Analyzing critical legal trends and developments across data, cyber, AI and digital regulations from around the world and beyond borders

On March 24, 2025, Virginia Governor Glenn Youngkin vetoed HB 2094 on High-Risk Artificial Intelligence Systems, a bill that passed through the state legislature by slim margins and which would have established a regulatory regime largely mirroring last year’s Colorado AI Act.

As with the Colorado Act, HB 2094 would have imposed a number of requirements on organizations that develop or deploy high-risk AI systems that make certain consequential decisions. Such requirements would have included the completion of impact assessments, maintaining technical documentation, adopting risk management frameworks, and providing individuals with a means to request review of adverse decisions undertaken by AI.

In his veto message, Governor Youngkin cited concern that HB 2094 “would undermine [ ] progress, and risks turning back the clock on Virginia’s economic growth, stifling the AI industry as it is taking off.” The message also points to existing laws on discriminatory practices, privacy, data use, and libel that can already be harnessed to protect the public from potential AI harms.

The governor’s veto underscores the challenges that U.S. legislators and policymakers have faced in striking a balance between encouraging innovation while promoting the responsible, safe development of AI. For instance, Texas lawmakers recently shelved their proposed Texas Responsible AI Governance Act for a new bill that focuses more narrowly on discrimination against protected classes and government use of AI. Last year, California Governor Gavin Newsom vetoed the enactment of the Safe and Secure Innovation for Frontier Artificial Intelligence Models Act following a tepid response from the industry. The Colorado AI Act which remains the only U.S. law on the books to comprehensively govern AI, is also slated for significant revisions.

With the Trump administration retreating from more proactive regulatory approaches adopted by the predecessor administration, some state lawmakers are expected to step up. But HB 2094 veto highlights the fraught path to comprehensive AI regulation at the state level and significant foundational work still needed to achieve consensus around how to regulate AI.

Author

Brian provides advice on global data privacy, data protection, cybersecurity, digital media, direct marketing information management, and other legal and regulatory issues. He is Chair of Baker McKenzie's Global Data Privacy and Security group.

Author

Adam Aft helps global companies navigate the complex issues regarding intellectual property, data, and technology in product counseling, technology, and M&A transactions. He leads the Firm's North America Technology Transactions group and co-leads the group globally. Adam regularly advises a range of clients on transformational activities, including the intellectual property, data and data privacy, and technology aspects of mergers and acquisitions, new product and service initiatives, and new trends driving business such as platform development, data monetization, and artificial intelligence.

Author

Cynthia J. Cole is Chair of Baker McKenzie’s Global Commercial, Tech and Transactions Business Unit, a member of the Firm’s global Commercial, Data, IP and Trade (CDIT) practice group steering Committee and Co-chair of Baker Women California. A former CEO and General Counsel, just before joining the Firm, Cynthia was Deputy Department Chair of the Corporate Section in the California offices of Baker Botts where she built the technology transactions and data privacy practice. An intellectual property transactions attorney, Cynthia also has expertise in AI, digital transformation, data privacy, and cybersecurity strategy.

Author

Justine focuses her practice on both proactive and reactive cybersecurity and data privacy services, representing clients in matters related to information governance, diligence in acquisitions and investments, incident preparedness and response, the California Consumer Privacy Act, privacy litigation, and cyber litigation.

Author

Keo McKenzie is a partner in Baker McKenzie's Intellectual Property and Technology Practice Group (IPTech), based in the Firm’s DC office. Keo has significant experience advising multinational technology, life sciences, and healthcare companies with complex matters related to regulatory and transactional issues presented by digital health technologies.

Author

Avi Toltzis is a Knowledge Lawyer in Baker McKenzie's Chicago office.