The explosive growth and widespread adoption of generative machine learning and artificial intelligence technology solutions (collectively, AI) have left the U.S. in pressing need of comprehensive regulations governing the creation, use, and disclosure of AI. Much like the current state of data privacy laws in the United States, the regulatory landscape for AI is still in its infancy, characterized by a loose collection of proposed state and federal initiatives.
The Current Regulatory Landscape
1.) Federal Initiatives and Proposed Legislation
Regulation of AI at the federal level is currently limited to guidance issued by the National Institute of Standards and Technology (NIST) and several executive orders issued by the Biden administration that emphasize the need for continued development of AI to be handled responsibly by addressing and mitigating the risks associated with AI technology. In Congress, Oregon Senator Ron Wyden introduced Senate Bill 2892, the Algorithmic Accountability Act (the AAA) on September 21, 2023. The AAA is a continuation of legislation originally proposed in 2019 that would obligate the Federal Trade Commission (FTC) to promulgate regulations requiring certain entities to perform impact assessments of their AI systems, maintain documentation of such assessments, announce that they are covered by the AAA, and submit annual reporting to the FTC. As of this writing, the AAA sits with the Senate Committee on Commerce, Science, and Transportation.
2.) State Regulations
Much like the state of data privacy regulation, true progress in the AI regulation arena is currently limited to state-level initiatives. California, Colorado, Utah and Illinois have active legislation regulating AI on the books. Brief summaries of these state laws follow:
- The California law requires state agencies to notify end users when they are interacting with AI and encourages the state to invest in AI education and build AI competency in the state’s workforce. The Governor just vetoed additional legislation that would have regulated the creation and use of AI in the state.
- The obligations imposed by the Colorado AI law become effective on February 1, 2026, and require any developer of a “high-risk artificial intelligence system” to use reasonable care to protect consumers from any known or reasonably foreseeable risks of algorithmic discrimination in such high-risk system. The Colorado law contains several steps that developers can take to have a rebuttable presumption of reasonable care in protecting consumers.
- The Illinois law amends the Illinois Human Rights Act to protect Illinois residents from potentially discriminatory decisions made by AI in the employment context, affecting any employer who uses AI to make decisions around recruitment, hiring, promotions, discipline or discharge.
- The Utah law imposes disclosure requirements on entities using AI tools with their customers and limits an entity’s ability to blame generative AI for statements that violate consumer protection laws, while also creating an Office of Artificial Intelligence Policy to administer a state AI program.
What’s Next?
It appears that AI regulation efforts will largely follow in the footsteps of data privacy laws in the United States, especially considering the rapid innovation and technological advancement in the AI space that far outpaces the current speed of federal legislative efforts. Other states are following in the footsteps of those with legislation already enacted likely leading to another patchwork of regulation that will make national compliance for technology companies a tedious and complicated effort. Without federal regulation, the enforcement of numerous state AI regulations will place a heavy compliance burden on companies to confidently determine if they are covered by a particular state law and, if so, what particularly actions they need to take to follow that specific law.
Contact Christopher Herrel (CGH@kjk.com; 216.736.7271), Brett Krantz (BK@kjk.com; 216.736.7238) or any attorney in KJK’s Cyber Security & Data Breach practice group at 216.696.8700 to discuss further or learn more about how this growing body of regulation may affect you or your business.