While it could be years before the bill becomes a law—it is due for a committee hearing this week where stakeholders will discuss and suggest possible amendments—companies using generative AI, especially for decision-making purposes, or planning to push their own version of it into the market, would do well to identify these processes ahead of coming regulation.

“Companies are going to have to put in place regular processes to understand when they onboard these types of products, conduct data protection impact assessments and understand its consequences,” said David Stauss, an attorney with experience in data privacy at the law firm Husch Blackwell.

A patchwork of statewide AI laws is likely, said Stauss, a similar scenario to the patchwork nature of privacy laws.

Changes within privacy laws

Meanwhile, state agency, the California Privacy Protection Agency, is focusing on data regulation issues around AI under its privacy law.

The state’s privacy law—the most conservative in the U.S.—lets people opt out of data collection when a business uses automated-decision making technology to collect such information. People also have the right to request information on how the technology is being used.  

Currently, the agency is collecting public comments on what regulations around AI should be issued, but it could take some time before anything is finalized.

“By the end of the session, we could be looking at a whole another regulatory regime,” said Stauss.