Michigan House Bill 4668 (Artificial Intelligence Safety and Security Transparency Act)

• Authority: Michigan
• Parent authority: State governments
• Jurisdiction: United States
• Collections: U.S. state and local documents
• Most recent activity: Proposed
• Most recent activity date: 2025-06-24

Risk subdomain coverage

Good coverage — Comprehensive governance measures or mitigations with clear procedures relating to the risk subdomain are explicitly described.

• AI system security vulnerabilities
• Cyberattacks, weapon development or use
• Governance failure
• AI pursuing its own goals
• AI possessing dangerous capabilities
• Lack of transparency or interpretability

Minimal coverage — Brief mention but no specific mitigations, recommendations or governance measures relating to the risk subdomain are described.

• Overreliance and unsafe use
• Competitive dynamics
• Lack of capability or robustness

All other risk subdomains had no coverage in this document.

Risk Coverage Summary

The document has good coverage of approximately 8 subdomains, with strong focus on malicious actors and weapons (4.2), AI system security vulnerabilities (2.2), governance mechanisms (6.5), and AI safety failures including goal misalignment (7.1), dangerous capabilities (7.2), lack of robustness (7.3), and lack of transparency (7.4). Coverage is concentrated in security, catastrophic risk prevention, and AI safety domains.

Sector coverage

Good coverage — Comprehensive governance measures or mitigations with clear procedures relating to the sector are explicitly described.

• Information
• Scientific Research & Development Services

Minimal coverage — Brief mention but no specific mitigations, recommendations or governance measures relating to the sector are described.

• National Security

All other sectors had no coverage in this document.

Sectors Summary

This legislation governs foundation model developers rather than specific application sectors. The regulated entities ('large developers') primarily operate in the Information sector (tech companies developing AI) and Scientific Research and Development Services sector (AI research labs). The law does not regulate downstream use of AI in specific industries like healthcare or finance.

Legislative Status

Hard Law

Legislative Status Summary

This is a binding legislative instrument with mandatory obligations ('shall'), civil penalties up to $1,000,000 per violation, and enforcement by the Michigan Attorney General through civil actions and injunctive relief.

Actors

Proposer

• Entity Types: AI_Governance_Actor
• Summary: The document header indicates this bill was introduced by Rep. Lightner and referred to the Committee on Judiciary, identifying the legislative proposer.

Target

• Entity Types: AI_Developer
• Summary: The document explicitly defines and targets 'large developers' - entities that develop foundation models meeting specific compute thresholds. All mandatory obligations ('shall') are imposed on large developers.

Enforcer

• Entity Types: AI_Governance_Actor
• Summary: The Attorney General is explicitly granted enforcement authority to bring civil actions, seek fines and injunctive relief, and inspect unredacted documents for violations of the act.

Monitor

• Entity Types: AI_Governance_Actor
• Summary: The document mandates annual third-party audits by reputable auditors with specific expertise requirements. The Attorney General has inspection rights over unredacted documents, providing governmental monitoring oversight.

AI Lifecycle Stages

Lifecycle stages covered by the documents, as defined in the OECD Framework for the Classification of AI Systems

• Plan and Design
• Collect and Process Data
• Build and Use Model
• Verify and Validate
• Deploy
• Operate and Monitor

AI Lifecycle Summary

The document comprehensively covers the AI lifecycle from development through operational monitoring. It addresses Build and Use Model (compute thresholds for training), Verify and Validate (extensive testing and assessment requirements), Deploy (deployment decision procedures), and Operate and Monitor (quarterly transparency reports, incident response, ongoing audits) stages with detailed requirements. Plan and Design is implicitly covered through safety protocol development requirements.

Technical Scope

Terms relating to technical scope that are mentioned or implicitly referenced in the document

• AI Models
• Foundation Models
• Compute Threshold

Technical Scope Summary

The document explicitly focuses on 'foundation models' as its primary technical scope, defining them as AI models trained on broad datasets, designed for generality, and adaptable to wide-ranging tasks. It uses compute thresholds ($5M and $100M in computing costs) to define regulatory scope rather than capability-based definitions. The document does not explicitly use terms like 'frontier AI', 'general purpose AI', or 'generative AI', though foundation models encompass these concepts.