From personal digital assistants to self-driving cars, the rapid advancement of artificial intelligence technology has transformed various aspects of our lives in recent years. However, as AI becomes increasingly integrated into the daily lives of Americans, many critics have raised concerns about the potential risks it poses to user data and security. To address these concerns, similarly to how governors around the country are taking executive action, various state legislators have introduced legislation to safeguard the privacy and security of their citizens and cultivate transparency and equity.

---

California’s AI-Ware Act Cultivates Fairness and Transparency Within State Agencies and Citizens

On February 6, 2023, State Senators Bill Dodd (D) and Melissa Hurtado (D) introduced Senate Bill 313, also known as the California AI-ware Act, to propose the establishment of the Office of Artificial Intelligence within the Department of Technology. This office would oversee state agencies’ design, use, and deployment of automated systems to ensure compliance with state and federal laws and regulations regarding privacy and civil liberties and minimize bias to promote equitable outcomes. Moreover, this bill requires any state agency to use generative artificial intelligence to communicate with individuals to clearly identify that the interaction involves AI and provide instructions on reaching a human representative at the agency. Thus, this legislation emphasizes the importance of fairness and accountability in the use of AI and affirms the public’s right to transparency in AI interactions.

---

Connecticut Bill Pioneers Critical Decision Oversight for Data Privacy Regarding the Use of AI

On February 23, 2023, Connecticut lawmakers introduced Senate Bill 1103 to establish the Connecticut Artificial Intelligence Advisory Board and hold public hearings for procedures and advice on AI policies. This bill mandates the appointment of an AI officer by the Office of Policy and Management (OPM) secretary and an AI implementation officer to oversee procedures by inventory automated systems. Additionally, this legislation enforces compliance with the consumer data privacy law for state contracts, exempts certain air carriers, and modifies regulations on targeted advertisements for children aged 13 to 16. Connecticut Governor Ned Lamont signed this bill into law on June 7, 2023.

---

Massachusetts Legislation Requires Companies Using Generative AI to Implement Security Measures to Protect User Data

On July 5, 2023, State Senators Barry Finegold (D) and Adam Gomez (D) introduced Senate Bill 31 to regulate generative artificial intelligence models like ChatGPT and protect the public’s safety, privacy, and intellectual property rights. This bill requires any company operating a large-scale generative artificial intelligence model to protect the data of individuals and implement security measures by obtaining informed consent and deleting or de-identifying data from individuals. Additionally, this legislation mandates companies to conduct regular risk assessments to identify, assess, and mitigate foreseeable risks and cognizable harms related to their products and services. Companies have 90 days from the effective date of this act to register with the attorney general.

---

Rhode Island Bill Regulates Generative Artificial Models and Addresses Safety, Privacy, and Intellectual Property Rights

On May 11, 2023, House Representatives Lauren Carson (D), Jacquelyn Baginski (D), and Joseph McNamara (D) introduced House Bill 6286 to regulate generative artificial models, like ChatGPT, in order to protect the public’s safety, privacy, and intellectual property rights. This bill requires any company operating a large-scale generative artificial model to register with the attorney general and provide detailed information about their models and data practices. It additionally mandates that these companies implement security measures to protect citizens’ data, obtain informed consent before collecting or disclosing their data, and delete or de-identify any data collected from individuals.

---