The explosive growth and widespread adoption of technology solutions in generative machine learning and artificial intelligence (collectively AI) have left the US in dire need of comprehensive regulations on the creation, use, and disclosure of AI. Like the current state of data privacy law in the United States, the regulatory landscape for AI is still in its infancy, characterized by a loose collection of proposed state and federal initiatives.
The current regulatory landscape
1.) Federal initiatives and proposed legislation
Regulation of AI at the federal level is currently limited to guidelines from the National Institute of Standards and Technology (NIST) and several executive orders issued by the Biden administration that emphasize the need to responsibly address the continued development of AI by addressing and mitigating the risks associated with AI technology. In Congress, Senator Ron Wyden of Oregon introduced Senate Bill 2892, the Algorithmic Accountability Act (the AAA) on September 21, 2023. The AAA is a continuation of legislation originally proposed in 2019 that would require the Federal Trade Commission (FTC) to issue regulations requiring certain entities to conduct impact assessments of their AI systems, maintain documentation of such assessments, announce that they are under AAA, and submit annual reporting to the FTC. At the time of this writing, AAA sits on the Senate Committee on Commerce, Science, and Transportation.
2.) State regulations
Similar to the state of data privacy regulation, real progress in AI regulation is currently limited to state-level initiatives. California, Colorado, Utah and Illinois have active legislation regulating AI. Brief summaries of these state laws follow:
- California law requires government agencies to notify end users when they interact with AI and encourages the state to invest in AI education and build AI competency in the state’s workforce. The governor just vetoed additional legislation that would have regulated the creation and use of AI in the state.
- The obligations imposed by the Colorado AI Act go into effect on February 1, 2026 and require any developer of a “high-risk artificial intelligence system” to exercise reasonable care to protect consumers from known or reasonably foreseeable risks of algorithmic discrimination at such high concentrations. risk system. Colorado law contains several steps developers can take to have a rebuttable presumption of reasonable care in protecting consumers.
- The Illinois law amends the Illinois Human Rights Act to protect Illinois residents from potentially discriminatory decisions made by AI in the employment context, affecting any employer who uses AI to make recruitment, hiring, promotion, disciplinary, or dismissal.
- Utah law imposes disclosure requirements on entities that use AI tools on their customers and limits an entity’s ability to blame generative AI for statements that violate consumer protection laws, while also establishing an Office of Artificial Intelligence Policy established to manage a state AI program.
What’s next?
It appears that AI regulatory efforts will largely follow in the footsteps of data privacy legislation in the United States, especially given the rapid innovation and technological advances in AI that are outpacing the current pace of federal legislative efforts. exceeds. Other states are following in the footsteps of states where the legislation has already been passed and will likely lead to a new patchwork of regulations that will make national compliance a tedious and complicated effort for tech companies. Without federal regulation, enforcement of numerous state AI regulations will impose a heavy compliance burden on companies to confidently determine whether they are covered by a particular state law and, if so, what actions specifically they must take to comply with that specific law to follow.
