LOGIN Request a call

← BLOG  |  EMPLOYMENT LAW UPDATES  |  NEWS

A.I. STATE BY STATE UPDATE ROUND-UP

11 Sep

Share

In this update, we are providing employers with the latest in A.I. laws and legislation.

During the 2023 legislative session, there has been a notable increase in the introduction of state-level AI-related laws. This upsurge has surpassed the count of AI-related laws that were either proposed or approved in previous legislative sessions. In this year alone, ten states have incorporated AI-related regulations as components of broader consumer privacy laws, all of which are slated for implementation or passage in 2023.

Furthermore, numerous additional states have put forth similar bills for consideration. A variety of states have suggested the establishment of task forces dedicated to investigating AI, while others have voiced apprehension regarding the potential impact of AI on critical sectors such as healthcare, insurance, and employment. The list below enumerates the array of state laws that are set to be enacted, have already been ratified, or are currently under proposal during this ongoing legislative session:

Laws passed this legislative session:

During this legislative session, several states have passed comprehensive consumer privacy laws that encompass provisions governing AI. These laws parallel the ones previously enacted in California, Colorado, Connecticut, and Virginia. Of particular significance, these laws grant consumers the right to opt out of automated profiling and necessitate data protection assessments when automated decision-making poses an elevated risk of harm. Notably, Iowa has also passed a consumer privacy law, albeit without including the provision to allow consumers to opt out of profiling. Additionally, numerous other states have passed laws specifically addressing AI, which are detailed in the following list:

  • Connecticut: An Act Concerning Artificial Intelligence, Automated Decision-Making and Personal Data Privacy (S1103)
    • Enacted: June 5, 2023
    • Effective: Starting from July 1, 2023
    • Description: This law establishes an Office of Artificial Intelligence, safeguards children from targeted advertising, and sets up a task force to study AI and formulate an AI Bill of Rights.
  • Delaware: Delaware Personal Data Privacy Act (HB154)
    • Enacted: June 30, 2023
    • Effective: January 1, 2025
    • Description: This law allows consumers to opt out of profiling for automated decisions and mandates data protection assessments for activities posing a “heightened risk of harm.”
  • Indiana: Indiana Data Privacy Act (SB5)
    • Enacted: May 1, 2023
    • Effective: January 1, 2026
    • Description: This law allows consumers to opt out of profiling for automated decisions and mandates data protection assessments for activities posing a “heightened risk of harm.”
  • Maryland: HB622
    • Enacted: May 8, 2023
    • Effective: October 1, 2023
    • Description: This law establishes a grant program supporting small and medium-sized businesses implementing “Industry 4.0 Technology,” including AI.
  • Montana: Montana Consumer Data Privacy Act (SB 384)
    • Enacted: April 21, 2023
    • Effective: October 1, 2024
    • Description: This law allows consumers to opt out of profiling for automated decisions and mandates data protection assessments for activities posing a “heightened risk of harm.”
  • North Dakota: HB 1361
    • Enacted: April 12, 2023
    • Effective: April 12, 2023
    • Description: This act clarifies that AI is not considered a legal person under the North Dakota Code.
  • Oregon: Oregon Consumer Privacy Act (SB619)
    • Enacted: June 23, 2023
    • Effective: July 1, 2024
    • Description: This act allows consumers to opt out of profiling and mandates data protection assessments for some controllers posing a “heightened risk of harm.”
  • Tennessee: Tennessee Information Protection Act (SB0073)
    • Enacted: May 11, 2023
    • Effective: July 1, 2025
    • Description: This act allows consumers to opt out of targeted advertising and profiling and requires data protection impact assessments for activities posing a “heightened risk.”
  • Texas: Texas Data Privacy and Security Act (HB4)
    • Enacted: June 18, 2023
    • Effective: July 1, 2024
    • Description: This act allows consumers to opt out of targeted advertising and profiling and mandates data protection assessments for certain controllers.
  • Texas: Artificial Intelligence Advisory Council (HB 2060)
    • Enacted: June 13, 2023
    • Effective: June 13, 2023
    • Description: This act establishes an advisory council to study the effects of AI and report findings to the legislature.

Laws that are in effect this year

The following are mostly part of comprehensive consumer privacy laws. These laws regulate AI and automated decision-making by allowing users to opt-out of profiling and requiring impact assessments.

  • California: California Privacy Rights Act (CPRA)
    • Enacted: November 3, 2020
    • Effective: January 1, 2023
    • Description: CPRA amends the California Consumer Privacy Act, introducing provisions impacting AI like additional limitations on data retention, data sharing, and use of sensitive personal information.
  • Colorado: Colorado Privacy Act (CPA)
    • Enacted: July 7, 2021
    • Effective: July 1, 2023
    • Description: The CPA gives consumers the right to opt-out of profiling in furtherance of automated decisions. It also requires a data protection assessment for activities that pose a “heightened risk of harm,” including targeted advertising and some types of profiling.
  • Connecticut: Connecticut Data Privacy Act (CTDPA)
    • Enacted: May 10, 2022
    • Effective: July 1, 2023
    • Description: The CTPA gives consumers the right to opt-out of profiling in furtherance of automated decisions. It also requires a data protection assessment for activities that pose a “heightened risk of harm,” including targeted advertising and some types of profiling.
  • New York City: Automated Employment Decision Tools
    • Enacted: December 11, 2021
    • Effective: January 1, 2023
    • Description: AEDT regulates the use of AI in hiring. It requires employers to notify candidates about the use of such tools, allows candidates to request what data is used, and requires an annual audit to evaluate the tool for bias.
  • Virginia: Virginia Consumer Data Privacy Act (VCDPA)
    • Enacted: March 2, 2021
    • Effective: January 1, 2023
    • Description: The VCDPA gives consumers the right to opt-out of profiling in furtherance of automated decisions. It also requires a data protection assessment for activities that pose a “heightened risk of harm,” including targeted advertising and some types of profiling.
  • Utah: Utah Consumer Privacy Act (UCPA)
    • Enacted: March 24, 2022
    • Effective: December 31, 2023
    • Description: The UCPA gives consumers the ability to opt-out of profiling using personal data. Notably, it does not require impact assessments for data controllers.

Laws proposed this legislative session:

In this legislative session, various states have put forward comprehensive consumer privacy bills, emulating the approach taken by states like Colorado, California, and Connecticut. These bills encompass AI-related provisions that align with those present in other states’ privacy laws.

  • Hawaii: Hawaii Consumer Data Protection Act (SB974 or SB1110/HB1497)
    • Date introduced: January 20, 2023
    • Description: This bill seeks to grant users the ability to opt out of profiling that utilizes their personal data. It also mandates data protection assessments for processing activities presenting a “heightened risk to consumers.”
  • Illinois: Illinois Data Privacy and Protection Act (HB3385)
    • Date introduced: February 17, 2023
    • Description: This bill aims to regulate the collection and processing of personal information through algorithms.
  • Maine: Maine Data Privacy and Protection Act (HB1270)
    • Date introduced: May 19, 2023
    • Description: This bill prohibits discrimination through data processing, regulates targeted advertising, and mandates an impact assessment for algorithms categorized as “high risk.”
  • Massachusetts: Massachusetts Data Privacy Protection Act (MDPPA), Massachusetts Information Privacy Protection Act (MIPSA), and the Internet Bill of Rights (H.1555)
    • Date introduced: January 18-20, 2023
    • Description: Three competing consumer privacy bills, all granting consumers the right to be informed about or opt out of automated profiling. They also require impact assessments for controllers engaged in automated decision making.
  • Minnesota: Minnesota Consumer Data Privacy Act (HF2309/SF2915)
    • Date introduced: March 15, 2023
    • Description: This bill proposes the right for consumers to opt out of profiling and calls for data protection assessments.
  • New Hampshire: Consumer Data Privacy Act (SB255)
    • Date introduced: January 19, 2023
    • Description: This bill aims to give consumers the right to opt out of profiling and requires data protection assessments.
  • New York: New York Privacy Act (SB365 or AB3593)
    • Date introduced: January 4 and February 3, 2023
    • Description: These alternative versions of a comprehensive privacy law in New York enhance consumer control over automated decisions used for profiling and mandate impact assessments.
  • Pennsylvania: Consumer Data Protection Act (HB708)
    • Date introduced: March 27, 2023
    • Description: This bill proposes the right for consumers to opt out of profiling and requires data protection assessments.
  • Rhode Island: Rhode Island Data Transparency and Privacy Protection Act (HB6236)
    • Date introduced: March 30, 2023
    • Description: This bill aims to give consumers the right to opt out of profiling and requires data protection assessments.
  • Washington: People’s Privacy Act (SB5643/HB1616)
    • Date introduced: January 31, 2023
    • Description: This bill seeks to restrict the use of AI profiling and facial recognition in public accommodations.

Regulating AI in Employment Settings:

States across the country are taking cues from New York City and introducing bills aimed at regulating the use of AI in employment scenarios, particularly in the context of hiring decisions.

  • Illinois: HB 3773
    • Date introduced: February 17, 2023
    • Description: This bill is designed to prohibit employers from utilizing race or zip code as a proxy for race when making automated hiring decisions.
  • Massachusetts: An Act Preventing a Dystopian Work Environment (H.1873)
    • Date introduced: February 16, 2023
    • Description: This bill mandates that employers provide employees with notice regarding algorithmic decisions and monitoring. It also grants employees the right to request information processed through algorithms.
  • New Jersey: A4909
    • Date introduced: December 5, 2022
    • Description: This bill proposes the implementation of bias audits for automated decision tools employed in the hiring process. It would also necessitate employers to inform candidates when they have been evaluated using automated tools.
  • New York: A7858
    • Date introduced: July 7, 2023
    • Description: This bill aims to mandate that employers notify candidates if they employ automated decision tools for making employment-related decisions.
  • Vermont: H114
    • Date introduced: January 25, 2023
    • Description: This bill is geared toward restricting the electronic monitoring of employees for the purpose of making employment-related decisions.

Regulating AI in Healthcare:

States are expressing concerns about algorithms surpassing medical professionals in healthcare decisions, and as a response, they are introducing bills to regulate AI use in both physical and mental health services.

  • California: AB1502
    • Date introduced: February 17, 2023
    • Description: This bill aims to prohibit healthcare providers utilizing automated decision systems from engaging in discrimination based on race, color, national origin, sex, age, or disability.
  • Illinois: HB1002
    • Date introduced: January 11, 2023
    • Description: This bill proposes that algorithms employed for diagnosing patients must be certified and demonstrated to yield accurate results. It also bestows upon patients the right to be informed when an algorithm has diagnosed them and the option to opt out of its use.
  • Illinois: HB3338
    • Date introduced: February 17, 2023
    • Description: This bill is designed to prevent hospitals from adopting policies that inhibit nurses from substituting their judgment for the automated recommendations of AI systems.
  • Maine: SB656a
    • Date introduced: April 12, 2023
    • Description: This bill seeks to prevent hospitals from adopting policies that obstruct nurses from exercising their judgment in lieu of the automated recommendations of AI systems.
  • Massachusetts: HB1974
    • Date introduced: February 16, 2023
    • Description: This bill mandates that AI employed for mental health patients must be pre-approved and monitored. Patients should be informed about AI use and must provide consent for its utilization.
  • Rhode Island: HB6285
    • Date introduced: April 19, 2023
    • Description: This bill requires that AI used for mental health services must be pre-approved. Additionally, patients should be informed about the use of AI and have the choice to opt for mental health treatment from a professional.
  • Texas: HB4695
    • Date introduced: March 10, 2023
    • Description: This bill would limit the administration of mental health care through AI to only mental health professionals. It also mandates that the mental health professional should be available for monitoring progress or communication with the patient.

Regulating Generative AI:

These bills often concentrate on the risks posed by AI-generated images or videos.

  • Massachusetts: An Act drafted with the help of ChatGPT to regulate generative artificial intelligence models like ChatGPT (S.31)
    • Date introduced: February 16, 2023
    • Description: This bill aims to prohibit bias in generative AI models and mandates safeguards against plagiarism, consumer privacy protections for users of generative AI, and registration with the attorney general.
  • New York: S6859/A216A
    • Date introduced: January 2, 2023
    • Description: This bill mandates that advertisers disclose their use of “synthetic media.”
  • New York: A7106/S7592
    • Date introduced: May 10, 2023
    • Description: This bill would require political communications using synthetic media to be disclosed.
  • New York: A7634/S7422
    • Date introduced: May 25, 2023
    • Description: This bill aims to prevent film production companies from using AI to replace actors in their productions if they wish to receive production credit.
  • Pennsylvania: H1063
    • Date introduced: April 28, 2023
    • Description: This bill seeks to criminalize the dissemination of AI-generated sexually explicit images of individuals without their consent.
  • Rhode Island: HB6286
    • Date introduced: April 19, 2023
    • Description: This bill intends to establish certain operating standards for generative AI models and mandates their registration with the attorney general.

For more information, please see the links below:

Artificial Intelligence 2023 Legislation

Us State-By-State Ai Legislation Snapshot

Schedule a Call

Learn more about VensureHR and how we can make an impact on your business.

Contact VensureHR

This communication is intended solely for the purpose of conveying information. The present post might incorporate hyperlinks directing readers to websites managed by third-party entities. The inclusion of any links within this communication is meant to serve as points of reference and could encompass opinion articles from various law firms, articles from HR associations, official websites, news releases, and documents of government agencies, and other relevant third-party sources. Vensure has no authority over these external websites and bears no responsibility for their content. Furthermore, Vensure does not endorse the materials present on these websites. The contents of this communication should not be interpreted as legal advice or as a legal standpoint concerning specific facts or scenarios. Nor should it be deemed an exhaustive compilation of facts potentially pertinent to federal, state, or local laws. It is strongly advised that employers solicit legal guidance from an employment attorney when undertaking actions in response to any legal updates provided. This is due to the possibility of future alterations occurring in federal, state, and local laws, regulations, as well as the directives and guidelines issued by governing agencies. These changes may transpire at any given time, potentially rendering certain portions of the content within this update void or inaccurate.

Keep Your Business Compliant

Fill out the form below to receive monthly Employment Law Updates right in your inbox.

Keep Your Business Compliant

Fill out the form below to receive monthly Employment Law Updates right in your inbox.

Amazing!

You're all set.

Thanks for subscribing. Be on the look out for the Legal HR updates in your email.

Celebrating PEOs!

VensureHR joins the nationwide celebration, reflecting on an industry of excellence in providing payroll, employee benefits, compliance assistance, and HR services to thousands of SMBs across North America.

Tracking Convertion image