Talking Tech with Maddy Dwyer & Travis Hall on State AI Regulation
Talking Tech with Maddy Dwyer & Travis Hall on State AI Regulation by Center for Democracy and Technology
Top Keywords
- bills 0.015
- education 0.009
- states 0.009
- lawmakers 0.007
- state 0.007
- public 0.007
- public sector 0.007
- maddie 0.007
- risk 0.006
- bill 0.006
- travis 0.006
- laws 0.006
Transcript
Welcome to CDT's tech talks, where we dish on tech and Internet policy while also explaining what these policies mean to our daily lives. I'm Jamal Magby, and it's time to talk tech. Welcome to tech talk. Bye.
CDT.
The last two years have been transformative for tech policy. As artificial intelligence systems have rapidly expanded across industries, lawmakers have raised to address the opportunities and risk they present. State legislators, in particular, have become major testing grounds for AI governance, advancing policies that affect everything from public services and education to privacy and consumer protection. In today's episode, we're taking a look back at the 2025 legislative session, examining key developments from 2026 and exploring what may be on the horizon. We'll discuss the ongoing debate over federal preemption, highlight some of the most promising state approaches to governing AI in the public sector in education, and consider the emerging technology issues policymakers should be preparing for next. To help us unpack these developments, I'm joined by two members of the CDT state engagement team, Travis Hall, director of state engagement, and Maddie Dwyer, policy analyst. Maddie and Travis, it's so great to have you both here today. Awesome. It's so good to be here. Thanks for having us, Jamal. So to kick us off, what were some of the big highlights from state legislators last year related to AI in the public sector in education?
Yeah. I'm happy to to highlight. There was a lot that went on in the legislative session last year in states. I'll start with AI in education. So during the last legislative session in 2025, there were actually 53 bills that were proposed on the use of AI in education across 21 states, including 51 of those bills that specifically applied to the k through 12 context. So, again, as you could see, states are really active on this issue. Out of these bills, there were four states in particular across the political spectrum, including Illinois, Louisiana, Nevada, and New Mexico that actually enacted laws on AI in education. And then I'll go into some of the trends, that we saw across all these bills because they varied a lot in scope, what they covered, but I think that there were five main buckets that really stood out to us. The first is advancing AI literacy for students and professional development for teachers. The second was requiring the creation of guidance or guidelines on the responsible use of AI in the classroom, including addressing things like privacy, security, and transparency. The third bucket was creating studies and task forces to assess the current state of AI in education and its impacts on students, teachers, and other stakeholders. The fourth bucket was actually going so far as to prohibit specific AI uses in schools such as those related to student mental health support, student assessment, or replacing teachers fully. So really trying to target those extremely high stakes uses of AI in the education context. And finally, the last piece that lawmakers in states addressed was addressing, AI generated nonconsensual intimate imagery in schools, which as we know is a very large epidemic. I mean, it's just growing, especially in the k through 12 context. And a lot of these bills did things like updating cyberbullying policies and mandating appropriate response and prevention mechanisms to the spread of deepfake, nonconsensual intimate imagery. And then on the public sector side, there was also a lot of movement and momentum, when it comes to AI regulations. So there were 50 total bills that were proposed designed to regulate government use of AI in 2025. And these were introduced across 20 states, including 15 that were passed into law. And the three main buckets that, a lot of these bills fell into was the first, risk management, which did things like requiring implementing new practices aimed at preventing harms of high impact AI uses. The second is AI governance. So, particularly, a lot of the bills created task forces and studies to oversee public sector AI use and also address establishing centralized leadership structures. And finally, the last is transparency. And a big one that a lot of these bills covered was publishing public facing AI inventories.
Which states in your opinion have brought the strongest proposed legislations, and where did you see the most action within this context?
Yeah. So I'll start with, education and public sector, and perhaps Travis can go into some of, CDT's other issues and priorities. So in terms of AI and education, there were a few states that had really strong proposals. Unfortunately, these ones didn't move. But the first we identified was New York's a b sixty eight seventy four a. The second was Indiana's h b twelve ninety six, and the third was Texas's h b 14 o five. And I'll go into Indiana's law in particular because I think it's a a very comprehensive one. So this bill would have required the Department of Education in the state to create guidelines on school AI policies and a model policy, create an inventory of AI platforms used across schools to really try to understand the scope of use within the state. And then it would also do things like allowing teachers and other school administrators to submit an AI platform that they're using to the inventory. It would conduct survey research of teachers and students regarding the AI platforms that they're using. And finally, the bill would also require school corporations and charter schools to, number one, adopt, two, post, and three, communicate to students their school policy regarding AI.
And I'll jump in and say, oh gosh. The last couple of years have been full of fun AI stuff happening in The States. Is it strong? It depends on your definition of strong. I mean, I think that a lot of the heat and the focus has certainly been focused on Colorado over the last couple of years. They passed, the twenty four two zero five, and the 24 stands for 2024 because it was two years ago that they passed this bill, and it never actually went into effect. And this bill would have have regulated, the use of artificial intelligence in consequential decisions, so things like employment or housing, things that affect people's lives and livelihoods. And, you know, it was framed as an anti discrimination law. This year, after a couple years of debates with Jared Polis, who's the governor of of Colorado, as soon as he signed it, he said, I don't actually like this bill, and said, I have to go back and, like, actually, like, we we need to fix it. And so there was all these debates and task forces and special sessions and things like this, and they finally came out with a revision of it that pulls it back quite a bit. So this year was the year that they file that they did put in place a bill a law, that focuses primarily on disclosure. So developers have to disclose to the, deployers some of the information about how the systems are being used, and the deployers have to disclose things to, the data subjects or the consumers about these systems that are being used to make decisions about, like, did they get the job? Did they get the loan? Did they get the house? You know, all these kind kinds of things. So Colorado has been this kind of big focus, and it's really been the only place that's passed that style of bill. With the exception now of Connecticut who is, passed that kind of bill, in part of a big omnibus bill on, AI that includes something on deployment. A lot of the interest has been focused on some of these other bills that have been focused on frontier safety. We've heard a lot about California, about Illinois, about New York, and, the bills that, focus on kind of, like, existential risk. Now at CDT, we focus a lot more on consumer harms and people's rights, and, and so we didn't really engage too much in those bills. But what's really interesting about those, particularly Illinois, is it does start putting in place requirements on developers about how they should be developing these tools, whether or not there are responsibilities around the development and and deployment of these tools, and with Illinois, whether they can be audited against those responsibilities.
And I'll just, I'll also add, on the public sector front and government use of AI, there were also a few strong examples from the twenty twenty five legislative session. And a lot of those, if not, most of them that we identified came from red states, which I think is an interesting trend that we saw. So some of those examples are Kentucky's s b four, Texas's s b nineteen sixty four, and Montana's h b one seventy eight. And Kentucky's s b four, I'll I'll dive into that one. It really established a comprehensive approach to public sector AI governance. That was a promising approach that we saw, and some of their requirements under the bill is actually directing their centralized office of technology to establish standards for the responsible use of AI, including for things like risk management, policies for the use of high risk AI systems. It established an AI governance committee, and it required public agencies to disclose their use of AI to their constituents publicly. And finally, it also had a provision creating an AI inventory. So packing a lot of those, AI governance and transparency mechanisms into that bill. Transparency mechanisms into that bill.
And adding on to that, the fun doesn't stop. There's also this was the year of chatbot bills. Right? And so we saw chatbot bills focused on mental health, Right? And so we saw chatbot bills focused on mental health and, or and health with large, like, whether or not a doctor has to disclose if they're using an AI tool to record you, focused on, like, companion, like, chatbots, whether or not compare like, chatbots can, like, try to show or create or craft an emotional relationship with, the user, and then also kind of broad chatbot regulations around disclosure about are you interacting with a chatbot in a context where it doesn't seem like you would be interacting with a chatbot. And each of these different types of chatbot bills come with broad flavors and also ones focused on kids. And, of course, if you say, oh, a technology can only be or or needs to be regulated when it's being used with kids, that requires verifying whether or not the kids are in fact kids, whether the users are are kids or are adults. And so that comes with age verification requirements of some form or other. You also see some bills that are focused on where does the data come from, how is it being used, how can you show either in an election context or elsewhere if data if, like, a piece of content was created by artificial intelligence. Is the responsibility by from platforms to disclose that con that kind of, like, pass through message that, oh, hey. There's some metadata embedded in an image that says it's AI. Does the platform have to actually tell that to users or make that available to users? And so we've seen kind of, like, a broad range of bills that kind of touch on just every single aspect. But I will say that the thing that was kind of the big theme of this year or where there was the most momentum was on chatbots.
I wanna push us forward a little bit and discuss preemption because it feels like with all of these laws moving through the states, there's gonna be some kind of friction there. Right? Can you, Travis, can you talk a little bit more about the battle over federal preemption of state AI laws and where things currently stand and what the actual effect of this fight has been on state lawmakers?
Absolutely. So I will say that the impression that you might get from the podcast so far is there's so much happening in The States. The truth is there's a lot of activity in The States, a lot of bills that have been introduced, a lot of conversations and discourse. But in terms of the laws that have been passed, there's actually quite a lot fewer. And if you look at other areas of regulation like alcohol or agriculture, something like that, you could probably see similar numbers of lots of bills being introduced and a fairly smaller number that are actually passing. However, the fact that there is activity, that there are regulations being passed has caused a lot of people to come to the federal government and say, you know what? We don't like this. We don't like that there will be these regulations being put in place, and we're worried that there's gonna be some inconsistencies in how these laws are being put in place. Please preempt all these laws, and we've seen this before. Usually, what happens, though, is at the federal level, you say, okay. We're going to protect you and protect everyone the same way, and those protections are universal for people living in United States. Right? With the first time that the preemption came through, it said, for ten years, you can't do anything to regulate AI states, and we're also not going to do anything. We're we we need some time to think about it. We're gonna we're gonna think about it a little bit more. Don't don't you worry. We'll we'll come up with an idea. But in the meantime, while we're thinking, don't just don't do anything, please. And that was awful. It was such a bad idea, and it actually lost 99 to one. The truth is is that it was probably a little bit closer in terms of some of the negotiations in the last minute kind of back and forth and, ultimately, because it was going to lose. It lost 99 to one in the senate, but it lost 99 to one in the senate. And then they tried again with the national defense authorization saying, oh, well, this is must pass. And so you have to put in preemption because, like, it's gonna be because national security, and that also failed. So then the White House came out and said, well, if Congress can't do it, we're gonna do it. And then their lawyer said, actually, you can't. It's the Congress has to preempt things. You're you're not actually able to. So they're saying, well, you know what we can do and what we're really good at? We're really good at bullying. And so we're gonna go and we're gonna sue the states that are have laws that we don't like, and we're also going to withhold funds from a program called BED, which deploys broadband. We're gonna withhold some of those like, a chunk of those funds from states that have AI laws that we don't like, and we're just gonna threaten them. And then the law they're they're gonna stop, and they didn't. The states haven't stopped. Some, however, particularly red states, have had bills where where they have had and this has been reported widely in the news. The White House has gone to the legislators or to the governors and said, don't do this. We don't like this bill. We think that this shouldn't should be a you know, this is overregulation. Stop. And they did. In purple states and blue states, that hasn't been the case, and people are still moving forward, still passing bills. And so it's it's kind of an interest it will be interesting to see how that dynamic moves forward, especially with all these Republican state legislators who had, like, these great ideas for bills. Sometimes they were bad ideas, but they thought they were great ideas for bills. And they were gonna put things forward, and then they were told by the White House, no. Stop. And that that they they might only hold on to that for so long. So that's where it stands currently. There is still a push from the White House and from their allies in Congress to preempt, but it has lost a significant amount of momentum and steam from what we saw last year. It sounds like really states are the ones leading the charge right now.
Maddie, I wanna turn to you and ask, as these states try to get nuances right, what are some of the unique considerations that policymakers really need to keep in mind when they're looking at an AI in public agencies versus educational setting, for example?
Yeah. It's a great question, Jamal, because as Travis mentioned, there's been a lot of proposed bills, particularly in education and the public sector. There's actually been, I think, more bills actually passed, but still, again, like, a a fairly few amount. So I think there's two things that I would highlight. The first, in terms of policy making and especially in how AI is being used in government use and the education context is we're not just talking about generative AI and chatbots. I think that that's been a really big focus of a lot of the legislative proposals. And I wanna say particularly in the education sector, there's a lot of focus on tools used for personalized learning or personalized learning or teacher feedback, etcetera. But in both cases, there's a lot of different types of AI being deployed and used, and a lot of these are even more high stakes than some of these generative systems. So when we're thinking about the education context, we think about predictive AI powered analytics that are saying, hey. This student is at risk of dropping out. We know that a lot of those tools have bias and discrimination tendencies. We're also talking about things like AI powered student activity monitoring that is flagging students' messages, emails for keywords that indicate that they are at risk of harming themselves, harming others, suicidal ideation. But in a lot of these cases and through the research that CDT has done, we found that a lot of these systems can actually falsely flag things because these systems, you know, do not have the context to say, you know, when someone, you know, makes a comment to their friend, that they're, you know, quote, dying, laughing, that might not be appropriately flagged by the AI system. And then both in the public sector context, there's AI tools being used to determine who gets access to public benefit systems. Other things like in the child welfare context, there's predictive analytics being used to determine which kids are at most risk for entering the foster care system. But for similar reasons, as I mentioned earlier, there's a lot of bias, a lot of discrimination that can come out of those systems. So I think the first, again, is just that there's a lot more high risk uses of AI in these contexts beyond just generative AI. The second is there are existing laws at both the federal and state levels in both the education and public sector context that agencies and schools have to already comply with and also in the context of AI apply. So these include things like title nine for civil rights and student privacy laws for schools. And then when it comes to public agencies, they already have laws and policies related to privacy, to procurement. And a lot of these laws overlap with things like AI. So I think that policymakers should really think about how the new introduced proposals that they have intersect with these laws, how they can build on a lot of these laws because in a lot of places, in the states and then at the federal government, these laws are very robust and have a lot of, you know, protections that also apply to the deployment of AI. Travis, I wanna turn to you because now that we're moving through 2026,
what has been the biggest shift you've seen from 2025 until now in state level legislation and regulation? And on the flip side, are there any trends that have remained consistent?
Sure. So, again, I would respond that the shift has been, like, chatbots are kind of the new shiny thing that everybody's focused on. I do think that the that last year, there was a lot of focus more on these kind of broader system level kind of, like, consequential decision style bills. And there was some momentum around that that did get ultimately somewhat blunted, and we're seeing fewer of those style of bills really kind of, like, push it getting pushed or getting close to the end. You know, if you take, Connecticut, for example, Connecticut last year came really, really close, to passing s b two, which was a Colorado style kind of, like, you know, consequential decision, like, automated decision system style bill. And, ultimately, the governor was not going to sign it, and it did not get out of, the legislature. And this year, instead, they passed a chatbot bill, that included, some of the governor's priorities in terms of, like, creating a safe harbor and then also, did include the kinda more narrow employment focused ADS style bill. I think that we're also seeing, you know, some of the overlaps with AI and other types of issues starting to pop up a bit more. We're seeing some bills that are a bit more focused on privacy. Right? Like, there is some some of that, starting to to percolate up a little bit. What are the consistencies? Well, I do think that over the last couple of years, we are seeing consistent attempts to put in place guardrails and regulations around the use of AI. And I do think that we're seeing a focus of that be on, in terms of broad scale AI, transparency, some degree of accountability, right, in terms of either trying to figure out how liability should be distributed between the people who use the AI system, the people who are developing the AI system, and the people who are maybe the intermediaries in between somehow. Or conversely, things like auditing or, you know, kind of the the style of, like, you need to have a published plan that you can be audited against or there's particular, like, giving tools to regulators in order to in order to actually audit against, preexisting law. So I do think that there is some kind of, like, growing trend and focus on that particular thing, as opposed to regulating AI specifically with the exceptions of chatbots where there is still this kind of, like, drive to specifically define and regulate the technology as the technology. And given a lot of the news stories, it's not surprising. Right? Like, chatbots kind of are somewhat novel,
and so there is potentially some gaps that do need to be filled in terms of how we address or interact with these tools. So we've taken a look forward. Maddie, I'd like to take a step back and look at the past few legislative cycles as a whole. What are the biggest and most critical lessons that lawmakers should take away when it comes to how AI and data are actually used in education and public agency? Education
and the use of AI for public services are particularly high stakes and high risk domains, and AI is actively being used in these high risk ways. And then I think something else, that colors both of these sectors is even when lawmakers or just the average person perceives an AI use case to be low risk in these scenarios, it's critical that folks really reexamine, and I'll give an example of a low risk AI use, that is actually high risk. One of them in the education context is generative AI systems that give writing feedback. Seemingly a low stakes use, and actually helpful for students. There's an emerging study coming out of Stanford that these writing feedback AI systems that give students, you know, assistance on their grammatical style, etcetera, actually changed their feedback when it knew the student's race and gender. So that's just sort of one example of how you can look on its face. This is a low risk use of AI, but, actually, it can have discriminatory impact. The second biggest critical lesson that I think lawmakers should take away in these two domains is that AI regulations in the public sector and education have bipartisan and public support. And I think that that's unique to these two domains where we saw in the 2025, 2024, and even this legislative session, a lot of both blue and red states are proposing bills and passing them on public sector regulation and AI in education related to things like establishing graduation requirements that say students have to complete a class on AI. The third biggest takeaway related to the first one is that communities really do care about how AI is used to impact education and government services because it can have such large impacts on their children, their communities, their families. And so I think that a really big takeaway is that lawmakers should really prioritize community engagement on these issues and putting those into legislative proposals. I think across the country, we're seeing, you know, parents push back on AI use in classrooms. We're seeing even the data center push back. We're seeing communities rise up when facial recognition systems are installed in their local city, and, you know, they were not aware of these systems being deployed. So I think that lawmakers really need to take steps to listen to their constituents and ensure that proposals are responding to the needs of their communities.
We all know CDT is active across many fronts. Travis, what are some of the other issues that the team is focusing on at the state level outside of AI? And do those issues overlap with AI policy at all?
Absolutely. And I will say that Maddie is so fantastic in talking about public sector and education, but guess what? She is now on the state's team and gets to do all of the things too. And so we are so excited to have her on the state's team, doing work on, age verification across the board, not just for artificial intelligence or chatbot tools. Oftentimes, those types of, restrictions actually violate kids' rights, their rights to access information, their right to read, and the rights of adults to access that information as well. We are active on privacy. That is a fight that feels like it will has been decades long and probably will never go away, but we are fighting continuing to fight for good comprehensive consumer privacy laws as well as things that's like, bans on the sale of precise geolocation data that, can expose really sensitive aspects about people's lives. We're fighting, on things like the proper regulation of government use of technology, such as facial recognition technology or automated license plate readers. We're also, actively monitoring shield laws, which is, where states are refusing to extradite people or honor other states' attempts to criminalize activity in other states regarding abortion right and abortion access. We're active on a range of issues that Maddie's former team worked on, including federal government access to state held personal information and how to help bolster protections at the state level against those types of intrusions. We're also active on elections and democracy. Our team is really in the weeds on helping state officials work through the cybersecurity threats that they are facing, especially in the collapse of CISA as a coordinating body for those types of cybersecurity incidents. So there is a broad range. And do they all interact with artificial intelligence? The unfortunate answer is, yeah, kind of, because artificial intelligence is a black hole that pulls every issue into it and actually does in some way, form, or other touch on that. But that's the thing about this tech policy piece. Right? It does all interrelate. It is all kind of part of the same universe. And when you touch on one aspect, you are talking about the others. When you're talking about age verification, you are talking about privacy. Right? When you're talking about elections, you are talking about surveillance. So all of these things do interact, and at its core, that's what we're fighting for. We're fighting for users and user rights and individual rights across this sphere and all the different ways the technology touches on it. Keeping those overlapping issues and the current landscape in mind, Maddie, what are some key policy priorities that lawmakers
should include in bills and other regulatory measures moving forward? Yeah. I think the three key areas that CDT's
equity and civic technology team are focused on in particular, which again covers education and public sector uses of AI, are risk management, AI governance, and transparency. And even though the equity and civic tech team is focusing on these, I think that these three priorities actually cut across a lot of CDT's issue areas. So I'll go into a few examples of what I mean when I say that. So in the education sector, this includes things like creating and incentivizing the adoption of model AI policies so that schools and school districts actually have frameworks to understand, you know, how students should be using AI in responsible ways, how teachers should be using AI in responsible ways, and how school administrators can respond to things like deepfake, nonconsensual intimate imagery, how students and teachers can protect privacy and security when they're using AI tools. The second on the risk management front is actually, again, establishing formal avenues for community members to provide input on whether and if, schools and school districts should actually use AI. As I mentioned earlier, there's there's a big need for this across communities and across states. So those are two things in education that can be addressed in the risk management context. Going into AI governance, another thing that state lawmakers can be focused on is actually doing things like creating a vetting process for AI ed tech vendors to one understand who is operating in their state across schools, and then two, understanding their policies as it relates to pedagogy, privacy, security, and ethical standards so that the state and schools can, actually vet which tools are being used and make sure that those are actually protecting students, enhancing their educational experiences. And then finally, on the transparency front in education, this can include things like requiring AI inventories for schools and school districts and ensuring that they're publicly available, regularly updated, and easily accessible to the public so that the community can understand how their children's schools, their community schools are using these tools. On the government use of AI side, some other things that state lawmakers can focus on, first in the risk management category is doing things like incorporating AI governance requirements into contracts with government service providers, including, language like, requirement of risk management practice and data privacy protections so that those things are actually built into the contracts with these AI providers so that they have to follow these, protections and requirements. The second is doing things like directing agencies and government wide offices to develop AI training for their employees. I think this is a really important way to make sure that employees in the government are privy to privacy and security protections for their constituents' data, etcetera. Some other things on the AI governance front is doing things like creating a government wide AI governance board that actually guides statewide AI governance priorities. So when everyone's on board in terms of how they're moving forward with AI, on board with the ways that agencies, again, should be protecting constituents' data, making sure these systems are being used in ways that actually enhance government services rather than take away from them or, introduce harms to constituents. That's another really important mechanism. And the last on transparency in the public sector context is actually instituting notice and disclosure requirements for public facing AI tools. So this can include explanations about why and how an outcome was determined or influenced by an AI system, say, in a public benefit setting. So why someone's benefits were cut or why they were adjusted and giving constituents knowledge that AI is actually influencing their access to government services and give them mechanisms for recourse and remediation. So there were those are just a few of the policy priorities that I think lawmakers can really address, in both of those context. CDT on our website, we actually have resources that go into more detail that viewers are welcome to check out. To close this out and, Travis, this question is for you.
Looking further down the road, what are the emerging issues that you see as the next big thing state legislators are going to focus on. And is there anything states can do right now to help prepare for them? Yeah. So,
two things. One, we actually saw some movement on it this year, but I think it's gonna continue to gain momentum, and we're gonna see even more of these style of bills, happening next year, which is on surveillance pricing, which is the practice of using personal information to set individual prices. This is a form of dynamic pricing where, you know, like, your prices change depending on the time of day or, like, you know, whether you're close to the store or not close to the store or something like that. Surveillance pricing is, like, way beyond that because it's taking also your personal data to say, oh, and we're going to set the price for you. And if we think you are going to be susceptible to this, like, quote, unquote discount or if we think that you would actually pay a whole lot more because you really need this thing right now and you have no other choice. And so it's a pretty horrific practice, and we're seeing attempts to, rein it in across both red and blue states and with some mild successes this year. And I think that we're gonna see even more in the next year. The second thing that I think we're gonna start seeing in state legislatures, which is gonna be a hard one to grapple with, is AI agents. What happens when you actually take these models that we've been talking about and actually empower them with your credit card or with the with a a broad task to not just simply talk to you and tell you what to do, but to go out and represent you or pretend to be something else or just do things. Right? Where does the liability where does the agency lie for if things go wrong, if there is harm? And we're starting to see government officials starting to grapple with that both in terms of how they can or should use agents, but then also how to protect people from the harm that these agents could potentially cause. So I do think that we're gonna be seeing some of that happening as well. What I don't think that we're gonna see is any stop at the state level in grappling with these tech policy issues because I do think that we're there is, a just increasingly intense focus on, understanding of, and desire to help mitigate against some of the harms that are being caused by these tools and technologies while also, like, actively being able to use them for good purposes
and in ways that are helpful. So it sounds like we're gonna have to plan to bring you both back on very soon. We're always available. Jamal, anytime you want. Well, Maddie and Travis, it's been a pleasure having you both on. Thank you for listening to Tech Talks, presented by the Center for Democracy and Technology. I've been your host, Jamal Magby. Tech Talks is edited by Jacob Kaufman and produced by Drew Courtney. Check out more of CDT's work by visiting us online at cdt.org and on various social media at send them tech. That's c e n d e m tech. Thanks for talking tech.
