There’s a wave of state AI legislation coming, new report says

In lieu of a federal law regulating artificial intelligence, state policymakers have introduced nearly 700 pieces of AI legislation in 2024, signaling an impending wave of legislation to come in 2025. A new report says this trajectory follows the pattern of consumer data privacy laws that were similarly introduced en masse over the last several years.

The pattern of AI legislation — according to the 2024 State Summary on AI report from the global software trade association The Software Alliance, also known as BSA — closely follows the wave of data breach and comprehensive consumer privacy laws laws that were introduced and passed in many states. The report claims that while the this year’s wave of 693 pieces of AI legislation that were introduced in 45 states is a significant increase from the 2023 total of 191 pieces of legislation, there’s still no consensus on a specific model of regulation.

The report points to two waves of privacy legislation as precedent. The first occurred between 2002 and 2018, during which all 50 states, Washington, D.C., and three territories passed data breach consumer notification laws following the increase of high-profile cyberattacks on entities possessing consumer data.

The second wave involved comprehensive consumer privacy laws, which 20 states have passed since June 2018. These laws often require businesses to meet certain standards, such as only collecting the minimum required information and allowing customers to opt out of personal data collection.

Craig Albright, senior vice president for U.S. government relations at BSA, said that while there may not yet be a model emerging for comprehensive AI legislation, there are great examples happening in the states.

Colorado’s legislature last May passed a bill designed to mitigate AI-powered discrimination. Gov. Jared Polis said it made his state the “first in the country to attempt to regulate the burgeoning artificial industry on such a scale.”

Many other states have passed other regulations on uses of AI, such as the dissemination of deepfakes and the use of AI in political campaigns.

The establishment of AI task forces or councils in 33 states, Albright said, also indicates the coming wave of AI legislation.

“It’s the same dynamic we’ve seen with privacy, where there’s a need for policymakers to respond, and state policymakers do, and we’ve seen that wave of privacy work its way through the states, and it’s still ongoing, but clearly that wave has gotten a lot of momentum,” Albright said during a press call Tuesday. “We’ve not yet seen a specific model emerge at the state level. So it’s not that the wave is ready to break, necessarily, but when you look at 2024, the big takeaway is 2025 has already started, and we can look at what happened in 2024 to give us clues about what might happen in 2025.”