U.S. state legislative bills on AI: a mid-year update

In 2023, state legislatures across the U.S. responded to the growing impact of artificial intelligence (AI) by introducing a substantial number of bills aimed at regulating its development and use by private industry.  To date, forty-three bills have been introduced across twenty-one states that would regulate a businesses’ development or deployment of AI solutions.  Of these, four bills have passed and become law, while twenty-one bills failed to advance in the current legislative session. The remaining eighteen active bills are currently awaiting further action or review by state legislatures.

Enacted Bills

The four enacted bills are omnibus consumer privacy laws (Indiana, Montana, Tennessee, and Texas*) that include AI-related provisions within a broader privacy framework. More broadly, these laws establish guidelines for the collection, use, disclosure of personal data, and confer various data privacy rights to individuals.  This legislation also give individuals the right to opt out of of the use of AI to render an automated decision for certain types of legally significant decisions (e.g. access to employment, housing, or credit).  Though the definitions of automated decision-making and profiling differ slightly across the new laws, automated decision-making generally refers to a decision made by automated means without human intervention or with limited human intervention.  In addition, where automated decision-making takes place, these privacy laws impose requirements and guardrails that are intended to reduce bias. 

Our 2023 State-by-State AI Legislation Snapshot details regulation of AI in private industry, but it is worth noting that states are also looking to regulate the use and procurement of AI by government agencies.  The state of Connecticut was the first to cross the finish line to regulate the state’s use of AI.  SB 1103 was signed into law on June 7, 2023, and although the final bill is less ambitious than what was originally proposed, Connecticut has made a huge step towards the regulation of government AI procurement, and has laid the groundwork for the Connecticut legislature to pass a private sector AI bill next year.

Failed Bills

Twenty-one bills have failed to pass and are unlikely to be revived in the current term. Some sought to address specific AI use cases, such as algorithmic decision-making in hiring. Others would have required transparency in the use of AI-generated content in advertising.  Notable among the failed bills is California’s AB 311, which sought to regulate AI tools “specifically developed and marketed to or specifically modified to, make, or be a controlling factor in making, consequential decisions.” Consequential decisions are those that would impact certain enumerated individual rights and opportunities, such as employment, education, housing, health care or health insurance, and financial services. 

California’s failure to advance a broad AI bill this year could potentially help clear the path for Congress to act to regulate AI without fear of objection from the California Congressional delegation, as has happened with other privacy legislation.  In 2022, the California Congressional delegation played a key role in derailing Congress’ efforts to pass the omnibus American Data Privacy and Protection Act over pre-emption concerns.

Active Bills

Currently, there are eighteen active bills undergoing legislative review. As with the failed bills, they cover a variety of topics, including AI governance, accountability, auditing, and transparency requirements for private sector organizations. Some bills also focus on sector-specific regulation, such as AI deployment in the provision of mental health services, hiring, and insurance underwriting. The fate of these bills will shape the AI compliance landscape, especially as individual industries are subject to specific requirements, which may vary from state to state.

The wave of AI bills introduced in 2023 highlights the continued efforts of states to address the challenges and implications of AI, in the vacuum left by the absence of comprehensive federal legislation on AI.  While only a fraction of these bills have been enacted, their impact on corporate compliance and privacy practices cannot be overlooked.  As AI becomes increasingly integrated into business operations, organizations should proactively assess their AI implementation and risk management protocols, and closely monitor the status of AI-related bills to proactively adapt their practices to remain in compliance.

For up-to-date information on AI legislation in the EEA, please see our EU/UK AI Regulation Tracker.

* HB4, the Texas Data Privacy and Security Act, has not yet been signed into law but is expected to pass.