Florida's AI Bill of Rights Stalled. It's Still a Map of Where the Rules Are Going.

Where it stands

The Florida Senate passed SB 482, the "Artificial Intelligence Bill of Rights," with the Governor behind it. The House did not take it up before the April special session closed, so it did not become law. Its effective date would have been July 1, 2026.

That is a pause, not a stop. The people closest to it expect this bill to be the starting point for next Session.

What happens next, and when

Nothing new gets filed until after the November 3 statewide election. Then it moves fast: committees meet November through February to set priorities and draft bills, and Session begins in March. Most of the real drafting is done before March.

The politics point one way. The GOP gubernatorial front-runner has said Florida should lead on AI rules rather than wait for Congress, and would look to Texas and Tennessee as collaborators while rejecting California and New York as models.

So if you operate AI and have a view on how it should be governed, the window to be in the room is now — before the bills are written, not after.

What the bill actually said

SB 482 ran to 15 sections. Most of the headlines will not touch a typical company's internal AI — companion chatbots used by minors, AI-generated name/image/likeness, AI tools in schools. Worth knowing, because the next bill will be built from this one.

Three parts every AI-operating company should read: a declared right for people to know whether AI companies collect their personal or biometric data, and to expect it protected and de-identified; duties on AI companies not to sell or disclose personal information unless it is truly de-identified, pushed down to anyone they share it with; and an Attorney General investigation power, where altering or destroying relevant records carries penalties of $5,000 per week.

The real signal: the bar is becoming "show your receipts"

Here is the part most coverage missed. SB 482 did not just set rules. It built a safe harbor — and it spelled out the evidence that earns it.

For most violations, the state had to give a company 45 days to cure before bringing an action. A company could avoid the action entirely by showing "reasonable measures." The bill says what that looks like, in its own words: "structured interaction logs," "monitoring, and auditing," and verified deletion events. It also names controls aligned with the latest NIST AI Risk Management Framework and ISO 42001.

The line between a letter of guidance and a $50,000-per-violation action is whether you can produce a trustworthy record. What did your AI do, who did it touch, and what data did it handle? That record is almost impossible to reconstruct after a subpoena arrives. It has to exist before the question is asked. This is where state AI regulation is converging, in Florida and beyond.

Why internal AI should not get a pass

The bill exempts internal tools — bots "used solely by employees for internal operational purposes." We think that is a mistake, and we would argue against carrying it into the next draft.

Internal quality and safety are not separate from customer outcomes. They are upstream of them. The AI your teams query all day shapes the advice that reaches customers, the decisions made about them, and the data that can leak through them. An ungoverned internal AI is still a blast-radius problem; the harm just surfaces later, one interaction at a time.

You do not have to wait for the law to agree. Governing your internal AI well is good practice on its own — and it happens to put you ahead of exactly where the rules are going.

How Latten governs its own AI

We hold ourselves to the standard we just described, starting with our own systems.

What we never hold is raw data. Sensitive data is detected on your side and reported as types and counts, never values; payload contents are not part of what we store, so they cannot leak by mistake. We observe — we are never in your request path, and we have no write access to your systems.

What we enforce in our own database: tenant isolation by Postgres row-level security, not by application code remembering to check. We hold our own audit and policy tables to that same rule. Credentials are encrypted at rest with AES-256-GCM, the key held outside the database. Our enforcement audit is append-only and hash-chained, so even an attacker with database access cannot quietly rewrite history. Nothing we recommend auto-applies: every fix lands as a diff a human reviews.

And we are honest about the edges. We are not yet SOC 2 certified — preparation is underway, and we will never show a badge we do not hold. We have mapped our controls to the NIST AI Risk Management Framework and ISO 42001 as a self-assessment, aligned not certified, and we publish that crosswalk. We are now instrumenting our own AI with our own product: the coding agents that build Latten run against the same observe-only graph we give customers. We would rather show you our own receipts than ask for yours on faith.

What to do before November

Engage early. The drafting conversation starts in committee this fall. Get someone watching Tallahassee.

Build the evidence layer now. Whatever the final language, the bar will be monitoring, logging, and auditability you can produce on demand. Stand it up before you need it.

Treat the NIST AI Risk Management Framework and ISO 42001 as the standard. The bill named them. The next one almost certainly will too.

Where this leaves you

We read these bills closely so you do not have to, and we help teams build the evidence layer the new rules reward — for the AI you sell and the AI you run inside. As Florida moves this fall, we will keep tracking it here.