Experts urge Michigan to require safety protocols, third‑party audits for largest AI developers

Presenters for House Bill 4668 told the Michigan House Judiciary Committee on Feb. 20 that the bill would require the state’s largest AI developers to publish safety and security protocols, allow independent audits, and submit quarterly implementation reports.

Andrew Dorris of the Secure AI Project, a nonprofit, said the measure targets “very large companies that spend more than a $100,000,000 a year developing these foundational models.” He told the committee the bill would require four main actions: publish and follow safety and security protocols for preventing “critical harms” (defined in testimony as harms causing more than 100 casualties or more than $1,000,000,000 in economic damage); provide quarterly reports of tests and outcomes; submit to independent third‑party audits to confirm compliance with published protocols; and provide whistleblower protections for employees who report unmitigated critical risks.

Daniel Croft, senior researcher at the Center for AI Risk Management and Alignment and a nonresident fellow at the Berkeley Risk and Security Lab, summarized the threat landscape the bill intends to address and urged Michigan to act, noting the state’s manufacturing and agricultural sectors could be affected by advanced AI misuse. Croft said advanced models already demonstrate unexpected and hazardous capabilities — including autonomous exploitation of cyber vulnerabilities in testing environments — and said the bill’s developer‑focused design is intended to be adaptable as the technology evolves.

Committee members asked about flexibility, enforcement, cost and who would pay for audits. Dorris said the bill is deliberately “light touch” on specifying particular tests and avoids defining “frontier” models by technical metrics; instead it targets organizations that meet specified developer‑spending thresholds. On enforcement, Dorris said the attorney general could seek civil fines of up to $1,000,000 for violations and that companies would hire and pay the third‑party auditors; if violations were found, the company would be liable for fines.

Committee members raised questions about whether the bill would impede small businesses; presenters said the thresholds exclude small and mid‑sized companies. Presenters also compared the proposal to other state efforts, saying it has a narrower developer‑focused scope than some bills that would create new regulatory bodies or impose mandatory incident reporting.

No committee vote on HB 4668 occurred at the hearing; the item was presented for consideration and followed by questions from committee members.