MI HB4668: Trade: business regulation; requirements and safety standards for developers of certain artificial intelligence models; provide for. Creates new act.

In one paragraph

Michigan's HB 4668 (as introduced) would create the Artificial Intelligence Safety and Security Transparency Act. Large developers of foundation models (compute costing at least $5 million for one model and $100 million over 12 months) would have to publish a safety and security protocol for critical risks, publish transparency reports at least every 90 days, and get an annual third-party audit, with whistleblower protection. The attorney general could seek fines up to $1,000,000 per violation. Re-referred to the House Communications and Technology Committee March 19, 2026; it has not passed either house.

Plain-English summary, written with AI assistance. The official text controls.

What it means for business

None yet: the bill has not been enacted. If enacted, only developers of very large foundation models would have to publish risk protocols and reports, undergo annual audits and protect whistleblowers.

Key provisions

1. 1Applies to a 'large developer': one that developed a foundation model using compute costing at least $5,000,000 and, in the preceding 12 months, foundation models using compute costing at least $100,000,000
2. 2Critical risk: a foreseeable and material risk of death or serious injury to more than 100 people, or more than $1,000,000,000 in damages, from a CBRN weapon, a cyberattack, or a foundation model acting with limited human intervention in a way that would be a crime requiring intent, recklessness or gross negligence if done by a person
3. 3Beginning January 1, 2026, a large developer would produce, follow and publish a safety and security protocol, and publish material changes within 30 days
4. 4At least every 90 days it would publish a transparency report, and it would retain test results for 5 years; knowingly false or materially misleading statements would be barred
5. 5At least annually it would retain a third-party auditor to assess compliance and publish the audit report within 90 days of completion
6. 6It could not retaliate against employees who report critical risks to authorities; it would have to keep an anonymous internal disclosure process, with a civil fine up to $500 and employee civil actions
7. 7The attorney general could sue for violations of the publication and audit sections, seeking a civil fine of up to $1,000,000 per violation and injunctive or declaratory relief
8. 8Status: introduced June 24, 2025; re-referred to the Committee on Communications and Technology March 19, 2026; not passed by either chamber

Latest legislative action

Mar 19, 2026. re-referred to Committee on Communications and Technology

Sponsors

Roll call votes