Wisconsin — Federal AI Profile + State AI Laws (Act 123 political-deepfake disclosure 2024; Act 224 AI-CSAM 2024; Act 34 synthetic intimate images 2025) + OCI AI Bulletin 2025 & Insurance Data Security Law (Act 73): AI Compliance Requirements

2023 Wisconsin Act 224 (Senate Bill 314, approved March 27, 2024) expanded Wis. Stat. § 948.12 (possession of child pornography) to cover AI/computer-generated "virtual child pornography" — visual depictions of a minor engaged in sexually explicit conduct created by computer or generative AI, even where no real child was depicted — closing the loophole that previously excluded synthetic imagery. Producing, possessing, or distributing such material is a Class D felony (up to 25 years imprisonment plus fines). Binds individuals and any business or platform that creates or distributes such material in Wisconsin. Counsel should confirm the exact amended § 948.12 language, the felony class/sentencing, and the effective date against the enacted text.

2025 Wisconsin Act 34 (Senate Bill 33, enacted October 2, 2025; signed by Gov. Evers) amended the nonconsensual-intimate-image statute (Wis. Stat. § 942.09) to add "synthetic intimate representations" — sexually explicit content generated by computer or AI that uses an identifiable person's face or likeness and is so realistic that a reasonable person would believe it is real. It is a felony to generate such a representation of a person without their consent, and a misdemeanor to duplicate or share intimate content. Any individual or business that creates or distributes AI-generated sexual deepfakes of an identifiable Wisconsin person must comply. Counsel should confirm the exact § 942.09 amendment, the felony/misdemeanor degrees and penalties, and the effective date against the enacted text.

On March 18, 2025 Commissioner of Insurance Nathan Houdek issued a bulletin to "All Insurers and Interested Parties" adopting the NAIC Model Bulletin on the Use of Artificial Intelligence Systems by Insurers, making Wisconsin the 24th state to do so. The bulletin reminds every OCI-regulated entity that decisions or actions impacting consumers made or supported by AI Systems must comply with all applicable insurance laws and regulations, including those addressing unfair trade practices and unfair discrimination. It defines "AI System" as a machine-based system that can, for a given set of objectives, generate outputs such as predictions, recommendations, or content influencing decisions in real or virtual environments, and separately defines "Predictive Model," "Machine Learning," "Generative AI," "Algorithm," "Model Drift," "Adverse Consumer Outcome," "Degree of Potential Harm to Consumers," and "Third Party." OCI expects each insurer to develop, implement, and maintain a written AIS Program governing the development, acquisition, and use of AI Systems, proportionate to the degree of potential harm to consumers, built on three components: (1) a GOVERNANCE framework — senior-management accountability to the board or a board committee, policies and procedures across the AI System lifecycle, documentation requirements, cross-functional committee structures spanning business units, actuarial, data science, underwriting, claims, compliance and legal, defined scopes of responsibility and chains of command, independence of decision-makers at successive lifecycle stages, monitoring/auditing/escalation/reporting protocols, personnel training and supervision, and Predictive Model design, verification, deployment, updating and monitoring procedures; (2) RISK MANAGEMENT AND INTERNAL CONTROLS — oversight and approval of AI System development, adoption or acquisition; data practices addressing currency, lineage, quality, integrity and bias analysis; Predictive Model inventories and documentation assessing interpretability, repeatability, robustness, reproducibility, traceability, model drift and auditability; validation, testing and retesting on unseen data and post-implementation; protection of non-public information; and data and record retention; and (3) THIRD-PARTY VENDOR OVERSIGHT — due diligence on third parties and their data and AI Systems, contractual audit rights and regulatory-cooperation terms, performance of contractual audit and verification activities, and confirmation of third-party compliance. Section 4 of the bulletin sets out the information OCI may request in an investigation or market conduct action, including the written AIS Program and evidence of its adoption, policies and training materials, data governance controls, Predictive Model inventories and model-specific documentation of data provenance and bias analysis, validation and testing records, model drift evaluations, third-party due diligence files, vendor contracts and audit reports. The bulletin states that regardless of the existence or scope of a written AIS Program, an insurer can expect to be asked about its use of AI Systems in an investigation or market conduct action, and that nothing in it limits OCI's authority to conduct any regulatory investigation, examination, or enforcement action.

Wisconsin adopted the NAIC Insurance Data Security Model Law (#668) as 2021 Wisconsin Act 73, signed July 15, 2021 and effective November 1, 2021, codified at Wis. Stat. §§ 601.95 to 601.956. Every covered licensee must develop, implement and maintain a comprehensive WRITTEN information security program containing administrative, technical and physical safeguards that protect against threats and hazards to the security and integrity of its information systems, safeguard nonpublic information against unauthorized access, and set retention and disposal schedules (§ 601.952). The program must rest on a risk assessment identifying reasonably foreseeable internal and external threats, assessing their likelihood and potential damage, and evaluating the sufficiency of existing safeguards across employee training, information systems, and attack-detection processes. Where the licensee has a board, the board must require executive management to develop and maintain the program, oversee its implementation, and receive an annual report on compliance status, material issues, and recommended modifications. Licensees must exercise due diligence in selecting third-party service providers and require them to implement appropriate safeguards and report cybersecurity events. A written incident response plan is mandatory, covering response goals, internal processes, role assignments, communications, remediation, documentation, and post-incident evaluation of the plan. Licensees certify compliance to the commissioner annually by MARCH 1. On a cybersecurity event the licensee must promptly investigate — assessing the nature and scope of the event, identifying the nonpublic information potentially compromised, taking reasonable measures to restore system security, and retaining records for at least 5 years (§ 601.953) — and must notify the commissioner electronically as promptly as possible and NO LATER THAN 3 BUSINESS DAYS from determining that a cybersecurity event occurred (§ 601.954), where the licensee is domiciled in Wisconsin and the event has a reasonable likelihood of materially harming a consumer or the licensee's operations, or the event involves the nonpublic information of at least 250 consumers and either must be reported to another government body or has a reasonable likelihood of material harm. The notification must state, to the extent possible, the date and source of the event and the timeframe of the compromise, how it was discovered, how information was exposed or stolen and whether it was recovered, the specific data elements acquired, the number of affected consumers, remediation efforts, internal review results, other agencies notified, a copy of the privacy policy and the investigation and notification steps taken, and an authorized contact. The licensee must update and supplement that information as material changes emerge, and must notify the commissioner within 3 days of learning of a triggering cybersecurity event on a third-party service provider's systems. This regime governs the same nonpublic information that an AIS Program's data-governance and third-party components handle, so an insurer's AI vendor pipeline sits inside both obligations at once.

FTC Act § 5 applies to all Wisconsin businesses using AI. Wisconsin DATCP (Department of Agriculture, Trade and Consumer Protection) independently enforces Wisconsin Consumer Protection Law (Wis. Stat. § 100.18) against deceptive AI practices in trade and commerce. DATCP has pursued algorithmic deception cases. Ensure AI systems disclose their nature, AI claims are truthful, and AI pricing is fair.

Wisconsin's manufacturing sector (Oshkosh Defense, Johnson Controls, Kohler, Harley-Davidson) uses AI for hiring, scheduling, and production monitoring. EEOC May 2023 guidance requires disparate impact testing for AI employment tools. NLRB GC Memo 23-02 requires bargaining with unions before deploying AI algorithmic management in unionized Wisconsin plants. Violations are unfair labor practices under NLRA.

Wisconsin is home to Northwestern Mutual and Fiserv — major financial services and fintech companies. AI credit and insurance underwriting decisions must comply with FCRA adverse action notice requirements. Fiserv's payment processing AI systems serving financial institutions must meet CFPB and OCC AI risk management expectations. Provide consumer-file-specific reasons when AI denies or limits credit.

2023 Wisconsin Act 123 (Assembly Bill 664, signed by Gov. Tony Evers on March 21, 2024) requires any campaign audio or video political communication that contains "synthetic media" — audio or video content substantially produced by generative artificial intelligence — to display the disclaimer "Contains content generated by AI" at the beginning and end of the communication. The law does not ban synthetic media; it mandates disclosure. Violations carry a forfeiture of up to $1,000 each, and the Wisconsin Ethics Commission has rule-making authority. Any committee, campaign, or person distributing AI-generated/altered political audio or video in Wisconsin must include the disclaimer. Counsel should confirm the exact election-code section, the covered-communication scope, and the effective date against the enacted text.

Wis. Stat. § 134.98 requires an entity whose principal place of business is in Wisconsin, or that maintains or licenses personal information in Wisconsin, to make reasonable efforts to notify each subject of the personal information when it knows that personal information in its possession has been acquired by a person the entity did not authorize to acquire it; a parallel duty covers entities outside Wisconsin holding Wisconsin residents' information, and a further provision reaches entities that store personal information they do not own. "Personal information" is an individual's last name combined with first name or first initial, linked to any of: social security number, driver's license or state identification number, financial account number together with a security or access code, DNA profile, or the individual's UNIQUE BIOMETRIC DATA including fingerprint, voice print, retina or iris image, or any other unique physical representation — which places AI-generated and AI-processed face, voice and iris templates squarely inside the statute's scope. The elements are excluded where they are publicly available, encrypted, redacted, or otherwise rendered unreadable. Notice must be given within a reasonable time, NOT TO EXCEED 45 DAYS after the entity learns of the acquisition, by mail or by a method previously used to communicate with the subject, or where the mailing address cannot be determined with reasonable diligence and no prior communication method exists, by a method reasonably calculated to provide actual notice. Where notification is required for 1,000 or more individuals, the entity must also notify all nationwide consumer reporting agencies of the timing, distribution and content of the notices. Wisconsin does NOT require notice to the Attorney General or to any state agency — a genuine gap against most states. Local government is preempted: no city, village, town or county may enact or enforce an ordinance or regulation relating to notice or disclosure of the unauthorized acquisition of personal information.

Monitor legis.wisconsin.gov for private-sector AI legislation. Wisconsin meets in regular session. AB 568 covers government AI only — private-sector AI legislation is pending. Wisconsin's strong manufacturing and financial services base makes AI employment and consumer protection legislation likely.