The AI policy trend that I’m keeping a keen eye on this year is what I’ll refer to as the “comprehensive consumer protection” AI bills. These originated last year with the introduction of Sen. Maroney (D) SB 2 in Connecticut. While that particular bill failed to cross the finish line due to a gubernatorial veto threat, legislation originally modeled off CT SB 2 passed the legislature in Colorado and was (reluctantly?) signed by Gov. Polis (D) into law. Notably, that law (CO SB 205) won’t go into effect until February 2026, giving lawmakers time to make necessary amendments.

We’re closely watching the introductions of anti-bias legislation inspired by last year’s proposed CT SB 2 and enacted CO SB 205, but they’ll only be a fraction of the bills debating in state capitol hearing rooms this year. Those bills attempt to address major consumer interactions with AI by laying out broad fields like employment, financial and legal services, housing, health care, and insurance. But narrower focused bills that target these industries individually or even a subset of known issues with AI and those sectors, are also popular.

California was the first to enact a comprehensive data privacy law and establish an agency to protect consumer data. The California Privacy Protection Agency (CPPA) has been slow to promulgate regulations, last month initiating formal rulemaking to update privacy laws and create new regulations on “automated decision-making technology” — specifically aimed at the emergence of artificial intelligence. These rules could have a broad scope with wide-ranging obligations for businesses that use the emerging technology to facilitate decisions. 

The elections are over, and while some states are still counting the final votes, we have a solid understanding of who will wield political control in each of the states next year. Lawmakers are already prefiling bills as we anticipate a wave of new legislation on artificial intelligence. As the first year of the legislative biennium in most states, 2025 should be very active with first-year lawmakers looking to get in on the action and a typically longer odd-year legislative session calendar.

This week, Texas Rep. Giovanni Capriglione (R) unveiled a draft of his anticipated artificial intelligence legislative proposal for next year’s legislative session, as reported by Austin Jenkins at Pluribus News. Capriglione has tried to position the bill as a more business-friendly model than the law enacted by Colorado and legislation proposed in Connecticut. In fact, this bill is likely a preview of the type of model legislation we’ll see introduced across a dozen states next year developed by a bipartisan group of 200 state lawmakers from 45 states.

While much of the focus on AI this year has been on the newest trend of generative AI, states have also addressed an AI-related legislative trend with more history — autonomous vehicles (AVs). As manufacturers continue testing and deploying AVs on public roads, most states now have laws in place regulating the operation of AVs on their public roads. 

California solidified itself as the leading state in the volume of AI-related laws after Gov. Newsom signed 18 additional AI bills into law in September. However, Newsom vetoed the most high-profile AI bill of the year (CA SB 1047) aimed at the safety of frontier AI models. Let’s take a look at which bills were enacted, which were vetoed, and what it means for AI policy in 2025.

Although state lawmakers introduced over 600 bills relating to AI this year, less than 15% of them became law. While legislators may have a lot of experience in other areas of public policy, artificial intelligence is such a new technology that many need time to educate themselves on the capabilities and risks. With most sessions complete for the year, many state lawmakers are using the summer and fall to study AI through special committees and task forces — 33 states have established groups specifically tasked to study AI or assigned AI to a standing committee.

Lawmakers sent an entire menu of AI-related bills to the governor’s desk for his approval. By our count, Gov. Newsom has 21 bills related to AI sitting on his desk. While SB 1047 has garnered the majority of attention, this week we’re providing an overview of each of the bills that made it out of the legislature this year. Gov. Newsom has until Sep. 30 to decide whether they become law or not. 

The AI industry is nervously monitoring California for what could be a new standard in regulation of the nascent technology. California lawmakers advanced major AI legislation this week, but with changes to address concerns raised by developers. The amendments may smooth the path for legislation to pass before the session adjourns later this month.

Even as most state legislatures have adjourned for the year, AI legislation is still being signed into law. Last Friday, Illinois Governor J.B. Britzker (D) signed four AI bills into law addressing sexual deepfakes, providing protections against a person's image or voice being used without their permission, and placing restrictions on AI used in the hiring process. 

One sticking point that has emerged is how best to define a “developer” of an AI system. AI systems are not exactly static programs, they learn from additional training over time and one advantage is that you can train an AI model on the data specific to your organization — so-called “fine-tuning” the model. But how much additional training or modification of the model would cross the line from a user of a model to a model developer yourself? The handful of bills attempting to regulate the development of AI models can shed some light on this debate.

Earlier this spring, state lawmakers began addressing artificial intelligence in public policy, passing legislation on deepfakes, guiding AI policies in state government and schools, and even a few comprehensive regulatory bills. This summer, over two dozen of those bills went into effect, and we will see how some of these initial attempts at imposing guardrails on the new technology will play out, and what unintended consequences might arise.

The AI-related issue that states have acted to address the most quickly and extensively is sexual deepfakes. Currently, 27 states have enacted new laws to address the proliferation of sexual deepfakes generated by AI. Disturbing stories from local high schools and celebrities have spurred lawmakers to action, but these bills are also relatively easy to add to existing revenge porn and child sexual abuse laws.

Helping businesses sort through the thousands of job applicants they receive for job openings has been an early use case for artificial intelligence. However, widespread use of such tools has attracted scrutiny. Policymakers seek to protect the privacy of job applicants and combat unintentional biases these tools could promote. We see a similar set of policy levers used in proposed AI hiring laws as we’ve found in other use-level regulations of AI: disclosures and impact assessments. But as NYC policymakers earned, getting the scope right can be a challenge.

AI legislation in California has been on the move recently. The Golden State has considered over 50 AI-related bills so far, but several have advanced in the last few weeks, including the bill the AI industry has watched most closely — SB 1047. We highlighted SB 1047 earlier this year, which would establish a new state office to regulate large AI models and certify compliance. Having already passed the Senate, the measure was tweaked by sponsor Sen. Scott Wiener (D) this week to address concerns raised by industry groups.

With the enactment of a comprehensive law in Colorado and several deepfake measures in other states, we are starting to see the enacted laws designed to deal with artificial intelligence technology. But if the policymaking battles over consumer data privacy are any indication, this is just the first chapter of the story of AI regulation. With legislative sessions in many states concluding, it is a good time to examine what efforts to pass privacy legislation can tell us about where AI legislation is headed.

State lawmakers have tried different approaches to regulate AI, hoping to balance “broad guardrails” with a “soft touch.” In a recent publication, Dean Ball, a Research Fellow at the Mercatus Center specializing in technology and innovation, introduced a framework for approaching AI regulation focused on (1) conduct, (2) use, and (3) the model.

In the past few years, AI went from an idiosyncratic legislative interest to 150 mostly study bills in 2023 to over 600 and counting this year. This growing pile of studies, committee transcripts, and legislative language represent not only the interest of policymakers in regulating AI but also the speed at which the technology (its real and potential costs and benefits) has accelerated today. And we’ve only scratched the surface.

While all eyes were on Connecticut to pass a comprehensive AI bill, Colorado lawmakers sent a similar AI bill through both chambers of the legislature on the last day of session, sending what could be a landmark AI law to the governor's desk. Meanwhile, the Connecticut bill fizzled out in the House due to a gubernatorial veto threat. Now, if Governor Polis (D) signs Colorado’s bill into law, it would be the broadest effort yet to impose obligations on AI developers to protect consumers with one important caveat: these provisions won’t go into effect until 2026.