MI HB4668

Requires "large developers" (companies that have spent at least $100 million on computing power for AI foundation models in the past 12 months) to implement and publicly publish safety and security protocols for managing "critical risks" beginning January 1, 2026

Defines "critical risks" as foreseeable risks that could cause death or serious injury to more than 100 people, or more than $1 billion in damages, through weapons creation, cyberattacks, or AI conduct that would constitute a crime if performed by a human

Mandates quarterly transparency reports detailing risk assessments and deployment decisions, annual third-party audits of compliance, and retention of testing records for 5 years

Establishes whistleblower protections for employees who report critical risks to federal or state authorities, allowing civil actions for reinstatement, back wages, and damages within 90 days of alleged retaliation

Authorizes the attorney general to bring civil actions with fines up to $1 million per violation and seek injunctive relief if a large developer's activities present an imminent critical risk