One sticking point that has emerged is how best to define a “developer” of an AI system. AI systems are not exactly static programs, they learn from additional training over time and one advantage is that you can train an AI model on the data specific to your organization — so-called “fine-tuning” the model. But how much additional training or modification of the model would cross the line from a user of a model to a model developer yourself? The handful of bills attempting to regulate the development of AI models can shed some light on this debate.

Earlier this spring, state lawmakers began addressing artificial intelligence in public policy, passing legislation on deepfakes, guiding AI policies in state government and schools, and even a few comprehensive regulatory bills. This summer, over two dozen of those bills went into effect, and we will see how some of these initial attempts at imposing guardrails on the new technology will play out, and what unintended consequences might arise.

The AI-related issue that states have acted to address the most quickly and extensively is sexual deepfakes. Currently, 27 states have enacted new laws to address the proliferation of sexual deepfakes generated by AI. Disturbing stories from local high schools and celebrities have spurred lawmakers to action, but these bills are also relatively easy to add to existing revenge porn and child sexual abuse laws.

Helping businesses sort through the thousands of job applicants they receive for job openings has been an early use case for artificial intelligence. However, widespread use of such tools has attracted scrutiny. Policymakers seek to protect the privacy of job applicants and combat unintentional biases these tools could promote. We see a similar set of policy levers used in proposed AI hiring laws as we’ve found in other use-level regulations of AI: disclosures and impact assessments. But as NYC policymakers earned, getting the scope right can be a challenge.

AI legislation in California has been on the move recently. The Golden State has considered over 50 AI-related bills so far, but several have advanced in the last few weeks, including the bill the AI industry has watched most closely — SB 1047. We highlighted SB 1047 earlier this year, which would establish a new state office to regulate large AI models and certify compliance. Having already passed the Senate, the measure was tweaked by sponsor Sen. Scott Wiener (D) this week to address concerns raised by industry groups.

With the enactment of a comprehensive law in Colorado and several deepfake measures in other states, we are starting to see the enacted laws designed to deal with artificial intelligence technology. But if the policymaking battles over consumer data privacy are any indication, this is just the first chapter of the story of AI regulation. With legislative sessions in many states concluding, it is a good time to examine what efforts to pass privacy legislation can tell us about where AI legislation is headed.

State lawmakers have tried different approaches to regulate AI, hoping to balance “broad guardrails” with a “soft touch.” In a recent publication, Dean Ball, a Research Fellow at the Mercatus Center specializing in technology and innovation, introduced a framework for approaching AI regulation focused on (1) conduct, (2) use, and (3) the model.

In the past few years, AI went from an idiosyncratic legislative interest to 150 mostly study bills in 2023 to over 600 and counting this year. This growing pile of studies, committee transcripts, and legislative language represent not only the interest of policymakers in regulating AI but also the speed at which the technology (its real and potential costs and benefits) has accelerated today. And we’ve only scratched the surface.

While all eyes were on Connecticut to pass a comprehensive AI bill, Colorado lawmakers sent a similar AI bill through both chambers of the legislature on the last day of session, sending what could be a landmark AI law to the governor's desk. Meanwhile, the Connecticut bill fizzled out in the House due to a gubernatorial veto threat. Now, if Governor Polis (D) signs Colorado’s bill into law, it would be the broadest effort yet to impose obligations on AI developers to protect consumers with one important caveat: these provisions won’t go into effect until 2026.

Events have unfolded quickly in Connecticut, where lawmakers have tweaked a potential landmark AI bill in response to stakeholder concerns. The unlikely state has become the key battleground for AI policy in the United States. With just weeks to go before the May 8 adjournment date, the bill cleared the Senate on Wednesday but still faces an uncertain future in the House as long as Governor Ned Lamont (D) is not fully on board.

Events have unfolded quickly in Connecticut, where lawmakers have tweaked a potential landmark AI bill in response to stakeholder concerns. The unlikely state has become the key battleground for AI policy in the United States. With just weeks to go before the May 8 adjournment date, the bill cleared the Senate on Wednesday but still faces an uncertain future in the House as long as Governor Ned Lamont (D) is not fully on board.

Congressional inaction on artificial intelligence has left a vacuum for states to fill. State lawmakers have been reluctant to regulate the nascent industry enough to stifle innovation but have also expressed a desire to act quickly and offer broad guardrails to keep the technology from causing harm to consumers. A few states have proposed landmark comprehensive AI legislation that could provide an early template for others to follow. With sessions winding down in many states, some of those bills are slowly traveling down the legislative process, already with many changes as industry provides feedback.

It’s been five months since we originally dove into the topic of political deepfakes. Since then, seven additional states have enacted laws to limit the use of deepfake media in electoral campaigns, making a total of eleven states so far. With only seven short months until this year’s major elections, lawmaker’s interest in this topic has only increased.

This session, beyond their focus on combating deepfakes or comprehensively regulating the development of AI models, state lawmakers have introduced dozens of bills aimed specifically at AI use in particular industries. Last week we discussed how lawmakers are looking to protect certain industries from AI competition (e.g., music, movies, fashion), but this week we’ll examine legislation aimed at protecting the customers of specific industries — such as insurance, health care, legal, and housing — from AI use.

Deepfakes have been an easy target of state lawmakers throughout the past year. At first, these bills focused on deepfake uses in political campaigns or nonconsensual sexual exploitation. But we’ve reached the stage in the narrowly focused phase of AI regulation that lawmakers are expanding to new areas where deepfakes may wreak havoc on society. The latest is Tennessee’s ELVIS Act.

After months of work by a legislative work group, Connecticut lawmakers proposed a landmark comprehensive AI bill last month that could set a template for other states to follow. Not surprisingly, lawmakers have already amended the original bill to address numerous concerns raised after weeks of testimony from stakeholders. The proposal reflects one of the first major attempts to set broad guardrails for the emerging AI industry.

Utah enacted a package of AI bills into law this week. While not revolutionary, Utah’s legislative package represents a middle ground that most state policymakers are taking on AI regulation. These bills do not establish a comprehensive framework for the development and deployment of AI (they’ll let California and Connecticut take the lead on that), but the Utah bills address pressing issues (deepfakes and consumer protections) and align current laws with the new realities that AI tools represent, with particular emphasis on protecting vulnerable populations and mandating transparency.

So far, much of the state-level focus of AI regulation has targeted the outputs the systems produce — how AI models impact individuals. Far less attention has been given to the inputs fed into the systems — the terabytes of data developers use to train AI models. But the California Legislature is currently considering a bill that would do just that.

This week, lawmakers in Connecticut released the text of their much-anticipated AI bill (CT SB 2), which provides a comprehensive framework aimed at the development and deployment of AI models, while providing a longer timeline of enforcement with rolling effective dates and safe harbor provisions. It also compiles many of the narrower focused legislation we’ve seen enacted in a handful of other states, addressing issues like deepfakes and government use.