As state lawmakers develop, pass, and ultimately enforce technology policy in the absence of federal action, a recognizable pattern has emerged. While Congress has struggled to pass legislation on some major tech issues, state policymakers from coast to coast have moved to enact statutes addressing a range of technology policy concerns.
There is clear precedent for this pattern:
- Following high-profile cyber hacks, all 50 states, Washington, DC, and three territories passed data breach consumer notification laws between 2002 and 2018; and
- After major incidents regarding the misuse of consumer data, 20 states enacted new, comprehensive consumer privacy laws between June 2018 and 2024.
Now, after the launch of powerful generative artificial intelligence (AI) models, a wave of AI legislation is building, with almost 700 AI-related bills introduced in 2024 alone. For AI, the wave is still in its early stages. However, despite a dramatic increase in legislative activity around AI — from under 200 bills in 2023 to nearly 700 in 2024 — policymakers have not yet coalesced around a specific model of regulation.
This year has seen some major developments. Colorado passed comprehensive, first-in-the-nation legislation to address high-risk uses of AI. Other states, like California and Tennessee, enacted targeted reforms to address specific issues such as data provenance and digital replicas. More broadly, 33 states established task forces or directed existing committees to study the impact of AI on a range of policy areas.
Governors also put their stamp on AI policy in 2024. They issued executive orders to establish new initiatives and direct government agencies on how to use the technology, among other things. Many also used their executive powers to direct AI policy. For example, Governor Gavin Newsom approved a significant number of AI-related bills while vetoing California’s SB 1047, which would have regulated large-scale AI models.
We expect state policymakers at all levels to carry this momentum into 2025 and introduce hundreds more legislative proposals related to AI. BSA | The Software Alliance will continue to urge lawmakers to focus on high-risk uses of AI and to drive toward a consistent and harmonized approach to legislation, rather than pursue divergent or conflicting models.
The AI Wave Is Building
In 2024, 45 states considered nearly 700 pieces of AI-related legislation. Four additional state legislatures — Montana, Nevada, North Dakota, and Texas — were not in session this year and are expected to consider AI legislation when lawmakers return in 2025.
AI Legislation by the Numbers:
- 2023 Total: 191 pieces of legislation
- 2024 Total: 693 pieces of legislation
- 113 bills enacted
- 77 additional bills advanced through one chamber
Focus on High-Risk Uses
In 2024, Colorado became the first state to enact a comprehensive law regulating high-risk uses of AI. This measure largely mirrored legislation developed and nearly enacted in Connecticut, signaling growing interest among lawmakers to share ideas across state borders.
Similar bills were considered in 11 other states, including California, where AB 2930 was significantly amended but failed to advance. Lawmakers are likely to reintroduce these high-risk focused bills in 2025, with many closely watching developments in Colorado, as state policymakers and leadership revisit and potentially amend the law.
New Laws on Digital Replicas
Seven states introduced nearly 20 bills to protect consumers from the unauthorized use of digital replicas. Two such laws were enacted in Tennessee and Illinois, where lawmakers amended existing right of publicity statutes. Similarly, California enacted legislation to expand the state’s existing right of publicity law to prohibit the use of AI in the creation of digital replicas of deceased individuals. BSA has outlined its proposals to counter unauthorized digital replicas.
Deepfakes a Focus
Forty-three states considered legislation addressing a range of issues related to deepfakes and AI. Among these were proposals to regulate or prohibit the use of deepfakes in election-related communications and bills to provide for civil and criminal penalties when deepfakes are created to harass or defame. Of over 300 pieces of legislation introduced by lawmakers, 71 became laws.
Training Data Transparency Is a Work in Progress
California enacted AB 2013, which will require developers of generative AI systems to post detailed documentation about how their systems are trained. It also raises concerns about how companies can continue to protect trade secrets and confidential information.
Directing Government Use
Nineteen states have discussed legislation related to how government uses AI to improves it services. Over 40 laws have been proposed, aimed at directing state government’s use and implementation of the technology. This includes studying and monitoring the development and deployment of AI.
