Michigan HB 4668 (2025–2026)
AI-generated text. This page was generated using artificial intelligence.
Artificial Intelligence Safety and Security Transparency Act (proposed)
Michigan, United States
Proposed state legislation
HB 4668, 2025–2026 session.[1]
Pending; re-referred to House Communications and Technology March 19, 2026.[1]
Introduced text proposes January 1, 2026 duties; bill remains pending in the reviewed record.[2][1]
October 11, 2026 — full introduced text and bill history reviewed.
Michigan HB 4668 would create the Artificial Intelligence Safety and Security Transparency Act. Representative Sarah Lightner introduced it June 24, 2025. Its latest recorded action is a March 19, 2026 re-referral to the House Committee on Communications and Technology.[1]
Scope
The introduced bill covers a developer that meets both computing-cost criteria: it has developed a foundation model costing at least $5 million in computing power, and within the preceding 12 months has developed one or more foundation models with aggregate computing costs of at least $100 million. Costs are measured at prevailing U.S. cloud-computing market prices when the power was used. A foundation model must be trained on a broad dataset, designed for general output and adaptable to varied tasks.[2]
A critical risk is a foreseeable, material risk of an incident resulting in death or serious injury to more than 100 people, or more than $1 billion in damage to money or property rights, through specified weapons, cyberattack or autonomous criminal conduct. Harm inflicted by an intervening person is included where the developer’s activities made it substantially easier or more likely to inflict that harm.[2]
Proposed requirements
Developers would publish and follow safety and security protocols describing risk thresholds, testing, deployment decisions, model security, mitigation, incident response and reporting, reassessment and independent-expert roles. They would publish material protocol modifications within 30 days, transparency reports at least every 90 days and retain specific risk-assessment tests and results for five years.[2]
The bill proposes annual third-party compliance audits and publication of audit reports within 90 days of completion. Permitted redactions would require an explanation, retention of unredacted records for at least five years and Attorney General inspection on request. False or materially misleading statements or omissions in required documents would be prohibited.[2]
Whistleblowers and enforcement
The bill would protect employees reporting critical risks to appropriate authorities, provide an anonymous internal reporting process and require monthly investigation updates. Protected employees include specified contractors, subcontractors, unpaid risk advisers and corporate officers. An employee alleging retaliation would have 90 days to bring a civil action for damages, fees, reinstatement or other relief. Section 11 also provides a civil fine of up to $500 for a developer’s violation of that section.[2]
For violations of the protocol, transparency or audit requirements in sections 7 and 9, the Attorney General could seek civil fines up to $1 million per violation and injunctive or declaratory relief. The Attorney General could also seek an injunction where a developer’s activities present an imminent critical risk.[2]
Timeline and proposed dates
- June 24, 2025: Introduced and referred to Judiciary.[1]
- September 2025: Referred to Communications and Technology, then Regulatory Reform.[1]
- March 19, 2026: Re-referred to Communications and Technology; latest recorded action in the history reviewed October 11.[1]
- The introduced text states January 1, 2026 as the starting date for sections 7 and 9 duties. That date appears in the proposal; the reviewed history establishes a pending bill rather than operative statutory duties.[2][1]