With the public release of Open AI’s ChatGPT in November 2022 and Google’s Bard in March 2023, governments across the world have a renewed focus on regulating the use of artificial intelligence (“AI”). Within the United States, a patchwork of state regulation concerning AI has emerged—a trend that is likely to continue in 2023 given the reality that there is unlikely to be meaningful federal AI legislation in the 118th Congress.
In 2022 alone, bills or resolutions concerning AI have been introduced in seventeen states and the District of Columbia, and were enacted in states including Vermont, Colorado, Illinois, and Washington. State legislatures in Colorado and Illinois created bodies to study AI; the Illinois legislature amended its Artificial Intelligence Video Interview Act with additional requirements to collect demographic data when AI analysis is used to make hiring decisions through video interviews; Washington provided funding for the state’s chief information officer to study how automated decision-making systems could be reviewed for fairness and equity; and Vermont established a Division of Artificial Intelligence within the Agency of Digital Services to implement recommendations of the Artificial Intelligence Task Force and require the Agency of Digital Services to conduct a survey of all automated decision-making systems that are being developed, used, or procured by the state. Presumably substantive recommendations will follow and, in some form, be implemented.
Proposed state AI regulation continues to percolate in 2023 in response to emerging use cases for AI and headlines documenting troubling incidents with nascent AI products or services. One approach taken by state legislators has simply been to push for additional transparency. For example, Pennsylvania House Bill 49, introduced in the Pennsylvania legislature in March 2023, would require that anyone running a business operating an AI system in Pennsylvania register with the Pennsylvania Department of State. The bill would require the business to provide information such as a contact person for the business, the type of code being utilized for the operation of the AI system, and the intent of the software being utilized by the business.
Other state legislation is focused on the potential for civil rights abuses or discrimination caused by AI systems. The California legislature, for example, is considering Assembly Bill 331, which would impose several new requirements on developers and deployers of automated decision-making tools in California, including local government agencies. Among other things, if a deployer uses an automated decision tool to make a consequential decision affecting an individual, the bill would require the deployer to alert the individual that the tool is being used and provide a statement of the tool’s purpose. If the decision is made solely using the tool, then, if technically feasible, the person must be allowed to opt to have the decision made by an alternative selection process. In addition, the bill would prohibit a deployer from using an automated decision tool in a manner that contributes to algorithmic discrimination, including with respect to race, sex, religion, age, genetic information, reproductive health, and other factors or characteristics. The bill contains provisions for both administrative enforcement actions and a private right of action. And the bill is not targeting merely hypothetical uses of AI; a February 2022 survey from the Society of Human Resources Management found that 79% of employers use AI or automation for recruitment and hiring purposes.
Companies should expect state legislatures across the country to consider not only general AI legislation, but also industry-specific regulation, addressed specifically to the use of AI in areas like healthcare, hiring, lending, and other highly regulated spaces that are likely to involve the risk of algorithmic discrimination or bias.
As a patchwork of state-by-state regulation emerges, there are at least two main risks. First, a growing body of state regulation may slow innovation—for better or worse—as the technology continues to grow. Second, a patchwork of state-by-state regulation may ultimately be unworkable for companies or products that, among other limitations, are unable to geofence users by jurisdiction.
One potential answer would be meaningful and carefully considered federal regulation. However, progress on that front has been elusive. To date, the federal government has only begun to produce guidelines and frameworks to signal best practices in the field. For example, the White House established an AI research office and recently released a Blueprint for an AI Bill of Rights. The National Institute of Standards and Technology, housed within the Department of Commerce, has also released an AI Risk Management Framework. However, both are voluntary. More recently, the Commerce Department’s National Telecommunications and Information Administration requested public comments on developing an AI accountability policy.
On the legislative front, Senator Ron Wyden (D-OR) introduced the Algorithmic Accountability Act in the 117th Congress, which would have required companies utilizing AI to conduct critical impact assessments of the automated systems they use and sell in accordance with regulations promulgated by the Federal Trade Commission (“FTC”). Senator Wyden has indicated that he plans to again introduce the Algorithmic Accountability Act in 2023, but there is no indication that it will be enacted this session. Representative Ted Lieu (D-CA) has also called upon Congress to regulate AI. Representative Lieu introduced a congressional resolution drafted entirely by ChatGPT—allegedly the first of its kind—and is working on legislation to establish a federal agency to oversee AI. Senator Chris Murphy (D-CT) has also tweeted about the risk of AI and our lack of preparation for the changes that this new technology will bring. Given concerns that generative AI could pose a significant risk to everything from children’s safety to election integrity, new legislation is likely to be introduced, even if the likelihood of any such legislation becoming law currently seems remote in today’s divided Congress.
In the absence of new federal regulation, regulators are likely to use the existing tools they have to combat perceived misuse or abuses of AI. The FTC, for example, recently put out a public warning to companies that false or deceptive claims regarding AI capabilities could result in enforcement actions, and FTC Commissioner Alvaro Bedoya commented at a recent public event that companies who make deceptive claims about their AI products or injure consumers through unfair practices can be “held accountable” under Section 5 of the FTC Act. The FTC is unlikely to be the only regulator currently looking at its enforcement toolkit with an eye to emerging issues in AI, and Jonathan Kanter, who leads the Department of Justice’s Antitrust Division, has stated publicly that the DOJ is already paying close attention to companies and products in the AI space.
As with several other regulatory issues in the technology space, the European Union is moving more quickly than the United States government to regulate AI. The EU Commission introduced a regulatory proposal in April 2021, with the hope that it would enter into force in 2023. There would then be a transitional period in which standards would be further developed and enforcement could begin sometime in 2024. However, recent reports suggest that the dynamic pace of innovation in AI—and specifically the capabilities of OpenAI’s ChatGPT—has sent EU lawmakers back to the drawing board. In the absence of an EU-wide approach, Italy recently banned ChatGPT on account of privacy concerns raised by the product.
Regulation and enforcement actions in the AI space are likely to increase in the coming year as legislators and regulators struggle to understand this new technology and how it fits within existing regulatory schemes. Companies will need to pay careful attention to where their product is available to consumers and what regulations are applicable in each jurisdiction. Innovation may quickly outpace regulation, but lawmakers and regulators are unlikely to sit idly by as this quickly developing technology transforms how we work, create, learn, and communicate.
[View source.]
