regulations, requires exclusive use by qualified end-user, and directs deployers to implement Quality Assurance Program, etc. Effective on November 1, 2025.

HB1916

Introduced on February 3, 2025, HB 1916 creates the Responsible Deployment of AI Systems Act, which 1) directs AI systems to comply with existing laws, 2) requires deployers to classify AI systems,3) requires deployers to conduct assessments of AI systems, 4) notifies individuals when high-risk AI system influences certain decisions, 5) requires implementation of protocols, 6) requires annual performance report, 7) directs the AI Council to analyze feedback & make annual recommendations, and 8) provides for penalties. Would become effective on November 1, 2025.

HB1917 and HB1899

Both introduced on February 3, 2025, HB 1917 and HB 1899 create the Artificial Intelligence Act of 2025. The bill does not modify existing statutes but creates a standalone piece of legislation. It does not contain any details about how the bill will regulate AI but serves as a preliminary legislative action to recognize and regulate AI technologies at the state level. Effective on November 1, 2025.

HB1537

Introduced on January 16, 2025, HB 1537 provides that a sports wagering operator cannot use AI to track the wagers of an individual, create an offer or promotion targeting a specific person, or create a gambling product like a microbet.

SB546

Introduced on January 13, 2025, SB 546 allows a consumer to exercise their consumer rights by opting out of the processing of the personal data for the purpose of profiling in furtherance of a decision that produces a decision affecting the customer.

SB894

Introduced on January 16, 2025, SB 894 prohibits using a knowing deepfake of a candidate or political party within 90 days of an election, unless there is a conspicuous disclaimer stating that the image has been generated by AI. Effective on November 1, 2025.

SB885

Introduced on January 16, 2025, SB 885 prohibits social media platforms from using an algorithm, AI, machine learning, or other technology to select, recommend, rank, or personalize content for a minor user based on the user’s profile/ other data from their online activity. Effective on November 1, 2025.

SB611

Introduced on January 14, 2025, SB 611 amends the current Oklahoma Statute to mandate that government, or businesses cannot use AI and biotech applications to determine who will live or die in any situation, receive medical care, or receive insurance coverage/ determine the amount of the coverage. Effective upon its passage and approval.

Failed

HB3835

Introduced on February 5, 2024, HB 3835, the Ethical Artificial Intelligence Act would:

direct deployers of automated decision tools to complete and document certain impact assessments;
direct developers of automated decision tools to complete and document certain impact assessment;
direct deployers and developers to make impact assessment of certain updates;
mandate that developers and deployers provide certain impact assessment to the office of the attorney general;
require developer provide certain documentation to deployer;
require developer make certain information publicly available;
prohibit deployers from algorithmic discrimination.

The act would be enforced by the attorney general. A violation of the act would be an unfair or deceptive act in trade or commerce for the purpose of applying the Oklahoma Consumer Protection Act. Harmed parties may bring a civil action.

If passed, the act would take effect November 1, 2024.

HB3577

Introduced on February 5, 2024, HB3577, the Artificial Intelligence Utilization Review Act would:

Require health insurers to disclose the use of AI algorithms;
Require health insurers to submit AI systems to Oklahoma Department of Insurance for review;

A violation shall be deemed to be an unfair method of competition and an unfair or deceptive act or practice. Civil penalties between $5,000 and $10,000.

If passed, the act would take effect November 1, 2024.

HB3453

Introduced on February 5, 2024, HB 3453, the Oklahoma Artificial Intelligence Bill of Rights would give Oklahoma residents the following rights:

The right to know when they are interacting with an artificial intelligence engine rather than a real person;
The right to know when their data is being used in an artificial intelligence model and the right to opt-out;
The right to know when contracts and other documents that they are relying on were generated by an artificial intelligence engine rather than a real person;
The right to know when they are consuming images or text that were generated entirely by an artificial intelligence engine and not reviewed by a human;
The right to be able to rely on a watermark or some other form of content credentials to verify the authenticity of creative product they generate or consume. Specifically, it shall not be permissible for any websites, social media platforms, search engines, and the like, to remove a watermark or content credential without inserting an updated credential that indicates that the original was removed or altered.
The right to know that any company which includes any of their data in an artificial intelligence model has implemented industry best practice security measures for data privacy, and conducts at least annual risk assessments to assess design, operational and discrimination harm.
The right to approve any derivative media that is generated by an artificial intelligence engine and uses audio recordings of their voice or images of them to recreate their likeness.
The right to not be subject to algorithmic or model bias which discriminates based on age, race, national origin, sex, disability, pregnancy, religious beliefs, veteran status, or any other legally protected classification.

If passed, the act would take effect November 1, 2024.

Enacted

SB619

On August 1, 2023, Oregon passed SB619, the state’s first omnibus consumer privacy law. The bill generally follows the Virginia Consumer Data Protection Act and sets out rules for profiling and automated decision-making. Specifically, the bill enables individuals to opt-out of processing for the purpose of “profiling the consumer to support decisions that produce legal effects or effects of similar significant significance.” Profiling is defined as “an automated processing of personal data for the purpose of evaluating, analyzing or predicting an identified or identifiable consumer’s economic circumstances, health, personal preferences, interests, reliability, behavior, location or movements.” Controllers must also perform a data protection assessment for high-risk profiling activities. The law goes into effect on July 1, 2024.

Proposed

HB78

Introduced on January 14, 2025, HB 78 enacts the Consumer Data Privacy Act, and gives the consumer the right to opt out of the processing of the consumer’s personal data for the purpose of profiling. Effective in six months.

HB2660

Under both HB 2660 and HB 317, individuals who create or distribute AI-generated content must place a water mark of 50% opacity on 30% of the content. The watermark must include the statement: “Artificial Intelligence Generated Material.” Film or television productions are exempt if AI is used for visual effects without involving the use of an individual or if the individual has provided written consent for their likeness to be used. Violating this requirement is a second-degree misdemeanor and the first offense will result in a $1000 fine, while the second or subsequent offense within five years will result in a $10,000 fine.

HB95

Under HB 95, introduced on January 14, 2025, it is considered an unfair or deceptive act to knowingly or recklessly create, distribute, or publish AI-generated content without a clear and conspicuous disclosure. The disclosure must state that the content was generated using AI and be presented in a way that is understandable and noticeable to the average consumer. The disclosure must be 1) displayed in the first instance when the content is presented to the consumer, 2) presented in the same medium as the content, 3) readily noticeable and understandable, 4) not contradictory or inconsistent, and 5) presented in the same medium as the content. Effective within 60 days of its passage.

HB431

Under HB 431, introduced on January 31, 2025, an individual is guilty of unauthorized dissemination if they knowingly or recklessly distribute an artificially generated impersonation of an individual without their consent. This offense is a first-degree misdemeanor and is considered a third-degree felony if committed with the intent to defraud or injure the other person. Consent from the depicted person and law enforcement officers performing their official duties are exempted from prosecution under this bill. This bill is applicable if the victim or the offender is located within Pennsylvania. Effective in 90 days after its passage.

HB518

HB 518, introduced on February 5, 2025, aims to modify the definitions of “unfair methods of competition” and “unfair or deceptive acts or practices” to include failing to comply with the terms of a written guarantee, warranty, or policy generated by consumer-facing AI used by a business, and also engaging in any other fraudulent or deceptive behavior that creates a likelihood of confusion or misunderstanding. Effective in 60 days after its passage.

Failed

HB49

Introduced on March 7, 2023, HB49, would direct the Department of State to establish a registry of businesses operating artificial intelligence systems in the State. The registry would include (1) The name of the business operating artificial intelligence systems; (2) The IP address of the business; (3) The type of code the business is utilizing for artificial intelligence; (4) The intent of the software being utilized; (5) The personal information and first and last name of a contact person at the business; (6) The address, electronic email address and ten-digit telephone number of the contact person; and (7) A signed statement indicating that the business operating an artificial intelligence system has agreed for the Department of State to store the business's information on the registry. There has been no further action on HB49 since March 7, 2023.

HB708

Introduced on March 27, 2023, HB708, would establish an omnibus consumer privacy law along the lines of those enacted in states like Virginia. Among its requirements, the bill provides consumers with the right to opt-out of the processing of their personal data for purposes of “profiling in furtherance of decisions that produce legal or similarly significant effects concerning the consumer.” Profiling is defined as a “form of automated processing performed on personal data to evaluate, analyze or predict personal aspects related to an identified or identifiable natural person's economic situation, health, personal preferences, interests, reliability, behavior, location or movements.” The bill also mandates the performance of data protection assessments in connection with “profiling” where the profiling presents “a reasonably foreseeable risk of: (i) discriminatory, unfair or deceptive treatment of, or unlawful disparate impact on, consumers; (ii) financial, physical or reputational injury to consumers; (iii) a physical or other intrusion upon the solitude or seclusion, or the private affairs or concerns, of consumers, where the intrusion would be offensive to a reasonable person; or (iv) other substantial injury to consumers.”

If passed, the act would go into effect in 18 months. There has been no further action taken on HB708 since March 27, 2023.

HB1201

Introduced on December 13, 2023, HB 1201 appears similar to HB 708 (above) in that it would establish an omnibus consumer privacy law. It provides consumers with the right to “Opt out of the processing of the consumer's personal data for the purpose of any of the following: (i) Targeted advertising; (ii) The sale of personal data, except as provided under section 5(b); and (iii) Profiling in furtherance of solely automated decisions that produce legal or similarly significant effects concerning the consumer.” “Profiling” is defined as “Any form of automated processing performed on personal data to evaluate, analyze or predict personal aspects related to an identified or identifiable individual's economic situation, health, personal preferences, interests, reliability, behavior, location or movements.” The bill would mandate data protection impact assessments where “the profiling presents a reasonably foreseeable risk of any of the following: (i) Unfair or deceptive treatment of, or an unlawful disparate impact on, a consumer.

(ii) Financial, physical or reputational injury to a consumer. (iii) A physical or other intrusion upon the solitude or seclusion of a consumer or the private affairs or concerns of a consumer where the intrusion would be offensive to a reasonable person. (iv) Any other substantial injury to a consumer.”

If passed, the act will take effect in 6 months.

HB1947

Introduced on January 9, 2024, HB 1947 appears similar to HB 708 and HB 1201 (above) in that it would establish an omnibus consumer privacy law. It provides consumers with the right to “Decline or opt out of the processing of the consumer's personal information for the purpose of any of the following: (i) Targeted advertising. (ii) The sale of personal information. (iii) Profiling in furtherance of decisions that produce legal or similarly significant effects concerning a consumer.” “Profiling” is defined as “A form of automated processing of personal information to evaluate, analyze or predict personal aspects concerning an identified individual or identifiable individual, including the individual's economic situation, health, personal preferences, interests, reliability, behavior, location or movements.” A Data Protection Impact Assessment is not specifically mentioned in this bill.

If passed, the act will take effect in 1 year.

HB1663

Introduced on September 7, 2023, HB 1663 would require disclosure by health insurers of the use of artificial intelligence-based algorithms in the utilization review process. Requirements would include:

Disclose to clinicians, subscribers, and the public that claims evaluations use AI algorithms
Define ‘Algorithms used in claims review’ as clinical review criteria and therefore ensure they are subject to existing laws and regulations that such criteria be grounded in clinical evidence
Require specialized health care professionals who review claims for health insurance companies and rely on initial AI algorithms for such reviews to individually open each clinical record or clinical data, examine this information, and document both their own review and reason for denial before any decision to deny a claim is conveyed to a subscriber or health care provider.
Require health insurance companies to submit their AI-based algorithms and training datasets to the Pennsylvania Department of Insurance for transparency and require the Department of Insurance to certify that said algorithms and training data sets have minimized the risk of bias based on categories outlined in the Human Relations Act and other anti-discrimination statutes as applicable to health insurance in Pennsylvania and adhere to evidence-based clinical guidelines.

If passed, the act will take effect in 60 days. No further action has been taken on HB 1663 since September 7, 2023.

SB1044

PA SB1044, introduced May 16, 2024, proposes amendments to the Unfair Trade Practices and Consumer Protection Law that address the creation, distribution, or publication of AI-generated content. A disclosure would be required that clearly states that the content was AI-generated. The amendments would exempt owners, agents, or employees of radio or television stations, ISPs, newspapers, and other publications that, in good faith, acted without knowledge that the content was AI-generated.

HB1598

Introduced on August 7, 2023, HB 1598 would amend the Unfair Trade Practices and Consumer Protection Law to expand the definition of an unfair trade practice to include “creating, distributing or publishing any content generated by artificial intelligence without clear and conspicuous disclosure, including written text, images, audio and video content and other forms of media.”

If passed, the act will take effect in 60 days.

Proposed

H5224

Introduced on February 7, 2025, H5224 provides a cause of action in AI cases—developers of covered models or covered model derivatives are strictly liable for all injuries to a non-user of the covered model that satisfy the harm element of a negligence claim, if causation and foreseeability elements are met. Effective upon passage.

S13 and H5172

Introduced on January 23 and 24, 2025, S13 and H5172 both amend Title 27 of the General Laws to add the Transparency and Accountability in Artificial Intelligence Use by Health Insurers to Manage Coverage and Claims Act. The bill aims to regulate the use of AI by health insurers to ensure transparency, accountability, and compliance with state and federal requirements for claims and coverage management. Under the bill, insurers must publicly disclose how they use AI to manage claims and coverage, and maintain documentation of AI decision for at least five years. Additionally, enrollees and healthcare providers must receive notice when AI is used to issue an adverse determination, along with a clear process for appealing such determination. To increase accountability in the use of AI in insurance coverage and claims management, the bill also provides that insurers cannot rely exclusively on AI to deny, reduce, or alter coverage or claims for medically necessary care, and that adverse determinations must be reviewed by human healthcare professionals. Effective upon passage.

Failed

H7521

RI H7521, introduced February 7, 2024, seeks to regulate automated decision tools and artificial intelligence by requiring regular impact assessments to measure the purpose, outputs, safeguards, and adverse impacts of such technologies. The bill would require that individuals subject to such automated decisions be notified that the consequential decisions were made using automated tools and/or AI. It also prohibits discrimination and allows civil actions against developers and deployers for such discrimination.

Committee recommended that the measure be held for further study.

S2888

S2888, entitled “Automated Decision Tools” and introduced on March 22, 2024, would require companies developing or deploying high-risk AI systems to conduct impact assessment and adopt risk management programs. Deployers would be required to implement and maintain risk management programs that identify, mitigate, and document risks associated with “consequential artificial intelligence decision systems” (CAIDS) before deployment. Developers would be obligated to provide deployers with information related to impact assessments, including the capabilities and limitations of CAIDS.

Committee recommended that the measure be held for further study.

SB146

Introduced on February 1, 2023, SB146, would prohibit certain uses of automated decision systems and algorithmic operations in connection with video-lottery terminals and sports betting applications. The law would take effect upon passage. The law was not accepted prior to the end of the legislative session in June 2023.

HB6236

Introduced on March 30, 2023, HB6236, the Rhode Island Data Transparency And Privacy Protection Act, would establish an omnibus consumer privacy law along the lines of those enacted in states like Virginia. Among its requirements, the bill provides consumers with the right to opt-out of the processing of their personal data for purposes of “profiling in furtherance of solely automated decisions that produce legal or similarly significant effects concerning the customer.” Profiling is defined as “any form of automated processing performed on personal data to evaluate, analyze or predict personal aspects related to an identified or identifiable individual's economic situation, health, personal preferences, interests, reliability, behavior, location or movements.” The bill also mandates the performance of data protection assessments in connection with “profiling” where the profiling presents “a reasonably foreseeable risk of unfair or deceptive treatment of, or unlawful disparate impact on, customers, financial, physical or reputational injury to customers, a physical or other intrusion upon the solitude or seclusion, or the private affairs or concerns, of customers, where such intrusion would be offensive to a reasonable person, or other substantial injury to customers[.]” The law was not accepted prior to the end of the legislative session in June 2023.

H6286

Introduced on April 19, 2023, H6286, would regulate companies’ uses of generative artificial intelligence models. Any company using large-scale generative AI may not use AI for discriminatory practices. The AI model must be programmed to generate text with a distinctive watermark to prevent plagiarism. The company must implement reasonable security measures to protect the data of individuals used to train the model, and the company must obtain informed consent from these individuals before using their data. The company must also conduct regular risk assessments of potential risks and harms related to their services. Within 90 days of the effective date of this act, any company using large-scale generative AI must register the name of the company, description of the AI model, and information on the company’s data gathering practices with the attorney general.

Proposed

SB268

Introduced on January 28, 2025, SB 268 aims to protect minors by regulating how online services handle minors’ personal data and design features. Under this bill, online services must exercise care in using minors’ personal data and designing features to prevent harms such as compulsive usage, psychological harm, and identity theft. Online services can only collect the minimum amount of personal data necessary and restrict its use to that specific purpose. The bill also prohibits sending push notifications to minors during specific hours and restrict profiling of minors unless necessary and with appropriate safeguards. For the minors and their parents, the bill provides tools for the minors to limit communication, control data visibility, opt-out features, and manage in-app purchases. The bill also offers parents tools to manage account settings, restrict purchases, and monitor their children’s usage. The state’s Attorney General is responsible for enforcing this bill, and online services may be liable for financial damages for violations, while officers and employees may be held personally liable for willful violations. Effective upon approval by the Governor.

HB3402

Introduced on December 5, 2024, HB 3402 provides that a covered entity that provides an online service, product, or feature reasonably likely to be accessed by children cannot profile a child by default unless it can demonstrate that appropriate safeguards are in place, profiling is necessary, and a compelling reason exists for the profiling. Effective upon approval by the Governor.

Failed

SB404

Introduced on January 18, 2023, SB404, would prohibit any operator of a website, an online service, or an online or mobile application, including any social media platform, to utilize an automated decision system (ADS) for content placement, including feeds, posts, advertisements, or product offerings, for a user under the age of eighteen. In addition, an operator that utilizes an ADS for content placement for residents of South Carolina who are eighteen years or older shall perform an age verification through an independent, third-party age-verification service, unless the operator employs the bill’s prescribed protections to ensure age verification. The bill includes a private right of action.

H4696

Introduced on January 9, 2024, H4696 would create a consumer data privacy law in South Carolina similar to those in states like Virginia. Among other requirements, controllers must honor verifiable consumer requests to opt-out of “profiling in furtherance of a decision that produces a legal or similarly significant effect concerning a consumer.” Controllers also must conduct a data protection impact assessment for “ the processing of personal data for purposes of profiling if the profiling presents a reasonably foreseeable risk of: (a) unfair or deceptive treatment of or unlawful disparate impact on consumers; (b) financial, physical, or reputational injury to consumers; (c) a physical or other intrusion on the solitude or seclusion, or the private affairs or concerns, of consumers, if the intrusion would be offensive to a reasonable person; or (d) other substantial injury to consumers.”

"Profiling" means “any form of solely automated processing performed on personal data to evaluate, analyze, or predict personal aspects related to an identified or identifiable individual's economic situation, health, personal preferences, interests, reliability, behavior, location, or movements.” If passed, the act would take effect immediately.

H4660

Introduced on January 9, 2024, H4660 would require that “a person, corporation, committee, or other entity shall not, within ninety days of an election at which a candidate for elective office will appear on the ballot, distribute a synthetic media message that the person, corporation, committee, or other entity knows or should have known is a deceptive and fraudulent deepfake of a candidate on the ballot.”

If passed, the act would take effect immediately.

H4842

Introduced on January 16, 2024, H4842, the South Carolina Age-Appropriate Design Code Act would apply to any business operating in South Carolina that either: “(i) has annual gross revenues more than twenty-five million dollars, as adjusted every odd-numbered year to reflect the Consumer Price Index; (ii) alone or in combination, annually buys, receives for the covered entity's commercial purposes, sells, or shares for commercial purposes, alone or in combination, the personal data of fifty thousand or more consumers, households, or devices; or (iii) derives fifty percent or more of its annual revenues from selling consumers' personal data.”

Covered entities would be prohibited from “profiling” children under age 18 by default unless both of the following criteria are met: “ (a) the covered entity can demonstrate it has appropriate safeguards in place to ensure that profiling is consistent with the best interests of children reasonably likely to access the online service, product, or feature; and (b) either of the following is true: (i) profiling is necessary to provide the online service, product, or feature requested and only with respect to the aspects of the online service, product, or feature with which a child is actively and knowingly engaged; or (ii) the covered entity can demonstrate a compelling reason that profiling is in the best interests of children.”

“Profiling” means “any form of automated processing of personal data to evaluate, analyze, or predict personal aspects concerning an identified or identifiable natural person’s economic situation, health, personal preferences, interests, reliability, behavior, location, or movements. ‘Profiling’ does not include the processing of information that does not result in an assessment or judgment about a natural person.”

Enacted.

HB1181

Effective July 1, 2024, HB1181, the Tennessee Information Protection Act, establishes an omnibus consumer privacy law along the lines of those enacted in states like Virginia. Among its requirements, the bill mandates the performance of data protection assessments in connection with “profiling” where the profiling presents a reasonably foreseeable risk of: (A) Unfair or deceptive treatment of, or unlawful disparate impact on, consumers; (B) Financial, physical, or reputational injury to consumers; (C) A physical or other intrusion upon the solitude or seclusion, or the private affairs or concerns, of consumers, where the intrusion would be offensive to a reasonable person; or (D) Other substantial injury to consumers. "Profiling" is defined as “a form of automated processing performed on personal information to evaluate, analyze, or predict personal aspects related to an identified or identifiable natural person's economic situation, health, personal preferences, interests, reliability, behavior, location, or movements[.]” The law gives the Tennessee Attorney General’s Office authority to impose civil penalties on companies who violate the law.

ELVIS Act

The Ensuring Likeness Voice and Image Security Act (“ELVIS Act”) was signed into law on March 21, 2024. The Act protects voices of songwriters, performers, and celebrities from artificial intelligence and deepfakes by prohibiting the use of AI to mimic a person’s voice without their permission, and treats violations as Class A misdemeanors. The Act also authorizes civil action against any person who violates the law. The Act becomes effective July 1, 2024.

Proposed

TRAIGA

The Texas Responsible AI Governance Act (“TRAIGA”) was introduced by Rep. Capriglione on December 23, 2024. Rep. Capriglione has had prior success with privacy-related bills in Texas, such as the Texas Data Privacy and Security Act, and worked with industry stakeholders to draft TRAIGA. If passed, TRAIGA would amend the Texas Data Privacy and Security Act to establish risk-based obligations in connection with the use of AI systems.

A “high-risk artificial intelligence system” is defined as any AI system that, when deployed, makes, or contributes to making, a consequential decision. “Consequential decisions” are decisions that have a material legal or similarly significant effect on the consumer, such as those relating to criminal case assessments, education enrollment, financial services, electricity services, food, healthcare services, housing, and other similarly important considerations. “Algorithmic discrimination” is defined as any unlawful differential treatment or impact that disfavors an individual or group based on their actual or perceived age, color, disability, ethnicity, genetic information, national origin, race, religion, sex, veteran status, or other protected classifications. TRAIGA would also establish an AI Council in Texas.

TRAIGA would require developers of “high-risk artificial intelligence systems” to exercise reasonable care to protect consumers from any known or reasonably foreseeable risks of algorithmic discrimination arising from the intended and contracted uses of the system. Developers would also be required to provide a risk assessment to any deployers of the system, describing how the system should be used, any known limitations, and any reasonably foreseeable risks associated with its use, among other factors. Deployers of these systems would also be required to independently prepare a separate risk assessment of the system.

TRAIGA would impose additional obligations, including requirements to: (i) limit the risk that a high-risk AI system could be used to circumvent informed decision-making; (ii) prohibit the use of the system for social scoring; (iii) prohibit the collection of biometric identifiers in certain instances; (iv) prohibit emotion recognition without a consumer’s consent; and (v) prohibit the development of sexually explicit media.

Consumers would be required to be notified about the use of high-risk AI systems, both by the developer and the deployer, depending on the circumstances and the consumer's relationship with the deployer. In general, consumers must be notified of the system's use prior to interacting with it. This notification must include a description of the system's purpose, the fact that the system may or will make a consequential decision affecting the consumer, the nature of any consequential decisions in which the system may be a contributing factor, the factors used in making those decisions, contact information for the deployer, a statement regarding any human or automated components of the system, and a declaration of consumer rights under Section 551.107 (e.g., the right to seek declaratory or injunctive relief, as described below).

The deployer or developer would also be required to notify relevant state regulators (e.g., the state Attorney General, the AI Council created under TRAIGA, or the relevant state regulator for the industry) and affected consumers “as soon as practicable, but no later than the 10th day” after discovering that a high-risk AI system has caused or is likely to cause: (1) algorithmic discrimination of an individual or group, or (2) an inappropriate or discriminatory consequential decision. If the developer discovers or is made aware that a deployed high-risk AI system is using inputs or producing outputs that violate TRAIGA, the deployer must cease operating the system as soon as technically feasible and notify the AI Council and the Texas Attorney General as soon as practicable, but no later than 10 days after discovering the violation.

Enforcement would be handled by the Texas Attorney General, who would be authorized to bring civil actions against the developer and/or deployer to recover reasonable attorney’s fees and other reasonable expenses. The Attorney General could also impose a fine of between $5,000 and $10,000 per uncured violation. If a violation cannot be cured, the Attorney General may impose an administrative fine of between $40,000 and $100,000 per violation. As currently drafted, there would be a 30-day cure period from the notification of any alleged violation of the Act. Any developer or deployer who continues to operate in violation of the Act would be subject to a fine of $1,000 to $20,000 per day.

TRAIGA also authorizes consumers to seek declaratory relief (with the ability to recover reasonable attorneys’ fees) or injunctive relief against any deployer or developer who violates the Act.

TRAIGA would establish an “AI Regulatory Sandbox Program” for participating AI developers to test AI systems under a statutory exemption from TRAIGA’s general restrictions. Additionally, there is an exemption for AI developers who release their systems under a free and open-source license in certain circumstances.

Enacted

HB4

Introduced on February 16, 2023, HB4, the Texas Data Privacy and Security Act, is based on the Virginia Consumer Data Protection Act. Once effective, the law will create similar requirements enabling individuals to opt-out of “profiling” that produces a legal or similarly significant effect concerning the individual. Controllers must also perform a data protection assessment for high-risk profiling activities. The Act goes into force on July 1, 2024.

Failed

HB4695

Introduced on March 10, 2023, HB4695, would prohibit the use of artificial intelligence technology to provide counseling, therapy, or other mental health services unless (1) the artificial intelligence technology application through which the services are provided is an application approved by the commission; and (2) the person providing the services is a licensed mental health professional or a person that makes a licensed mental health professional available at all times to each person who receives services through the artificial intelligence technology. The artificial intelligence technology must undergo testing and approval by the, Texas Health and Human Services Commission, the results of which will be made publicly available. If passed, the law would take effect September 1, 2023.

Enacted

SB149

Signed into law on March 13, 2024, SB149 requires covered businesses to “clearly and conspicuously” disclose to a consumer that they are interacting with “generative artificial intelligence and not a human.” “Generative artificial intelligence” refers to “an artificial system that: i) is trained on data; ii) interacts with a person using text, audio, or visual communication; and iii) generates non-scripted outputs similar to outputs created by a human, with limited or no human oversight.” The Act applies to any “person” in a “regulated occupation” (i.e., occupations that require a person to obtain a license or state certificate), and any person regulated by the Utah Consumer Protection Division that uses generative artificial intelligence (though the disclosures obligations differ).

The Act requires that individuals be informed about the use of generative artificial intelligence in the following instances: individuals interacting with a generative artificial intelligence system, when that system is being provided by a “person” in a “regulated occupation”; and “if asked or prompted by the person” who is interacting with the system for acts governed by Utah Code 13-2-1, which include sales, charitable activities, interactions with consumers, online activities, and similar commercial activities. Put another way, persons in a regulated occupation are required to disclose the use of a generative artificial intelligence system in most instances where a third person interacts with the system, while other persons regulated by the Consumer Protection Division are only required to disclose the use of such a system when asked by a third person about whether the system is a human or not.

Such disclosures must be provided verbally, at the start of an oral exchange or conversation, and through electronic messaging before a written exchange.

The Act also creates the Office of Artificial Intelligence Policy to propose implementing rules and administer the Artificial Intelligence Learning Laboratory Program. Participants in the Learning Laboratory must meet certain eligibility criteria (e.g., technical expertise, financial resources, and effective plans to monitor and mitigate risks associated with generative artificial intelligence) and will work with the Office and will be able to apply for “regulatory mitigation” under an agreement with the Office to govern their use of artificial intelligence. These mitigations include, for instance, reduced civil fines during participation in the program, limits on when restitution may be required to the individual interacting with the system, and terms and conditions related to any cure period before penalties may be assessed.

Failure to comply with the bill would result in a civil penalty of no more than $2,500 per violation. The Utah Attorney General may also seek $5,000 per violation from any person who violates an administrative or court order relating to the use of generative artificial intelligence. Note that it is not a defense that the generative artificial intelligence made the violation, such as a violative statement, violative act, or in furtherance of any other violation of the Act.

The Act became effective May 1, 2024.

Proposed

H710

Introduced on January 9, 2024, H.710 would put in place certain obligations for both developers and deployers of “high-risk artificial intelligence system.” For developers, these obligations would include, among others, using reasonable care to avoid any risk of algorithmic discrimination that is a reasonably foreseeable consequence of developing or modifying a high-risk system to make consequential decisions. Developers would also be required to provide disclosures relating to the system, such as disclosures about the known limitations of the system and foreseeable risks of algorithmic discrimination, a summary of the type of data to be processed, the purpose of processing, mitigation measures put in place to limit identified risks, and other similar information necessary to conduct a risk assessment. Similar obligations would apply to developers of generative artificial intelligence.

Deployers would be required to use reasonably care to avoid any risk of algorithmic discrimination that is a reasonably foreseeable consequence of deploying or using a high-risk artificial intelligence system. High-risk systems may only be used to the extent that the deployer has already implemented a risk management policy that is at least as stringent as the Artificial Intelligence Risk Management Framework published through NIST and the deployer has conducted a risk assessment for the system.

Search engines and social media platforms knowingly using, or which reasonably believes that it is using, synthetic digital content would also be required to provide consumers with a signal indicating that the content was produced, or is reasonably believed to have been produced, by generative artificial intelligence.

Failure to comply with the Act would be treated as an unfair and deceptive act in trade and commerce in violation of 9 VSA 2453. The Attorney General may provide a cure period at its discretion. The Act would take effect on July 1, 2024.

H711

Introduced on January 9, 2024, H.711 would create an oversight and enforcement agency to collect and review risk assessments taken in connection with the use of high-risk artificial intelligence systems. The Act would require each deployer of “inherently dangerous artificial intelligence systems” to submit a risk assessment prior to deploying such a system and every two years thereafter, as well as submit a new risk assessment in case material and substantial changes are made to the system. Deployers would also be required to submit a 1-, 6-, and 12-month testing results to the Division of Artificial Intelligence showing the reliability of the results generated by the systems, as well as variances and mitigation measures put in place to limit risks posed by the use of such systems.

The Act would also create a duty for deployers and developers to meet a certain standard of care for the use of any inherently dangerous artificial intelligence systems that “could be reasonably expected to impact consumers.” The Act would also prohibit the deployment of inherently dangerous artificial intelligence systems that pose disproportionate risks unless those risks are evaluated and validated against the Artificial Intelligence Risk Management Framework published by NIST.

Violations of the Act would be treated as an unfair practice in commerce. The Act would also create a private right of action for consumers harmed by a violation of the chapter. The Act would take effect July 1, 2024.

Failed

H114

Introduced on January 25, 2023, H114, would restrict the use of electronic monitoring of employees and the use of automated decision systems (ADSs) for employment-related decisions. Electronic monitoring of employees may only be conducted when, for example, the monitoring is used to ensure compliance with applicable employment or labor laws or to protect employee safety, and certain notice is given to employees 15 days prior to commencement of the monitoring. ADSs must also meet a number of requirements, including corroboration of system outputs by human oversight of the employee and creation of a written impact assessment prior to using the ADS. The law was not accepted prior to the end of the legislative session in May 2023.

Proposed

HB2094

Passed on February 20, 2025, HB 2094, the High-Risk Artificial Intelligence Developer and Deployer Act, prohibits developers of “high-risk artificial intelligence systems” from offering, selling, leasing, giving, or otherwise providing to a third party to deploy any artificial intelligence unless they provide the developers with sufficient information to perform a risk assessment on the use of the system through a documentation detailing the potential risks and benefits of using the system, the purpose of the system, how the system was evaluated for performance, and the measures taken to mitigate reasonable foreseeable risks of algorithmic discrimination that the developer knows arises from use of such system, as well as a statement disclosing the intended uses of that system. Similar obligations apply to developers of generative artificial intelligence.

The Act also requires deployers of artificial intelligence to take reasonable care to avoid any risk of reasonably foreseeable "algorithmic discrimination” and may only use the high-risk artificial intelligence system to make “consequential decisions” if the deployer has designed and implemented a risk management policy and impact assessment for the use of that program. The Act also specifies the elements that must be included in a impact assessment, which includes, among other considerations, the purpose and intended uses of the system and whether the deployment of the system poses and known or foreseeable risks of algorithmic discrimination, including the nature of such algorithmic discrimination and steps taken to mitigate the risk. Developers or deployers or such systems must keep record of impact assessments for at least three years following the final deployment of the system.

Moreover, a deployer or developer that has deployed a high-risk artificial intelligence system to interact with consumers, the deployer must disclose to the consumer that it is interacting with an artificial intelligence system, in addition to the purpose and nature of the system, the nature of the consequential decision, and descriptions of the characteristics and attributes that the system measures or assesses, among other requirements. Where the consequential decision was adverse to such consumer and based on personal data beyond what the consumer directly provided to the deployer, the deployer shall provide a statement regarding the reasons for the decision, an opportunity to correct any inaccuracies in the consumer’s personal data, and an opportunity to appeal such decision.

Failure to comply with the Act can result in civil penalties not to exceed $1,000 plus reasonable attorney fees, expenses, court costs, and willful violations may result in civil penalties between $1,000 and $10,000. The law takes effect July 1, 2026.

HB747

Introduced on January 10, 2024, HB 747, the Artificial Intelligence Developer Act, would prohibit developers of “high-risk artificial intelligence systems” from offering, selling, leasing, giving, or otherwise providing to a third party to deploy any artificial intelligence unless they provide the developers with sufficient information to perform a risk assessment on the use of the system, such as through a document detailing the potential risks and benefits of using the system, as well as a description of the intended uses of that system. Similar obligations would apply to developers of generative artificial intelligence.

The Act would also require deployers of artificial intelligence to take reasonable care to avoid any risk of reasonably foreseeable "algorithmic discrimination” and may only use the high-risk artificial intelligence system to make “consequential decisions” if the deployer has designed and implemented a risk management policy for the use of that program. The Act also specifies the elements that must be included in a risk assessment, which includes, among other considerations, the purpose of processing, a description of transparency measures taken concerning the system, a description of the data used to train the algorithm, and other information.

Failure to comply with the Act would result in civil penalties not to exceed $1,000 plus reasonable attorney fees, expenses, court costs, and willful violations may result in civil penalties between $1,000 and $10,000. The law would take effect July 1, 2026.

Enacted

VA321127

VA ST § 32.1-127, effective July 1, 2025, requires each hospital, nursing home, and certified nursing facility to establish and implement policies to ensure the permissible access to and use of an “intelligent personal assistant” provided by a patient, in accordance with such regulations, while receiving inpatient services. Such policies shall ensure protection of health information in accordance with the requirements of the federal Health Insurance Portability and Accountability Act of 1996.

Under this section, an “intelligent personal assistant” means a combination of an electronic device and a specialized software application designed to assist users with basic tasks using a combination of natural language processing and artificial intelligence, including such combinations known as “digital assistants” or “virtual assistants”.

VCDPA

The Virginia Consumer Data Protection Act (VCDPA), which went into force on January 1, 2023, sets out rules for profiling and automated decision-making. Specifically, the VCDPA enables individuals to opt-out of “profiling in furtherance of decisions that produce legal or similarly significant effects” concerning the consumer, which is generally defined as “the denial and/or provision of financial and lending services, housing, insurance, education enrollment or opportunities, criminal justice, employment opportunities, healthcare services, or access to basic necessities.” Controllers must also perform a data protection impact assessment for high-risk profiling activities.

Failed

SB5643

Introduced on January 31, 2023, and reintroduced on January 8, 2024, SB5643 and its companion HB1616, the People’s Privacy Act, would prohibit a covered entity or Washington governmental entity from operating, installing, or commissioning the operation or installation of equipment incorporating “artificial intelligence-enabled profiling” in any place of public resort, accommodation, assemblage, or amusement, or to use artificial intelligence-enabled profiling to make decisions that produce legal effects (e.g., denial or degradation of consequential services or support, such as financial or lending services, housing, insurance, educational enrollment, criminal justice, employment opportunities, health care services, and access to basic necessities, such as food and water) or similarly significant effects concerning individuals. "Artificial intelligence-enabled profiling" is defined as the “automated or semiautomated process by which the external or internal characteristics of an individual are analyzed to determine, infer, or characterize an individual's state of mind, character, propensities, protected class status, political affiliation, religious beliefs or religious affiliation, immigration status, or employability.” The bill also bans the use of “face recognition” in any place of public resort, accommodation, assemblage, or amusement. “Face recognition” is defined as “(i) An automated or semiautomated process by which an individual is identified or attempted to be identified based on the characteristics of the individual's face; or (ii) an automated or semiautomated process by which the characteristics of an individual's face are analyzed to determine the individual's sentiment, state of mind, or other propensities including, but not limited to, the person's level of dangerousness[.]”

SB6299

Introduced on January 24, 2024, SB6299, would make it unlawful for any employer to utilize artificial intelligence or generative artificial intelligence to evaluate or otherwise make employment decisions regarding current employees without written disclosure of the employer's use of such technology at the time of the employee's initial hire, or within 30 calendar days of the employer starting to use such technology for such purpose.

HB1951

Introduced on December 14, 2023, HB1951, provides that by January 1, 2025, and annually thereafter, a developers and deployers of automated decision tools must complete and document an impact assessment for any automated decision tool the deployer uses, or the developer develops, as specified. "Automated decision tool" means a system or service that uses artificial intelligence and has been specifically developed and marketed to, or specifically modified to, make, or be a controlling factor in making, consequential decisions. Upon the request of the office of the attorney general, a developer or deployer must provide any impact assessment that it performed pursuant to this section to the office of the attorney general. The bill requires certain other public disclosures. The bill also prohibits the use of an automated decision tool that results in algorithmic discrimination.

Failed

HB3498

Introduced on February 14, 2023, HB3498, the Consumer Data Protection Act, would create an omnibus consumer privacy law. The bill generally follows the Virginia Consumer Data Protection Act and sets out rules for profiling and automated decision-making. Specifically, the bill enables individuals to opt-out of the processing of their personal data for the purpose of “profiling in furtherance of decisions that produce legal or similarly significant effects concerning the consumer.” Profiling is defined as “any form of automated processing performed on personal data to evaluate, analyze, or predict personal aspects related to an identified or identifiable natural person’s economic situation, health, personal preferences, interests, reliability, behavior, location, or movements.” Controllers must also perform a data protection assessment for high-risk profiling activities.

Related Practice Areas

Data Privacy & Security

Meet The Team

+1 415 675 3448

+1 303 417 8535

Meet The Team

+1 312 602 5144

+1 415 675 3448

+1 303 417 8535

+1 312 602 5144

Meet The Team

+1 415 675 3448

+1 303 417 8535

+1 312 602 5144

This material is not comprehensive, is for informational purposes only, and is not legal advice. Your use or receipt of this material does not create an attorney-client relationship between us. If you require legal advice, you should consult an attorney regarding your particular circumstances. The choice of a lawyer is an important decision and should not be based solely upon advertisements. This material may be “Attorney Advertising” under the ethics and professional rules of certain jurisdictions. For advertising purposes, St. Louis, Missouri, is designated BCLP’s principal office and Kathrine Dixon (kathrine.dixon@bclplaw.com) as the responsible attorney.