How States Are Stepping Into AI Regulation

States are taking regulatory action in the absence of federal rules to meet the rapidly changing needs of technology.

This spring, Colorado became the first state to pass a comprehensive AI bill that covers a variety of industries and aspects of AI use. The Colorado law focuses on high-risk AI systems—or those that make “decisions with consequences” that could affect consumers’ ability to apply for jobs, loans, or a variety of other services.

While other states may follow Colorado’s lead and adopt broad legislation, most have taken a more targeted approach to AI regulation, with their efforts focused on regulating specific AI applications and industries.

More than 40 states have introduced AI-related legislation this year, according to the National Conference of State Legislatures. Large states, including California, can set standards that companies across the country can follow to avoid the complexity of complying with multiple regulations. These standards also sometimes serve as models that other states look to when crafting their own legislation.

Below is a detailed look at how countries are approaching AI regulation in light of the exponential growth in innovation and investment in this area over the past two years:

Industry-specific AI regulations

State lawmakers are focusing on industries like health care, insurance and technology, with goals that include protecting patients and eliminating bias and discrimination.

Healthcare: California proposed a bill in February that would require licensed physicians to monitor AI tools used to determine patient treatment. The bill, called SB 1120, was introduced to ensure that AI serves as a tool to augment — but not replace — a doctor’s nuanced understanding of a patient’s medical history and treatment needs.
Insurance: Rhode Island, Louisiana, and New York have introduced bills aimed at preventing biased outcomes in insurance decisions. The New York bill specifically focuses on preventing discrimination when AI helps set insurance rates.
Technology: Some legislative action is aimed at AI developers. For example, California’s SB 1047 would require AI developers to implement several security measures before training their AI models. These include ensuring that their models can be completely and quickly shut down, and developing a process for testing whether their models could launch cyberattacks that would result in significant financial losses.
The California legislature recently passed SB 1047, and the bill now heads to California Governor Gavin Newsom for final approval or veto. If passed, SB 1047 could impact AI laws in states across the country, given the large number of AI companies doing business in California, as well as the state’s ability to set legal precedents.

Regulations aimed at AI applications

State lawmakers are focusing on specific applications of AI, with the most common focuses being content creation, consumer interactions and recruiting.

Content creation: The Tennessee Ensuring Likeness Voice and Image Security (ELVIS) Act, which went into effect July 1, protects an individual’s voice as a personal right for the first time. The law protects recording artists from artificial intelligence-generated voice clones that imitate a musician’s voice and could mislead the public. It updates an existing law that protects an artist’s name, image and likeness.
Consumer interactions: The Utah AI Policy Act (UAIPA), which went into effect May 1, requires companies to inform consumers when they use generative AI tools like chatbots. The UAIPA also creates an office of AI policy to oversee a so-called regulatory sandbox that gives companies up to two years of relaxed regulations while they develop AI systems.
Recruitment: New Jersey proposed a bill earlier this year that would require companies using AI in their hiring process to notify job candidates if AI is evaluating their video interviews. Candidates must be able to opt out of AI-enabled video interviews.

Integrating AI Regulation with Consumer Privacy Laws

In recent years, several states have passed consumer privacy laws that regulate how companies can use automated systems to analyze consumers’ personal data. These laws often cover systems that make decisions using artificial intelligence, even if they don’t mention it explicitly.

For example, the Virginia Consumer Data Protection Act, which went into effect in January 2023, sets rules for profiling — the automated processing of personal data that companies use to make predictions about consumers. Specifically, Virginia law allows consumers to opt out of profiling that could impact their ability to get loans, jobs, housing, and other services.

Oregon’s consumer privacy law, which took effect in July, is based on similar principles to Virginia’s law.

Colorado’s More Comprehensive Approach

This spring, Colorado passed a law aimed at protecting consumers from bias and discrimination in AI systems. The Colorado AI Act, which is set to take effect in 2026, is similar to the EU AI Act, known as the world’s first AI regulation. Both laws are broad and apply to developers and deployers of AI systems used for a variety of purposes.

Like the EU AI Act, the Colorado AI Act focuses on regulating high-risk AI systems. Colorado law defines such systems as those that make “decisions with consequences” about opportunities and services such as loans, health care, and employment.

Colorado law requires developers to document and share information about high-risk AI systems—including misuse—with implementers or other developers. It requires implementers to notify consumers when high-risk AI systems are used to make decisions that could, for example, affect consumers’ ability to get a loan.

The Colorado AI Act’s focus on regulating high-risk AI systems could help other states determine which AI applications to prioritize for regulation. Indeed, while the Colorado AI Act is the first comprehensive state-level AI law, it likely won’t be the last, especially in the absence of federal AI legislation.

***

Further advances in artificial intelligence will continue to transform intellectual property law, regulation, transactions, and other issues.

(See source.)