House Republicans on the Energy and Commerce Committee submitted text to be included in the budget reconciliation bill that includes Section 43201, a ten-year moratorium on enforcement of any state or local law or regulation “regulating artificial intelligence models, artificial intelligence systems, or automated decision systems.” For years, companies have pushed for federal preemption in consumer data privacy, to replace a growing patchwork of state laws with a single national standard more favorable to industry interests. But attempts to pass federal legislation have failed, leaving consumer data regulation to the states. If enacted, the measure would bar states from enforcing or enacting laws governing AI systems and automated decision-making tools, effectively freezing and negating state oversight.

Last year, we noted that Utah’s moderate approach to AI regulation could be a potential model for other states to follow. This year, lawmakers and regulators in Utah followed up on last year’s AI Policy Act with a targeted approach to mental health AI chatbots. Since 2021, Utah has enacted 14 bills related to AI (including 6 this year). The state’s signature AI law is last year’s Artificial Intelligence Policy Act (UT SB 149), which clarifies that the use of an AI system is not a defense for violating the state’s consumer protection laws and requires disclosure when an individual interacts with AI in a regulated occupation. This emphasis on transparency is a hallmark of Utah’s strategy of light-touch AI regulation.

In 2024, Colorado became the first state to enact a broad algorithmic discrimination law regulating high-risk artificial intelligence systems. Gov. Jared Polis (D) signed the bill “with reservations”, vowing there would be changes to the law before it went into effect. This week, we saw the first concrete proposal to amend that law with the introduction of SB 318 by Sen. Robert Rodriguez (D), who drafted the original AI law. The proposed changes would significantly pare back the law, loosening its strictest provisions while preserving core protections against algorithmic discrimination.

Montana became the first state to enact a “Right to Compute Act”. Montana lawmakers introduced 48 AI-related bills. Two have been signed into law, and another six bills have passed the legislature and are awaiting the governor’s signature to become law. Two additional bills have passed their chamber of origin and await further action before the legislature is scheduled to adjourn for the year on May 3. 

Connecticut lawmakers are navigating a delicate balance between encouraging artificial intelligence innovation and imposing meaningful regulatory guardrails, a tension reflected in two major bills recently advanced by the General Law Committee.

The California Privacy Protection Agency (CPPA) considered proposed regulations on automated decision-making technology (ADMT), cybersecurity audits, and risk assessments, ultimately directing staff to revise the proposals in response to public comments. The meeting shows a retreat on regulation due to industry pushback and a recognition of shifting political winds. 

The recent release of multimodal image generation has allowed users to create high-quality images, and when expanded to not just images, but to video and voice, is ripe for fraud.