After months of work by a legislative work group, Connecticut lawmakers proposed a landmark comprehensive AI bill last month that could set a template for other states to follow. Not surprisingly, lawmakers have already amended the original bill to address numerous concerns raised after weeks of testimony from stakeholders. The proposal reflects one of the first major attempts to set broad guardrails for the emerging AI industry.

Utah enacted a package of AI bills into law this week. While not revolutionary, Utah’s legislative package represents a middle ground that most state policymakers are taking on AI regulation. These bills do not establish a comprehensive framework for the development and deployment of AI (they’ll let California and Connecticut take the lead on that), but the Utah bills address pressing issues (deepfakes and consumer protections) and align current laws with the new realities that AI tools represent, with particular emphasis on protecting vulnerable populations and mandating transparency.

So far, much of the state-level focus of AI regulation has targeted the outputs the systems produce — how AI models impact individuals. Far less attention has been given to the inputs fed into the systems — the terabytes of data developers use to train AI models. But the California Legislature is currently considering a bill that would do just that.

We’re tracking over 500 AI-related bills in the states and I thought it might be a good time to take a step back and evaluate the landscape. The way that I look at the state legislative landscape for AI right now is by viewing the progression of AI bills within three stages: study bills, narrowly focused bills, and comprehensive legislation. Right now, we’re moving out of the study phase, are deep in the narrowly focused phase, and are just beginning the comprehensive phase.

This week, lawmakers in Connecticut released the text of their much-anticipated AI bill (CT SB 2), which provides a comprehensive framework aimed at the development and deployment of AI models, while providing a longer timeline of enforcement with rolling effective dates and safe harbor provisions. It also compiles many of the narrower focused legislation we’ve seen enacted in a handful of other states, addressing issues like deepfakes and government use.

A sexual deepfake bill was signed into law in South Dakota, and additional deepfake bills passed the full legislature in New Mexico and made it through their chambers of origin in South Dakota, Utah, and Wisconsin. Plus, we saw new AI executive orders in Massachusetts and Washington, D.C. But this week we’re going to focus our analysis on an important bill recently introduced in California, which might be the most comprehensive piece of state AI legislation to date.

“Impact assessments” have been a key reporting requirement of many comprehensive AI bills that lawmakers have introduced this year. They are one of the safeguards being put in place to help combat disparate treatment and discriminatory outcomes from the use of AI tools in hiring, education, and other settings. Like mandatory disclosures, impact assessments are another early tool policymakers are using to regulate AI as the technology becomes an increasingly common aspect of our daily lives.

States are investing heavily in AI innovation and workforce development, with New York proposing a $400 million "Empire AI" consortium of seven universities, New Jersey partnering with Princeton University for an AI hub, and California establishing a university symposium on generative AI. Massachusetts, Oklahoma, and other states have created AI task forces, while legislators in California, Florida, Kentucky, and Oklahoma are proposing bills to integrate AI into education and research infrastructure.

States are advancing comprehensive AI legislation in 2024 inspired by Biden's Blueprint for an AI Bill of Rights. New York introduced bills (AB 8129/SB 8209) incorporating all five Blueprint principles, requiring pre-deployment testing and opt-out rights. Virginia's HB 747 targets "high-risk" AI systems affecting credit, employment, and healthcare decisions. Vermont's HB 711 establishes a private right of action for consumers, while Oklahoma's HB 3453 outlines rights without enforcement mechanisms.

State lawmakers are embracing AI disclosure requirements as a regulatory tool, with Washington and Michigan enacting laws requiring disclaimers for AI-generated political content. Nine additional states have introduced similar political advertising bills. Broader disclosure legislation is pending in California, Massachusetts, Pennsylvania, and other states covering general AI content, specific media like books and newspapers, and AI decision-making tools affecting consumers.

State lawmakers are addressing AI's threat to jobs through industry-specific legislation. Tennessee's ELVIS Act protects artists' voices from unauthorized AI use. California's AB 459 allows performers to nullify contracts permitting digital replicas, while New York bars AI-using productions from tax credits. New York previously proposed taxing companies for automation-displaced workers. Other states fund retraining programs or commission AI job-impact reports as policymakers balance workforce protection against economic gains.

State lawmakers are preparing bipartisan AI legislation for 2024, balancing innovation with consumer protection through "broad guardrails" with a "light touch." Connecticut, California, Colorado, and New York plan comprehensive bills, while Republicans favor narrower approaches. Key focus areas include AI disclosure requirements, algorithmic discrimination prevention, deepfake regulation (nine states already enacted sexual deepfake laws, Michigan the fifth for political deepfakes), and workforce development initiatives like Kentucky's educational curriculum integration.

Nine states have enacted legislation targeting nonconsensual explicit deepfakes, with Virginia becoming the first in 2019. Research found 113,000 deepfake images uploaded in nine months, a 54% increase from 2022. Recent incidents involving high school students prompted action. States like Texas, New York, and Minnesota added criminal penalties, while California and Illinois allow civil lawsuits. Ohio, California, New Hampshire, and Oklahoma are considering additional legislation for 2024.

Illinois' 2008 Biometric Information Privacy Act (BIPA) has emerged as the nation's strongest biometric regulation, requiring notice, consent, and prohibiting profit from biometric data while providing private lawsuit rights. The Illinois Supreme Court clarified violations occur with each scan, enabling multi-hundred million dollar settlements against tech companies. Clearview AI, which scraped 30 billion photos and serves 3,000 U.S. law enforcement agencies, settled by restricting private sector sales.

California's Privacy Protection Agency released draft regulations on November 27, 2023, governing automated decision-making technology (ADMT) that uses personal information. The regulations establish consumer opt-out rights for ADMT producing legal effects, profiling employees or job applicants, and tracking consumers in public spaces. Consumers must receive plain-language notices about ADMT use. The draft contrasts with pending legislation CA AB 331, which would mandate impact assessments and allow private lawsuits for algorithmic discrimination.

States are enacting legislation to combat AI-generated deepfakes in elections ahead of 2024. California and Texas passed laws in 2019, while Minnesota criminalized deepfake use and Washington mandated disclosure requirements this year. Michigan recently passed bills requiring AI disclosure in political ads and prohibiting manipulated media within 90 days of elections without disclaimers. Seven additional states introduced similar legislation, adapting existing campaign regulations to address AI-generated content threats.

State lawmakers introduced over 160 AI-related bills in 2023, though most failed to advance past committee stage. Legislation focused on six key areas: facial recognition technology, bias protections, deepfakes, social media regulation, government AI use, and study groups. Montana prohibited continuous facial surveillance by law enforcement, while Minnesota and Illinois passed laws addressing nonconsensual deepfake sexual content. Connecticut and Texas established AI inventories for state agencies.

State lawmakers are grappling with how to define artificial intelligence for regulatory purposes, with no universal definition yet established. Rhode Island's HB 6285 defines AI as technology simulating human intelligence, while Michigan's HB 5143 describes it as machine-based prediction systems. New York's AB 8129 avoids the term entirely, instead defining "automated systems." Governor Hochul recently signed legislation addressing deepfakes without defining AI directly.

State policymakers are in the education phase of AI regulation, with eight states creating dedicated study groups and 11 states assigning standing committees or agencies to examine the technology ahead of 2024 legislative sessions. New Mexico lawmakers heard testimony emphasizing transparency and disclosure requirements, while California AB 331 exemplifies early legislation mandating impact assessments and allowing private lawsuits for algorithmic discrimination.