This is Gregory Allen with the AI Policy Podcast. On today's show, we're talking with Dean Ball of the Mercatus Center about state and local regulation of AI, which, in his words, is where the action is.
My guest today is Dean Ball, who is a research fellow in the Artificial Intelligence and Progress Project at George Mason University's Mercatus Center. In addition to his role at George Mason, Dean Ball is also the author of the Substack Hyperdimensional, where a lot of his work goes out these days. And before this, he was a senior program manager in the Hoover Institution's State and Local Governance Initiative, which is not the only thing on his resume focused on state and local governance initiatives. So, at the intersection of AI and state and local government policy, we're very lucky to have you here, Dean. Thanks so much for coming on the show.
Thanks so much for having me.
So before we get into the weeds of all these hundreds of bills that are out there right now, I kind of want to understand a little bit more about you. So, you've been doing state and local policy analysis work for a while. How did you get into that work, and then how did you get into AI?
Well, it really all started for me in college. I read a book called Triumph of the City by Ed Glaeser. I went to college in upstate New York, and reading that book, it occurred to me that not only are cities these interesting economic units, but they're also governance units, and they have local governments. And in fact, New York City has a government that dwarfs the size of most national governments around the world. And so that seemed really interesting, and like there were a lot of practical problems to be solved. So I went and interned for a think tank called the Manhattan Institute, where Glaeser was affiliated, and sort of followed in his footsteps, I suppose, and then ended up getting a full-time job there. Did state and local policy at the Manhattan Institute for about five years, took a brief detour—well, about a four-year detour—doing some other things that were related mostly to policy and economic education of young people, and then really realized I loved state and local policy, so went back to it at Hoover from about 2022 to 2024, and then joined Mercatus to do the AI policy writing. But kind of in parallel with all that, I've always been very interested in technology. Most of my state and local work was things like housing, transportation, public safety, and economic policy—not really a lot of tech policy. But since I was a kid, you know, I learned to program when I was like 10 or 11 years old. I've always been very interested in that, and so this seemed like a good intersection. Though I will say, when I joined Mercatus, I was not really expecting to be focusing on state and local policy all the time. It just so happens that that is kind of where all the interesting domestic policy on AI is being made right now.
Yeah, so at the same time that the federal government, especially in Congress, is mostly gridlocked—it's really hard to pass any kind of laws—the states are taking up that mantle, exercising their governance authorities, and which is why we wanted to have you on the show. So, at least according to the tracker put out by MultiState, there are now 833 bills related to AI that have been introduced so far in 2025, and we're only in March. That's an average of 16 per state, so way more than what happened in 2024. You know, what do you think is really the story of how we got here with this explosion in legislative initiatives? Like, what has prompted this influx of state-level AI legislation?
I think it's a few different things, but if I were to summarize it in one sort of point of view that you hear on the left and the right very frequently, it's: we don't want to repeat what happened with social media. Now, you can debate whether what happened with social media is really something that public policy could have ever fixed. Like, could you have ever foreseen what would have happened in like 2007 or something and passed a law to fix whatever it is you think went wrong with social media? I'm skeptical of that, but that is the general sentiment: that we need to get ahead of this because we didn't get ahead of other big technologies, and now we feel as though—uh, we being the policymakers—feel as though those technologies are beyond our control.
That's so interesting because, you know, Meta, obviously one of the largest social media platforms on Earth, has been running advertisements saying that they support comprehensive legislation on social media for, I don't know, five years now, and yet it still hasn't happened. So how has it happened, you know, that the number one giant behind this, quote-unquote, supports comprehensive legislation, but it keeps not happening?
This gridlock phenomenon is pretty remarkable and pretty stubborn. And so, as you said, policymakers see AI and they're like, okay, maybe social media is beyond us to fix, but maybe we can prevent AI from becoming equivalently broken—or at least that's the ambition. And I think it's interesting that there are folks on both the left and the right who use this exact same language of 'we got social media wrong, let's not get it wrong when it comes to AI,' which is interesting because people don't make that argument vis-à-vis the internet writ large, right? They often say that not regulating the internet in the early days was a win, but not regulating social media in the early days was a loss. It's not clear to me that this historiography is intellectually consistent in any kind of way, but it is sort of where we find ourselves here.
So all right, there's 833 bills in 2025 alone. Colorado has actually passed something that has become law. A lot of other states have either passed something that is awaiting a governor's signature or, you know, still haven't passed anything. Can you bring some order to this madness? Like, how do we understand this universe of 833 bills?
Yeah, so I would taxonomize them in a few different categories. First category is fairly anodyne—sort of like the legislature is going to create a committee to study the effect of AI on blah.
Right, right, classic government move.
Yeah, yeah, yeah, and that's like several hundred bills right there. So you can take those kind of off the proverbial table. Number two would be deepfakes—that's a big one. And there's a wide variety of different deepfake bills, but for the most part, this is not preemptive legislation. For the most part, what this is doing is creating a post hoc sort of either civil or criminal offense. So it's like, we've always sort of thought that revenge pornography was bad. We think that the AI deepfake-enabled equivalent of revenge pornography is bad. Oh, it turns out there's not a law against that. Well, we're going to make a law against that, or something to that effect.
I mean, sometimes it's actually redundant. And then in other states, I actually did a pretty thorough survey of the statutory and common law in all 50 states to look at this issue, and it turns out that there are actually some states where knowingly distributing a malicious deepfake of someone is not in and of itself an offense, and so they wanted to make it one. In other cases, it's more of a symbolic move. So there's that, and that's a big chunk right there.
So you're already taking like quite a lot off the table. And then, sorry, just on the deepfake thing—we talked about the malicious deepfakes in terms of pornography or child sexual abuse material. There's been a lot of political momentum for that. Even when I talk about what might pass in Congress, I usually say deepfakes is the one where you can imagine something resembling a bipartisan coalition getting there. There's also the political type of deepfake, right? You can imagine some major political figure—you create a deepfake of them saying something incredibly scandalous that they never actually said. Do you think there's any momentum there, in addition to the other categories that we were talking about, or is that sort of its own animal?
There have been a bunch of political deepfake laws that have moved last year and that will move this year, I suspect. Some of those are going to run into constitutional problems. It's very hard to craft one of these laws in such a way that it's in the First Amendment.
Yeah, yeah. I mean, and California passed a very ambitious version of this that was enjoined by a court, by the Ninth Circuit, within like a week of passing.
Yeah, and so we'll see that too. Yep.
Okay, so we've got create-a-committee, big bucket. We've got deepfakes, big bucket. Keep going.
Yeah, and then we get into the more substantive buckets, and I would kind of divide that between two categories. The first, you have kind of near-term, more, you might say, 'em risks' from AI. So the big thing here is algorithmic discrimination. And I'll talk about those in more depth, I think, but there's about 15 to 20 of those bills, and these are very, very large, complicated bills affecting businesses throughout the economy, affecting AI development. So this is probably, in terms of—I think the impact of the bills, these are the most impactful bills being considered. And then there are bills aimed at—
We pause there for just one second because, you know, we were talking about how there's been a lot of inaction at the federal government level, but in the case of algorithmic discrimination, it's true in Congress, but it's not precisely true in the federal government that there's been a lot of inaction here. So if you think about organizations like the Equal Employment Opportunity Commission, which has been around since literally the Civil Rights Act which created it, you know, they basically say you're not allowed to hire, fire, promote, or give a bonus to somebody on the basis of race, right? You need a reason that is not race for why you were taking all of those actions. And what the EEOC has said, which I think is true and good, is that your use of AI is not a get-out-of-jail-free card in abiding by that. So you can't, you know, just go to a judge and say, 'Hey, I'm sorry, it's the AI that's racist, not me. If I had known it was racist, I never would have used it.' It's like, well, look, you fired somebody on the basis of race, you hired somebody on the basis of race, you gave a promotion to somebody on the basis of race. It doesn't matter that AI was the reason behind that; the existing law already applies. And the same, I think, applies in the case of housing discrimination or financial loan offering discrimination. So I think, to the federal government's credit, a lot of these agencies, a lot of these commissions have sort of noticed that their existing laws, you know, apply in an AI-enabled world. And so it's not that there's been inaction; it's just that the action that was most urgently needed was clarifying guidance to issue, you know, not some new rulemaking type of activity. And so I just want to point out that it's interesting that in these states, they're sort of saying whatever's going on in the government, whatever is going on in the agencies, it's not enough. We still want dedicated legislation that is specifically focused on algorithmic discrimination, which I think is an interesting choice.
Right, signal something that they want. What they want specifically is preemptive regulations. So the difference between what you've—and you've also seen, by the way, lots of state AGs take algorithmic discrimination-related actions against AI companies, so using their existing legal authorities without new laws.
Yeah, yes, consumer protection, civil rights—I mean, every state really has one of these. So there's a robust set of law in America about this. That's one of the points I've made, kind of pushing back on these laws. But yeah, what these laws are really more about is preemptive action as opposed to enforcing the laws after an alleged discrimination. So can you just unpack what you mean by preemptive action?
Yeah, so preemptive action in this context would mean requiring both developers and, quote-unquote, deployers of AI systems—which is to say, commercial users and regulated industries—before they use AI on a per-use case basis, if it's going to be something that, if their use of AI is going to be consequential as these laws define them, the company has to do a variety of compliance steps, including writing algorithmic impact assessments, creating risk management plans. And so these are kind of lengthy compliance steps that you have to go through before you are allowed to use the AI system in any practical way.
Okay, so to use like what I think is a straw man example, but like, are you regulating a power plant in a post-hoc environment, which is, 'Hey, you spilled a bunch of, you know, chemicals into the river, and now you're going to have a big fine,' versus are you regulating the power plant on the basis of, 'Hey, you failed to put in place procedures that we believe prevent such spills'? That's the preemptive regulation, and that therefore you're being punished for failing to put in place those kinds of safeguards.
So what you're saying is that in the case of algorithmic discrimination for the state and local bills, what they're interested in is this kind of preemptive phenomenon.
Yeah, that's right, that's right.
So the next category, and the last one, is what I would call frontier AI regulation. This is a small category; it always has been. Last year, the most prominent AI policy debate in America, I would argue, was a bill of this kind from a state—the state of California, SB 1047. And we can go into more detail on what that bill was, but I would say there are a few such bills this year. We've got some, sort of, whistleblower protections, for example, moving in a few different states, specifically for employees of frontier AI companies. And these are really bills that are intended to regulate, in various ways, the most severe anticipated risks from AI. So we're talking about, you know, widescale cyber attacks, the ability to create bioweapons with AI systems that are not even on the market today.
Yeah, this is intended at like catastrophic risk or existential risk.
I think it's fair to say so. System autonomy, things of that kind.
Yeah, so this is only for those largest models that are either aiming at explicitly or unexplicably talking about these frontier systems, not just every image classifier, not just every voice recognizer, sort of vanilla machine learning.
Great. Okay, so this is an awful lot, and we could go in a lot of different directions here, but I want to start—now that we've got our buckets—I want to start with a piece that you wrote recently in February 2025 titled 'The EU AI Act Is Coming to America.' So what did you mean by this, and what would you say is the influence of the EU AI Act on state AI bills more generally?
So the algorithmic discrimination bills that I mentioned earlier are part of a common framework that was developed under the aegis of a sort of group—a multi-state group of legislators throughout the country, Republican and Democrat. And those bills are quite influenced by the deployer-side provisions of the AI Act. So the AI Act requires deployers in, you know, regulated industries—banking, insurance, healthcare, etc.—to conduct fundamental rights impact assessments before they deploy AI. In the United States, we have laws that require people in those same industries to do algorithmic impact assessments before they can deploy AI. So a lot of the mechanisms, terminology of these bills are actually not just similar, but sometimes word-for-word the same, taken from the AI Act. And sometimes that's because they're drawing upon language from the OECD, you know, that the EU was also drawing from. Sometimes that's because they're drawing from stuff like the NIST AI Risk Management Framework or ISO—gosh, what's the number there? 4201, you know, standards that are meant to be international that a lot of legislative things do.
But you're pointing out, like, the basic mechanisms and mindset—you're seeing a lot of echoes between these state bills and the EU AI Act.
Yeah, yeah. I mean, you know, I would actually really even say the algorithmic discrimination concept more broadly started in the era of narrow AI systems. So we're talking about facial recognition, pre-ChatGPT revolution, pre-general-purpose ChatGPT-style models, right? A bank creates a specialized statistical model to predict the likelihood that a loan applicant is going to pay back their loan, and it's entirely reasonable in those contexts to ask the question: what kind of data are you using to train that statistical model? Because if it's the bank's historical data, there have obviously been periods in American history where, you know, African Americans and women and other civil rights-protected groups were not able to access financial services as well as other people could, right? If your AI is basically saying, 'Hey, we did everything right in the 1970s,' so just create a model that basically exemplifies a bank manager of the 1970s, well, you're going to run into a lot of trouble. If it's using historical data as pure ground truth, then I think there are legitimate questions to be asked. But those laws are really tailored for that kind of a system, and the EU AI Act itself was tailored for those kinds of systems because it started to come to fruition in the early 2020s, you know, in like 2020, 2021, before ChatGPT. And then ChatGPT came out, and it was this kind of enormous inconvenience for everyone. They were like, 'We were so close.' And in the EU, the way that they handled that was they created this new general-purpose AI distinction, and there's this code of practice which is for sort of frontier AI that's being drafted right now in the EU. I bet you will see that influence American states too. But really, the states are taking this kind of pre-existing thing from the EU, which I think was outdated when the EU passed it and is even more outdated now, and they're trying to apply it to general-purpose models. And it's not like a one-to-one. I mean, if you look at, for example, the Virginia AI bill, which I think is one of the ones that you pointed out has some echoes of the EU AI Act, the fines are very different. For example, I think Virginia is like a $10,000 fine per violation, which is like what Mark Zuckerberg uses as Kleenex, right? Compared to the EU AI Act, which is 6% of global turnover, you know, as the potential maximum fine for a violation, so that could be like tens of billions of dollars, literally.
So it's interesting that there's like these echoes in mechanisms, there's some echoes in mindset, as you're pointing out, but there's also like these crazy differences in what implementation and enforcement might look like.
That's true. Although what I would say there is that, you know, the big tech companies are actually going to have a pretty easy time complying with these algorithmic discrimination laws because the requirements on them are actually not so heavy. They really need to disclose some stuff about training data, some stuff about training practices, they need to have a risk management plan, etc. It's mostly stuff they already have in place. The people that will really bear the burden of this will be the commercial users, which are going to be in Virginia. In fact, literally, I would be a deployer of a high-risk system in some contexts. Like if I lived in Virginia and I tried to hire a nanny and I used ChatGPT to filter resumes, that is a deployment of a high-risk AI system for the purposes of the Virginia algorithmic discrimination law. And so technically, I as an individual would have to write the algorithmic impact—I mean, I don't think anyone's ever going to enforce—there are like exemptions for size of business in some states, but not in Virginia.
Oh, interesting. So a household employer with one employee might theoretically be subject to this.
Yeah, they're not thinking about that, though. You know, I mean, this is the thing—is they're in a completely different mindset from the way that these systems are actually being used on the ground.
Yeah, that's interesting. Now, you said that the big model developers like an OpenAI are probably going to be more or less unaffected by a lot of these laws, but at the same time, we saw OpenAI's response to the White House Office of Science and Technology Policy's RFI and the AI Action Plan. OpenAI is asking for, quote, 'relief,' end quote, from state and local AI regulation in exchange for a, quote, 'voluntary partnership between the federal government and the private sector to protect and strengthen American national security,' end quote. So what do you make of this interesting phenomenon whereby, at least in your own description just a moment ago, the big model deployers are not the ones who are principally affected, however they are asking the federal government, you know, to get involved and try and head off some of this work?
Well, I would say a couple of things. First of all, these algorithmic discrimination laws do create the possibility of negligence liability on developers for instances of discrimination, and I think that—
Can you just like walk us through a scenario for how that might happen?
Well, I mean, I guess like one good example would be if I'm trying to filter resumes—employment is covered in all these laws—if I'm trying to filter resumes and I say, 'Show me people with an advanced degree in machine learning,' and that filters out, it only shows me Asian men after doing that, then in some world that could be discriminatory.
But you said negligence, though. Like, what's the negligence mechanism?
The mechanism there, I mean, is that they have to exercise reasonable care to avoid algorithmic discrimination. So I think that, you know, trial lawyers can be quite creative, and I think we've seen that throughout the last 50 years of American history. So it would not shock me in the slightest to see—especially because, you know, the frontier AI developers have the biggest pockets. So if your option is suing some random bank in your state versus suing OpenAI or Microsoft or Meta or whatever, you'd probably, like, if you could find a way to sue the bigger guy, you probably would.
Oh, interesting. And I think there—I mean, another—I'm just thinking out loud here—but another point is that they, as big frontier AI model developers or big cloud hyperscalers, they want their customers to succeed, right? And so if their customers are these deployers, whether that's a bank, whether that's a, you know, local business, etc., if those local businesses are scared of adopting AI, then that's sort of bad for the providers.
That's right. It also diminishes their customer base, I would say. And finally, I think, you know, they're looking at the writing on the wall and seeing what could be coming next, because if the states do this this year, then next year there's going to be something else, and there's going to be something else. You know, it's not going to end with just this.
Yeah, I mean, there's kind of two ways that legislation can go. You can have something happen and, okay, good, glad that we fixed that, that's done. Or you can have something happen and that's precedent that things can happen in this world, and suddenly momentum starts snowballing.
Yes, and I think specifically in the case of the algorithmic discrimination laws, these are laws that are going to inspire lots of more laws, lots of additional laws, and lots of additional guidance. In the EU, they view this as a feature. They're like, oh, every country can have its own AI office that promulgates guidance and standards around how to implement the AI Act. We're seeing this—the one state that's passed an algorithmic discrimination law is Colorado. It was called SB 24-205, and it passed in May of last year. That law was, at the governor's request, the implementation date of that law was delayed until February of 2026 to give them this legislative session to work out the kinks, because he viewed it as very complex. Governor Polis had very significant reservations but signed the bill anyway. They created a one-year task force of the legislature to bring in stakeholders and try to figure out how to implement this law. And after a year of meeting, the task force released its final recommendations a couple months ago and basically said we have made no progress on how to implement this, because they're just very, very, very difficult laws to implement when you actually think practically and you actually bring in the perspective of people that are building technology, that are using technology. There are hospitals that have said we would have to cease use of all kinds of diagnostic tools if we use this. You know, we're trying to create new AI diagnostic tools for people with Parkinson's or whatever, but we have not satisfied the very, very, very rigorous requirements of this law on algorithmic discrimination, and so we would just have to cease use or spend hundreds of thousands of dollars on technical and compliance work.
Amazing. So I want to rewind a bit to something you said a bit ago about a multi-state group that was influenced by deployers that is sort of responsible for driving some of this. So we're seeing a lot of bills, you know, pop up in various states. As I mentioned, there's more than 800 out there right now, just in 2025 alone. To what extent are these copycats of each other? To what extent is there some external actor that is just promoting the same draft bill in multiple worlds? And to what extent is this a partisan or bipartisan phenomenon?
Yeah, you see this very frequently in the states. The states are very mimetic. If they know somebody else who's thought—if they know a legislator in another state—
who they perceive as having thought a lot about this issue is using certain text, they'll just take the text and copy it, to the point sometimes that there are drafting errors specific to the statutes of like another state, like referencing like Texas law, blah blah blah, but in Colorado, yeah, that will happen occasionally. So yeah, there are a few groups here. There's the one most prominently is a group convened by a nonprofit called the Future of Privacy Forum, which also has done a lot of work on privacy laws in the states, which have tended to mimic each other in various ways as well. That group convened a multi-state commission of different legislators, and pretty much every legislator on the steering committee of that group has introduced one of these bills, and they're all remarkably similar. This is, you know, Virginia, Texas, but also places like Arkansas and Georgia, and you know, Massachusetts, Connecticut, all over the place. So this is...
with states controlled by, you know, different parties?
Yes, yeah, yeah. So I would say it has been bipartisan so far, and you know, to a certain extent it's, well, we need to do something and this is something, and this is, you know, it's like a 50-page bill seems very well fleshed out, and so I think that there's an element of, you know, some degree of coordination that's going on here, which is again quite common.
It's funny, I mean, just thinking out loud, you said like a 50-page bill. I mean, I think the Virginia bill when we counted it was more than 6,000 words, which sounds like a lot until you meet the EU AI Act, which is 90,000 words, which is like not quite dictionary length, but boy, it's a long bill.
Yeah, and one of the... I love that the EU just released their definition of an AI system and it was like 10 pages long. It's complicated.
What is the meaning of life, basically, is what they're getting to.
Okay, so you said it's bipartisan. I mean, I think this would probably be surprising to a lot of folks because AI was a mostly bipartisan issue in Congress from, you know, 2016 until maybe certainly by 2024, I think it started to become a more partisan issue. Is that sort of the same situation in the states? Do you see it become more partisan, or what do you think is going to happen?
I find it remarkable that it's been this nonpartisan so far. So just as an example, Texas, which kind of does now fancy itself as a leader in Republican tech regulation, you know, they had a very aggressive social media bill a couple years ago that went to the Supreme Court. It was like no viewpoint discrimination in social media content moderation. So like they do introduce quite partisan-coded tech policy bills. Texas's AI bill was the same as Connecticut's and Massachusetts, basically, in fact more aggressive than those from a regulatory stance, but not in a partisan-coded way. More like, you know, I mean, it's Texas doing an algorithmic discrimination bill based on disparate impact, which Republicans hate, and the very disparate-impact-based definition of algorithmic discrimination is the first thing in these bills, first definition in these bills, and it was right there in the Texas bill, and that was like quite remarkable to me.
Yeah, and I guess at this stage though we're still talking about draft bills because Colorado, to my understanding, is the only state that's actually passed a big one.
That's right, that's right. But even the fact that the drafting is so bipartisan is kind of in of itself interesting.
I mean, and this bill, you know, so in Texas in particular, this bill actually just got completely rewritten and got a new bill number, but it was called the Texas Responsible AI Government Act, TRAIGA. And it, you know, I mean, the Texas legislature has been in session for a month and a half now, and it lived for that whole time. But I do think, frankly, Texas in particular, a lot of people sort of with a more national lens have been scratching their heads about that, thinking to themselves, why is Texas doing a disparate impact bill? And you know, all of this when this is like, you know, Trump is releasing an executive order once a day that goes after some aspect of disparate impact. So yeah, yeah.
It's... I mean, do you think there's any shot of that bill, either in its original form or its revised form, of passing? Because as you said, as somebody whose focus tends to be more national and international, I would not have predicted, you know, Texas to be the one.
Yeah, so I mean, I think that there was a real chance of it passing even in its original form, but the legislator has gotten such pushback that he has completely rewritten that bill. And it is now much more sort of coded along traditional partisan lines, which is to say the bill focuses on... it prohibits Texas government agencies from setting up social scoring systems. There's a real fear of this in a lot of... I mean, I think all over the place, but especially conservative circles, of, you know, a CCP-style social scoring system, where like you can't get a loan if the Communist Party is mad at something you said on social media, etc., etc. Not super plausible that the Texas government would set that up if we didn't block it with legislation, but okay, I would be surprised. I also think the way that it's written will probably harm the ability of a lot of Texas state agencies to use their data to do much of anything interesting from an analytical perspective, but that's like a secondary point. There's also something they're trying to do, this social media content moderation thing again, but they're doing it from an AI perspective rather than from a social media perspective. So they're saying it's illegal to create an AI system or use an AI system in a way that could be used for viewpoint discrimination on online platforms.
