IN SB0150: Artificial intelligence and cybersecurity.

In one paragraph

Indiana's SB 150 (Public Law 108 of 2024) creates a 15-member legislative AI task force (IC 2-5-53.7) that studies AI used, developed or considered by state agencies, assesses its benefits, risks and effects on residents' rights, privacy, employment and economic welfare, and reports recommendations by October 31 each year. From July 1, 2025, state agencies may submit AI inventories and public entities may adopt technology and cybersecurity policies; entities connecting to state technology infrastructure after July 1, 2026 (public entities after July 1, 2027) must meet cybersecurity rules. Signed March 13, 2024; task force effective July 1, 2024; the AI chapters expire December 31, 2027.

Plain-English summary, written with AI assistance. The official text controls.

What it means for business

Private entities that connect to Indiana's state technology infrastructure after July 1, 2026 need a cybersecurity assessment every two years and secondary user authentication; software vendors may not restrict the hardware state agencies run licensed software on.

Key provisions

1. 1AI task force (IC 2-5-53.7, effective July 1, 2024): 15 members, including four legislators (the Speaker's and President Pro Tempore's appointees co-chair), the chief information and chief data officers (nonvoting), the solicitor general, and governor's appointees with expertise in ethics, AI, law enforcement AI use, legal and constitutional rights, and the cloud industry; first meeting by September 1, 2024
2. 2The task force studies agency AI and other bodies' recommendations, assesses benefits and risks to agencies and effects on residents' constitutional and legal rights, privacy, employment and economic welfare, and reports recommended policies and legislation by October 31, 2024 and each October 31 after
3. 3AI inventory (IC 4-13.1-5, effective July 1, 2025): by November 1, 2025, each executive or legislative state agency may submit an inventory of AI in use or under consideration (vendor, purposes, whether it informs decisions or makes them without human intervention, data, security, benefits and risks, costs, third-party testing, bias evaluation) to the office of technology and the task force
4. 4Public entities (political subdivisions, state agencies, school corporations and state educational institutions) may adopt a technology resources policy, a cybersecurity policy and mandatory employee training; cybersecurity policies are confidential
5. 5Public entities connecting to the state's technology infrastructure after July 1, 2027 need a cybersecurity assessment every three years, a .gov domain (agencies and political subdivisions) and secondary end-user authentication; other entities connecting after July 1, 2026 need an assessment every two years and secondary authentication; noncompliant entities may be disconnected
6. 6Software licensors may not require a state agency to run licensed desktop or server software on dedicated hardware or otherwise restrict its choice of hardware; title to state and local government records is held by the state or the local government
7. 7Passed the Senate 47-2 (January 29, 2024) and the House 97-0 (March 4); conference report adopted March 7; signed March 13, 2024 (Public Law 108); Section 1 effective July 1, 2024, the rest July 1, 2025; the task force and inventory chapters expire December 31, 2027

Latest legislative action

Mar 13, 2024. Public Law 108 (signed by the Governor March 13, 2024)

Sponsors (showing 5 of 14)

Roll call votes (showing 3 of 5)

Amendments (9)

• Senate Commerce and Technology Amendment #4 Not adopted 2024-01-18
• Senate Amendment #2 Not adopted 2024-01-22
• Senate Amendment #1 Not adopted 2024-01-22
• Senate Amendment #4 Not adopted 2024-01-23
• Senate Amendment #3 Not adopted 2024-01-23
• House Government and Regulatory Reform Amendment #8 Not adopted 2024-02-20
• House Amendment #3 Adopted 2024-02-29
• House Amendment #2 Adopted 2024-02-29
• House Amendment #1 Not adopted 2024-02-27