Connecticut · Senate Bill · January Session, 2025
SB2
Connecticut Committee Bill No. 2 — An Act Concerning Artificial Intelligence

Status ● Failed Effective N/A Passage Likelihood M

WHAT THIS BILL REGULATES · 11 REQUIREMENT TYPES

How Is This Bill Enforced

Enforcement Authority
Attorney General has exclusive enforcement authority. No private right of action. During the first year (Oct 1, 2026 – Sept 30, 2027), the AG must issue a notice of violation and allow 60 days to cure before initiating action. Beginning Oct 1, 2027, cure opportunity is discretionary. An affirmative defense is available for violations discovered through red-teaming, cured within 60 days, and where the entity is otherwise compliant with NIST AI RMF or equivalent frameworks. Violations constitute unfair trade practices under Conn. Gen. Stat. § 42-110b, enforceable solely by the AG; § 42-110g (private enforcement) does not apply.
Private Right of Action
No private right of action. Enforcement is exclusive to the designated authority.
Penalties
Violations are enforceable as unfair trade practices under Conn. Gen. Stat. § 42-110b, which authorizes the Attorney General to seek injunctive relief, civil penalties, restitution, and other equitable remedies. The private enforcement provisions of § 42-110g are expressly excluded. No specific statutory minimum or maximum is stated in the bill itself; penalty amounts are governed by the general CUTPA enforcement framework.

What This Bill Requires

Verbatim statutory text on the left; plain-language analysis and a per-section checklist on the right. Numbered markers cross-link to the matching checklist row.

Statutory Text
Analysis & Obligations
Section 1
Definitions

(1)–(16) For the purposes of this section and sections 2 to 10, inclusive, of this act, unless the context otherwise requires: (1) "Algorithmic discriminationAlgorithmic discrimination"Algorithmic discrimination" (A) means any use of an artificial intelligence system that results in any unlawful differential treatment or impact that disfavors any individual or group of individuals on the basis of one or more classifications protected under the laws of this state or federal law, and (B) does not include (i) the offer, license or use of a high-risk artificial intelligence system by a developer, integrator or deployer for the sole purpose of (I) the developer's, integrator's or deployer's self-testing to identify, mitigate or prevent discrimination or otherwise ensure compliance with state and federal law, or (II) expanding an applicant, customer or participant pool to increase diversity or redress historic discrimination, or (ii) an act or omission by or on behalf of a private club or other establishment not in fact open to the public, as set forth in Title II of the Civil Rights Act of 1964, 42 USC 2000a(e), as amended from time to time;Section 1(1)" ... (2) "Artificial intelligence systemArtificial intelligence system"Artificial intelligence system" means any machine-based system that, for any explicit or implicit objective, infers from the inputs such system receives how to generate outputs, including, but not limited to, content, decisions, predictions or recommendations, that can influence physical or virtual environments;Section 1(2)" ... (3) "Consequential decisionConsequential decision"Consequential decision" means any decision or judgment that has a legal, material or similarly significant effect on a consumer with respect to (A) employment, including, but not limited to, any such decision or judgment made (i) concerning hiring, termination, compensation or promotion, or (ii) by way of any automated task allocation that limits, segregates or classifies employees for the purpose of assigning or determining material terms or conditions of employment, (B) education or vocational training, including, but not limited to, any such decision or judgment made concerning (i) assessments, (ii) student cheating or plagiarism detection, (iii) accreditation, (iv) certification, (v) admissions, or (vi) financial aid or scholarships, (C) the provision or denial, or terms and conditions, of (i) financial lending or credit services, (ii) housing or lodging, including, but not limited to, rentals or short-term housing or lodging, (iii) insurance, or (iv) legal services, or (D) the provision or denial of (i) essential government services, or (ii) health care services;Section 1(3)" ... (4) "ConsumerConsumer"Consumer" means any individual who is a resident of this state;Section 1(4)" ... (5) "DeployDeploy"Deploy" means to use a high-risk artificial intelligence system to make, or as a substantial factor in making, a consequential decision;Section 1(5)" ... (6) "DeployerDeployer"Deployer" means any person doing business in this state that deploys a high-risk artificial intelligence system in this state;Section 1(6)" ... (7) "DeveloperDeveloper"Developer" means any person doing business in this state that develops, or intentionally and substantially modifies, an artificial intelligence system;Section 1(7)" ... (8) "General-purpose artificial intelligence modelGeneral-purpose artificial intelligence model"General-purpose artificial intelligence model" (A) means any form of artificial intelligence system that (i) displays significant generality, (ii) is capable of competently performing a wide range of distinct tasks, and (iii) can be integrated into a variety of downstream applications or systems, and (B) does not include any artificial intelligence model that is used for development, prototyping and research activities before such artificial intelligence model is released on the market;Section 1(8)" ... (9) "High-risk artificial intelligence systemHigh-risk artificial intelligence system"High-risk artificial intelligence system" (A) means any artificial intelligence system that, when deployed, makes, or is a substantial factor in making, a consequential decision, and (B) does not include (i) any artificial intelligence system that is intended to (I) perform any narrow procedural task, or (II) detect decision-making patterns, or deviations from decision-making patterns, unless such artificial intelligence system is intended to replace or influence any assessment previously completed by an individual without sufficient human review, or (ii) unless the technology, when deployed, makes, or is a substantial factor in making, a consequential decision, (I) any anti-fraud technology that does not make use of facial recognition technology, (II) any artificial intelligence-enabled video game technology, (III) any anti-malware, anti-virus, calculator, cybersecurity, database, data storage, firewall, Internet domain registration, Internet-web-site loading, networking, robocall-filtering, spam-filtering, spellchecking, spreadsheet, web-caching, web-hosting or similar technology, (IV) any technology that performs tasks exclusively related to an entity's internal management affairs, including, but not limited to, ordering office supplies or processing payments, or (V) any technology that communicates with consumers in natural language for the purpose of providing users with information, making referrals or recommendations and answering questions, and is subject to an accepted use policy that prohibits generating content that is discriminatory or harmful;Section 1(9)" ... (10) "IntegratorIntegrator"Integrator" means any person doing business in this state that, with respect to a given high-risk artificial intelligence system, (A) neither develops nor intentionally and substantially modifies the high-risk artificial intelligence system, and (B) integrates the high-risk artificial intelligence system into a product or service such person offers to any other person;Section 1(10)" ... (11) "Intentional and substantial modificationIntentional and substantial modification"Intentional and substantial modification" (A) means any deliberate change made to (i) an artificial intelligence system that materially increases the risk of algorithmic discrimination, or (ii) a general-purpose artificial intelligence model that (I) affects compliance of the general-purpose artificial intelligence model, (II) materially changes the purpose of the general-purpose artificial intelligence model, or (III) materially increases the risk of algorithmic discrimination, and (B) does not include any change made to a high-risk artificial intelligence system, or the performance of a high-risk artificial intelligence system, if (i) the high-risk artificial intelligence system continues to learn after such high-risk artificial intelligence system is (I) offered, sold, leased, licensed, given or otherwise made available to a deployer, or (II) deployed, and (ii) such change (I) is made to such high-risk artificial intelligence system as a result of any learning described in subparagraph (B)(i) of this subdivision, (II) was predetermined by the deployer, or the third party contracted by the deployer, when such deployer or third party completed the initial impact assessment of such high-risk artificial intelligence system pursuant to subsection (c) of section 4 of this act, and (III) is included in the technical documentation for such high-risk artificial intelligence system;Section 1(11)" ... (12) "Person" ... (13) "Red-teamingRed-teaming"Red-teaming" means an exercise that is conducted to identify the potential adverse behaviors or outcomes of an artificial intelligence system, how such behaviors or outcomes occur and stress test the safeguards against such behaviors or outcomes;Section 1(13)" ... (14) "Substantial factorSubstantial factor"Substantial factor" (A) means a factor that (i) alters the outcome of a consequential decision, and (ii) is generated by an artificial intelligence system, (B) includes, but is not limited to, any use of an artificial intelligence system to generate any content, decision, prediction or recommendation concerning a consumer that is used as a basis to make a consequential decision concerning the consumer, and (C) does not include any output produced by an artificial intelligence system where an individual was involved in the data processing that produced such output and such individual (i) meaningfully considered such data as part of such data processing, and (ii) had the authority to change or influence the output produced by such data processing;Section 1(14)" ... (15) "Synthetic digital contentSynthetic digital content"Synthetic digital content" means any digital content, including, but not limited to, any audio, image, text or video, that is produced or manipulated by an artificial intelligence system, including, but not limited to, a general-purpose artificial intelligence model;Section 1(15)" ... (16) "Trade secret" has the same meaning as provided in section 35-51 of the general statutes.

Section 1 establishes the defined terms used throughout sections 1–10 of the act. Key definitions include high-risk artificial intelligence system (an AI system that makes or is a substantial factor in making a consequential decision), consequential decision (covering employment, education, credit, housing, insurance, legal services, government services, and health care), and the three regulated party types: developer, deployer, and integrator. The high-risk AI definition contains broad carve-outs for narrow procedural tasks, anti-fraud tools without facial recognition, video games, utility software, internal management tools, and chatbots subject to acceptable-use policies.

Section 2
Developer obligations for high-risk AI systems
Developer

(a) 1 Beginning on October 1, 2026, a developer of a high-risk artificial intelligence systemHigh-risk artificial intelligence system"High-risk artificial intelligence system" (A) means any artificial intelligence system that, when deployed, makes, or is a substantial factor in making, a consequential decision, and (B) does not include (i) any artificial intelligence system that is intended to (I) perform any narrow procedural task, or (II) detect decision-making patterns, or deviations from decision-making patterns, unless such artificial intelligence system is intended to replace or influence any assessment previously completed by an individual without sufficient human review, or (ii) unless the technology, when deployed, makes, or is a substantial factor in making, a consequential decision, (I) any anti-fraud technology that does not make use of facial recognition technology, (II) any artificial intelligence-enabled video game technology, (III) any anti-malware, anti-virus, calculator, cybersecurity, database, data storage, firewall, Internet domain registration, Internet-web-site loading, networking, robocall-filtering, spam-filtering, spellchecking, spreadsheet, web-caching, web-hosting or similar technology, (IV) any technology that performs tasks exclusively related to an entity's internal management affairs, including, but not limited to, ordering office supplies or processing payments, or (V) any technology that communicates with consumers in natural language for the purpose of providing users with information, making referrals or recommendations and answering questions, and is subject to an accepted use policy that prohibits generating content that is discriminatory or harmful;Section 1(9) shall use reasonable care to protect consumersConsumer"Consumer" means any individual who is a resident of this state;Section 1(4) from any known or reasonably foreseeable risks of algorithmic discriminationAlgorithmic discrimination"Algorithmic discrimination" (A) means any use of an artificial intelligence system that results in any unlawful differential treatment or impact that disfavors any individual or group of individuals on the basis of one or more classifications protected under the laws of this state or federal law, and (B) does not include (i) the offer, license or use of a high-risk artificial intelligence system by a developer, integrator or deployer for the sole purpose of (I) the developer's, integrator's or deployer's self-testing to identify, mitigate or prevent discrimination or otherwise ensure compliance with state and federal law, or (II) expanding an applicant, customer or participant pool to increase diversity or redress historic discrimination, or (ii) an act or omission by or on behalf of a private club or other establishment not in fact open to the public, as set forth in Title II of the Civil Rights Act of 1964, 42 USC 2000a(e), as amended from time to time;Section 1(1) arising from the intended and contracted uses of the high-risk artificial intelligence systemHigh-risk artificial intelligence system"High-risk artificial intelligence system" (A) means any artificial intelligence system that, when deployed, makes, or is a substantial factor in making, a consequential decision, and (B) does not include (i) any artificial intelligence system that is intended to (I) perform any narrow procedural task, or (II) detect decision-making patterns, or deviations from decision-making patterns, unless such artificial intelligence system is intended to replace or influence any assessment previously completed by an individual without sufficient human review, or (ii) unless the technology, when deployed, makes, or is a substantial factor in making, a consequential decision, (I) any anti-fraud technology that does not make use of facial recognition technology, (II) any artificial intelligence-enabled video game technology, (III) any anti-malware, anti-virus, calculator, cybersecurity, database, data storage, firewall, Internet domain registration, Internet-web-site loading, networking, robocall-filtering, spam-filtering, spellchecking, spreadsheet, web-caching, web-hosting or similar technology, (IV) any technology that performs tasks exclusively related to an entity's internal management affairs, including, but not limited to, ordering office supplies or processing payments, or (V) any technology that communicates with consumers in natural language for the purpose of providing users with information, making referrals or recommendations and answering questions, and is subject to an accepted use policy that prohibits generating content that is discriminatory or harmful;Section 1(9). In any enforcement action brought on or after said date by the Attorney General pursuant to section 10 of this act, there shall be a rebuttable presumption that a developerDeveloper"Developer" means any person doing business in this state that develops, or intentionally and substantially modifies, an artificial intelligence system;Section 1(7) used reasonable care as required under this subsection if the developerDeveloper"Developer" means any person doing business in this state that develops, or intentionally and substantially modifies, an artificial intelligence system;Section 1(7) complied with the provisions of this section or, if the developerDeveloper"Developer" means any person doing business in this state that develops, or intentionally and substantially modifies, an artificial intelligence system;Section 1(7) enters into a contract with an integratorIntegrator"Integrator" means any person doing business in this state that, with respect to a given high-risk artificial intelligence system, (A) neither develops nor intentionally and substantially modifies the high-risk artificial intelligence system, and (B) integrates the high-risk artificial intelligence system into a product or service such person offers to any other person;Section 1(10) as set forth in subsection (b) of section 3 of this act, the developerDeveloper"Developer" means any person doing business in this state that develops, or intentionally and substantially modifies, an artificial intelligence system;Section 1(7) and integratorIntegrator"Integrator" means any person doing business in this state that, with respect to a given high-risk artificial intelligence system, (A) neither develops nor intentionally and substantially modifies the high-risk artificial intelligence system, and (B) integrates the high-risk artificial intelligence system into a product or service such person offers to any other person;Section 1(10) complied with the provisions of this section and section 3 of this act.

(b)(1)–(4) 2 Except as provided in subsection (c) of section 3 of this act, a developer of a high-risk artificial intelligence systemHigh-risk artificial intelligence system"High-risk artificial intelligence system" (A) means any artificial intelligence system that, when deployed, makes, or is a substantial factor in making, a consequential decision, and (B) does not include (i) any artificial intelligence system that is intended to (I) perform any narrow procedural task, or (II) detect decision-making patterns, or deviations from decision-making patterns, unless such artificial intelligence system is intended to replace or influence any assessment previously completed by an individual without sufficient human review, or (ii) unless the technology, when deployed, makes, or is a substantial factor in making, a consequential decision, (I) any anti-fraud technology that does not make use of facial recognition technology, (II) any artificial intelligence-enabled video game technology, (III) any anti-malware, anti-virus, calculator, cybersecurity, database, data storage, firewall, Internet domain registration, Internet-web-site loading, networking, robocall-filtering, spam-filtering, spellchecking, spreadsheet, web-caching, web-hosting or similar technology, (IV) any technology that performs tasks exclusively related to an entity's internal management affairs, including, but not limited to, ordering office supplies or processing payments, or (V) any technology that communicates with consumers in natural language for the purpose of providing users with information, making referrals or recommendations and answering questions, and is subject to an accepted use policy that prohibits generating content that is discriminatory or harmful;Section 1(9) shall, beginning on October 1, 2026, make available to each deployerDeployer"Deployer" means any person doing business in this state that deploys a high-risk artificial intelligence system in this state;Section 1(6), or other developerDeveloper"Developer" means any person doing business in this state that develops, or intentionally and substantially modifies, an artificial intelligence system;Section 1(7), of the high-risk artificial intelligence systemHigh-risk artificial intelligence system"High-risk artificial intelligence system" (A) means any artificial intelligence system that, when deployed, makes, or is a substantial factor in making, a consequential decision, and (B) does not include (i) any artificial intelligence system that is intended to (I) perform any narrow procedural task, or (II) detect decision-making patterns, or deviations from decision-making patterns, unless such artificial intelligence system is intended to replace or influence any assessment previously completed by an individual without sufficient human review, or (ii) unless the technology, when deployed, makes, or is a substantial factor in making, a consequential decision, (I) any anti-fraud technology that does not make use of facial recognition technology, (II) any artificial intelligence-enabled video game technology, (III) any anti-malware, anti-virus, calculator, cybersecurity, database, data storage, firewall, Internet domain registration, Internet-web-site loading, networking, robocall-filtering, spam-filtering, spellchecking, spreadsheet, web-caching, web-hosting or similar technology, (IV) any technology that performs tasks exclusively related to an entity's internal management affairs, including, but not limited to, ordering office supplies or processing payments, or (V) any technology that communicates with consumers in natural language for the purpose of providing users with information, making referrals or recommendations and answering questions, and is subject to an accepted use policy that prohibits generating content that is discriminatory or harmful;Section 1(9): (1) A general statement describing the reasonably foreseeable uses, and the known harmful or inappropriate uses, of such high-risk artificial intelligence systemHigh-risk artificial intelligence system"High-risk artificial intelligence system" (A) means any artificial intelligence system that, when deployed, makes, or is a substantial factor in making, a consequential decision, and (B) does not include (i) any artificial intelligence system that is intended to (I) perform any narrow procedural task, or (II) detect decision-making patterns, or deviations from decision-making patterns, unless such artificial intelligence system is intended to replace or influence any assessment previously completed by an individual without sufficient human review, or (ii) unless the technology, when deployed, makes, or is a substantial factor in making, a consequential decision, (I) any anti-fraud technology that does not make use of facial recognition technology, (II) any artificial intelligence-enabled video game technology, (III) any anti-malware, anti-virus, calculator, cybersecurity, database, data storage, firewall, Internet domain registration, Internet-web-site loading, networking, robocall-filtering, spam-filtering, spellchecking, spreadsheet, web-caching, web-hosting or similar technology, (IV) any technology that performs tasks exclusively related to an entity's internal management affairs, including, but not limited to, ordering office supplies or processing payments, or (V) any technology that communicates with consumers in natural language for the purpose of providing users with information, making referrals or recommendations and answering questions, and is subject to an accepted use policy that prohibits generating content that is discriminatory or harmful;Section 1(9); (2) Documentation disclosing (A) high-level summaries of the type of data used to train such high-risk artificial intelligence systemHigh-risk artificial intelligence system"High-risk artificial intelligence system" (A) means any artificial intelligence system that, when deployed, makes, or is a substantial factor in making, a consequential decision, and (B) does not include (i) any artificial intelligence system that is intended to (I) perform any narrow procedural task, or (II) detect decision-making patterns, or deviations from decision-making patterns, unless such artificial intelligence system is intended to replace or influence any assessment previously completed by an individual without sufficient human review, or (ii) unless the technology, when deployed, makes, or is a substantial factor in making, a consequential decision, (I) any anti-fraud technology that does not make use of facial recognition technology, (II) any artificial intelligence-enabled video game technology, (III) any anti-malware, anti-virus, calculator, cybersecurity, database, data storage, firewall, Internet domain registration, Internet-web-site loading, networking, robocall-filtering, spam-filtering, spellchecking, spreadsheet, web-caching, web-hosting or similar technology, (IV) any technology that performs tasks exclusively related to an entity's internal management affairs, including, but not limited to, ordering office supplies or processing payments, or (V) any technology that communicates with consumers in natural language for the purpose of providing users with information, making referrals or recommendations and answering questions, and is subject to an accepted use policy that prohibits generating content that is discriminatory or harmful;Section 1(9), (B) the known or reasonably foreseeable limitations of such high-risk artificial intelligence systemHigh-risk artificial intelligence system"High-risk artificial intelligence system" (A) means any artificial intelligence system that, when deployed, makes, or is a substantial factor in making, a consequential decision, and (B) does not include (i) any artificial intelligence system that is intended to (I) perform any narrow procedural task, or (II) detect decision-making patterns, or deviations from decision-making patterns, unless such artificial intelligence system is intended to replace or influence any assessment previously completed by an individual without sufficient human review, or (ii) unless the technology, when deployed, makes, or is a substantial factor in making, a consequential decision, (I) any anti-fraud technology that does not make use of facial recognition technology, (II) any artificial intelligence-enabled video game technology, (III) any anti-malware, anti-virus, calculator, cybersecurity, database, data storage, firewall, Internet domain registration, Internet-web-site loading, networking, robocall-filtering, spam-filtering, spellchecking, spreadsheet, web-caching, web-hosting or similar technology, (IV) any technology that performs tasks exclusively related to an entity's internal management affairs, including, but not limited to, ordering office supplies or processing payments, or (V) any technology that communicates with consumers in natural language for the purpose of providing users with information, making referrals or recommendations and answering questions, and is subject to an accepted use policy that prohibits generating content that is discriminatory or harmful;Section 1(9), including, but not limited to, the known or reasonably foreseeable risks of algorithmic discriminationAlgorithmic discrimination"Algorithmic discrimination" (A) means any use of an artificial intelligence system that results in any unlawful differential treatment or impact that disfavors any individual or group of individuals on the basis of one or more classifications protected under the laws of this state or federal law, and (B) does not include (i) the offer, license or use of a high-risk artificial intelligence system by a developer, integrator or deployer for the sole purpose of (I) the developer's, integrator's or deployer's self-testing to identify, mitigate or prevent discrimination or otherwise ensure compliance with state and federal law, or (II) expanding an applicant, customer or participant pool to increase diversity or redress historic discrimination, or (ii) an act or omission by or on behalf of a private club or other establishment not in fact open to the public, as set forth in Title II of the Civil Rights Act of 1964, 42 USC 2000a(e), as amended from time to time;Section 1(1) arising from the intended uses of such high-risk artificial intelligence systemHigh-risk artificial intelligence system"High-risk artificial intelligence system" (A) means any artificial intelligence system that, when deployed, makes, or is a substantial factor in making, a consequential decision, and (B) does not include (i) any artificial intelligence system that is intended to (I) perform any narrow procedural task, or (II) detect decision-making patterns, or deviations from decision-making patterns, unless such artificial intelligence system is intended to replace or influence any assessment previously completed by an individual without sufficient human review, or (ii) unless the technology, when deployed, makes, or is a substantial factor in making, a consequential decision, (I) any anti-fraud technology that does not make use of facial recognition technology, (II) any artificial intelligence-enabled video game technology, (III) any anti-malware, anti-virus, calculator, cybersecurity, database, data storage, firewall, Internet domain registration, Internet-web-site loading, networking, robocall-filtering, spam-filtering, spellchecking, spreadsheet, web-caching, web-hosting or similar technology, (IV) any technology that performs tasks exclusively related to an entity's internal management affairs, including, but not limited to, ordering office supplies or processing payments, or (V) any technology that communicates with consumers in natural language for the purpose of providing users with information, making referrals or recommendations and answering questions, and is subject to an accepted use policy that prohibits generating content that is discriminatory or harmful;Section 1(9), (C) the purpose of such high-risk artificial intelligence systemHigh-risk artificial intelligence system"High-risk artificial intelligence system" (A) means any artificial intelligence system that, when deployed, makes, or is a substantial factor in making, a consequential decision, and (B) does not include (i) any artificial intelligence system that is intended to (I) perform any narrow procedural task, or (II) detect decision-making patterns, or deviations from decision-making patterns, unless such artificial intelligence system is intended to replace or influence any assessment previously completed by an individual without sufficient human review, or (ii) unless the technology, when deployed, makes, or is a substantial factor in making, a consequential decision, (I) any anti-fraud technology that does not make use of facial recognition technology, (II) any artificial intelligence-enabled video game technology, (III) any anti-malware, anti-virus, calculator, cybersecurity, database, data storage, firewall, Internet domain registration, Internet-web-site loading, networking, robocall-filtering, spam-filtering, spellchecking, spreadsheet, web-caching, web-hosting or similar technology, (IV) any technology that performs tasks exclusively related to an entity's internal management affairs, including, but not limited to, ordering office supplies or processing payments, or (V) any technology that communicates with consumers in natural language for the purpose of providing users with information, making referrals or recommendations and answering questions, and is subject to an accepted use policy that prohibits generating content that is discriminatory or harmful;Section 1(9), (D) the intended benefits and uses of such high-risk artificial intelligence systemHigh-risk artificial intelligence system"High-risk artificial intelligence system" (A) means any artificial intelligence system that, when deployed, makes, or is a substantial factor in making, a consequential decision, and (B) does not include (i) any artificial intelligence system that is intended to (I) perform any narrow procedural task, or (II) detect decision-making patterns, or deviations from decision-making patterns, unless such artificial intelligence system is intended to replace or influence any assessment previously completed by an individual without sufficient human review, or (ii) unless the technology, when deployed, makes, or is a substantial factor in making, a consequential decision, (I) any anti-fraud technology that does not make use of facial recognition technology, (II) any artificial intelligence-enabled video game technology, (III) any anti-malware, anti-virus, calculator, cybersecurity, database, data storage, firewall, Internet domain registration, Internet-web-site loading, networking, robocall-filtering, spam-filtering, spellchecking, spreadsheet, web-caching, web-hosting or similar technology, (IV) any technology that performs tasks exclusively related to an entity's internal management affairs, including, but not limited to, ordering office supplies or processing payments, or (V) any technology that communicates with consumers in natural language for the purpose of providing users with information, making referrals or recommendations and answering questions, and is subject to an accepted use policy that prohibits generating content that is discriminatory or harmful;Section 1(9), and (E) all other information necessary to enable such deployerDeployer"Deployer" means any person doing business in this state that deploys a high-risk artificial intelligence system in this state;Section 1(6) to comply with the provisions of section 4 of this act; (3) Documentation describing (A) how such high-risk artificial intelligence systemHigh-risk artificial intelligence system"High-risk artificial intelligence system" (A) means any artificial intelligence system that, when deployed, makes, or is a substantial factor in making, a consequential decision, and (B) does not include (i) any artificial intelligence system that is intended to (I) perform any narrow procedural task, or (II) detect decision-making patterns, or deviations from decision-making patterns, unless such artificial intelligence system is intended to replace or influence any assessment previously completed by an individual without sufficient human review, or (ii) unless the technology, when deployed, makes, or is a substantial factor in making, a consequential decision, (I) any anti-fraud technology that does not make use of facial recognition technology, (II) any artificial intelligence-enabled video game technology, (III) any anti-malware, anti-virus, calculator, cybersecurity, database, data storage, firewall, Internet domain registration, Internet-web-site loading, networking, robocall-filtering, spam-filtering, spellchecking, spreadsheet, web-caching, web-hosting or similar technology, (IV) any technology that performs tasks exclusively related to an entity's internal management affairs, including, but not limited to, ordering office supplies or processing payments, or (V) any technology that communicates with consumers in natural language for the purpose of providing users with information, making referrals or recommendations and answering questions, and is subject to an accepted use policy that prohibits generating content that is discriminatory or harmful;Section 1(9) was evaluated for performance, and mitigation of algorithmic discriminationAlgorithmic discrimination"Algorithmic discrimination" (A) means any use of an artificial intelligence system that results in any unlawful differential treatment or impact that disfavors any individual or group of individuals on the basis of one or more classifications protected under the laws of this state or federal law, and (B) does not include (i) the offer, license or use of a high-risk artificial intelligence system by a developer, integrator or deployer for the sole purpose of (I) the developer's, integrator's or deployer's self-testing to identify, mitigate or prevent discrimination or otherwise ensure compliance with state and federal law, or (II) expanding an applicant, customer or participant pool to increase diversity or redress historic discrimination, or (ii) an act or omission by or on behalf of a private club or other establishment not in fact open to the public, as set forth in Title II of the Civil Rights Act of 1964, 42 USC 2000a(e), as amended from time to time;Section 1(1), before such high-risk artificial intelligence systemHigh-risk artificial intelligence system"High-risk artificial intelligence system" (A) means any artificial intelligence system that, when deployed, makes, or is a substantial factor in making, a consequential decision, and (B) does not include (i) any artificial intelligence system that is intended to (I) perform any narrow procedural task, or (II) detect decision-making patterns, or deviations from decision-making patterns, unless such artificial intelligence system is intended to replace or influence any assessment previously completed by an individual without sufficient human review, or (ii) unless the technology, when deployed, makes, or is a substantial factor in making, a consequential decision, (I) any anti-fraud technology that does not make use of facial recognition technology, (II) any artificial intelligence-enabled video game technology, (III) any anti-malware, anti-virus, calculator, cybersecurity, database, data storage, firewall, Internet domain registration, Internet-web-site loading, networking, robocall-filtering, spam-filtering, spellchecking, spreadsheet, web-caching, web-hosting or similar technology, (IV) any technology that performs tasks exclusively related to an entity's internal management affairs, including, but not limited to, ordering office supplies or processing payments, or (V) any technology that communicates with consumers in natural language for the purpose of providing users with information, making referrals or recommendations and answering questions, and is subject to an accepted use policy that prohibits generating content that is discriminatory or harmful;Section 1(9) was offered, sold, leased, licensed, given or otherwise made available to such deployerDeployer"Deployer" means any person doing business in this state that deploys a high-risk artificial intelligence system in this state;Section 1(6), (B) the data governance measures used to cover the training datasets and the measures used to examine the suitability of data sources, possible biases and appropriate mitigation, (C) the intended outputs of such high-risk artificial intelligence systemHigh-risk artificial intelligence system"High-risk artificial intelligence system" (A) means any artificial intelligence system that, when deployed, makes, or is a substantial factor in making, a consequential decision, and (B) does not include (i) any artificial intelligence system that is intended to (I) perform any narrow procedural task, or (II) detect decision-making patterns, or deviations from decision-making patterns, unless such artificial intelligence system is intended to replace or influence any assessment previously completed by an individual without sufficient human review, or (ii) unless the technology, when deployed, makes, or is a substantial factor in making, a consequential decision, (I) any anti-fraud technology that does not make use of facial recognition technology, (II) any artificial intelligence-enabled video game technology, (III) any anti-malware, anti-virus, calculator, cybersecurity, database, data storage, firewall, Internet domain registration, Internet-web-site loading, networking, robocall-filtering, spam-filtering, spellchecking, spreadsheet, web-caching, web-hosting or similar technology, (IV) any technology that performs tasks exclusively related to an entity's internal management affairs, including, but not limited to, ordering office supplies or processing payments, or (V) any technology that communicates with consumers in natural language for the purpose of providing users with information, making referrals or recommendations and answering questions, and is subject to an accepted use policy that prohibits generating content that is discriminatory or harmful;Section 1(9), (D) the measures the developerDeveloper"Developer" means any person doing business in this state that develops, or intentionally and substantially modifies, an artificial intelligence system;Section 1(7) has taken to mitigate any known or reasonably foreseeable risks of algorithmic discriminationAlgorithmic discrimination"Algorithmic discrimination" (A) means any use of an artificial intelligence system that results in any unlawful differential treatment or impact that disfavors any individual or group of individuals on the basis of one or more classifications protected under the laws of this state or federal law, and (B) does not include (i) the offer, license or use of a high-risk artificial intelligence system by a developer, integrator or deployer for the sole purpose of (I) the developer's, integrator's or deployer's self-testing to identify, mitigate or prevent discrimination or otherwise ensure compliance with state and federal law, or (II) expanding an applicant, customer or participant pool to increase diversity or redress historic discrimination, or (ii) an act or omission by or on behalf of a private club or other establishment not in fact open to the public, as set forth in Title II of the Civil Rights Act of 1964, 42 USC 2000a(e), as amended from time to time;Section 1(1) that may arise from deployment of such high-risk artificial intelligence systemHigh-risk artificial intelligence system"High-risk artificial intelligence system" (A) means any artificial intelligence system that, when deployed, makes, or is a substantial factor in making, a consequential decision, and (B) does not include (i) any artificial intelligence system that is intended to (I) perform any narrow procedural task, or (II) detect decision-making patterns, or deviations from decision-making patterns, unless such artificial intelligence system is intended to replace or influence any assessment previously completed by an individual without sufficient human review, or (ii) unless the technology, when deployed, makes, or is a substantial factor in making, a consequential decision, (I) any anti-fraud technology that does not make use of facial recognition technology, (II) any artificial intelligence-enabled video game technology, (III) any anti-malware, anti-virus, calculator, cybersecurity, database, data storage, firewall, Internet domain registration, Internet-web-site loading, networking, robocall-filtering, spam-filtering, spellchecking, spreadsheet, web-caching, web-hosting or similar technology, (IV) any technology that performs tasks exclusively related to an entity's internal management affairs, including, but not limited to, ordering office supplies or processing payments, or (V) any technology that communicates with consumers in natural language for the purpose of providing users with information, making referrals or recommendations and answering questions, and is subject to an accepted use policy that prohibits generating content that is discriminatory or harmful;Section 1(9), and (E) how such high-risk artificial intelligence systemHigh-risk artificial intelligence system"High-risk artificial intelligence system" (A) means any artificial intelligence system that, when deployed, makes, or is a substantial factor in making, a consequential decision, and (B) does not include (i) any artificial intelligence system that is intended to (I) perform any narrow procedural task, or (II) detect decision-making patterns, or deviations from decision-making patterns, unless such artificial intelligence system is intended to replace or influence any assessment previously completed by an individual without sufficient human review, or (ii) unless the technology, when deployed, makes, or is a substantial factor in making, a consequential decision, (I) any anti-fraud technology that does not make use of facial recognition technology, (II) any artificial intelligence-enabled video game technology, (III) any anti-malware, anti-virus, calculator, cybersecurity, database, data storage, firewall, Internet domain registration, Internet-web-site loading, networking, robocall-filtering, spam-filtering, spellchecking, spreadsheet, web-caching, web-hosting or similar technology, (IV) any technology that performs tasks exclusively related to an entity's internal management affairs, including, but not limited to, ordering office supplies or processing payments, or (V) any technology that communicates with consumers in natural language for the purpose of providing users with information, making referrals or recommendations and answering questions, and is subject to an accepted use policy that prohibits generating content that is discriminatory or harmful;Section 1(9) should be used, not be used and be monitored by an individual when such high-risk artificial intelligence systemHigh-risk artificial intelligence system"High-risk artificial intelligence system" (A) means any artificial intelligence system that, when deployed, makes, or is a substantial factor in making, a consequential decision, and (B) does not include (i) any artificial intelligence system that is intended to (I) perform any narrow procedural task, or (II) detect decision-making patterns, or deviations from decision-making patterns, unless such artificial intelligence system is intended to replace or influence any assessment previously completed by an individual without sufficient human review, or (ii) unless the technology, when deployed, makes, or is a substantial factor in making, a consequential decision, (I) any anti-fraud technology that does not make use of facial recognition technology, (II) any artificial intelligence-enabled video game technology, (III) any anti-malware, anti-virus, calculator, cybersecurity, database, data storage, firewall, Internet domain registration, Internet-web-site loading, networking, robocall-filtering, spam-filtering, spellchecking, spreadsheet, web-caching, web-hosting or similar technology, (IV) any technology that performs tasks exclusively related to an entity's internal management affairs, including, but not limited to, ordering office supplies or processing payments, or (V) any technology that communicates with consumers in natural language for the purpose of providing users with information, making referrals or recommendations and answering questions, and is subject to an accepted use policy that prohibits generating content that is discriminatory or harmful;Section 1(9) is used to make, or as a substantial factorSubstantial factor"Substantial factor" (A) means a factor that (i) alters the outcome of a consequential decision, and (ii) is generated by an artificial intelligence system, (B) includes, but is not limited to, any use of an artificial intelligence system to generate any content, decision, prediction or recommendation concerning a consumer that is used as a basis to make a consequential decision concerning the consumer, and (C) does not include any output produced by an artificial intelligence system where an individual was involved in the data processing that produced such output and such individual (i) meaningfully considered such data as part of such data processing, and (ii) had the authority to change or influence the output produced by such data processing;Section 1(14) in making, a consequential decisionConsequential decision"Consequential decision" means any decision or judgment that has a legal, material or similarly significant effect on a consumer with respect to (A) employment, including, but not limited to, any such decision or judgment made (i) concerning hiring, termination, compensation or promotion, or (ii) by way of any automated task allocation that limits, segregates or classifies employees for the purpose of assigning or determining material terms or conditions of employment, (B) education or vocational training, including, but not limited to, any such decision or judgment made concerning (i) assessments, (ii) student cheating or plagiarism detection, (iii) accreditation, (iv) certification, (v) admissions, or (vi) financial aid or scholarships, (C) the provision or denial, or terms and conditions, of (i) financial lending or credit services, (ii) housing or lodging, including, but not limited to, rentals or short-term housing or lodging, (iii) insurance, or (iv) legal services, or (D) the provision or denial of (i) essential government services, or (ii) health care services;Section 1(3); and (4) Any additional documentation that is reasonably necessary to assist a deployerDeployer"Deployer" means any person doing business in this state that deploys a high-risk artificial intelligence system in this state;Section 1(6) to (A) understand the outputs of such high-risk artificial intelligence systemHigh-risk artificial intelligence system"High-risk artificial intelligence system" (A) means any artificial intelligence system that, when deployed, makes, or is a substantial factor in making, a consequential decision, and (B) does not include (i) any artificial intelligence system that is intended to (I) perform any narrow procedural task, or (II) detect decision-making patterns, or deviations from decision-making patterns, unless such artificial intelligence system is intended to replace or influence any assessment previously completed by an individual without sufficient human review, or (ii) unless the technology, when deployed, makes, or is a substantial factor in making, a consequential decision, (I) any anti-fraud technology that does not make use of facial recognition technology, (II) any artificial intelligence-enabled video game technology, (III) any anti-malware, anti-virus, calculator, cybersecurity, database, data storage, firewall, Internet domain registration, Internet-web-site loading, networking, robocall-filtering, spam-filtering, spellchecking, spreadsheet, web-caching, web-hosting or similar technology, (IV) any technology that performs tasks exclusively related to an entity's internal management affairs, including, but not limited to, ordering office supplies or processing payments, or (V) any technology that communicates with consumers in natural language for the purpose of providing users with information, making referrals or recommendations and answering questions, and is subject to an accepted use policy that prohibits generating content that is discriminatory or harmful;Section 1(9), and (B) monitor the performance of such high-risk artificial intelligence systemHigh-risk artificial intelligence system"High-risk artificial intelligence system" (A) means any artificial intelligence system that, when deployed, makes, or is a substantial factor in making, a consequential decision, and (B) does not include (i) any artificial intelligence system that is intended to (I) perform any narrow procedural task, or (II) detect decision-making patterns, or deviations from decision-making patterns, unless such artificial intelligence system is intended to replace or influence any assessment previously completed by an individual without sufficient human review, or (ii) unless the technology, when deployed, makes, or is a substantial factor in making, a consequential decision, (I) any anti-fraud technology that does not make use of facial recognition technology, (II) any artificial intelligence-enabled video game technology, (III) any anti-malware, anti-virus, calculator, cybersecurity, database, data storage, firewall, Internet domain registration, Internet-web-site loading, networking, robocall-filtering, spam-filtering, spellchecking, spreadsheet, web-caching, web-hosting or similar technology, (IV) any technology that performs tasks exclusively related to an entity's internal management affairs, including, but not limited to, ordering office supplies or processing payments, or (V) any technology that communicates with consumers in natural language for the purpose of providing users with information, making referrals or recommendations and answering questions, and is subject to an accepted use policy that prohibits generating content that is discriminatory or harmful;Section 1(9) for risks of algorithmic discriminationAlgorithmic discrimination"Algorithmic discrimination" (A) means any use of an artificial intelligence system that results in any unlawful differential treatment or impact that disfavors any individual or group of individuals on the basis of one or more classifications protected under the laws of this state or federal law, and (B) does not include (i) the offer, license or use of a high-risk artificial intelligence system by a developer, integrator or deployer for the sole purpose of (I) the developer's, integrator's or deployer's self-testing to identify, mitigate or prevent discrimination or otherwise ensure compliance with state and federal law, or (II) expanding an applicant, customer or participant pool to increase diversity or redress historic discrimination, or (ii) an act or omission by or on behalf of a private club or other establishment not in fact open to the public, as set forth in Title II of the Civil Rights Act of 1964, 42 USC 2000a(e), as amended from time to time;Section 1(1).

(c) 2 Except as provided in subsection (c) of section 3 of this act, any developerDeveloper"Developer" means any person doing business in this state that develops, or intentionally and substantially modifies, an artificial intelligence system;Section 1(7) that, on or after October 1, 2026, offers, sells, leases, licenses, gives or otherwise makes available to a deployerDeployer"Deployer" means any person doing business in this state that deploys a high-risk artificial intelligence system in this state;Section 1(6) or another developerDeveloper"Developer" means any person doing business in this state that develops, or intentionally and substantially modifies, an artificial intelligence system;Section 1(7) a high-risk artificial intelligence systemHigh-risk artificial intelligence system"High-risk artificial intelligence system" (A) means any artificial intelligence system that, when deployed, makes, or is a substantial factor in making, a consequential decision, and (B) does not include (i) any artificial intelligence system that is intended to (I) perform any narrow procedural task, or (II) detect decision-making patterns, or deviations from decision-making patterns, unless such artificial intelligence system is intended to replace or influence any assessment previously completed by an individual without sufficient human review, or (ii) unless the technology, when deployed, makes, or is a substantial factor in making, a consequential decision, (I) any anti-fraud technology that does not make use of facial recognition technology, (II) any artificial intelligence-enabled video game technology, (III) any anti-malware, anti-virus, calculator, cybersecurity, database, data storage, firewall, Internet domain registration, Internet-web-site loading, networking, robocall-filtering, spam-filtering, spellchecking, spreadsheet, web-caching, web-hosting or similar technology, (IV) any technology that performs tasks exclusively related to an entity's internal management affairs, including, but not limited to, ordering office supplies or processing payments, or (V) any technology that communicates with consumers in natural language for the purpose of providing users with information, making referrals or recommendations and answering questions, and is subject to an accepted use policy that prohibits generating content that is discriminatory or harmful;Section 1(9) shall, to the extent feasible, make available to the deployersDeployer"Deployer" means any person doing business in this state that deploys a high-risk artificial intelligence system in this state;Section 1(6) and other developers of such high-risk artificial intelligence systemHigh-risk artificial intelligence system"High-risk artificial intelligence system" (A) means any artificial intelligence system that, when deployed, makes, or is a substantial factor in making, a consequential decision, and (B) does not include (i) any artificial intelligence system that is intended to (I) perform any narrow procedural task, or (II) detect decision-making patterns, or deviations from decision-making patterns, unless such artificial intelligence system is intended to replace or influence any assessment previously completed by an individual without sufficient human review, or (ii) unless the technology, when deployed, makes, or is a substantial factor in making, a consequential decision, (I) any anti-fraud technology that does not make use of facial recognition technology, (II) any artificial intelligence-enabled video game technology, (III) any anti-malware, anti-virus, calculator, cybersecurity, database, data storage, firewall, Internet domain registration, Internet-web-site loading, networking, robocall-filtering, spam-filtering, spellchecking, spreadsheet, web-caching, web-hosting or similar technology, (IV) any technology that performs tasks exclusively related to an entity's internal management affairs, including, but not limited to, ordering office supplies or processing payments, or (V) any technology that communicates with consumers in natural language for the purpose of providing users with information, making referrals or recommendations and answering questions, and is subject to an accepted use policy that prohibits generating content that is discriminatory or harmful;Section 1(9) the documentation and information necessary for a deployerDeployer"Deployer" means any person doing business in this state that deploys a high-risk artificial intelligence system in this state;Section 1(6), or the third party contracted by a deployerDeployer"Deployer" means any person doing business in this state that deploys a high-risk artificial intelligence system in this state;Section 1(6), to complete an impact assessment pursuant to subsection (c) of section 4 of this act. The developerDeveloper"Developer" means any person doing business in this state that develops, or intentionally and substantially modifies, an artificial intelligence system;Section 1(7) shall make such documentation and information available through artifacts such as model cards, dataset cards or other impact assessments. (2) A developerDeveloper"Developer" means any person doing business in this state that develops, or intentionally and substantially modifies, an artificial intelligence system;Section 1(7) that also serves as a deployerDeployer"Deployer" means any person doing business in this state that deploys a high-risk artificial intelligence system in this state;Section 1(6) for any high-risk artificial intelligence systemHigh-risk artificial intelligence system"High-risk artificial intelligence system" (A) means any artificial intelligence system that, when deployed, makes, or is a substantial factor in making, a consequential decision, and (B) does not include (i) any artificial intelligence system that is intended to (I) perform any narrow procedural task, or (II) detect decision-making patterns, or deviations from decision-making patterns, unless such artificial intelligence system is intended to replace or influence any assessment previously completed by an individual without sufficient human review, or (ii) unless the technology, when deployed, makes, or is a substantial factor in making, a consequential decision, (I) any anti-fraud technology that does not make use of facial recognition technology, (II) any artificial intelligence-enabled video game technology, (III) any anti-malware, anti-virus, calculator, cybersecurity, database, data storage, firewall, Internet domain registration, Internet-web-site loading, networking, robocall-filtering, spam-filtering, spellchecking, spreadsheet, web-caching, web-hosting or similar technology, (IV) any technology that performs tasks exclusively related to an entity's internal management affairs, including, but not limited to, ordering office supplies or processing payments, or (V) any technology that communicates with consumers in natural language for the purpose of providing users with information, making referrals or recommendations and answering questions, and is subject to an accepted use policy that prohibits generating content that is discriminatory or harmful;Section 1(9) shall not be required to generate the documentation required by this section unless such high-risk artificial intelligence systemHigh-risk artificial intelligence system"High-risk artificial intelligence system" (A) means any artificial intelligence system that, when deployed, makes, or is a substantial factor in making, a consequential decision, and (B) does not include (i) any artificial intelligence system that is intended to (I) perform any narrow procedural task, or (II) detect decision-making patterns, or deviations from decision-making patterns, unless such artificial intelligence system is intended to replace or influence any assessment previously completed by an individual without sufficient human review, or (ii) unless the technology, when deployed, makes, or is a substantial factor in making, a consequential decision, (I) any anti-fraud technology that does not make use of facial recognition technology, (II) any artificial intelligence-enabled video game technology, (III) any anti-malware, anti-virus, calculator, cybersecurity, database, data storage, firewall, Internet domain registration, Internet-web-site loading, networking, robocall-filtering, spam-filtering, spellchecking, spreadsheet, web-caching, web-hosting or similar technology, (IV) any technology that performs tasks exclusively related to an entity's internal management affairs, including, but not limited to, ordering office supplies or processing payments, or (V) any technology that communicates with consumers in natural language for the purpose of providing users with information, making referrals or recommendations and answering questions, and is subject to an accepted use policy that prohibits generating content that is discriminatory or harmful;Section 1(9) is provided to another person that serves as a deployerDeployer"Deployer" means any person doing business in this state that deploys a high-risk artificial intelligence system in this state;Section 1(6) for such high-risk artificial intelligence systemHigh-risk artificial intelligence system"High-risk artificial intelligence system" (A) means any artificial intelligence system that, when deployed, makes, or is a substantial factor in making, a consequential decision, and (B) does not include (i) any artificial intelligence system that is intended to (I) perform any narrow procedural task, or (II) detect decision-making patterns, or deviations from decision-making patterns, unless such artificial intelligence system is intended to replace or influence any assessment previously completed by an individual without sufficient human review, or (ii) unless the technology, when deployed, makes, or is a substantial factor in making, a consequential decision, (I) any anti-fraud technology that does not make use of facial recognition technology, (II) any artificial intelligence-enabled video game technology, (III) any anti-malware, anti-virus, calculator, cybersecurity, database, data storage, firewall, Internet domain registration, Internet-web-site loading, networking, robocall-filtering, spam-filtering, spellchecking, spreadsheet, web-caching, web-hosting or similar technology, (IV) any technology that performs tasks exclusively related to an entity's internal management affairs, including, but not limited to, ordering office supplies or processing payments, or (V) any technology that communicates with consumers in natural language for the purpose of providing users with information, making referrals or recommendations and answering questions, and is subject to an accepted use policy that prohibits generating content that is discriminatory or harmful;Section 1(9).

(d) 3 Beginning on October 1, 2026, each developerDeveloper"Developer" means any person doing business in this state that develops, or intentionally and substantially modifies, an artificial intelligence system;Section 1(7) shall make available, in a manner that is clear and readily available on such developerDeveloper"Developer" means any person doing business in this state that develops, or intentionally and substantially modifies, an artificial intelligence system;Section 1(7)'s Internet web site or in a public use case inventory, a statement summarizing: (A) The types of high-risk artificial intelligence systemsHigh-risk artificial intelligence system"High-risk artificial intelligence system" (A) means any artificial intelligence system that, when deployed, makes, or is a substantial factor in making, a consequential decision, and (B) does not include (i) any artificial intelligence system that is intended to (I) perform any narrow procedural task, or (II) detect decision-making patterns, or deviations from decision-making patterns, unless such artificial intelligence system is intended to replace or influence any assessment previously completed by an individual without sufficient human review, or (ii) unless the technology, when deployed, makes, or is a substantial factor in making, a consequential decision, (I) any anti-fraud technology that does not make use of facial recognition technology, (II) any artificial intelligence-enabled video game technology, (III) any anti-malware, anti-virus, calculator, cybersecurity, database, data storage, firewall, Internet domain registration, Internet-web-site loading, networking, robocall-filtering, spam-filtering, spellchecking, spreadsheet, web-caching, web-hosting or similar technology, (IV) any technology that performs tasks exclusively related to an entity's internal management affairs, including, but not limited to, ordering office supplies or processing payments, or (V) any technology that communicates with consumers in natural language for the purpose of providing users with information, making referrals or recommendations and answering questions, and is subject to an accepted use policy that prohibits generating content that is discriminatory or harmful;Section 1(9) that such developerDeveloper"Developer" means any person doing business in this state that develops, or intentionally and substantially modifies, an artificial intelligence system;Section 1(7) (i) has developed or intentionally and substantially modified, and (ii) currently makes available to a deployerDeployer"Deployer" means any person doing business in this state that deploys a high-risk artificial intelligence system in this state;Section 1(6) or another developerDeveloper"Developer" means any person doing business in this state that develops, or intentionally and substantially modifies, an artificial intelligence system;Section 1(7); and (B) How such developerDeveloper"Developer" means any person doing business in this state that develops, or intentionally and substantially modifies, an artificial intelligence system;Section 1(7) manages any known or reasonably foreseeable risks of algorithmic discriminationAlgorithmic discrimination"Algorithmic discrimination" (A) means any use of an artificial intelligence system that results in any unlawful differential treatment or impact that disfavors any individual or group of individuals on the basis of one or more classifications protected under the laws of this state or federal law, and (B) does not include (i) the offer, license or use of a high-risk artificial intelligence system by a developer, integrator or deployer for the sole purpose of (I) the developer's, integrator's or deployer's self-testing to identify, mitigate or prevent discrimination or otherwise ensure compliance with state and federal law, or (II) expanding an applicant, customer or participant pool to increase diversity or redress historic discrimination, or (ii) an act or omission by or on behalf of a private club or other establishment not in fact open to the public, as set forth in Title II of the Civil Rights Act of 1964, 42 USC 2000a(e), as amended from time to time;Section 1(1) that may arise from development or intentional and substantial modification of the types of high-risk artificial intelligence systemsHigh-risk artificial intelligence system"High-risk artificial intelligence system" (A) means any artificial intelligence system that, when deployed, makes, or is a substantial factor in making, a consequential decision, and (B) does not include (i) any artificial intelligence system that is intended to (I) perform any narrow procedural task, or (II) detect decision-making patterns, or deviations from decision-making patterns, unless such artificial intelligence system is intended to replace or influence any assessment previously completed by an individual without sufficient human review, or (ii) unless the technology, when deployed, makes, or is a substantial factor in making, a consequential decision, (I) any anti-fraud technology that does not make use of facial recognition technology, (II) any artificial intelligence-enabled video game technology, (III) any anti-malware, anti-virus, calculator, cybersecurity, database, data storage, firewall, Internet domain registration, Internet-web-site loading, networking, robocall-filtering, spam-filtering, spellchecking, spreadsheet, web-caching, web-hosting or similar technology, (IV) any technology that performs tasks exclusively related to an entity's internal management affairs, including, but not limited to, ordering office supplies or processing payments, or (V) any technology that communicates with consumers in natural language for the purpose of providing users with information, making referrals or recommendations and answering questions, and is subject to an accepted use policy that prohibits generating content that is discriminatory or harmful;Section 1(9) described in subparagraph (A) of this subdivision. (2) Each developerDeveloper"Developer" means any person doing business in this state that develops, or intentionally and substantially modifies, an artificial intelligence system;Section 1(7) shall update the statement made available pursuant to subdivision (1) of this subsection (A) as necessary to ensure that such statement remains accurate, and (B) not later than ninety days after the developerDeveloper"Developer" means any person doing business in this state that develops, or intentionally and substantially modifies, an artificial intelligence system;Section 1(7) intentionally and substantially modifies any high-risk artificial intelligence systemHigh-risk artificial intelligence system"High-risk artificial intelligence system" (A) means any artificial intelligence system that, when deployed, makes, or is a substantial factor in making, a consequential decision, and (B) does not include (i) any artificial intelligence system that is intended to (I) perform any narrow procedural task, or (II) detect decision-making patterns, or deviations from decision-making patterns, unless such artificial intelligence system is intended to replace or influence any assessment previously completed by an individual without sufficient human review, or (ii) unless the technology, when deployed, makes, or is a substantial factor in making, a consequential decision, (I) any anti-fraud technology that does not make use of facial recognition technology, (II) any artificial intelligence-enabled video game technology, (III) any anti-malware, anti-virus, calculator, cybersecurity, database, data storage, firewall, Internet domain registration, Internet-web-site loading, networking, robocall-filtering, spam-filtering, spellchecking, spreadsheet, web-caching, web-hosting or similar technology, (IV) any technology that performs tasks exclusively related to an entity's internal management affairs, including, but not limited to, ordering office supplies or processing payments, or (V) any technology that communicates with consumers in natural language for the purpose of providing users with information, making referrals or recommendations and answering questions, and is subject to an accepted use policy that prohibits generating content that is discriminatory or harmful;Section 1(9) described in subparagraph (A) of subdivision (1) of this subsection.

(e) 4 Beginning on October 1, 2026, a developer of a high-risk artificial intelligence systemHigh-risk artificial intelligence system"High-risk artificial intelligence system" (A) means any artificial intelligence system that, when deployed, makes, or is a substantial factor in making, a consequential decision, and (B) does not include (i) any artificial intelligence system that is intended to (I) perform any narrow procedural task, or (II) detect decision-making patterns, or deviations from decision-making patterns, unless such artificial intelligence system is intended to replace or influence any assessment previously completed by an individual without sufficient human review, or (ii) unless the technology, when deployed, makes, or is a substantial factor in making, a consequential decision, (I) any anti-fraud technology that does not make use of facial recognition technology, (II) any artificial intelligence-enabled video game technology, (III) any anti-malware, anti-virus, calculator, cybersecurity, database, data storage, firewall, Internet domain registration, Internet-web-site loading, networking, robocall-filtering, spam-filtering, spellchecking, spreadsheet, web-caching, web-hosting or similar technology, (IV) any technology that performs tasks exclusively related to an entity's internal management affairs, including, but not limited to, ordering office supplies or processing payments, or (V) any technology that communicates with consumers in natural language for the purpose of providing users with information, making referrals or recommendations and answering questions, and is subject to an accepted use policy that prohibits generating content that is discriminatory or harmful;Section 1(9) shall disclose to the Attorney General, in a form and manner prescribed by the Attorney General, and to all known deployersDeployer"Deployer" means any person doing business in this state that deploys a high-risk artificial intelligence system in this state;Section 1(6) or other developers of the high-risk artificial intelligence systemHigh-risk artificial intelligence system"High-risk artificial intelligence system" (A) means any artificial intelligence system that, when deployed, makes, or is a substantial factor in making, a consequential decision, and (B) does not include (i) any artificial intelligence system that is intended to (I) perform any narrow procedural task, or (II) detect decision-making patterns, or deviations from decision-making patterns, unless such artificial intelligence system is intended to replace or influence any assessment previously completed by an individual without sufficient human review, or (ii) unless the technology, when deployed, makes, or is a substantial factor in making, a consequential decision, (I) any anti-fraud technology that does not make use of facial recognition technology, (II) any artificial intelligence-enabled video game technology, (III) any anti-malware, anti-virus, calculator, cybersecurity, database, data storage, firewall, Internet domain registration, Internet-web-site loading, networking, robocall-filtering, spam-filtering, spellchecking, spreadsheet, web-caching, web-hosting or similar technology, (IV) any technology that performs tasks exclusively related to an entity's internal management affairs, including, but not limited to, ordering office supplies or processing payments, or (V) any technology that communicates with consumers in natural language for the purpose of providing users with information, making referrals or recommendations and answering questions, and is subject to an accepted use policy that prohibits generating content that is discriminatory or harmful;Section 1(9), any known or reasonably foreseeable risks of algorithmic discriminationAlgorithmic discrimination"Algorithmic discrimination" (A) means any use of an artificial intelligence system that results in any unlawful differential treatment or impact that disfavors any individual or group of individuals on the basis of one or more classifications protected under the laws of this state or federal law, and (B) does not include (i) the offer, license or use of a high-risk artificial intelligence system by a developer, integrator or deployer for the sole purpose of (I) the developer's, integrator's or deployer's self-testing to identify, mitigate or prevent discrimination or otherwise ensure compliance with state and federal law, or (II) expanding an applicant, customer or participant pool to increase diversity or redress historic discrimination, or (ii) an act or omission by or on behalf of a private club or other establishment not in fact open to the public, as set forth in Title II of the Civil Rights Act of 1964, 42 USC 2000a(e), as amended from time to time;Section 1(1) arising from the intended uses of such high-risk artificial intelligence systemHigh-risk artificial intelligence system"High-risk artificial intelligence system" (A) means any artificial intelligence system that, when deployed, makes, or is a substantial factor in making, a consequential decision, and (B) does not include (i) any artificial intelligence system that is intended to (I) perform any narrow procedural task, or (II) detect decision-making patterns, or deviations from decision-making patterns, unless such artificial intelligence system is intended to replace or influence any assessment previously completed by an individual without sufficient human review, or (ii) unless the technology, when deployed, makes, or is a substantial factor in making, a consequential decision, (I) any anti-fraud technology that does not make use of facial recognition technology, (II) any artificial intelligence-enabled video game technology, (III) any anti-malware, anti-virus, calculator, cybersecurity, database, data storage, firewall, Internet domain registration, Internet-web-site loading, networking, robocall-filtering, spam-filtering, spellchecking, spreadsheet, web-caching, web-hosting or similar technology, (IV) any technology that performs tasks exclusively related to an entity's internal management affairs, including, but not limited to, ordering office supplies or processing payments, or (V) any technology that communicates with consumers in natural language for the purpose of providing users with information, making referrals or recommendations and answering questions, and is subject to an accepted use policy that prohibits generating content that is discriminatory or harmful;Section 1(9). The developerDeveloper"Developer" means any person doing business in this state that develops, or intentionally and substantially modifies, an artificial intelligence system;Section 1(7) shall make such disclosures without unreasonable delay but in no event later than ninety days after the date on which: (1) The developerDeveloper"Developer" means any person doing business in this state that develops, or intentionally and substantially modifies, an artificial intelligence system;Section 1(7) discovers, through the developerDeveloper"Developer" means any person doing business in this state that develops, or intentionally and substantially modifies, an artificial intelligence system;Section 1(7)'s ongoing testing and analysis, that the high-risk artificial intelligence systemHigh-risk artificial intelligence system"High-risk artificial intelligence system" (A) means any artificial intelligence system that, when deployed, makes, or is a substantial factor in making, a consequential decision, and (B) does not include (i) any artificial intelligence system that is intended to (I) perform any narrow procedural task, or (II) detect decision-making patterns, or deviations from decision-making patterns, unless such artificial intelligence system is intended to replace or influence any assessment previously completed by an individual without sufficient human review, or (ii) unless the technology, when deployed, makes, or is a substantial factor in making, a consequential decision, (I) any anti-fraud technology that does not make use of facial recognition technology, (II) any artificial intelligence-enabled video game technology, (III) any anti-malware, anti-virus, calculator, cybersecurity, database, data storage, firewall, Internet domain registration, Internet-web-site loading, networking, robocall-filtering, spam-filtering, spellchecking, spreadsheet, web-caching, web-hosting or similar technology, (IV) any technology that performs tasks exclusively related to an entity's internal management affairs, including, but not limited to, ordering office supplies or processing payments, or (V) any technology that communicates with consumers in natural language for the purpose of providing users with information, making referrals or recommendations and answering questions, and is subject to an accepted use policy that prohibits generating content that is discriminatory or harmful;Section 1(9) has (A) been deployed, and (B) caused, or is reasonably likely to have caused, algorithmic discriminationAlgorithmic discrimination"Algorithmic discrimination" (A) means any use of an artificial intelligence system that results in any unlawful differential treatment or impact that disfavors any individual or group of individuals on the basis of one or more classifications protected under the laws of this state or federal law, and (B) does not include (i) the offer, license or use of a high-risk artificial intelligence system by a developer, integrator or deployer for the sole purpose of (I) the developer's, integrator's or deployer's self-testing to identify, mitigate or prevent discrimination or otherwise ensure compliance with state and federal law, or (II) expanding an applicant, customer or participant pool to increase diversity or redress historic discrimination, or (ii) an act or omission by or on behalf of a private club or other establishment not in fact open to the public, as set forth in Title II of the Civil Rights Act of 1964, 42 USC 2000a(e), as amended from time to time;Section 1(1) to at least one thousand consumersConsumer"Consumer" means any individual who is a resident of this state;Section 1(4); or (2) The developerDeveloper"Developer" means any person doing business in this state that develops, or intentionally and substantially modifies, an artificial intelligence system;Section 1(7) receives, from a deployer of the high-risk artificial intelligence systemHigh-risk artificial intelligence system"High-risk artificial intelligence system" (A) means any artificial intelligence system that, when deployed, makes, or is a substantial factor in making, a consequential decision, and (B) does not include (i) any artificial intelligence system that is intended to (I) perform any narrow procedural task, or (II) detect decision-making patterns, or deviations from decision-making patterns, unless such artificial intelligence system is intended to replace or influence any assessment previously completed by an individual without sufficient human review, or (ii) unless the technology, when deployed, makes, or is a substantial factor in making, a consequential decision, (I) any anti-fraud technology that does not make use of facial recognition technology, (II) any artificial intelligence-enabled video game technology, (III) any anti-malware, anti-virus, calculator, cybersecurity, database, data storage, firewall, Internet domain registration, Internet-web-site loading, networking, robocall-filtering, spam-filtering, spellchecking, spreadsheet, web-caching, web-hosting or similar technology, (IV) any technology that performs tasks exclusively related to an entity's internal management affairs, including, but not limited to, ordering office supplies or processing payments, or (V) any technology that communicates with consumers in natural language for the purpose of providing users with information, making referrals or recommendations and answering questions, and is subject to an accepted use policy that prohibits generating content that is discriminatory or harmful;Section 1(9), a credible report disclosing that such high-risk artificial intelligence systemHigh-risk artificial intelligence system"High-risk artificial intelligence system" (A) means any artificial intelligence system that, when deployed, makes, or is a substantial factor in making, a consequential decision, and (B) does not include (i) any artificial intelligence system that is intended to (I) perform any narrow procedural task, or (II) detect decision-making patterns, or deviations from decision-making patterns, unless such artificial intelligence system is intended to replace or influence any assessment previously completed by an individual without sufficient human review, or (ii) unless the technology, when deployed, makes, or is a substantial factor in making, a consequential decision, (I) any anti-fraud technology that does not make use of facial recognition technology, (II) any artificial intelligence-enabled video game technology, (III) any anti-malware, anti-virus, calculator, cybersecurity, database, data storage, firewall, Internet domain registration, Internet-web-site loading, networking, robocall-filtering, spam-filtering, spellchecking, spreadsheet, web-caching, web-hosting or similar technology, (IV) any technology that performs tasks exclusively related to an entity's internal management affairs, including, but not limited to, ordering office supplies or processing payments, or (V) any technology that communicates with consumers in natural language for the purpose of providing users with information, making referrals or recommendations and answering questions, and is subject to an accepted use policy that prohibits generating content that is discriminatory or harmful;Section 1(9) has (A) been deployed, and (B) caused algorithmic discriminationAlgorithmic discrimination"Algorithmic discrimination" (A) means any use of an artificial intelligence system that results in any unlawful differential treatment or impact that disfavors any individual or group of individuals on the basis of one or more classifications protected under the laws of this state or federal law, and (B) does not include (i) the offer, license or use of a high-risk artificial intelligence system by a developer, integrator or deployer for the sole purpose of (I) the developer's, integrator's or deployer's self-testing to identify, mitigate or prevent discrimination or otherwise ensure compliance with state and federal law, or (II) expanding an applicant, customer or participant pool to increase diversity or redress historic discrimination, or (ii) an act or omission by or on behalf of a private club or other establishment not in fact open to the public, as set forth in Title II of the Civil Rights Act of 1964, 42 USC 2000a(e), as amended from time to time;Section 1(1) to at least one thousand consumersConsumer"Consumer" means any individual who is a resident of this state;Section 1(4).

(f)–(g) 5 The provisions of subsections (b) to (e), inclusive, of this section shall not be construed to require a developerDeveloper"Developer" means any person doing business in this state that develops, or intentionally and substantially modifies, an artificial intelligence system;Section 1(7) to disclose any information (1) that is a trade secret or otherwise protected from disclosure under state or federal law, or (2) the disclosure of which would present a security risk to the developerDeveloper"Developer" means any person doing business in this state that develops, or intentionally and substantially modifies, an artificial intelligence system;Section 1(7). (g) Beginning on October 1, 2026, the Attorney General may require that a developerDeveloper"Developer" means any person doing business in this state that develops, or intentionally and substantially modifies, an artificial intelligence system;Section 1(7) disclose to the Attorney General, as part of an investigation conducted by the Attorney General and in a form and manner prescribed by the Attorney General, the general statement or documentation described in subsection (b) of this section. The Attorney General may evaluate such general statement or documentation to ensure compliance with the provisions of this section. In disclosing such general statement or documentation to the Attorney General pursuant to this subsection, the developerDeveloper"Developer" means any person doing business in this state that develops, or intentionally and substantially modifies, an artificial intelligence system;Section 1(7) may designate such general statement or documentation as including any information that is exempt from disclosure under subsection (f) of this section or the Freedom of Information Act, as defined in section 1-200 of the general statutes. To the extent such general statement or documentation includes such information, such general statement or documentation shall be exempt from disclosure under subsection (f) of this section or said act. To the extent any information contained in such general statement or documentation is subject to the attorney-client privilege or work product protection, such disclosure shall not constitute a waiver of such privilege or protection.

Section 2 imposes the primary developer-side obligations. Developers of high-risk AI systems must exercise reasonable care to protect consumers from algorithmic discrimination, with a rebuttable presumption of compliance available for developers that meet the section's requirements. Developers must provide deployers with detailed documentation covering foreseeable uses, training data summaries, discrimination risks, performance evaluation methods, data governance measures, and monitoring guidance. Developers must also publish and maintain a public use-case statement describing their high-risk AI systems and discrimination risk management. A disclosure obligation to the Attorney General and all known deployers is triggered when algorithmic discrimination affecting at least 1,000 consumers is discovered or credibly reported. Trade secret and security risk information is protected from mandatory disclosure.

Compliance actions 5 items
1
Developers of high-risk AI systems must use reasonable care to protect consumersConsumer"Consumer" means any individual who is a resident of this state;Section 1(4) from known or reasonably foreseeable risks of algorithmic discriminationAlgorithmic discrimination"Algorithmic discrimination" (A) means any use of an artificial intelligence system that results in any unlawful differential treatment or impact that disfavors any individual or group of individuals on the basis of one or more classifications protected under the laws of this state or federal law, and (B) does not include (i) the offer, license or use of a high-risk artificial intelligence system by a developer, integrator or deployer for the sole purpose of (I) the developer's, integrator's or deployer's self-testing to identify, mitigate or prevent discrimination or otherwise ensure compliance with state and federal law, or (II) expanding an applicant, customer or participant pool to increase diversity or redress historic discrimination, or (ii) an act or omission by or on behalf of a private club or other establishment not in fact open to the public, as set forth in Title II of the Civil Rights Act of 1964, 42 USC 2000a(e), as amended from time to time;Section 1(1) arising from intended and contracted uses of the system.
H-02.1
2
DevelopersDeveloper"Developer" means any person doing business in this state that develops, or intentionally and substantially modifies, an artificial intelligence system;Section 1(7) must make available to each deployerDeployer"Deployer" means any person doing business in this state that deploys a high-risk artificial intelligence system in this state;Section 1(6) documentation covering foreseeable uses, training data summaries, discrimination risks, performance evaluation methods, data governance measures, intended outputs, mitigation measures, and monitoring guidance for each high-risk AI system, including materials necessary for the deployerDeployer"Deployer" means any person doing business in this state that deploys a high-risk artificial intelligence system in this state;Section 1(6) to complete an impact assessment.
G-02.1
3
DevelopersDeveloper"Developer" means any person doing business in this state that develops, or intentionally and substantially modifies, an artificial intelligence system;Section 1(7) must publish and maintain on their website or in a public use-case inventory a statement summarizing the types of high-risk AI systems they offer and how they manage algorithmic discriminationAlgorithmic discrimination"Algorithmic discrimination" (A) means any use of an artificial intelligence system that results in any unlawful differential treatment or impact that disfavors any individual or group of individuals on the basis of one or more classifications protected under the laws of this state or federal law, and (B) does not include (i) the offer, license or use of a high-risk artificial intelligence system by a developer, integrator or deployer for the sole purpose of (I) the developer's, integrator's or deployer's self-testing to identify, mitigate or prevent discrimination or otherwise ensure compliance with state and federal law, or (II) expanding an applicant, customer or participant pool to increase diversity or redress historic discrimination, or (ii) an act or omission by or on behalf of a private club or other establishment not in fact open to the public, as set forth in Title II of the Civil Rights Act of 1964, 42 USC 2000a(e), as amended from time to time;Section 1(1) risks, updated within 90 days of any intentional and substantial modificationIntentional and substantial modification"Intentional and substantial modification" (A) means any deliberate change made to (i) an artificial intelligence system that materially increases the risk of algorithmic discrimination, or (ii) a general-purpose artificial intelligence model that (I) affects compliance of the general-purpose artificial intelligence model, (II) materially changes the purpose of the general-purpose artificial intelligence model, or (III) materially increases the risk of algorithmic discrimination, and (B) does not include any change made to a high-risk artificial intelligence system, or the performance of a high-risk artificial intelligence system, if (i) the high-risk artificial intelligence system continues to learn after such high-risk artificial intelligence system is (I) offered, sold, leased, licensed, given or otherwise made available to a deployer, or (II) deployed, and (ii) such change (I) is made to such high-risk artificial intelligence system as a result of any learning described in subparagraph (B)(i) of this subdivision, (II) was predetermined by the deployer, or the third party contracted by the deployer, when such deployer or third party completed the initial impact assessment of such high-risk artificial intelligence system pursuant to subsection (c) of section 4 of this act, and (III) is included in the technical documentation for such high-risk artificial intelligence system;Section 1(11).
G-02.4
4
DevelopersDeveloper"Developer" means any person doing business in this state that develops, or intentionally and substantially modifies, an artificial intelligence system;Section 1(7) must disclose to the Attorney General and all known deployersDeployer"Deployer" means any person doing business in this state that deploys a high-risk artificial intelligence system in this state;Section 1(6) any known or reasonably foreseeable risks of algorithmic discriminationAlgorithmic discrimination"Algorithmic discrimination" (A) means any use of an artificial intelligence system that results in any unlawful differential treatment or impact that disfavors any individual or group of individuals on the basis of one or more classifications protected under the laws of this state or federal law, and (B) does not include (i) the offer, license or use of a high-risk artificial intelligence system by a developer, integrator or deployer for the sole purpose of (I) the developer's, integrator's or deployer's self-testing to identify, mitigate or prevent discrimination or otherwise ensure compliance with state and federal law, or (II) expanding an applicant, customer or participant pool to increase diversity or redress historic discrimination, or (ii) an act or omission by or on behalf of a private club or other establishment not in fact open to the public, as set forth in Title II of the Civil Rights Act of 1964, 42 USC 2000a(e), as amended from time to time;Section 1(1) within 90 days of discovering (through testing or a credible deployerDeployer"Deployer" means any person doing business in this state that deploys a high-risk artificial intelligence system in this state;Section 1(6) report) that the system has caused or is reasonably likely to have caused algorithmic discriminationAlgorithmic discrimination"Algorithmic discrimination" (A) means any use of an artificial intelligence system that results in any unlawful differential treatment or impact that disfavors any individual or group of individuals on the basis of one or more classifications protected under the laws of this state or federal law, and (B) does not include (i) the offer, license or use of a high-risk artificial intelligence system by a developer, integrator or deployer for the sole purpose of (I) the developer's, integrator's or deployer's self-testing to identify, mitigate or prevent discrimination or otherwise ensure compliance with state and federal law, or (II) expanding an applicant, customer or participant pool to increase diversity or redress historic discrimination, or (ii) an act or omission by or on behalf of a private club or other establishment not in fact open to the public, as set forth in Title II of the Civil Rights Act of 1964, 42 USC 2000a(e), as amended from time to time;Section 1(1) to at least 1,000 consumersConsumer"Consumer" means any individual who is a resident of this state;Section 1(4).
R-01.3
5
DevelopersDeveloper"Developer" means any person doing business in this state that develops, or intentionally and substantially modifies, an artificial intelligence system;Section 1(7) must, upon request by the Attorney General as part of an investigation, disclose the documentation described in section 2(b) in a form and manner the AG prescribes. DevelopersDeveloper"Developer" means any person doing business in this state that develops, or intentionally and substantially modifies, an artificial intelligence system;Section 1(7) may designate trade-secret or security-sensitive information as exempt from public disclosure.
R-02.2
Section 3
Integrator obligations for high-risk AI systems
Deployer

(a) 6 Beginning on October 1, 2026, if an integratorIntegrator"Integrator" means any person doing business in this state that, with respect to a given high-risk artificial intelligence system, (A) neither develops nor intentionally and substantially modifies the high-risk artificial intelligence system, and (B) integrates the high-risk artificial intelligence system into a product or service such person offers to any other person;Section 1(10) integrates a high-risk artificial intelligence systemHigh-risk artificial intelligence system"High-risk artificial intelligence system" (A) means any artificial intelligence system that, when deployed, makes, or is a substantial factor in making, a consequential decision, and (B) does not include (i) any artificial intelligence system that is intended to (I) perform any narrow procedural task, or (II) detect decision-making patterns, or deviations from decision-making patterns, unless such artificial intelligence system is intended to replace or influence any assessment previously completed by an individual without sufficient human review, or (ii) unless the technology, when deployed, makes, or is a substantial factor in making, a consequential decision, (I) any anti-fraud technology that does not make use of facial recognition technology, (II) any artificial intelligence-enabled video game technology, (III) any anti-malware, anti-virus, calculator, cybersecurity, database, data storage, firewall, Internet domain registration, Internet-web-site loading, networking, robocall-filtering, spam-filtering, spellchecking, spreadsheet, web-caching, web-hosting or similar technology, (IV) any technology that performs tasks exclusively related to an entity's internal management affairs, including, but not limited to, ordering office supplies or processing payments, or (V) any technology that communicates with consumers in natural language for the purpose of providing users with information, making referrals or recommendations and answering questions, and is subject to an accepted use policy that prohibits generating content that is discriminatory or harmful;Section 1(9) into a product or service the integratorIntegrator"Integrator" means any person doing business in this state that, with respect to a given high-risk artificial intelligence system, (A) neither develops nor intentionally and substantially modifies the high-risk artificial intelligence system, and (B) integrates the high-risk artificial intelligence system into a product or service such person offers to any other person;Section 1(10) offers to any other person, such integratorIntegrator"Integrator" means any person doing business in this state that, with respect to a given high-risk artificial intelligence system, (A) neither develops nor intentionally and substantially modifies the high-risk artificial intelligence system, and (B) integrates the high-risk artificial intelligence system into a product or service such person offers to any other person;Section 1(10) shall use reasonable care to protect consumersConsumer"Consumer" means any individual who is a resident of this state;Section 1(4) from any known or reasonably foreseeable risks of algorithmic discriminationAlgorithmic discrimination"Algorithmic discrimination" (A) means any use of an artificial intelligence system that results in any unlawful differential treatment or impact that disfavors any individual or group of individuals on the basis of one or more classifications protected under the laws of this state or federal law, and (B) does not include (i) the offer, license or use of a high-risk artificial intelligence system by a developer, integrator or deployer for the sole purpose of (I) the developer's, integrator's or deployer's self-testing to identify, mitigate or prevent discrimination or otherwise ensure compliance with state and federal law, or (II) expanding an applicant, customer or participant pool to increase diversity or redress historic discrimination, or (ii) an act or omission by or on behalf of a private club or other establishment not in fact open to the public, as set forth in Title II of the Civil Rights Act of 1964, 42 USC 2000a(e), as amended from time to time;Section 1(1) arising from the intended and contracted uses of such integrated high-risk artificial intelligence systemHigh-risk artificial intelligence system"High-risk artificial intelligence system" (A) means any artificial intelligence system that, when deployed, makes, or is a substantial factor in making, a consequential decision, and (B) does not include (i) any artificial intelligence system that is intended to (I) perform any narrow procedural task, or (II) detect decision-making patterns, or deviations from decision-making patterns, unless such artificial intelligence system is intended to replace or influence any assessment previously completed by an individual without sufficient human review, or (ii) unless the technology, when deployed, makes, or is a substantial factor in making, a consequential decision, (I) any anti-fraud technology that does not make use of facial recognition technology, (II) any artificial intelligence-enabled video game technology, (III) any anti-malware, anti-virus, calculator, cybersecurity, database, data storage, firewall, Internet domain registration, Internet-web-site loading, networking, robocall-filtering, spam-filtering, spellchecking, spreadsheet, web-caching, web-hosting or similar technology, (IV) any technology that performs tasks exclusively related to an entity's internal management affairs, including, but not limited to, ordering office supplies or processing payments, or (V) any technology that communicates with consumers in natural language for the purpose of providing users with information, making referrals or recommendations and answering questions, and is subject to an accepted use policy that prohibits generating content that is discriminatory or harmful;Section 1(9). In any enforcement action brought on or after said date by the Attorney General pursuant to section 10 of this act, there shall be a rebuttable presumption that the integratorIntegrator"Integrator" means any person doing business in this state that, with respect to a given high-risk artificial intelligence system, (A) neither develops nor intentionally and substantially modifies the high-risk artificial intelligence system, and (B) integrates the high-risk artificial intelligence system into a product or service such person offers to any other person;Section 1(10) used reasonable care as required under this subsection if the integratorIntegrator"Integrator" means any person doing business in this state that, with respect to a given high-risk artificial intelligence system, (A) neither develops nor intentionally and substantially modifies the high-risk artificial intelligence system, and (B) integrates the high-risk artificial intelligence system into a product or service such person offers to any other person;Section 1(10) complied with the provisions of this section.

(b) 7 Beginning on October 1, 2026, no integratorIntegrator"Integrator" means any person doing business in this state that, with respect to a given high-risk artificial intelligence system, (A) neither develops nor intentionally and substantially modifies the high-risk artificial intelligence system, and (B) integrates the high-risk artificial intelligence system into a product or service such person offers to any other person;Section 1(10) shall integrate a high-risk artificial intelligence systemHigh-risk artificial intelligence system"High-risk artificial intelligence system" (A) means any artificial intelligence system that, when deployed, makes, or is a substantial factor in making, a consequential decision, and (B) does not include (i) any artificial intelligence system that is intended to (I) perform any narrow procedural task, or (II) detect decision-making patterns, or deviations from decision-making patterns, unless such artificial intelligence system is intended to replace or influence any assessment previously completed by an individual without sufficient human review, or (ii) unless the technology, when deployed, makes, or is a substantial factor in making, a consequential decision, (I) any anti-fraud technology that does not make use of facial recognition technology, (II) any artificial intelligence-enabled video game technology, (III) any anti-malware, anti-virus, calculator, cybersecurity, database, data storage, firewall, Internet domain registration, Internet-web-site loading, networking, robocall-filtering, spam-filtering, spellchecking, spreadsheet, web-caching, web-hosting or similar technology, (IV) any technology that performs tasks exclusively related to an entity's internal management affairs, including, but not limited to, ordering office supplies or processing payments, or (V) any technology that communicates with consumers in natural language for the purpose of providing users with information, making referrals or recommendations and answering questions, and is subject to an accepted use policy that prohibits generating content that is discriminatory or harmful;Section 1(9) into a product or service the integratorIntegrator"Integrator" means any person doing business in this state that, with respect to a given high-risk artificial intelligence system, (A) neither develops nor intentionally and substantially modifies the high-risk artificial intelligence system, and (B) integrates the high-risk artificial intelligence system into a product or service such person offers to any other person;Section 1(10) offers to any other person unless the integratorIntegrator"Integrator" means any person doing business in this state that, with respect to a given high-risk artificial intelligence system, (A) neither develops nor intentionally and substantially modifies the high-risk artificial intelligence system, and (B) integrates the high-risk artificial intelligence system into a product or service such person offers to any other person;Section 1(10) has entered into a contract with the developer of the high-risk artificial intelligence systemHigh-risk artificial intelligence system"High-risk artificial intelligence system" (A) means any artificial intelligence system that, when deployed, makes, or is a substantial factor in making, a consequential decision, and (B) does not include (i) any artificial intelligence system that is intended to (I) perform any narrow procedural task, or (II) detect decision-making patterns, or deviations from decision-making patterns, unless such artificial intelligence system is intended to replace or influence any assessment previously completed by an individual without sufficient human review, or (ii) unless the technology, when deployed, makes, or is a substantial factor in making, a consequential decision, (I) any anti-fraud technology that does not make use of facial recognition technology, (II) any artificial intelligence-enabled video game technology, (III) any anti-malware, anti-virus, calculator, cybersecurity, database, data storage, firewall, Internet domain registration, Internet-web-site loading, networking, robocall-filtering, spam-filtering, spellchecking, spreadsheet, web-caching, web-hosting or similar technology, (IV) any technology that performs tasks exclusively related to an entity's internal management affairs, including, but not limited to, ordering office supplies or processing payments, or (V) any technology that communicates with consumers in natural language for the purpose of providing users with information, making referrals or recommendations and answering questions, and is subject to an accepted use policy that prohibits generating content that is discriminatory or harmful;Section 1(9). The contract shall be binding and clearly set forth the duties of the developerDeveloper"Developer" means any person doing business in this state that develops, or intentionally and substantially modifies, an artificial intelligence system;Section 1(7) and integratorIntegrator"Integrator" means any person doing business in this state that, with respect to a given high-risk artificial intelligence system, (A) neither develops nor intentionally and substantially modifies the high-risk artificial intelligence system, and (B) integrates the high-risk artificial intelligence system into a product or service such person offers to any other person;Section 1(10) with respect to the integrated high-risk artificial intelligence systemHigh-risk artificial intelligence system"High-risk artificial intelligence system" (A) means any artificial intelligence system that, when deployed, makes, or is a substantial factor in making, a consequential decision, and (B) does not include (i) any artificial intelligence system that is intended to (I) perform any narrow procedural task, or (II) detect decision-making patterns, or deviations from decision-making patterns, unless such artificial intelligence system is intended to replace or influence any assessment previously completed by an individual without sufficient human review, or (ii) unless the technology, when deployed, makes, or is a substantial factor in making, a consequential decision, (I) any anti-fraud technology that does not make use of facial recognition technology, (II) any artificial intelligence-enabled video game technology, (III) any anti-malware, anti-virus, calculator, cybersecurity, database, data storage, firewall, Internet domain registration, Internet-web-site loading, networking, robocall-filtering, spam-filtering, spellchecking, spreadsheet, web-caching, web-hosting or similar technology, (IV) any technology that performs tasks exclusively related to an entity's internal management affairs, including, but not limited to, ordering office supplies or processing payments, or (V) any technology that communicates with consumers in natural language for the purpose of providing users with information, making referrals or recommendations and answering questions, and is subject to an accepted use policy that prohibits generating content that is discriminatory or harmful;Section 1(9), including, but not limited to, whether the developerDeveloper"Developer" means any person doing business in this state that develops, or intentionally and substantially modifies, an artificial intelligence system;Section 1(7) or integratorIntegrator"Integrator" means any person doing business in this state that, with respect to a given high-risk artificial intelligence system, (A) neither develops nor intentionally and substantially modifies the high-risk artificial intelligence system, and (B) integrates the high-risk artificial intelligence system into a product or service such person offers to any other person;Section 1(10) shall be responsible for performing the developerDeveloper"Developer" means any person doing business in this state that develops, or intentionally and substantially modifies, an artificial intelligence system;Section 1(7)'s duties under subsections (b) and (c) of section 2 of this act.

(d) 8 Beginning on October 1, 2026, each integratorIntegrator"Integrator" means any person doing business in this state that, with respect to a given high-risk artificial intelligence system, (A) neither develops nor intentionally and substantially modifies the high-risk artificial intelligence system, and (B) integrates the high-risk artificial intelligence system into a product or service such person offers to any other person;Section 1(10) shall make available, in a manner that is clear and readily available on such integratorIntegrator"Integrator" means any person doing business in this state that, with respect to a given high-risk artificial intelligence system, (A) neither develops nor intentionally and substantially modifies the high-risk artificial intelligence system, and (B) integrates the high-risk artificial intelligence system into a product or service such person offers to any other person;Section 1(10)'s Internet web site or in a public use case inventory, a statement summarizing: (A) The types of high-risk artificial intelligence systemsHigh-risk artificial intelligence system"High-risk artificial intelligence system" (A) means any artificial intelligence system that, when deployed, makes, or is a substantial factor in making, a consequential decision, and (B) does not include (i) any artificial intelligence system that is intended to (I) perform any narrow procedural task, or (II) detect decision-making patterns, or deviations from decision-making patterns, unless such artificial intelligence system is intended to replace or influence any assessment previously completed by an individual without sufficient human review, or (ii) unless the technology, when deployed, makes, or is a substantial factor in making, a consequential decision, (I) any anti-fraud technology that does not make use of facial recognition technology, (II) any artificial intelligence-enabled video game technology, (III) any anti-malware, anti-virus, calculator, cybersecurity, database, data storage, firewall, Internet domain registration, Internet-web-site loading, networking, robocall-filtering, spam-filtering, spellchecking, spreadsheet, web-caching, web-hosting or similar technology, (IV) any technology that performs tasks exclusively related to an entity's internal management affairs, including, but not limited to, ordering office supplies or processing payments, or (V) any technology that communicates with consumers in natural language for the purpose of providing users with information, making referrals or recommendations and answering questions, and is subject to an accepted use policy that prohibits generating content that is discriminatory or harmful;Section 1(9) that such integratorIntegrator"Integrator" means any person doing business in this state that, with respect to a given high-risk artificial intelligence system, (A) neither develops nor intentionally and substantially modifies the high-risk artificial intelligence system, and (B) integrates the high-risk artificial intelligence system into a product or service such person offers to any other person;Section 1(10) has integrated into products or services such integratorIntegrator"Integrator" means any person doing business in this state that, with respect to a given high-risk artificial intelligence system, (A) neither develops nor intentionally and substantially modifies the high-risk artificial intelligence system, and (B) integrates the high-risk artificial intelligence system into a product or service such person offers to any other person;Section 1(10) currently offers to any other person; and (B) How such integratorIntegrator"Integrator" means any person doing business in this state that, with respect to a given high-risk artificial intelligence system, (A) neither develops nor intentionally and substantially modifies the high-risk artificial intelligence system, and (B) integrates the high-risk artificial intelligence system into a product or service such person offers to any other person;Section 1(10) manages any known or reasonably foreseeable risks of algorithmic discriminationAlgorithmic discrimination"Algorithmic discrimination" (A) means any use of an artificial intelligence system that results in any unlawful differential treatment or impact that disfavors any individual or group of individuals on the basis of one or more classifications protected under the laws of this state or federal law, and (B) does not include (i) the offer, license or use of a high-risk artificial intelligence system by a developer, integrator or deployer for the sole purpose of (I) the developer's, integrator's or deployer's self-testing to identify, mitigate or prevent discrimination or otherwise ensure compliance with state and federal law, or (II) expanding an applicant, customer or participant pool to increase diversity or redress historic discrimination, or (ii) an act or omission by or on behalf of a private club or other establishment not in fact open to the public, as set forth in Title II of the Civil Rights Act of 1964, 42 USC 2000a(e), as amended from time to time;Section 1(1) that may arise from the types of high-risk artificial intelligence systemsHigh-risk artificial intelligence system"High-risk artificial intelligence system" (A) means any artificial intelligence system that, when deployed, makes, or is a substantial factor in making, a consequential decision, and (B) does not include (i) any artificial intelligence system that is intended to (I) perform any narrow procedural task, or (II) detect decision-making patterns, or deviations from decision-making patterns, unless such artificial intelligence system is intended to replace or influence any assessment previously completed by an individual without sufficient human review, or (ii) unless the technology, when deployed, makes, or is a substantial factor in making, a consequential decision, (I) any anti-fraud technology that does not make use of facial recognition technology, (II) any artificial intelligence-enabled video game technology, (III) any anti-malware, anti-virus, calculator, cybersecurity, database, data storage, firewall, Internet domain registration, Internet-web-site loading, networking, robocall-filtering, spam-filtering, spellchecking, spreadsheet, web-caching, web-hosting or similar technology, (IV) any technology that performs tasks exclusively related to an entity's internal management affairs, including, but not limited to, ordering office supplies or processing payments, or (V) any technology that communicates with consumers in natural language for the purpose of providing users with information, making referrals or recommendations and answering questions, and is subject to an accepted use policy that prohibits generating content that is discriminatory or harmful;Section 1(9) described in subparagraph (A) of this subdivision. (2) Each integratorIntegrator"Integrator" means any person doing business in this state that, with respect to a given high-risk artificial intelligence system, (A) neither develops nor intentionally and substantially modifies the high-risk artificial intelligence system, and (B) integrates the high-risk artificial intelligence system into a product or service such person offers to any other person;Section 1(10) shall update the statement made available pursuant to subdivision (1) of this subsection (A) as necessary to ensure that such statement remains accurate, and (B) not later than ninety days after any intentional and substantial modificationIntentional and substantial modification"Intentional and substantial modification" (A) means any deliberate change made to (i) an artificial intelligence system that materially increases the risk of algorithmic discrimination, or (ii) a general-purpose artificial intelligence model that (I) affects compliance of the general-purpose artificial intelligence model, (II) materially changes the purpose of the general-purpose artificial intelligence model, or (III) materially increases the risk of algorithmic discrimination, and (B) does not include any change made to a high-risk artificial intelligence system, or the performance of a high-risk artificial intelligence system, if (i) the high-risk artificial intelligence system continues to learn after such high-risk artificial intelligence system is (I) offered, sold, leased, licensed, given or otherwise made available to a deployer, or (II) deployed, and (ii) such change (I) is made to such high-risk artificial intelligence system as a result of any learning described in subparagraph (B)(i) of this subdivision, (II) was predetermined by the deployer, or the third party contracted by the deployer, when such deployer or third party completed the initial impact assessment of such high-risk artificial intelligence system pursuant to subsection (c) of section 4 of this act, and (III) is included in the technical documentation for such high-risk artificial intelligence system;Section 1(11) is made to any high-risk artificial intelligence systemHigh-risk artificial intelligence system"High-risk artificial intelligence system" (A) means any artificial intelligence system that, when deployed, makes, or is a substantial factor in making, a consequential decision, and (B) does not include (i) any artificial intelligence system that is intended to (I) perform any narrow procedural task, or (II) detect decision-making patterns, or deviations from decision-making patterns, unless such artificial intelligence system is intended to replace or influence any assessment previously completed by an individual without sufficient human review, or (ii) unless the technology, when deployed, makes, or is a substantial factor in making, a consequential decision, (I) any anti-fraud technology that does not make use of facial recognition technology, (II) any artificial intelligence-enabled video game technology, (III) any anti-malware, anti-virus, calculator, cybersecurity, database, data storage, firewall, Internet domain registration, Internet-web-site loading, networking, robocall-filtering, spam-filtering, spellchecking, spreadsheet, web-caching, web-hosting or similar technology, (IV) any technology that performs tasks exclusively related to an entity's internal management affairs, including, but not limited to, ordering office supplies or processing payments, or (V) any technology that communicates with consumers in natural language for the purpose of providing users with information, making referrals or recommendations and answering questions, and is subject to an accepted use policy that prohibits generating content that is discriminatory or harmful;Section 1(9) described in subparagraph (A) of subdivision (1) of this subsection.

Section 3 creates a new regulated party type — the integrator — for entities that embed a high-risk AI system developed by another party into their own product or service. Integrators must exercise reasonable care against algorithmic discrimination and must enter into a contract with the developer that allocates the developer's documentation and impact-assessment duties. Integrators must also publish and maintain a public use-case statement analogous to the developer's obligation in section 2(d). Where the integrator contractually assumes the developer's duties under section 2(b) and (c), the developer is relieved of those duties.

Compliance actions 3 items
6
IntegratorsIntegrator"Integrator" means any person doing business in this state that, with respect to a given high-risk artificial intelligence system, (A) neither develops nor intentionally and substantially modifies the high-risk artificial intelligence system, and (B) integrates the high-risk artificial intelligence system into a product or service such person offers to any other person;Section 1(10) must use reasonable care to protect consumersConsumer"Consumer" means any individual who is a resident of this state;Section 1(4) from known or reasonably foreseeable risks of algorithmic discriminationAlgorithmic discrimination"Algorithmic discrimination" (A) means any use of an artificial intelligence system that results in any unlawful differential treatment or impact that disfavors any individual or group of individuals on the basis of one or more classifications protected under the laws of this state or federal law, and (B) does not include (i) the offer, license or use of a high-risk artificial intelligence system by a developer, integrator or deployer for the sole purpose of (I) the developer's, integrator's or deployer's self-testing to identify, mitigate or prevent discrimination or otherwise ensure compliance with state and federal law, or (II) expanding an applicant, customer or participant pool to increase diversity or redress historic discrimination, or (ii) an act or omission by or on behalf of a private club or other establishment not in fact open to the public, as set forth in Title II of the Civil Rights Act of 1964, 42 USC 2000a(e), as amended from time to time;Section 1(1) arising from the intended and contracted uses of any high-risk AI system they integrate into a product or service.
H-02.1
7
IntegratorsIntegrator"Integrator" means any person doing business in this state that, with respect to a given high-risk artificial intelligence system, (A) neither develops nor intentionally and substantially modifies the high-risk artificial intelligence system, and (B) integrates the high-risk artificial intelligence system into a product or service such person offers to any other person;Section 1(10) must enter into a binding contract with the developer of each high-risk AI system they integrate, clearly allocating the developerDeveloper"Developer" means any person doing business in this state that develops, or intentionally and substantially modifies, an artificial intelligence system;Section 1(7)'s documentation and impact-assessment duties between the developerDeveloper"Developer" means any person doing business in this state that develops, or intentionally and substantially modifies, an artificial intelligence system;Section 1(7) and integratorIntegrator"Integrator" means any person doing business in this state that, with respect to a given high-risk artificial intelligence system, (A) neither develops nor intentionally and substantially modifies the high-risk artificial intelligence system, and (B) integrates the high-risk artificial intelligence system into a product or service such person offers to any other person;Section 1(10).
H-02
8
IntegratorsIntegrator"Integrator" means any person doing business in this state that, with respect to a given high-risk artificial intelligence system, (A) neither develops nor intentionally and substantially modifies the high-risk artificial intelligence system, and (B) integrates the high-risk artificial intelligence system into a product or service such person offers to any other person;Section 1(10) must publish and maintain on their website or in a public use-case inventory a statement summarizing the types of high-risk AI systems they have integrated and how they manage algorithmic discriminationAlgorithmic discrimination"Algorithmic discrimination" (A) means any use of an artificial intelligence system that results in any unlawful differential treatment or impact that disfavors any individual or group of individuals on the basis of one or more classifications protected under the laws of this state or federal law, and (B) does not include (i) the offer, license or use of a high-risk artificial intelligence system by a developer, integrator or deployer for the sole purpose of (I) the developer's, integrator's or deployer's self-testing to identify, mitigate or prevent discrimination or otherwise ensure compliance with state and federal law, or (II) expanding an applicant, customer or participant pool to increase diversity or redress historic discrimination, or (ii) an act or omission by or on behalf of a private club or other establishment not in fact open to the public, as set forth in Title II of the Civil Rights Act of 1964, 42 USC 2000a(e), as amended from time to time;Section 1(1) risks, updated within 90 days of any intentional and substantial modificationIntentional and substantial modification"Intentional and substantial modification" (A) means any deliberate change made to (i) an artificial intelligence system that materially increases the risk of algorithmic discrimination, or (ii) a general-purpose artificial intelligence model that (I) affects compliance of the general-purpose artificial intelligence model, (II) materially changes the purpose of the general-purpose artificial intelligence model, or (III) materially increases the risk of algorithmic discrimination, and (B) does not include any change made to a high-risk artificial intelligence system, or the performance of a high-risk artificial intelligence system, if (i) the high-risk artificial intelligence system continues to learn after such high-risk artificial intelligence system is (I) offered, sold, leased, licensed, given or otherwise made available to a deployer, or (II) deployed, and (ii) such change (I) is made to such high-risk artificial intelligence system as a result of any learning described in subparagraph (B)(i) of this subdivision, (II) was predetermined by the deployer, or the third party contracted by the deployer, when such deployer or third party completed the initial impact assessment of such high-risk artificial intelligence system pursuant to subsection (c) of section 4 of this act, and (III) is included in the technical documentation for such high-risk artificial intelligence system;Section 1(11).
G-02.4
Section 4
Deployer obligations for high-risk AI systems
Deployer

(a) 9 Beginning on October 1, 2026, each deployer of a high-risk artificial intelligence systemHigh-risk artificial intelligence system"High-risk artificial intelligence system" (A) means any artificial intelligence system that, when deployed, makes, or is a substantial factor in making, a consequential decision, and (B) does not include (i) any artificial intelligence system that is intended to (I) perform any narrow procedural task, or (II) detect decision-making patterns, or deviations from decision-making patterns, unless such artificial intelligence system is intended to replace or influence any assessment previously completed by an individual without sufficient human review, or (ii) unless the technology, when deployed, makes, or is a substantial factor in making, a consequential decision, (I) any anti-fraud technology that does not make use of facial recognition technology, (II) any artificial intelligence-enabled video game technology, (III) any anti-malware, anti-virus, calculator, cybersecurity, database, data storage, firewall, Internet domain registration, Internet-web-site loading, networking, robocall-filtering, spam-filtering, spellchecking, spreadsheet, web-caching, web-hosting or similar technology, (IV) any technology that performs tasks exclusively related to an entity's internal management affairs, including, but not limited to, ordering office supplies or processing payments, or (V) any technology that communicates with consumers in natural language for the purpose of providing users with information, making referrals or recommendations and answering questions, and is subject to an accepted use policy that prohibits generating content that is discriminatory or harmful;Section 1(9) shall use reasonable care to protect consumersConsumer"Consumer" means any individual who is a resident of this state;Section 1(4) from any known or reasonably foreseeable risks of algorithmic discriminationAlgorithmic discrimination"Algorithmic discrimination" (A) means any use of an artificial intelligence system that results in any unlawful differential treatment or impact that disfavors any individual or group of individuals on the basis of one or more classifications protected under the laws of this state or federal law, and (B) does not include (i) the offer, license or use of a high-risk artificial intelligence system by a developer, integrator or deployer for the sole purpose of (I) the developer's, integrator's or deployer's self-testing to identify, mitigate or prevent discrimination or otherwise ensure compliance with state and federal law, or (II) expanding an applicant, customer or participant pool to increase diversity or redress historic discrimination, or (ii) an act or omission by or on behalf of a private club or other establishment not in fact open to the public, as set forth in Title II of the Civil Rights Act of 1964, 42 USC 2000a(e), as amended from time to time;Section 1(1). In any enforcement action brought on or after said date by the Attorney General pursuant to section 10 of this act, there shall be a rebuttable presumption that a deployer of a high-risk artificial intelligence systemHigh-risk artificial intelligence system"High-risk artificial intelligence system" (A) means any artificial intelligence system that, when deployed, makes, or is a substantial factor in making, a consequential decision, and (B) does not include (i) any artificial intelligence system that is intended to (I) perform any narrow procedural task, or (II) detect decision-making patterns, or deviations from decision-making patterns, unless such artificial intelligence system is intended to replace or influence any assessment previously completed by an individual without sufficient human review, or (ii) unless the technology, when deployed, makes, or is a substantial factor in making, a consequential decision, (I) any anti-fraud technology that does not make use of facial recognition technology, (II) any artificial intelligence-enabled video game technology, (III) any anti-malware, anti-virus, calculator, cybersecurity, database, data storage, firewall, Internet domain registration, Internet-web-site loading, networking, robocall-filtering, spam-filtering, spellchecking, spreadsheet, web-caching, web-hosting or similar technology, (IV) any technology that performs tasks exclusively related to an entity's internal management affairs, including, but not limited to, ordering office supplies or processing payments, or (V) any technology that communicates with consumers in natural language for the purpose of providing users with information, making referrals or recommendations and answering questions, and is subject to an accepted use policy that prohibits generating content that is discriminatory or harmful;Section 1(9) used reasonable care as required under this subsection if the deployerDeployer"Deployer" means any person doing business in this state that deploys a high-risk artificial intelligence system in this state;Section 1(6) complied with the provisions of this section.

(b) 10 Beginning on October 1, 2026, and except as provided in subsection (g) of this section, each deployer of a high-risk artificial intelligence systemHigh-risk artificial intelligence system"High-risk artificial intelligence system" (A) means any artificial intelligence system that, when deployed, makes, or is a substantial factor in making, a consequential decision, and (B) does not include (i) any artificial intelligence system that is intended to (I) perform any narrow procedural task, or (II) detect decision-making patterns, or deviations from decision-making patterns, unless such artificial intelligence system is intended to replace or influence any assessment previously completed by an individual without sufficient human review, or (ii) unless the technology, when deployed, makes, or is a substantial factor in making, a consequential decision, (I) any anti-fraud technology that does not make use of facial recognition technology, (II) any artificial intelligence-enabled video game technology, (III) any anti-malware, anti-virus, calculator, cybersecurity, database, data storage, firewall, Internet domain registration, Internet-web-site loading, networking, robocall-filtering, spam-filtering, spellchecking, spreadsheet, web-caching, web-hosting or similar technology, (IV) any technology that performs tasks exclusively related to an entity's internal management affairs, including, but not limited to, ordering office supplies or processing payments, or (V) any technology that communicates with consumers in natural language for the purpose of providing users with information, making referrals or recommendations and answering questions, and is subject to an accepted use policy that prohibits generating content that is discriminatory or harmful;Section 1(9) shall implement and maintain a risk management policy and program to govern such deployerDeployer"Deployer" means any person doing business in this state that deploys a high-risk artificial intelligence system in this state;Section 1(6)'s deployment of the high-risk artificial intelligence systemHigh-risk artificial intelligence system"High-risk artificial intelligence system" (A) means any artificial intelligence system that, when deployed, makes, or is a substantial factor in making, a consequential decision, and (B) does not include (i) any artificial intelligence system that is intended to (I) perform any narrow procedural task, or (II) detect decision-making patterns, or deviations from decision-making patterns, unless such artificial intelligence system is intended to replace or influence any assessment previously completed by an individual without sufficient human review, or (ii) unless the technology, when deployed, makes, or is a substantial factor in making, a consequential decision, (I) any anti-fraud technology that does not make use of facial recognition technology, (II) any artificial intelligence-enabled video game technology, (III) any anti-malware, anti-virus, calculator, cybersecurity, database, data storage, firewall, Internet domain registration, Internet-web-site loading, networking, robocall-filtering, spam-filtering, spellchecking, spreadsheet, web-caching, web-hosting or similar technology, (IV) any technology that performs tasks exclusively related to an entity's internal management affairs, including, but not limited to, ordering office supplies or processing payments, or (V) any technology that communicates with consumers in natural language for the purpose of providing users with information, making referrals or recommendations and answering questions, and is subject to an accepted use policy that prohibits generating content that is discriminatory or harmful;Section 1(9). The risk management policy and program shall specify and incorporate the principles, processes and personnel that the deployerDeployer"Deployer" means any person doing business in this state that deploys a high-risk artificial intelligence system in this state;Section 1(6) shall use to identify, document and mitigate any known or reasonably foreseeable risks of algorithmic discriminationAlgorithmic discrimination"Algorithmic discrimination" (A) means any use of an artificial intelligence system that results in any unlawful differential treatment or impact that disfavors any individual or group of individuals on the basis of one or more classifications protected under the laws of this state or federal law, and (B) does not include (i) the offer, license or use of a high-risk artificial intelligence system by a developer, integrator or deployer for the sole purpose of (I) the developer's, integrator's or deployer's self-testing to identify, mitigate or prevent discrimination or otherwise ensure compliance with state and federal law, or (II) expanding an applicant, customer or participant pool to increase diversity or redress historic discrimination, or (ii) an act or omission by or on behalf of a private club or other establishment not in fact open to the public, as set forth in Title II of the Civil Rights Act of 1964, 42 USC 2000a(e), as amended from time to time;Section 1(1). The risk management policy shall be the product of an iterative process, the risk management program shall be an iterative process and both the risk management policy and program shall be planned, implemented and regularly and systematically reviewed and updated over the lifecycle of the high-risk artificial intelligence systemHigh-risk artificial intelligence system"High-risk artificial intelligence system" (A) means any artificial intelligence system that, when deployed, makes, or is a substantial factor in making, a consequential decision, and (B) does not include (i) any artificial intelligence system that is intended to (I) perform any narrow procedural task, or (II) detect decision-making patterns, or deviations from decision-making patterns, unless such artificial intelligence system is intended to replace or influence any assessment previously completed by an individual without sufficient human review, or (ii) unless the technology, when deployed, makes, or is a substantial factor in making, a consequential decision, (I) any anti-fraud technology that does not make use of facial recognition technology, (II) any artificial intelligence-enabled video game technology, (III) any anti-malware, anti-virus, calculator, cybersecurity, database, data storage, firewall, Internet domain registration, Internet-web-site loading, networking, robocall-filtering, spam-filtering, spellchecking, spreadsheet, web-caching, web-hosting or similar technology, (IV) any technology that performs tasks exclusively related to an entity's internal management affairs, including, but not limited to, ordering office supplies or processing payments, or (V) any technology that communicates with consumers in natural language for the purpose of providing users with information, making referrals or recommendations and answering questions, and is subject to an accepted use policy that prohibits generating content that is discriminatory or harmful;Section 1(9). Each risk management policy and program implemented and maintained pursuant to this subsection shall be reasonable, considering: (A) The guidance and standards set forth in the latest version of (i) the "Artificial Intelligence Risk Management Framework" published by the National Institute of Standards and Technology, (ii) ISO or IEC 42001 of the International Organization for Standardization, or (iii) a nationally or internationally recognized risk management framework for artificial intelligence systemsArtificial intelligence system"Artificial intelligence system" means any machine-based system that, for any explicit or implicit objective, infers from the inputs such system receives how to generate outputs, including, but not limited to, content, decisions, predictions or recommendations, that can influence physical or virtual environments;Section 1(2) ... (B) The size and complexity of the deployerDeployer"Deployer" means any person doing business in this state that deploys a high-risk artificial intelligence system in this state;Section 1(6); (C) The nature and scope of the high-risk artificial intelligence systemsHigh-risk artificial intelligence system"High-risk artificial intelligence system" (A) means any artificial intelligence system that, when deployed, makes, or is a substantial factor in making, a consequential decision, and (B) does not include (i) any artificial intelligence system that is intended to (I) perform any narrow procedural task, or (II) detect decision-making patterns, or deviations from decision-making patterns, unless such artificial intelligence system is intended to replace or influence any assessment previously completed by an individual without sufficient human review, or (ii) unless the technology, when deployed, makes, or is a substantial factor in making, a consequential decision, (I) any anti-fraud technology that does not make use of facial recognition technology, (II) any artificial intelligence-enabled video game technology, (III) any anti-malware, anti-virus, calculator, cybersecurity, database, data storage, firewall, Internet domain registration, Internet-web-site loading, networking, robocall-filtering, spam-filtering, spellchecking, spreadsheet, web-caching, web-hosting or similar technology, (IV) any technology that performs tasks exclusively related to an entity's internal management affairs, including, but not limited to, ordering office supplies or processing payments, or (V) any technology that communicates with consumers in natural language for the purpose of providing users with information, making referrals or recommendations and answering questions, and is subject to an accepted use policy that prohibits generating content that is discriminatory or harmful;Section 1(9) deployed by the deployerDeployer"Deployer" means any person doing business in this state that deploys a high-risk artificial intelligence system in this state;Section 1(6) ... (D) The sensitivity and volume of data processed in connection with the high-risk artificial intelligence systemsHigh-risk artificial intelligence system"High-risk artificial intelligence system" (A) means any artificial intelligence system that, when deployed, makes, or is a substantial factor in making, a consequential decision, and (B) does not include (i) any artificial intelligence system that is intended to (I) perform any narrow procedural task, or (II) detect decision-making patterns, or deviations from decision-making patterns, unless such artificial intelligence system is intended to replace or influence any assessment previously completed by an individual without sufficient human review, or (ii) unless the technology, when deployed, makes, or is a substantial factor in making, a consequential decision, (I) any anti-fraud technology that does not make use of facial recognition technology, (II) any artificial intelligence-enabled video game technology, (III) any anti-malware, anti-virus, calculator, cybersecurity, database, data storage, firewall, Internet domain registration, Internet-web-site loading, networking, robocall-filtering, spam-filtering, spellchecking, spreadsheet, web-caching, web-hosting or similar technology, (IV) any technology that performs tasks exclusively related to an entity's internal management affairs, including, but not limited to, ordering office supplies or processing payments, or (V) any technology that communicates with consumers in natural language for the purpose of providing users with information, making referrals or recommendations and answering questions, and is subject to an accepted use policy that prohibits generating content that is discriminatory or harmful;Section 1(9) deployed by the deployerDeployer"Deployer" means any person doing business in this state that deploys a high-risk artificial intelligence system in this state;Section 1(6).

(c) 11 Except as provided in subdivisions (3) and (4) of this subsection and subsection (g) of this section: (A) A deployerDeployer"Deployer" means any person doing business in this state that deploys a high-risk artificial intelligence system in this state;Section 1(6) that deploysDeploy"Deploy" means to use a high-risk artificial intelligence system to make, or as a substantial factor in making, a consequential decision;Section 1(5) a high-risk artificial intelligence systemHigh-risk artificial intelligence system"High-risk artificial intelligence system" (A) means any artificial intelligence system that, when deployed, makes, or is a substantial factor in making, a consequential decision, and (B) does not include (i) any artificial intelligence system that is intended to (I) perform any narrow procedural task, or (II) detect decision-making patterns, or deviations from decision-making patterns, unless such artificial intelligence system is intended to replace or influence any assessment previously completed by an individual without sufficient human review, or (ii) unless the technology, when deployed, makes, or is a substantial factor in making, a consequential decision, (I) any anti-fraud technology that does not make use of facial recognition technology, (II) any artificial intelligence-enabled video game technology, (III) any anti-malware, anti-virus, calculator, cybersecurity, database, data storage, firewall, Internet domain registration, Internet-web-site loading, networking, robocall-filtering, spam-filtering, spellchecking, spreadsheet, web-caching, web-hosting or similar technology, (IV) any technology that performs tasks exclusively related to an entity's internal management affairs, including, but not limited to, ordering office supplies or processing payments, or (V) any technology that communicates with consumers in natural language for the purpose of providing users with information, making referrals or recommendations and answering questions, and is subject to an accepted use policy that prohibits generating content that is discriminatory or harmful;Section 1(9) on or after October 1, 2026, or a third party contracted by the deployerDeployer"Deployer" means any person doing business in this state that deploys a high-risk artificial intelligence system in this state;Section 1(6), shall complete an impact assessment of the high-risk artificial intelligence systemHigh-risk artificial intelligence system"High-risk artificial intelligence system" (A) means any artificial intelligence system that, when deployed, makes, or is a substantial factor in making, a consequential decision, and (B) does not include (i) any artificial intelligence system that is intended to (I) perform any narrow procedural task, or (II) detect decision-making patterns, or deviations from decision-making patterns, unless such artificial intelligence system is intended to replace or influence any assessment previously completed by an individual without sufficient human review, or (ii) unless the technology, when deployed, makes, or is a substantial factor in making, a consequential decision, (I) any anti-fraud technology that does not make use of facial recognition technology, (II) any artificial intelligence-enabled video game technology, (III) any anti-malware, anti-virus, calculator, cybersecurity, database, data storage, firewall, Internet domain registration, Internet-web-site loading, networking, robocall-filtering, spam-filtering, spellchecking, spreadsheet, web-caching, web-hosting or similar technology, (IV) any technology that performs tasks exclusively related to an entity's internal management affairs, including, but not limited to, ordering office supplies or processing payments, or (V) any technology that communicates with consumers in natural language for the purpose of providing users with information, making referrals or recommendations and answering questions, and is subject to an accepted use policy that prohibits generating content that is discriminatory or harmful;Section 1(9); and (B) Beginning on October 1, 2026, a deployerDeployer"Deployer" means any person doing business in this state that deploys a high-risk artificial intelligence system in this state;Section 1(6), or a third party contracted by the deployerDeployer"Deployer" means any person doing business in this state that deploys a high-risk artificial intelligence system in this state;Section 1(6), shall complete an impact assessment of a deployed high-risk artificial intelligence systemHigh-risk artificial intelligence system"High-risk artificial intelligence system" (A) means any artificial intelligence system that, when deployed, makes, or is a substantial factor in making, a consequential decision, and (B) does not include (i) any artificial intelligence system that is intended to (I) perform any narrow procedural task, or (II) detect decision-making patterns, or deviations from decision-making patterns, unless such artificial intelligence system is intended to replace or influence any assessment previously completed by an individual without sufficient human review, or (ii) unless the technology, when deployed, makes, or is a substantial factor in making, a consequential decision, (I) any anti-fraud technology that does not make use of facial recognition technology, (II) any artificial intelligence-enabled video game technology, (III) any anti-malware, anti-virus, calculator, cybersecurity, database, data storage, firewall, Internet domain registration, Internet-web-site loading, networking, robocall-filtering, spam-filtering, spellchecking, spreadsheet, web-caching, web-hosting or similar technology, (IV) any technology that performs tasks exclusively related to an entity's internal management affairs, including, but not limited to, ordering office supplies or processing payments, or (V) any technology that communicates with consumers in natural language for the purpose of providing users with information, making referrals or recommendations and answering questions, and is subject to an accepted use policy that prohibits generating content that is discriminatory or harmful;Section 1(9) (i) at least annually, and (ii) not later than ninety days after an intentional and substantial modificationIntentional and substantial modification"Intentional and substantial modification" (A) means any deliberate change made to (i) an artificial intelligence system that materially increases the risk of algorithmic discrimination, or (ii) a general-purpose artificial intelligence model that (I) affects compliance of the general-purpose artificial intelligence model, (II) materially changes the purpose of the general-purpose artificial intelligence model, or (III) materially increases the risk of algorithmic discrimination, and (B) does not include any change made to a high-risk artificial intelligence system, or the performance of a high-risk artificial intelligence system, if (i) the high-risk artificial intelligence system continues to learn after such high-risk artificial intelligence system is (I) offered, sold, leased, licensed, given or otherwise made available to a deployer, or (II) deployed, and (ii) such change (I) is made to such high-risk artificial intelligence system as a result of any learning described in subparagraph (B)(i) of this subdivision, (II) was predetermined by the deployer, or the third party contracted by the deployer, when such deployer or third party completed the initial impact assessment of such high-risk artificial intelligence system pursuant to subsection (c) of section 4 of this act, and (III) is included in the technical documentation for such high-risk artificial intelligence system;Section 1(11) to such high-risk artificial intelligence systemHigh-risk artificial intelligence system"High-risk artificial intelligence system" (A) means any artificial intelligence system that, when deployed, makes, or is a substantial factor in making, a consequential decision, and (B) does not include (i) any artificial intelligence system that is intended to (I) perform any narrow procedural task, or (II) detect decision-making patterns, or deviations from decision-making patterns, unless such artificial intelligence system is intended to replace or influence any assessment previously completed by an individual without sufficient human review, or (ii) unless the technology, when deployed, makes, or is a substantial factor in making, a consequential decision, (I) any anti-fraud technology that does not make use of facial recognition technology, (II) any artificial intelligence-enabled video game technology, (III) any anti-malware, anti-virus, calculator, cybersecurity, database, data storage, firewall, Internet domain registration, Internet-web-site loading, networking, robocall-filtering, spam-filtering, spellchecking, spreadsheet, web-caching, web-hosting or similar technology, (IV) any technology that performs tasks exclusively related to an entity's internal management affairs, including, but not limited to, ordering office supplies or processing payments, or (V) any technology that communicates with consumers in natural language for the purpose of providing users with information, making referrals or recommendations and answering questions, and is subject to an accepted use policy that prohibits generating content that is discriminatory or harmful;Section 1(9) is made available. (2)(A) Each impact assessment completed pursuant to this subsection shall include, at a minimum ... (i) A statement ... disclosing the purpose, intended use cases and deployment context ... (ii) An analysis of whether the deployment ... poses any known or reasonably foreseeable risks of algorithmic discriminationAlgorithmic discrimination"Algorithmic discrimination" (A) means any use of an artificial intelligence system that results in any unlawful differential treatment or impact that disfavors any individual or group of individuals on the basis of one or more classifications protected under the laws of this state or federal law, and (B) does not include (i) the offer, license or use of a high-risk artificial intelligence system by a developer, integrator or deployer for the sole purpose of (I) the developer's, integrator's or deployer's self-testing to identify, mitigate or prevent discrimination or otherwise ensure compliance with state and federal law, or (II) expanding an applicant, customer or participant pool to increase diversity or redress historic discrimination, or (ii) an act or omission by or on behalf of a private club or other establishment not in fact open to the public, as set forth in Title II of the Civil Rights Act of 1964, 42 USC 2000a(e), as amended from time to time;Section 1(1) ... (iii) A description of ... the categories of data the high-risk artificial intelligence systemHigh-risk artificial intelligence system"High-risk artificial intelligence system" (A) means any artificial intelligence system that, when deployed, makes, or is a substantial factor in making, a consequential decision, and (B) does not include (i) any artificial intelligence system that is intended to (I) perform any narrow procedural task, or (II) detect decision-making patterns, or deviations from decision-making patterns, unless such artificial intelligence system is intended to replace or influence any assessment previously completed by an individual without sufficient human review, or (ii) unless the technology, when deployed, makes, or is a substantial factor in making, a consequential decision, (I) any anti-fraud technology that does not make use of facial recognition technology, (II) any artificial intelligence-enabled video game technology, (III) any anti-malware, anti-virus, calculator, cybersecurity, database, data storage, firewall, Internet domain registration, Internet-web-site loading, networking, robocall-filtering, spam-filtering, spellchecking, spreadsheet, web-caching, web-hosting or similar technology, (IV) any technology that performs tasks exclusively related to an entity's internal management affairs, including, but not limited to, ordering office supplies or processing payments, or (V) any technology that communicates with consumers in natural language for the purpose of providing users with information, making referrals or recommendations and answering questions, and is subject to an accepted use policy that prohibits generating content that is discriminatory or harmful;Section 1(9) processes as inputs, and ... the outputs ... (iv) If the deployerDeployer"Deployer" means any person doing business in this state that deploys a high-risk artificial intelligence system in this state;Section 1(6) used data to customize ... an overview of the categories of data ... (v) Any metrics used to evaluate the performance and known limitations ... (vi) A description of any transparency measures ... (vii) A description of the post-deployment monitoring and user safeguards ... (5) A deployerDeployer"Deployer" means any person doing business in this state that deploys a high-risk artificial intelligence system in this state;Section 1(6) shall maintain the most recently completed impact assessment ... for a period of at least three years following the final deployment ...

(d) 12 Except as provided in subsection (g) of this section, a deployerDeployer"Deployer" means any person doing business in this state that deploys a high-risk artificial intelligence system in this state;Section 1(6), or a third party contracted by the deployerDeployer"Deployer" means any person doing business in this state that deploys a high-risk artificial intelligence system in this state;Section 1(6), shall review, not later than October 1, 2026, and at least annually thereafter, the deployment of each high-risk artificial intelligence systemHigh-risk artificial intelligence system"High-risk artificial intelligence system" (A) means any artificial intelligence system that, when deployed, makes, or is a substantial factor in making, a consequential decision, and (B) does not include (i) any artificial intelligence system that is intended to (I) perform any narrow procedural task, or (II) detect decision-making patterns, or deviations from decision-making patterns, unless such artificial intelligence system is intended to replace or influence any assessment previously completed by an individual without sufficient human review, or (ii) unless the technology, when deployed, makes, or is a substantial factor in making, a consequential decision, (I) any anti-fraud technology that does not make use of facial recognition technology, (II) any artificial intelligence-enabled video game technology, (III) any anti-malware, anti-virus, calculator, cybersecurity, database, data storage, firewall, Internet domain registration, Internet-web-site loading, networking, robocall-filtering, spam-filtering, spellchecking, spreadsheet, web-caching, web-hosting or similar technology, (IV) any technology that performs tasks exclusively related to an entity's internal management affairs, including, but not limited to, ordering office supplies or processing payments, or (V) any technology that communicates with consumers in natural language for the purpose of providing users with information, making referrals or recommendations and answering questions, and is subject to an accepted use policy that prohibits generating content that is discriminatory or harmful;Section 1(9) deployed by the deployerDeployer"Deployer" means any person doing business in this state that deploys a high-risk artificial intelligence system in this state;Section 1(6) to ensure that such high-risk artificial intelligence systemHigh-risk artificial intelligence system"High-risk artificial intelligence system" (A) means any artificial intelligence system that, when deployed, makes, or is a substantial factor in making, a consequential decision, and (B) does not include (i) any artificial intelligence system that is intended to (I) perform any narrow procedural task, or (II) detect decision-making patterns, or deviations from decision-making patterns, unless such artificial intelligence system is intended to replace or influence any assessment previously completed by an individual without sufficient human review, or (ii) unless the technology, when deployed, makes, or is a substantial factor in making, a consequential decision, (I) any anti-fraud technology that does not make use of facial recognition technology, (II) any artificial intelligence-enabled video game technology, (III) any anti-malware, anti-virus, calculator, cybersecurity, database, data storage, firewall, Internet domain registration, Internet-web-site loading, networking, robocall-filtering, spam-filtering, spellchecking, spreadsheet, web-caching, web-hosting or similar technology, (IV) any technology that performs tasks exclusively related to an entity's internal management affairs, including, but not limited to, ordering office supplies or processing payments, or (V) any technology that communicates with consumers in natural language for the purpose of providing users with information, making referrals or recommendations and answering questions, and is subject to an accepted use policy that prohibits generating content that is discriminatory or harmful;Section 1(9) is not causing algorithmic discriminationAlgorithmic discrimination"Algorithmic discrimination" (A) means any use of an artificial intelligence system that results in any unlawful differential treatment or impact that disfavors any individual or group of individuals on the basis of one or more classifications protected under the laws of this state or federal law, and (B) does not include (i) the offer, license or use of a high-risk artificial intelligence system by a developer, integrator or deployer for the sole purpose of (I) the developer's, integrator's or deployer's self-testing to identify, mitigate or prevent discrimination or otherwise ensure compliance with state and federal law, or (II) expanding an applicant, customer or participant pool to increase diversity or redress historic discrimination, or (ii) an act or omission by or on behalf of a private club or other establishment not in fact open to the public, as set forth in Title II of the Civil Rights Act of 1964, 42 USC 2000a(e), as amended from time to time;Section 1(1).

(e)(1)–(3) 13 Beginning on October 1, 2026, and before a deployerDeployer"Deployer" means any person doing business in this state that deploys a high-risk artificial intelligence system in this state;Section 1(6) deploysDeploy"Deploy" means to use a high-risk artificial intelligence system to make, or as a substantial factor in making, a consequential decision;Section 1(5) a high-risk artificial intelligence systemHigh-risk artificial intelligence system"High-risk artificial intelligence system" (A) means any artificial intelligence system that, when deployed, makes, or is a substantial factor in making, a consequential decision, and (B) does not include (i) any artificial intelligence system that is intended to (I) perform any narrow procedural task, or (II) detect decision-making patterns, or deviations from decision-making patterns, unless such artificial intelligence system is intended to replace or influence any assessment previously completed by an individual without sufficient human review, or (ii) unless the technology, when deployed, makes, or is a substantial factor in making, a consequential decision, (I) any anti-fraud technology that does not make use of facial recognition technology, (II) any artificial intelligence-enabled video game technology, (III) any anti-malware, anti-virus, calculator, cybersecurity, database, data storage, firewall, Internet domain registration, Internet-web-site loading, networking, robocall-filtering, spam-filtering, spellchecking, spreadsheet, web-caching, web-hosting or similar technology, (IV) any technology that performs tasks exclusively related to an entity's internal management affairs, including, but not limited to, ordering office supplies or processing payments, or (V) any technology that communicates with consumers in natural language for the purpose of providing users with information, making referrals or recommendations and answering questions, and is subject to an accepted use policy that prohibits generating content that is discriminatory or harmful;Section 1(9) to make, or be a substantial factorSubstantial factor"Substantial factor" (A) means a factor that (i) alters the outcome of a consequential decision, and (ii) is generated by an artificial intelligence system, (B) includes, but is not limited to, any use of an artificial intelligence system to generate any content, decision, prediction or recommendation concerning a consumer that is used as a basis to make a consequential decision concerning the consumer, and (C) does not include any output produced by an artificial intelligence system where an individual was involved in the data processing that produced such output and such individual (i) meaningfully considered such data as part of such data processing, and (ii) had the authority to change or influence the output produced by such data processing;Section 1(14) in making, a consequential decisionConsequential decision"Consequential decision" means any decision or judgment that has a legal, material or similarly significant effect on a consumer with respect to (A) employment, including, but not limited to, any such decision or judgment made (i) concerning hiring, termination, compensation or promotion, or (ii) by way of any automated task allocation that limits, segregates or classifies employees for the purpose of assigning or determining material terms or conditions of employment, (B) education or vocational training, including, but not limited to, any such decision or judgment made concerning (i) assessments, (ii) student cheating or plagiarism detection, (iii) accreditation, (iv) certification, (v) admissions, or (vi) financial aid or scholarships, (C) the provision or denial, or terms and conditions, of (i) financial lending or credit services, (ii) housing or lodging, including, but not limited to, rentals or short-term housing or lodging, (iii) insurance, or (iv) legal services, or (D) the provision or denial of (i) essential government services, or (ii) health care services;Section 1(3) concerning a consumerConsumer"Consumer" means any individual who is a resident of this state;Section 1(4), the deployerDeployer"Deployer" means any person doing business in this state that deploys a high-risk artificial intelligence system in this state;Section 1(6) shall: (A) Notify the consumerConsumer"Consumer" means any individual who is a resident of this state;Section 1(4) that the deployerDeployer"Deployer" means any person doing business in this state that deploys a high-risk artificial intelligence system in this state;Section 1(6) has deployed a high-risk artificial intelligence systemHigh-risk artificial intelligence system"High-risk artificial intelligence system" (A) means any artificial intelligence system that, when deployed, makes, or is a substantial factor in making, a consequential decision, and (B) does not include (i) any artificial intelligence system that is intended to (I) perform any narrow procedural task, or (II) detect decision-making patterns, or deviations from decision-making patterns, unless such artificial intelligence system is intended to replace or influence any assessment previously completed by an individual without sufficient human review, or (ii) unless the technology, when deployed, makes, or is a substantial factor in making, a consequential decision, (I) any anti-fraud technology that does not make use of facial recognition technology, (II) any artificial intelligence-enabled video game technology, (III) any anti-malware, anti-virus, calculator, cybersecurity, database, data storage, firewall, Internet domain registration, Internet-web-site loading, networking, robocall-filtering, spam-filtering, spellchecking, spreadsheet, web-caching, web-hosting or similar technology, (IV) any technology that performs tasks exclusively related to an entity's internal management affairs, including, but not limited to, ordering office supplies or processing payments, or (V) any technology that communicates with consumers in natural language for the purpose of providing users with information, making referrals or recommendations and answering questions, and is subject to an accepted use policy that prohibits generating content that is discriminatory or harmful;Section 1(9) to make, or be a substantial factorSubstantial factor"Substantial factor" (A) means a factor that (i) alters the outcome of a consequential decision, and (ii) is generated by an artificial intelligence system, (B) includes, but is not limited to, any use of an artificial intelligence system to generate any content, decision, prediction or recommendation concerning a consumer that is used as a basis to make a consequential decision concerning the consumer, and (C) does not include any output produced by an artificial intelligence system where an individual was involved in the data processing that produced such output and such individual (i) meaningfully considered such data as part of such data processing, and (ii) had the authority to change or influence the output produced by such data processing;Section 1(14) in making, such consequential decisionConsequential decision"Consequential decision" means any decision or judgment that has a legal, material or similarly significant effect on a consumer with respect to (A) employment, including, but not limited to, any such decision or judgment made (i) concerning hiring, termination, compensation or promotion, or (ii) by way of any automated task allocation that limits, segregates or classifies employees for the purpose of assigning or determining material terms or conditions of employment, (B) education or vocational training, including, but not limited to, any such decision or judgment made concerning (i) assessments, (ii) student cheating or plagiarism detection, (iii) accreditation, (iv) certification, (v) admissions, or (vi) financial aid or scholarships, (C) the provision or denial, or terms and conditions, of (i) financial lending or credit services, (ii) housing or lodging, including, but not limited to, rentals or short-term housing or lodging, (iii) insurance, or (iv) legal services, or (D) the provision or denial of (i) essential government services, or (ii) health care services;Section 1(3); and (B) Provide to the consumerConsumer"Consumer" means any individual who is a resident of this state;Section 1(4) (i) a statement disclosing (I) the purpose of such high-risk artificial intelligence systemHigh-risk artificial intelligence system"High-risk artificial intelligence system" (A) means any artificial intelligence system that, when deployed, makes, or is a substantial factor in making, a consequential decision, and (B) does not include (i) any artificial intelligence system that is intended to (I) perform any narrow procedural task, or (II) detect decision-making patterns, or deviations from decision-making patterns, unless such artificial intelligence system is intended to replace or influence any assessment previously completed by an individual without sufficient human review, or (ii) unless the technology, when deployed, makes, or is a substantial factor in making, a consequential decision, (I) any anti-fraud technology that does not make use of facial recognition technology, (II) any artificial intelligence-enabled video game technology, (III) any anti-malware, anti-virus, calculator, cybersecurity, database, data storage, firewall, Internet domain registration, Internet-web-site loading, networking, robocall-filtering, spam-filtering, spellchecking, spreadsheet, web-caching, web-hosting or similar technology, (IV) any technology that performs tasks exclusively related to an entity's internal management affairs, including, but not limited to, ordering office supplies or processing payments, or (V) any technology that communicates with consumers in natural language for the purpose of providing users with information, making referrals or recommendations and answering questions, and is subject to an accepted use policy that prohibits generating content that is discriminatory or harmful;Section 1(9), and (II) the nature of such consequential decisionConsequential decision"Consequential decision" means any decision or judgment that has a legal, material or similarly significant effect on a consumer with respect to (A) employment, including, but not limited to, any such decision or judgment made (i) concerning hiring, termination, compensation or promotion, or (ii) by way of any automated task allocation that limits, segregates or classifies employees for the purpose of assigning or determining material terms or conditions of employment, (B) education or vocational training, including, but not limited to, any such decision or judgment made concerning (i) assessments, (ii) student cheating or plagiarism detection, (iii) accreditation, (iv) certification, (v) admissions, or (vi) financial aid or scholarships, (C) the provision or denial, or terms and conditions, of (i) financial lending or credit services, (ii) housing or lodging, including, but not limited to, rentals or short-term housing or lodging, (iii) insurance, or (iv) legal services, or (D) the provision or denial of (i) essential government services, or (ii) health care services;Section 1(3), (ii) the right to opt-out of any automated decision-making based on the consumerConsumer"Consumer" means any individual who is a resident of this state;Section 1(4)'s personal data, (iii) contact information for such deployerDeployer"Deployer" means any person doing business in this state that deploys a high-risk artificial intelligence system in this state;Section 1(6), (iv) a description, in plain language, of such high-risk artificial intelligence systemHigh-risk artificial intelligence system"High-risk artificial intelligence system" (A) means any artificial intelligence system that, when deployed, makes, or is a substantial factor in making, a consequential decision, and (B) does not include (i) any artificial intelligence system that is intended to (I) perform any narrow procedural task, or (II) detect decision-making patterns, or deviations from decision-making patterns, unless such artificial intelligence system is intended to replace or influence any assessment previously completed by an individual without sufficient human review, or (ii) unless the technology, when deployed, makes, or is a substantial factor in making, a consequential decision, (I) any anti-fraud technology that does not make use of facial recognition technology, (II) any artificial intelligence-enabled video game technology, (III) any anti-malware, anti-virus, calculator, cybersecurity, database, data storage, firewall, Internet domain registration, Internet-web-site loading, networking, robocall-filtering, spam-filtering, spellchecking, spreadsheet, web-caching, web-hosting or similar technology, (IV) any technology that performs tasks exclusively related to an entity's internal management affairs, including, but not limited to, ordering office supplies or processing payments, or (V) any technology that communicates with consumers in natural language for the purpose of providing users with information, making referrals or recommendations and answering questions, and is subject to an accepted use policy that prohibits generating content that is discriminatory or harmful;Section 1(9), and (v) instructions on how to access the statement made available pursuant to subdivision (1) of subsection (f) of this section. (2) Beginning on October 1, 2026, a deployerDeployer"Deployer" means any person doing business in this state that deploys a high-risk artificial intelligence system in this state;Section 1(6) that has deployed a high-risk artificial intelligence systemHigh-risk artificial intelligence system"High-risk artificial intelligence system" (A) means any artificial intelligence system that, when deployed, makes, or is a substantial factor in making, a consequential decision, and (B) does not include (i) any artificial intelligence system that is intended to (I) perform any narrow procedural task, or (II) detect decision-making patterns, or deviations from decision-making patterns, unless such artificial intelligence system is intended to replace or influence any assessment previously completed by an individual without sufficient human review, or (ii) unless the technology, when deployed, makes, or is a substantial factor in making, a consequential decision, (I) any anti-fraud technology that does not make use of facial recognition technology, (II) any artificial intelligence-enabled video game technology, (III) any anti-malware, anti-virus, calculator, cybersecurity, database, data storage, firewall, Internet domain registration, Internet-web-site loading, networking, robocall-filtering, spam-filtering, spellchecking, spreadsheet, web-caching, web-hosting or similar technology, (IV) any technology that performs tasks exclusively related to an entity's internal management affairs, including, but not limited to, ordering office supplies or processing payments, or (V) any technology that communicates with consumers in natural language for the purpose of providing users with information, making referrals or recommendations and answering questions, and is subject to an accepted use policy that prohibits generating content that is discriminatory or harmful;Section 1(9) to make, or as a substantial factorSubstantial factor"Substantial factor" (A) means a factor that (i) alters the outcome of a consequential decision, and (ii) is generated by an artificial intelligence system, (B) includes, but is not limited to, any use of an artificial intelligence system to generate any content, decision, prediction or recommendation concerning a consumer that is used as a basis to make a consequential decision concerning the consumer, and (C) does not include any output produced by an artificial intelligence system where an individual was involved in the data processing that produced such output and such individual (i) meaningfully considered such data as part of such data processing, and (ii) had the authority to change or influence the output produced by such data processing;Section 1(14) in making, a consequential decisionConsequential decision"Consequential decision" means any decision or judgment that has a legal, material or similarly significant effect on a consumer with respect to (A) employment, including, but not limited to, any such decision or judgment made (i) concerning hiring, termination, compensation or promotion, or (ii) by way of any automated task allocation that limits, segregates or classifies employees for the purpose of assigning or determining material terms or conditions of employment, (B) education or vocational training, including, but not limited to, any such decision or judgment made concerning (i) assessments, (ii) student cheating or plagiarism detection, (iii) accreditation, (iv) certification, (v) admissions, or (vi) financial aid or scholarships, (C) the provision or denial, or terms and conditions, of (i) financial lending or credit services, (ii) housing or lodging, including, but not limited to, rentals or short-term housing or lodging, (iii) insurance, or (iv) legal services, or (D) the provision or denial of (i) essential government services, or (ii) health care services;Section 1(3) concerning a consumerConsumer"Consumer" means any individual who is a resident of this state;Section 1(4) shall, if such consequential decisionConsequential decision"Consequential decision" means any decision or judgment that has a legal, material or similarly significant effect on a consumer with respect to (A) employment, including, but not limited to, any such decision or judgment made (i) concerning hiring, termination, compensation or promotion, or (ii) by way of any automated task allocation that limits, segregates or classifies employees for the purpose of assigning or determining material terms or conditions of employment, (B) education or vocational training, including, but not limited to, any such decision or judgment made concerning (i) assessments, (ii) student cheating or plagiarism detection, (iii) accreditation, (iv) certification, (v) admissions, or (vi) financial aid or scholarships, (C) the provision or denial, or terms and conditions, of (i) financial lending or credit services, (ii) housing or lodging, including, but not limited to, rentals or short-term housing or lodging, (iii) insurance, or (iv) legal services, or (D) the provision or denial of (i) essential government services, or (ii) health care services;Section 1(3) is adverse to the consumerConsumer"Consumer" means any individual who is a resident of this state;Section 1(4), provide to such consumerConsumer"Consumer" means any individual who is a resident of this state;Section 1(4): (A) A statement disclosing the principal reason or reasons for such adverse consequential decisionConsequential decision"Consequential decision" means any decision or judgment that has a legal, material or similarly significant effect on a consumer with respect to (A) employment, including, but not limited to, any such decision or judgment made (i) concerning hiring, termination, compensation or promotion, or (ii) by way of any automated task allocation that limits, segregates or classifies employees for the purpose of assigning or determining material terms or conditions of employment, (B) education or vocational training, including, but not limited to, any such decision or judgment made concerning (i) assessments, (ii) student cheating or plagiarism detection, (iii) accreditation, (iv) certification, (v) admissions, or (vi) financial aid or scholarships, (C) the provision or denial, or terms and conditions, of (i) financial lending or credit services, (ii) housing or lodging, including, but not limited to, rentals or short-term housing or lodging, (iii) insurance, or (iv) legal services, or (D) the provision or denial of (i) essential government services, or (ii) health care services;Section 1(3), including ... the degree to which, and manner in which, the high-risk artificial intelligence systemHigh-risk artificial intelligence system"High-risk artificial intelligence system" (A) means any artificial intelligence system that, when deployed, makes, or is a substantial factor in making, a consequential decision, and (B) does not include (i) any artificial intelligence system that is intended to (I) perform any narrow procedural task, or (II) detect decision-making patterns, or deviations from decision-making patterns, unless such artificial intelligence system is intended to replace or influence any assessment previously completed by an individual without sufficient human review, or (ii) unless the technology, when deployed, makes, or is a substantial factor in making, a consequential decision, (I) any anti-fraud technology that does not make use of facial recognition technology, (II) any artificial intelligence-enabled video game technology, (III) any anti-malware, anti-virus, calculator, cybersecurity, database, data storage, firewall, Internet domain registration, Internet-web-site loading, networking, robocall-filtering, spam-filtering, spellchecking, spreadsheet, web-caching, web-hosting or similar technology, (IV) any technology that performs tasks exclusively related to an entity's internal management affairs, including, but not limited to, ordering office supplies or processing payments, or (V) any technology that communicates with consumers in natural language for the purpose of providing users with information, making referrals or recommendations and answering questions, and is subject to an accepted use policy that prohibits generating content that is discriminatory or harmful;Section 1(9) contributed ... the type of data ... and ... the source of the data ... (B) An opportunity to (i) examine the personal data that the high-risk artificial intelligence systemHigh-risk artificial intelligence system"High-risk artificial intelligence system" (A) means any artificial intelligence system that, when deployed, makes, or is a substantial factor in making, a consequential decision, and (B) does not include (i) any artificial intelligence system that is intended to (I) perform any narrow procedural task, or (II) detect decision-making patterns, or deviations from decision-making patterns, unless such artificial intelligence system is intended to replace or influence any assessment previously completed by an individual without sufficient human review, or (ii) unless the technology, when deployed, makes, or is a substantial factor in making, a consequential decision, (I) any anti-fraud technology that does not make use of facial recognition technology, (II) any artificial intelligence-enabled video game technology, (III) any anti-malware, anti-virus, calculator, cybersecurity, database, data storage, firewall, Internet domain registration, Internet-web-site loading, networking, robocall-filtering, spam-filtering, spellchecking, spreadsheet, web-caching, web-hosting or similar technology, (IV) any technology that performs tasks exclusively related to an entity's internal management affairs, including, but not limited to, ordering office supplies or processing payments, or (V) any technology that communicates with consumers in natural language for the purpose of providing users with information, making referrals or recommendations and answering questions, and is subject to an accepted use policy that prohibits generating content that is discriminatory or harmful;Section 1(9) processed ... and (ii) correct any incorrect personal data ... (C) ... an opportunity to appeal such adverse consequential decisionConsequential decision"Consequential decision" means any decision or judgment that has a legal, material or similarly significant effect on a consumer with respect to (A) employment, including, but not limited to, any such decision or judgment made (i) concerning hiring, termination, compensation or promotion, or (ii) by way of any automated task allocation that limits, segregates or classifies employees for the purpose of assigning or determining material terms or conditions of employment, (B) education or vocational training, including, but not limited to, any such decision or judgment made concerning (i) assessments, (ii) student cheating or plagiarism detection, (iii) accreditation, (iv) certification, (v) admissions, or (vi) financial aid or scholarships, (C) the provision or denial, or terms and conditions, of (i) financial lending or credit services, (ii) housing or lodging, including, but not limited to, rentals or short-term housing or lodging, (iii) insurance, or (iv) legal services, or (D) the provision or denial of (i) essential government services, or (ii) health care services;Section 1(3) if such adverse consequential decisionConsequential decision"Consequential decision" means any decision or judgment that has a legal, material or similarly significant effect on a consumer with respect to (A) employment, including, but not limited to, any such decision or judgment made (i) concerning hiring, termination, compensation or promotion, or (ii) by way of any automated task allocation that limits, segregates or classifies employees for the purpose of assigning or determining material terms or conditions of employment, (B) education or vocational training, including, but not limited to, any such decision or judgment made concerning (i) assessments, (ii) student cheating or plagiarism detection, (iii) accreditation, (iv) certification, (v) admissions, or (vi) financial aid or scholarships, (C) the provision or denial, or terms and conditions, of (i) financial lending or credit services, (ii) housing or lodging, including, but not limited to, rentals or short-term housing or lodging, (iii) insurance, or (iv) legal services, or (D) the provision or denial of (i) essential government services, or (ii) health care services;Section 1(3) is based upon inaccurate personal data ... Such appeal shall, if technically feasible, allow for human review. (3) The deployerDeployer"Deployer" means any person doing business in this state that deploys a high-risk artificial intelligence system in this state;Section 1(6) shall provide the notice, statements, information, description and instructions required under subdivisions (1) and (2) of this subsection: (A) Directly to the consumerConsumer"Consumer" means any individual who is a resident of this state;Section 1(4); (B) In plain language; (C) In all languages in which such deployerDeployer"Deployer" means any person doing business in this state that deploys a high-risk artificial intelligence system in this state;Section 1(6), in the ordinary course of such deployerDeployer"Deployer" means any person doing business in this state that deploys a high-risk artificial intelligence system in this state;Section 1(6)'s business, provides contracts, disclaimers, sale announcements and other information to consumersConsumer"Consumer" means any individual who is a resident of this state;Section 1(4); and (D) In a format that is accessible to consumersConsumer"Consumer" means any individual who is a resident of this state;Section 1(4) with disabilities.

(f) 14 Beginning on October 1, 2026, and except as provided in subsection (g) of this section, each deployerDeployer"Deployer" means any person doing business in this state that deploys a high-risk artificial intelligence system in this state;Section 1(6) shall make available, in a manner that is clear and readily available on such deployerDeployer"Deployer" means any person doing business in this state that deploys a high-risk artificial intelligence system in this state;Section 1(6)'s Internet web site, a statement summarizing: (A) The types of high-risk artificial intelligence systemsHigh-risk artificial intelligence system"High-risk artificial intelligence system" (A) means any artificial intelligence system that, when deployed, makes, or is a substantial factor in making, a consequential decision, and (B) does not include (i) any artificial intelligence system that is intended to (I) perform any narrow procedural task, or (II) detect decision-making patterns, or deviations from decision-making patterns, unless such artificial intelligence system is intended to replace or influence any assessment previously completed by an individual without sufficient human review, or (ii) unless the technology, when deployed, makes, or is a substantial factor in making, a consequential decision, (I) any anti-fraud technology that does not make use of facial recognition technology, (II) any artificial intelligence-enabled video game technology, (III) any anti-malware, anti-virus, calculator, cybersecurity, database, data storage, firewall, Internet domain registration, Internet-web-site loading, networking, robocall-filtering, spam-filtering, spellchecking, spreadsheet, web-caching, web-hosting or similar technology, (IV) any technology that performs tasks exclusively related to an entity's internal management affairs, including, but not limited to, ordering office supplies or processing payments, or (V) any technology that communicates with consumers in natural language for the purpose of providing users with information, making referrals or recommendations and answering questions, and is subject to an accepted use policy that prohibits generating content that is discriminatory or harmful;Section 1(9) that are currently deployed by such deployerDeployer"Deployer" means any person doing business in this state that deploys a high-risk artificial intelligence system in this state;Section 1(6); (B) How such deployerDeployer"Deployer" means any person doing business in this state that deploys a high-risk artificial intelligence system in this state;Section 1(6) manages any known or reasonably foreseeable risks of algorithmic discriminationAlgorithmic discrimination"Algorithmic discrimination" (A) means any use of an artificial intelligence system that results in any unlawful differential treatment or impact that disfavors any individual or group of individuals on the basis of one or more classifications protected under the laws of this state or federal law, and (B) does not include (i) the offer, license or use of a high-risk artificial intelligence system by a developer, integrator or deployer for the sole purpose of (I) the developer's, integrator's or deployer's self-testing to identify, mitigate or prevent discrimination or otherwise ensure compliance with state and federal law, or (II) expanding an applicant, customer or participant pool to increase diversity or redress historic discrimination, or (ii) an act or omission by or on behalf of a private club or other establishment not in fact open to the public, as set forth in Title II of the Civil Rights Act of 1964, 42 USC 2000a(e), as amended from time to time;Section 1(1) that may arise from deployment of each high-risk artificial intelligence systemHigh-risk artificial intelligence system"High-risk artificial intelligence system" (A) means any artificial intelligence system that, when deployed, makes, or is a substantial factor in making, a consequential decision, and (B) does not include (i) any artificial intelligence system that is intended to (I) perform any narrow procedural task, or (II) detect decision-making patterns, or deviations from decision-making patterns, unless such artificial intelligence system is intended to replace or influence any assessment previously completed by an individual without sufficient human review, or (ii) unless the technology, when deployed, makes, or is a substantial factor in making, a consequential decision, (I) any anti-fraud technology that does not make use of facial recognition technology, (II) any artificial intelligence-enabled video game technology, (III) any anti-malware, anti-virus, calculator, cybersecurity, database, data storage, firewall, Internet domain registration, Internet-web-site loading, networking, robocall-filtering, spam-filtering, spellchecking, spreadsheet, web-caching, web-hosting or similar technology, (IV) any technology that performs tasks exclusively related to an entity's internal management affairs, including, but not limited to, ordering office supplies or processing payments, or (V) any technology that communicates with consumers in natural language for the purpose of providing users with information, making referrals or recommendations and answering questions, and is subject to an accepted use policy that prohibits generating content that is discriminatory or harmful;Section 1(9) described in subparagraph (A) of this subdivision; and (C) In detail, the nature, source and extent of the information collected and used by such deployerDeployer"Deployer" means any person doing business in this state that deploys a high-risk artificial intelligence system in this state;Section 1(6). (2) Each deployerDeployer"Deployer" means any person doing business in this state that deploys a high-risk artificial intelligence system in this state;Section 1(6) shall periodically update the statement made available pursuant to subdivision (1) of this subsection.

(h) 15 If a deployerDeployer"Deployer" means any person doing business in this state that deploys a high-risk artificial intelligence system in this state;Section 1(6) deploysDeploy"Deploy" means to use a high-risk artificial intelligence system to make, or as a substantial factor in making, a consequential decision;Section 1(5) a high-risk artificial intelligence systemHigh-risk artificial intelligence system"High-risk artificial intelligence system" (A) means any artificial intelligence system that, when deployed, makes, or is a substantial factor in making, a consequential decision, and (B) does not include (i) any artificial intelligence system that is intended to (I) perform any narrow procedural task, or (II) detect decision-making patterns, or deviations from decision-making patterns, unless such artificial intelligence system is intended to replace or influence any assessment previously completed by an individual without sufficient human review, or (ii) unless the technology, when deployed, makes, or is a substantial factor in making, a consequential decision, (I) any anti-fraud technology that does not make use of facial recognition technology, (II) any artificial intelligence-enabled video game technology, (III) any anti-malware, anti-virus, calculator, cybersecurity, database, data storage, firewall, Internet domain registration, Internet-web-site loading, networking, robocall-filtering, spam-filtering, spellchecking, spreadsheet, web-caching, web-hosting or similar technology, (IV) any technology that performs tasks exclusively related to an entity's internal management affairs, including, but not limited to, ordering office supplies or processing payments, or (V) any technology that communicates with consumers in natural language for the purpose of providing users with information, making referrals or recommendations and answering questions, and is subject to an accepted use policy that prohibits generating content that is discriminatory or harmful;Section 1(9) on or after October 1, 2026, and subsequently discovers that the high-risk artificial intelligence systemHigh-risk artificial intelligence system"High-risk artificial intelligence system" (A) means any artificial intelligence system that, when deployed, makes, or is a substantial factor in making, a consequential decision, and (B) does not include (i) any artificial intelligence system that is intended to (I) perform any narrow procedural task, or (II) detect decision-making patterns, or deviations from decision-making patterns, unless such artificial intelligence system is intended to replace or influence any assessment previously completed by an individual without sufficient human review, or (ii) unless the technology, when deployed, makes, or is a substantial factor in making, a consequential decision, (I) any anti-fraud technology that does not make use of facial recognition technology, (II) any artificial intelligence-enabled video game technology, (III) any anti-malware, anti-virus, calculator, cybersecurity, database, data storage, firewall, Internet domain registration, Internet-web-site loading, networking, robocall-filtering, spam-filtering, spellchecking, spreadsheet, web-caching, web-hosting or similar technology, (IV) any technology that performs tasks exclusively related to an entity's internal management affairs, including, but not limited to, ordering office supplies or processing payments, or (V) any technology that communicates with consumers in natural language for the purpose of providing users with information, making referrals or recommendations and answering questions, and is subject to an accepted use policy that prohibits generating content that is discriminatory or harmful;Section 1(9) has caused algorithmic discriminationAlgorithmic discrimination"Algorithmic discrimination" (A) means any use of an artificial intelligence system that results in any unlawful differential treatment or impact that disfavors any individual or group of individuals on the basis of one or more classifications protected under the laws of this state or federal law, and (B) does not include (i) the offer, license or use of a high-risk artificial intelligence system by a developer, integrator or deployer for the sole purpose of (I) the developer's, integrator's or deployer's self-testing to identify, mitigate or prevent discrimination or otherwise ensure compliance with state and federal law, or (II) expanding an applicant, customer or participant pool to increase diversity or redress historic discrimination, or (ii) an act or omission by or on behalf of a private club or other establishment not in fact open to the public, as set forth in Title II of the Civil Rights Act of 1964, 42 USC 2000a(e), as amended from time to time;Section 1(1) to at least one thousand consumersConsumer"Consumer" means any individual who is a resident of this state;Section 1(4), the deployerDeployer"Deployer" means any person doing business in this state that deploys a high-risk artificial intelligence system in this state;Section 1(6) shall send to the Attorney General, in a form and manner prescribed by the Attorney General, a notice disclosing such discovery. The deployerDeployer"Deployer" means any person doing business in this state that deploys a high-risk artificial intelligence system in this state;Section 1(6) shall send such notice to the Attorney General without unreasonable delay but in no event later than ninety days after the date on which the deployerDeployer"Deployer" means any person doing business in this state that deploys a high-risk artificial intelligence system in this state;Section 1(6) discovered such algorithmic discriminationAlgorithmic discrimination"Algorithmic discrimination" (A) means any use of an artificial intelligence system that results in any unlawful differential treatment or impact that disfavors any individual or group of individuals on the basis of one or more classifications protected under the laws of this state or federal law, and (B) does not include (i) the offer, license or use of a high-risk artificial intelligence system by a developer, integrator or deployer for the sole purpose of (I) the developer's, integrator's or deployer's self-testing to identify, mitigate or prevent discrimination or otherwise ensure compliance with state and federal law, or (II) expanding an applicant, customer or participant pool to increase diversity or redress historic discrimination, or (ii) an act or omission by or on behalf of a private club or other establishment not in fact open to the public, as set forth in Title II of the Civil Rights Act of 1964, 42 USC 2000a(e), as amended from time to time;Section 1(1).

(j) 16 Beginning on October 1, 2026, the Attorney General may require that a deployerDeployer"Deployer" means any person doing business in this state that deploys a high-risk artificial intelligence system in this state;Section 1(6), or a third party contracted by the deployerDeployer"Deployer" means any person doing business in this state that deploys a high-risk artificial intelligence system in this state;Section 1(6) as set forth in subsection (c) of this section, as applicable, disclose to the Attorney General, as part of an investigation conducted by the Attorney General, not later than ninety days after a request by the Attorney General and in a form and manner prescribed by the Attorney General, the risk management policy implemented pursuant to subsection (b) of this section, impact assessment completed pursuant to subsection (c) of this section or records maintained pursuant to subdivision (5) of subsection (c) of this section.

Section 4 is the bill's most detailed obligation section. Deployers must exercise reasonable care against algorithmic discrimination (with a rebuttable presumption). Core requirements include: (1) implementing and maintaining an iterative risk management policy and program aligned with NIST AI RMF, ISO/IEC 42001, or equivalent frameworks; (2) completing impact assessments at deployment, annually, and within 90 days of an intentional and substantial modification; (3) conducting at least annual post-deployment reviews for discrimination; (4) notifying consumers before a consequential decision is made using a high-risk AI system and providing detailed adverse-decision explanations, data-access rights, and appeal opportunities with human review; (5) publicly disclosing deployed high-risk AI system types and data practices; (6) reporting to the AG within 90 days upon discovering discrimination affecting 1,000+ consumers; and (7) retaining impact assessments for at least three years after final deployment. A significant deployer carve-out exists where the developer contractually assumes the deployer's program and assessment duties and other conditions are met.

Compliance actions 8 items
9
Deployers of high-risk AI systems must use reasonable care to protect consumersConsumer"Consumer" means any individual who is a resident of this state;Section 1(4) from known or reasonably foreseeable risks of algorithmic discriminationAlgorithmic discrimination"Algorithmic discrimination" (A) means any use of an artificial intelligence system that results in any unlawful differential treatment or impact that disfavors any individual or group of individuals on the basis of one or more classifications protected under the laws of this state or federal law, and (B) does not include (i) the offer, license or use of a high-risk artificial intelligence system by a developer, integrator or deployer for the sole purpose of (I) the developer's, integrator's or deployer's self-testing to identify, mitigate or prevent discrimination or otherwise ensure compliance with state and federal law, or (II) expanding an applicant, customer or participant pool to increase diversity or redress historic discrimination, or (ii) an act or omission by or on behalf of a private club or other establishment not in fact open to the public, as set forth in Title II of the Civil Rights Act of 1964, 42 USC 2000a(e), as amended from time to time;Section 1(1).
H-02.1
10
DeployersDeployer"Deployer" means any person doing business in this state that deploys a high-risk artificial intelligence system in this state;Section 1(6) must implement and maintain an iterative risk management policy and program covering principles, processes, and personnel for identifying, documenting, and mitigating algorithmic discriminationAlgorithmic discrimination"Algorithmic discrimination" (A) means any use of an artificial intelligence system that results in any unlawful differential treatment or impact that disfavors any individual or group of individuals on the basis of one or more classifications protected under the laws of this state or federal law, and (B) does not include (i) the offer, license or use of a high-risk artificial intelligence system by a developer, integrator or deployer for the sole purpose of (I) the developer's, integrator's or deployer's self-testing to identify, mitigate or prevent discrimination or otherwise ensure compliance with state and federal law, or (II) expanding an applicant, customer or participant pool to increase diversity or redress historic discrimination, or (ii) an act or omission by or on behalf of a private club or other establishment not in fact open to the public, as set forth in Title II of the Civil Rights Act of 1964, 42 USC 2000a(e), as amended from time to time;Section 1(1) risks, calibrated to NIST AI RMF, ISO/IEC 42001, or an equivalent framework and to the deployerDeployer"Deployer" means any person doing business in this state that deploys a high-risk artificial intelligence system in this state;Section 1(6)'s size, system scope, and data sensitivity.
G-01.1
11
DeployersDeployer"Deployer" means any person doing business in this state that deploys a high-risk artificial intelligence system in this state;Section 1(6) must complete an impact assessment of each high-risk AI system at deployment, at least annually thereafter, and within 90 days of an intentional and substantial modificationIntentional and substantial modification"Intentional and substantial modification" (A) means any deliberate change made to (i) an artificial intelligence system that materially increases the risk of algorithmic discrimination, or (ii) a general-purpose artificial intelligence model that (I) affects compliance of the general-purpose artificial intelligence model, (II) materially changes the purpose of the general-purpose artificial intelligence model, or (III) materially increases the risk of algorithmic discrimination, and (B) does not include any change made to a high-risk artificial intelligence system, or the performance of a high-risk artificial intelligence system, if (i) the high-risk artificial intelligence system continues to learn after such high-risk artificial intelligence system is (I) offered, sold, leased, licensed, given or otherwise made available to a deployer, or (II) deployed, and (ii) such change (I) is made to such high-risk artificial intelligence system as a result of any learning described in subparagraph (B)(i) of this subdivision, (II) was predetermined by the deployer, or the third party contracted by the deployer, when such deployer or third party completed the initial impact assessment of such high-risk artificial intelligence system pursuant to subsection (c) of section 4 of this act, and (III) is included in the technical documentation for such high-risk artificial intelligence system;Section 1(11), covering purpose, discrimination risk analysis, data categories, performance metrics, transparency measures, and post-deployment monitoring. Impact assessments and all associated records must be retained for at least three years after final deployment.
H-02.3
12
DeployersDeployer"Deployer" means any person doing business in this state that deploys a high-risk artificial intelligence system in this state;Section 1(6) must review the deployment of each high-risk AI system at least annually to verify it is not causing algorithmic discriminationAlgorithmic discrimination"Algorithmic discrimination" (A) means any use of an artificial intelligence system that results in any unlawful differential treatment or impact that disfavors any individual or group of individuals on the basis of one or more classifications protected under the laws of this state or federal law, and (B) does not include (i) the offer, license or use of a high-risk artificial intelligence system by a developer, integrator or deployer for the sole purpose of (I) the developer's, integrator's or deployer's self-testing to identify, mitigate or prevent discrimination or otherwise ensure compliance with state and federal law, or (II) expanding an applicant, customer or participant pool to increase diversity or redress historic discrimination, or (ii) an act or omission by or on behalf of a private club or other establishment not in fact open to the public, as set forth in Title II of the Civil Rights Act of 1964, 42 USC 2000a(e), as amended from time to time;Section 1(1).
H-02.8
13
DeployersDeployer"Deployer" means any person doing business in this state that deploys a high-risk artificial intelligence system in this state;Section 1(6) must, before making a consequential decisionConsequential decision"Consequential decision" means any decision or judgment that has a legal, material or similarly significant effect on a consumer with respect to (A) employment, including, but not limited to, any such decision or judgment made (i) concerning hiring, termination, compensation or promotion, or (ii) by way of any automated task allocation that limits, segregates or classifies employees for the purpose of assigning or determining material terms or conditions of employment, (B) education or vocational training, including, but not limited to, any such decision or judgment made concerning (i) assessments, (ii) student cheating or plagiarism detection, (iii) accreditation, (iv) certification, (v) admissions, or (vi) financial aid or scholarships, (C) the provision or denial, or terms and conditions, of (i) financial lending or credit services, (ii) housing or lodging, including, but not limited to, rentals or short-term housing or lodging, (iii) insurance, or (iv) legal services, or (D) the provision or denial of (i) essential government services, or (ii) health care services;Section 1(3) using a high-risk AI system, notify the consumerConsumer"Consumer" means any individual who is a resident of this state;Section 1(4) that AI is being used, disclose the system's purpose and the nature of the decision, offer opt-out rights, and provide contact information and a plain-language system description. If the decision is adverse, the deployerDeployer"Deployer" means any person doing business in this state that deploys a high-risk artificial intelligence system in this state;Section 1(6) must disclose the principal reasons (including AI's contribution and the data types and sources used), provide an opportunity to examine and correct personal data, and offer an appeal with human review where technically feasible. All notices must be in plain language, multilingual, accessible, and delivered directly to the consumerConsumer"Consumer" means any individual who is a resident of this state;Section 1(4).
H-01.1
14
DeployersDeployer"Deployer" means any person doing business in this state that deploys a high-risk artificial intelligence system in this state;Section 1(6) must publish and periodically update on their website a statement summarizing the types of high-risk AI systems they deployDeploy"Deploy" means to use a high-risk artificial intelligence system to make, or as a substantial factor in making, a consequential decision;Section 1(5), how they manage algorithmic discriminationAlgorithmic discrimination"Algorithmic discrimination" (A) means any use of an artificial intelligence system that results in any unlawful differential treatment or impact that disfavors any individual or group of individuals on the basis of one or more classifications protected under the laws of this state or federal law, and (B) does not include (i) the offer, license or use of a high-risk artificial intelligence system by a developer, integrator or deployer for the sole purpose of (I) the developer's, integrator's or deployer's self-testing to identify, mitigate or prevent discrimination or otherwise ensure compliance with state and federal law, or (II) expanding an applicant, customer or participant pool to increase diversity or redress historic discrimination, or (ii) an act or omission by or on behalf of a private club or other establishment not in fact open to the public, as set forth in Title II of the Civil Rights Act of 1964, 42 USC 2000a(e), as amended from time to time;Section 1(1) risks, and the nature, source, and extent of data collected and used.
G-02.4
15
DeployersDeployer"Deployer" means any person doing business in this state that deploys a high-risk artificial intelligence system in this state;Section 1(6) must notify the Attorney General within 90 days of discovering that a deployed high-risk AI system has caused algorithmic discriminationAlgorithmic discrimination"Algorithmic discrimination" (A) means any use of an artificial intelligence system that results in any unlawful differential treatment or impact that disfavors any individual or group of individuals on the basis of one or more classifications protected under the laws of this state or federal law, and (B) does not include (i) the offer, license or use of a high-risk artificial intelligence system by a developer, integrator or deployer for the sole purpose of (I) the developer's, integrator's or deployer's self-testing to identify, mitigate or prevent discrimination or otherwise ensure compliance with state and federal law, or (II) expanding an applicant, customer or participant pool to increase diversity or redress historic discrimination, or (ii) an act or omission by or on behalf of a private club or other establishment not in fact open to the public, as set forth in Title II of the Civil Rights Act of 1964, 42 USC 2000a(e), as amended from time to time;Section 1(1) to at least 1,000 consumersConsumer"Consumer" means any individual who is a resident of this state;Section 1(4).
R-01.3
16
DeployersDeployer"Deployer" means any person doing business in this state that deploys a high-risk artificial intelligence system in this state;Section 1(6) must, upon AG request as part of an investigation, disclose their risk management policy, impact assessments, and related records within 90 days in a form and manner prescribed by the AG.
R-02.2
Section 5
General-purpose AI model developer obligations
Developer

(a)(1) 17 Beginning on October 1, 2026, each developer of a general-purpose artificial intelligence modelGeneral-purpose artificial intelligence model"General-purpose artificial intelligence model" (A) means any form of artificial intelligence system that (i) displays significant generality, (ii) is capable of competently performing a wide range of distinct tasks, and (iii) can be integrated into a variety of downstream applications or systems, and (B) does not include any artificial intelligence model that is used for development, prototyping and research activities before such artificial intelligence model is released on the market;Section 1(8) shall, except as provided in subsection (b) of this section: (1) (A) Create and maintain technical documentation for the general-purpose artificial intelligence modelGeneral-purpose artificial intelligence model"General-purpose artificial intelligence model" (A) means any form of artificial intelligence system that (i) displays significant generality, (ii) is capable of competently performing a wide range of distinct tasks, and (iii) can be integrated into a variety of downstream applications or systems, and (B) does not include any artificial intelligence model that is used for development, prototyping and research activities before such artificial intelligence model is released on the market;Section 1(8), which technical documentation shall: (i) Include the training and testing processes for such general-purpose artificial intelligence modelGeneral-purpose artificial intelligence model"General-purpose artificial intelligence model" (A) means any form of artificial intelligence system that (i) displays significant generality, (ii) is capable of competently performing a wide range of distinct tasks, and (iii) can be integrated into a variety of downstream applications or systems, and (B) does not include any artificial intelligence model that is used for development, prototyping and research activities before such artificial intelligence model is released on the market;Section 1(8); (ii) Include at least the following information, as appropriate, considering the size and risk profile of such general-purpose artificial intelligence modelGeneral-purpose artificial intelligence model"General-purpose artificial intelligence model" (A) means any form of artificial intelligence system that (i) displays significant generality, (ii) is capable of competently performing a wide range of distinct tasks, and (iii) can be integrated into a variety of downstream applications or systems, and (B) does not include any artificial intelligence model that is used for development, prototyping and research activities before such artificial intelligence model is released on the market;Section 1(8): (I) The tasks such general-purpose artificial intelligence modelGeneral-purpose artificial intelligence model"General-purpose artificial intelligence model" (A) means any form of artificial intelligence system that (i) displays significant generality, (ii) is capable of competently performing a wide range of distinct tasks, and (iii) can be integrated into a variety of downstream applications or systems, and (B) does not include any artificial intelligence model that is used for development, prototyping and research activities before such artificial intelligence model is released on the market;Section 1(8) is intended to perform; (II) The type and nature of artificial intelligence systemsArtificial intelligence system"Artificial intelligence system" means any machine-based system that, for any explicit or implicit objective, infers from the inputs such system receives how to generate outputs, including, but not limited to, content, decisions, predictions or recommendations, that can influence physical or virtual environments;Section 1(2) in which such general-purpose artificial intelligence modelGeneral-purpose artificial intelligence model"General-purpose artificial intelligence model" (A) means any form of artificial intelligence system that (i) displays significant generality, (ii) is capable of competently performing a wide range of distinct tasks, and (iii) can be integrated into a variety of downstream applications or systems, and (B) does not include any artificial intelligence model that is used for development, prototyping and research activities before such artificial intelligence model is released on the market;Section 1(8) is intended to be integrated; (III) Acceptable use policies for such general-purpose artificial intelligence modelGeneral-purpose artificial intelligence model"General-purpose artificial intelligence model" (A) means any form of artificial intelligence system that (i) displays significant generality, (ii) is capable of competently performing a wide range of distinct tasks, and (iii) can be integrated into a variety of downstream applications or systems, and (B) does not include any artificial intelligence model that is used for development, prototyping and research activities before such artificial intelligence model is released on the market;Section 1(8); (IV) The date such general-purpose artificial intelligence modelGeneral-purpose artificial intelligence model"General-purpose artificial intelligence model" (A) means any form of artificial intelligence system that (i) displays significant generality, (ii) is capable of competently performing a wide range of distinct tasks, and (iii) can be integrated into a variety of downstream applications or systems, and (B) does not include any artificial intelligence model that is used for development, prototyping and research activities before such artificial intelligence model is released on the market;Section 1(8) is released; (V) The methods by which such general-purpose artificial intelligence modelGeneral-purpose artificial intelligence model"General-purpose artificial intelligence model" (A) means any form of artificial intelligence system that (i) displays significant generality, (ii) is capable of competently performing a wide range of distinct tasks, and (iii) can be integrated into a variety of downstream applications or systems, and (B) does not include any artificial intelligence model that is used for development, prototyping and research activities before such artificial intelligence model is released on the market;Section 1(8) is distributed; and (VI) The modality and format of inputs and outputs for such general-purpose artificial intelligence modelGeneral-purpose artificial intelligence model"General-purpose artificial intelligence model" (A) means any form of artificial intelligence system that (i) displays significant generality, (ii) is capable of competently performing a wide range of distinct tasks, and (iii) can be integrated into a variety of downstream applications or systems, and (B) does not include any artificial intelligence model that is used for development, prototyping and research activities before such artificial intelligence model is released on the market;Section 1(8); (iii) Include a description of the data that were used for purposes of training, testing and validation ... including ... (I) The type and provenance of such data; (II) Curation methodologies used for such data; (III) How such data were obtained and selected; (IV) All measures used to identify unsuitable data sources; and (V) Where applicable, methods used to detect identifiable biases; and (iv) Be reviewed and revised at least annually or more frequently as necessary to maintain the accuracy of such technical documentation; and (B) Establish, implement and maintain a policy to comply with federal and state copyright laws;

(a)(2) 18 Create, implement, maintain and make available to persons that intend to integrate such general-purpose artificial intelligence modelGeneral-purpose artificial intelligence model"General-purpose artificial intelligence model" (A) means any form of artificial intelligence system that (i) displays significant generality, (ii) is capable of competently performing a wide range of distinct tasks, and (iii) can be integrated into a variety of downstream applications or systems, and (B) does not include any artificial intelligence model that is used for development, prototyping and research activities before such artificial intelligence model is released on the market;Section 1(8) into such persons' artificial intelligence systemsArtificial intelligence system"Artificial intelligence system" means any machine-based system that, for any explicit or implicit objective, infers from the inputs such system receives how to generate outputs, including, but not limited to, content, decisions, predictions or recommendations, that can influence physical or virtual environments;Section 1(2) documentation and information that: (A) Enables such persons to (i) understand the capabilities and limitations of such general-purpose artificial intelligence modelGeneral-purpose artificial intelligence model"General-purpose artificial intelligence model" (A) means any form of artificial intelligence system that (i) displays significant generality, (ii) is capable of competently performing a wide range of distinct tasks, and (iii) can be integrated into a variety of downstream applications or systems, and (B) does not include any artificial intelligence model that is used for development, prototyping and research activities before such artificial intelligence model is released on the market;Section 1(8), and (ii) comply with such persons' obligations under sections 1 to 10, inclusive, of this act; (B) Discloses, at a minimum, (i) the technical means required for such general-purpose artificial intelligence modelGeneral-purpose artificial intelligence model"General-purpose artificial intelligence model" (A) means any form of artificial intelligence system that (i) displays significant generality, (ii) is capable of competently performing a wide range of distinct tasks, and (iii) can be integrated into a variety of downstream applications or systems, and (B) does not include any artificial intelligence model that is used for development, prototyping and research activities before such artificial intelligence model is released on the market;Section 1(8) to be integrated into such persons' artificial intelligence systemsArtificial intelligence system"Artificial intelligence system" means any machine-based system that, for any explicit or implicit objective, infers from the inputs such system receives how to generate outputs, including, but not limited to, content, decisions, predictions or recommendations, that can influence physical or virtual environments;Section 1(2), (ii) the information listed in subparagraph (A)(ii) of subdivision (1) of this subsection, and (iii) the description required under subparagraph (A)(iii) of subdivision (1) of this subsection; and (C) Except as provided in subsection (b) of this section, is reviewed and revised at least annually or more frequently as necessary to maintain the accuracy of such documentation and information.

Section 5 addresses developers of general-purpose artificial intelligence models — models displaying significant generality and capable of performing a wide range of tasks. Developers must create and maintain technical documentation covering training/testing processes, intended tasks, system integration context, acceptable-use policies, release dates, distribution methods, input/output modalities, and detailed training data descriptions. They must also establish a copyright compliance policy and provide downstream integrators with documentation enabling them to understand model capabilities/limitations and comply with the act. Open-source models released under qualifying licenses are partially exempted from technical-documentation and annual-revision requirements if model parameters are publicly available, but developers relying on the internal-use exemption must still maintain an AI risk management framework.

Compliance actions 2 items
17
Developers of general-purpose AI models must create, maintain, and annually revise technical documentation covering training and testing processes, intended tasks, integration contexts, acceptable-use policies, release dates, distribution methods, input/output modalities, and detailed training data descriptions (type, provenance, curation methods, selection criteria, bias detection methods). DevelopersDeveloper"Developer" means any person doing business in this state that develops, or intentionally and substantially modifies, an artificial intelligence system;Section 1(7) must also establish and maintain a copyright compliance policy.
G-01.1
18
Developers of general-purpose AI models must create, maintain, and make available to downstream integratorsIntegrator"Integrator" means any person doing business in this state that, with respect to a given high-risk artificial intelligence system, (A) neither develops nor intentionally and substantially modifies the high-risk artificial intelligence system, and (B) integrates the high-risk artificial intelligence system into a product or service such person offers to any other person;Section 1(10) documentation enabling them to understand the model's capabilities and limitations and comply with the act, including technical integration requirements, training data descriptions, and model metadata.
T-03.3
Section 6
AI identity disclosure
Deployer

(a)–(b) 19 Beginning on October 1, 2026, and except as provided in subsection (b) of this section, each person doing business in this state, including, but not limited to, each deployerDeployer"Deployer" means any person doing business in this state that deploys a high-risk artificial intelligence system in this state;Section 1(6) that deploysDeploy"Deploy" means to use a high-risk artificial intelligence system to make, or as a substantial factor in making, a consequential decision;Section 1(5), offers, sells, leases, licenses, gives or otherwise makes available, as applicable, any artificial intelligence systemArtificial intelligence system"Artificial intelligence system" means any machine-based system that, for any explicit or implicit objective, infers from the inputs such system receives how to generate outputs, including, but not limited to, content, decisions, predictions or recommendations, that can influence physical or virtual environments;Section 1(2) that is intended to interact with consumersConsumer"Consumer" means any individual who is a resident of this state;Section 1(4) shall ensure that it is disclosed to each consumerConsumer"Consumer" means any individual who is a resident of this state;Section 1(4) who interacts with such artificial intelligence systemArtificial intelligence system"Artificial intelligence system" means any machine-based system that, for any explicit or implicit objective, infers from the inputs such system receives how to generate outputs, including, but not limited to, content, decisions, predictions or recommendations, that can influence physical or virtual environments;Section 1(2) that such consumerConsumer"Consumer" means any individual who is a resident of this state;Section 1(4) is interacting with an artificial intelligence systemArtificial intelligence system"Artificial intelligence system" means any machine-based system that, for any explicit or implicit objective, infers from the inputs such system receives how to generate outputs, including, but not limited to, content, decisions, predictions or recommendations, that can influence physical or virtual environments;Section 1(2). (b) No disclosure shall be required under subsection (a) of this section under circumstances in which a reasonable person would deem it obvious that such person is interacting with an artificial intelligence systemArtificial intelligence system"Artificial intelligence system" means any machine-based system that, for any explicit or implicit objective, infers from the inputs such system receives how to generate outputs, including, but not limited to, content, decisions, predictions or recommendations, that can influence physical or virtual environments;Section 1(2).

Section 6 imposes a broad AI identity disclosure requirement on any person doing business in Connecticut — including deployers — that offers an AI system intended to interact with consumers. The disclosure must inform each consumer that they are interacting with an AI system. An exception applies where a reasonable person would deem it obvious that they are interacting with AI.

Compliance actions 1 item
19
Any person doing business in Connecticut that offers a consumerConsumer"Consumer" means any individual who is a resident of this state;Section 1(4)-facing AI system must disclose to each interacting consumerConsumer"Consumer" means any individual who is a resident of this state;Section 1(4) that they are interacting with an AI system, unless a reasonable person would deem the AI nature obvious.
T-01.1
Section 7
Synthetic digital content labeling
Developer

(a)–(c) 20 Beginning on October 1, 2026, and except as provided in subsections (b) and (c) of this section, the developer of an artificial intelligence systemArtificial intelligence system"Artificial intelligence system" means any machine-based system that, for any explicit or implicit objective, infers from the inputs such system receives how to generate outputs, including, but not limited to, content, decisions, predictions or recommendations, that can influence physical or virtual environments;Section 1(2), including, but not limited to, a general-purpose artificial intelligence modelGeneral-purpose artificial intelligence model"General-purpose artificial intelligence model" (A) means any form of artificial intelligence system that (i) displays significant generality, (ii) is capable of competently performing a wide range of distinct tasks, and (iii) can be integrated into a variety of downstream applications or systems, and (B) does not include any artificial intelligence model that is used for development, prototyping and research activities before such artificial intelligence model is released on the market;Section 1(8), that generates or manipulates synthetic digital contentSynthetic digital content"Synthetic digital content" means any digital content, including, but not limited to, any audio, image, text or video, that is produced or manipulated by an artificial intelligence system, including, but not limited to, a general-purpose artificial intelligence model;Section 1(15) shall: (1) Ensure that the outputs of such artificial intelligence systemArtificial intelligence system"Artificial intelligence system" means any machine-based system that, for any explicit or implicit objective, infers from the inputs such system receives how to generate outputs, including, but not limited to, content, decisions, predictions or recommendations, that can influence physical or virtual environments;Section 1(2) are marked and detectable as synthetic digital contentSynthetic digital content"Synthetic digital content" means any digital content, including, but not limited to, any audio, image, text or video, that is produced or manipulated by an artificial intelligence system, including, but not limited to, a general-purpose artificial intelligence model;Section 1(15), and that such outputs are so marked and detectable (A) not later than the time that consumersConsumer"Consumer" means any individual who is a resident of this state;Section 1(4) who did not create such outputs first interact with, or are exposed to, such outputs, and (B) in a manner that (i) is detectable by consumersConsumer"Consumer" means any individual who is a resident of this state;Section 1(4), and (ii) complies with any applicable accessibility requirements; and (2) As far as technically feasible and in a manner that is consistent with any nationally or internationally recognized technical standards, ensure that such developerDeveloper"Developer" means any person doing business in this state that develops, or intentionally and substantially modifies, an artificial intelligence system;Section 1(7)'s technical solutions are effective, interoperable, robust and reliable, considering (A) the specificities and limitations of different types of synthetic digital contentSynthetic digital content"Synthetic digital content" means any digital content, including, but not limited to, any audio, image, text or video, that is produced or manipulated by an artificial intelligence system, including, but not limited to, a general-purpose artificial intelligence model;Section 1(15), (B) the implementation costs, and (C) the generally acknowledged state of the art. (b) If the synthetic digital contentSynthetic digital content"Synthetic digital content" means any digital content, including, but not limited to, any audio, image, text or video, that is produced or manipulated by an artificial intelligence system, including, but not limited to, a general-purpose artificial intelligence model;Section 1(15) described in subsection (a) of this section is in an audio, image or video format, and such synthetic digital contentSynthetic digital content"Synthetic digital content" means any digital content, including, but not limited to, any audio, image, text or video, that is produced or manipulated by an artificial intelligence system, including, but not limited to, a general-purpose artificial intelligence model;Section 1(15) forms part of an evidently artistic, creative, satirical, fictional analogous work or program, the disclosure required under said subsection shall be limited to a disclosure that does not hinder the display or enjoyment of such work or program. (c) The provisions of subsection (a) of this section shall not apply: (1) To any synthetic digital contentSynthetic digital content"Synthetic digital content" means any digital content, including, but not limited to, any audio, image, text or video, that is produced or manipulated by an artificial intelligence system, including, but not limited to, a general-purpose artificial intelligence model;Section 1(15) that (A) consists exclusively of text, (B) is published to inform the public on any matter of public interest, or (C) is unlikely to mislead a reasonable person consuming such synthetic digital contentSynthetic digital content"Synthetic digital content" means any digital content, including, but not limited to, any audio, image, text or video, that is produced or manipulated by an artificial intelligence system, including, but not limited to, a general-purpose artificial intelligence model;Section 1(15); or (2) To the extent that any artificial intelligence systemArtificial intelligence system"Artificial intelligence system" means any machine-based system that, for any explicit or implicit objective, infers from the inputs such system receives how to generate outputs, including, but not limited to, content, decisions, predictions or recommendations, that can influence physical or virtual environments;Section 1(2) described in subsection (a) of this section (A) performs an assistive function for standard editing, (B) does not substantially alter the input data provided by the developerDeveloper"Developer" means any person doing business in this state that develops, or intentionally and substantially modifies, an artificial intelligence system;Section 1(7) or the semantics thereof, or (C) is used to detect, prevent, investigate or prosecute any crime where authorized by law.

Section 7 requires developers of AI systems that generate or manipulate synthetic digital content to ensure outputs are marked and detectable as synthetic by the time consumers first encounter them. The marking must be consumer-perceptible, accessibility-compliant, and use interoperable, robust technical solutions consistent with recognized standards. Carve-outs apply for text-only content, content published in the public interest, content unlikely to mislead, evidently artistic or satirical works (limited disclosure), assistive editing functions, and law-enforcement uses.

Compliance actions 1 item
20
Developers of AI systems that generate or manipulate synthetic digital contentSynthetic digital content"Synthetic digital content" means any digital content, including, but not limited to, any audio, image, text or video, that is produced or manipulated by an artificial intelligence system, including, but not limited to, a general-purpose artificial intelligence model;Section 1(15) must ensure outputs are marked and detectable as synthetic by the time consumersConsumer"Consumer" means any individual who is a resident of this state;Section 1(4) first encounter them, using consumerConsumer"Consumer" means any individual who is a resident of this state;Section 1(4)-perceptible, accessibility-compliant, interoperable, robust, and reliable technical solutions consistent with recognized standards. Text-only content, public-interest content, content unlikely to mislead, evidently artistic works, assistive editing, and law-enforcement uses are exempt or subject to limited disclosure.
T-02.1
Section 8
Exemptions and savings clauses

(a)–(h) Nothing in sections 1 to 10, inclusive, of this act shall be construed to restrict a developerDeveloper"Developer" means any person doing business in this state that develops, or intentionally and substantially modifies, an artificial intelligence system;Section 1(7)'s, integratorIntegrator"Integrator" means any person doing business in this state that, with respect to a given high-risk artificial intelligence system, (A) neither develops nor intentionally and substantially modifies the high-risk artificial intelligence system, and (B) integrates the high-risk artificial intelligence system into a product or service such person offers to any other person;Section 1(10)'s, deployerDeployer"Deployer" means any person doing business in this state that deploys a high-risk artificial intelligence system in this state;Section 1(6)'s or other person's ability to: (1) Comply with federal, state or municipal law; (2) Comply with a civil, criminal or regulatory inquiry, investigation, subpoena or summons by a federal, state, municipal or other governmental authority; (3) Cooperate with a law enforcement agency ... (4) Investigate, establish, exercise, prepare for or defend a legal claim; (5) Take immediate steps to protect an interest that is essential for the life or physical safety of a consumerConsumer"Consumer" means any individual who is a resident of this state;Section 1(4) or another individual; (6) (A) By any means other than facial recognition technology, prevent, detect, protect against or respond to (i) a security incident ... (7) Engage in public or peer-reviewed scientific or statistical research in the public interest ... (8) Conduct research, testing, development and integration activities regarding an artificial intelligence systemArtificial intelligence system"Artificial intelligence system" means any machine-based system that, for any explicit or implicit objective, infers from the inputs such system receives how to generate outputs, including, but not limited to, content, decisions, predictions or recommendations, that can influence physical or virtual environments;Section 1(2) or model ... (9) Effectuate a product recall; (10) Identify and repair technical errors ... (11) Assist another developerDeveloper"Developer" means any person doing business in this state that develops, or intentionally and substantially modifies, an artificial intelligence system;Section 1(7), integratorIntegrator"Integrator" means any person doing business in this state that, with respect to a given high-risk artificial intelligence system, (A) neither develops nor intentionally and substantially modifies the high-risk artificial intelligence system, and (B) integrates the high-risk artificial intelligence system into a product or service such person offers to any other person;Section 1(10), deployerDeployer"Deployer" means any person doing business in this state that deploys a high-risk artificial intelligence system in this state;Section 1(6) or person with any of the obligations imposed under sections 1 to 10, inclusive, of this act. (b) The obligations imposed on developersDeveloper"Developer" means any person doing business in this state that develops, or intentionally and substantially modifies, an artificial intelligence system;Section 1(7), integratorsIntegrator"Integrator" means any person doing business in this state that, with respect to a given high-risk artificial intelligence system, (A) neither develops nor intentionally and substantially modifies the high-risk artificial intelligence system, and (B) integrates the high-risk artificial intelligence system into a product or service such person offers to any other person;Section 1(10), deployersDeployer"Deployer" means any person doing business in this state that deploys a high-risk artificial intelligence system in this state;Section 1(6) or other persons under sections 1 to 10, inclusive, of this act shall not apply where compliance by the developerDeveloper"Developer" means any person doing business in this state that develops, or intentionally and substantially modifies, an artificial intelligence system;Section 1(7), integratorIntegrator"Integrator" means any person doing business in this state that, with respect to a given high-risk artificial intelligence system, (A) neither develops nor intentionally and substantially modifies the high-risk artificial intelligence system, and (B) integrates the high-risk artificial intelligence system into a product or service such person offers to any other person;Section 1(10), deployerDeployer"Deployer" means any person doing business in this state that deploys a high-risk artificial intelligence system in this state;Section 1(6) or other person with said sections would violate an evidentiary privilege under the laws of this state. (c) Nothing in sections 1 to 10, inclusive, of this act shall be construed to impose any obligation on a developerDeveloper"Developer" means any person doing business in this state that develops, or intentionally and substantially modifies, an artificial intelligence system;Section 1(7), integratorIntegrator"Integrator" means any person doing business in this state that, with respect to a given high-risk artificial intelligence system, (A) neither develops nor intentionally and substantially modifies the high-risk artificial intelligence system, and (B) integrates the high-risk artificial intelligence system into a product or service such person offers to any other person;Section 1(10), deployerDeployer"Deployer" means any person doing business in this state that deploys a high-risk artificial intelligence system in this state;Section 1(6) or other person that adversely affects the rights or freedoms of any person, including, but not limited to, the rights of any person (1) to freedom of speech or freedom of the press guaranteed in (A) the First Amendment to the United States Constitution, and (B) section 5 of article first of the Constitution of the state, or (2) under section 52-146t of the general statutes. (d) Nothing in sections 1 to 10, inclusive, of this act shall be construed to apply to any developerDeveloper"Developer" means any person doing business in this state that develops, or intentionally and substantially modifies, an artificial intelligence system;Section 1(7), integratorIntegrator"Integrator" means any person doing business in this state that, with respect to a given high-risk artificial intelligence system, (A) neither develops nor intentionally and substantially modifies the high-risk artificial intelligence system, and (B) integrates the high-risk artificial intelligence system into a product or service such person offers to any other person;Section 1(10), deployerDeployer"Deployer" means any person doing business in this state that deploys a high-risk artificial intelligence system in this state;Section 1(6) or other person: (1) Insofar as such developerDeveloper"Developer" means any person doing business in this state that develops, or intentionally and substantially modifies, an artificial intelligence system;Section 1(7), integratorIntegrator"Integrator" means any person doing business in this state that, with respect to a given high-risk artificial intelligence system, (A) neither develops nor intentionally and substantially modifies the high-risk artificial intelligence system, and (B) integrates the high-risk artificial intelligence system into a product or service such person offers to any other person;Section 1(10), deployerDeployer"Deployer" means any person doing business in this state that deploys a high-risk artificial intelligence system in this state;Section 1(6) or other person develops, integrates, deploysDeploy"Deploy" means to use a high-risk artificial intelligence system to make, or as a substantial factor in making, a consequential decision;Section 1(5), puts into service or intentionally and substantially modifies, as applicable, a high-risk artificial intelligence systemHigh-risk artificial intelligence system"High-risk artificial intelligence system" (A) means any artificial intelligence system that, when deployed, makes, or is a substantial factor in making, a consequential decision, and (B) does not include (i) any artificial intelligence system that is intended to (I) perform any narrow procedural task, or (II) detect decision-making patterns, or deviations from decision-making patterns, unless such artificial intelligence system is intended to replace or influence any assessment previously completed by an individual without sufficient human review, or (ii) unless the technology, when deployed, makes, or is a substantial factor in making, a consequential decision, (I) any anti-fraud technology that does not make use of facial recognition technology, (II) any artificial intelligence-enabled video game technology, (III) any anti-malware, anti-virus, calculator, cybersecurity, database, data storage, firewall, Internet domain registration, Internet-web-site loading, networking, robocall-filtering, spam-filtering, spellchecking, spreadsheet, web-caching, web-hosting or similar technology, (IV) any technology that performs tasks exclusively related to an entity's internal management affairs, including, but not limited to, ordering office supplies or processing payments, or (V) any technology that communicates with consumers in natural language for the purpose of providing users with information, making referrals or recommendations and answering questions, and is subject to an accepted use policy that prohibits generating content that is discriminatory or harmful;Section 1(9) (A) that has been approved, authorized, certified, cleared, developed, integrated or granted by (i) a federal agency ... or (ii) a regulated entity subject to supervision and regulation by the Federal Housing Finance Agency, or (B) in compliance with standards that are (i) established by (I) any federal agency ... and (ii) substantially equivalent to, and at least as stringent as, the standards established in sections 1 to 10, inclusive, of this act; ... (f) Any insurer ... fraternal benefit society ... or health carrier ... shall be deemed to be in full compliance with the provisions of sections 1 to 10, inclusive, of this act if such insurer, fraternal benefit society or health carrier has implemented and maintains a written artificial intelligence systemsArtificial intelligence system"Artificial intelligence system" means any machine-based system that, for any explicit or implicit objective, infers from the inputs such system receives how to generate outputs, including, but not limited to, content, decisions, predictions or recommendations, that can influence physical or virtual environments;Section 1(2) program in accordance with all requirements established by the Insurance Commissioner. (g) (1) Any bank, out-of-state bank, Connecticut credit union, federal credit union or out-of-state credit union, or any affiliate or subsidiary thereof, shall be deemed to be in full compliance with the provisions of sections 1 to 10, inclusive, of this act if such bank ... is subject to examination by any state or federal prudential regulator under any published guidance or regulations that apply to the use of high-risk artificial intelligence systemsHigh-risk artificial intelligence system"High-risk artificial intelligence system" (A) means any artificial intelligence system that, when deployed, makes, or is a substantial factor in making, a consequential decision, and (B) does not include (i) any artificial intelligence system that is intended to (I) perform any narrow procedural task, or (II) detect decision-making patterns, or deviations from decision-making patterns, unless such artificial intelligence system is intended to replace or influence any assessment previously completed by an individual without sufficient human review, or (ii) unless the technology, when deployed, makes, or is a substantial factor in making, a consequential decision, (I) any anti-fraud technology that does not make use of facial recognition technology, (II) any artificial intelligence-enabled video game technology, (III) any anti-malware, anti-virus, calculator, cybersecurity, database, data storage, firewall, Internet domain registration, Internet-web-site loading, networking, robocall-filtering, spam-filtering, spellchecking, spreadsheet, web-caching, web-hosting or similar technology, (IV) any technology that performs tasks exclusively related to an entity's internal management affairs, including, but not limited to, ordering office supplies or processing payments, or (V) any technology that communicates with consumers in natural language for the purpose of providing users with information, making referrals or recommendations and answering questions, and is subject to an accepted use policy that prohibits generating content that is discriminatory or harmful;Section 1(9) and such guidance or regulations (A) impose requirements that are substantially equivalent to, and at least as stringent as, the requirements set forth in sections 1 to 10, inclusive, of this act ... (h) If a developerDeveloper"Developer" means any person doing business in this state that develops, or intentionally and substantially modifies, an artificial intelligence system;Section 1(7), integratorIntegrator"Integrator" means any person doing business in this state that, with respect to a given high-risk artificial intelligence system, (A) neither develops nor intentionally and substantially modifies the high-risk artificial intelligence system, and (B) integrates the high-risk artificial intelligence system into a product or service such person offers to any other person;Section 1(10), deployerDeployer"Deployer" means any person doing business in this state that deploys a high-risk artificial intelligence system in this state;Section 1(6) or other person engages in any action pursuant to an exemption set forth in subsections (a) to (g), inclusive, of this section, the developerDeveloper"Developer" means any person doing business in this state that develops, or intentionally and substantially modifies, an artificial intelligence system;Section 1(7), integratorIntegrator"Integrator" means any person doing business in this state that, with respect to a given high-risk artificial intelligence system, (A) neither develops nor intentionally and substantially modifies the high-risk artificial intelligence system, and (B) integrates the high-risk artificial intelligence system into a product or service such person offers to any other person;Section 1(10), deployerDeployer"Deployer" means any person doing business in this state that deploys a high-risk artificial intelligence system in this state;Section 1(6) or other person bears the burden of demonstrating that such action qualifies for such exemption.

Section 8 enumerates a broad set of exemptions and savings clauses applicable to the entire act (sections 1–10). These include exemptions for law-enforcement cooperation, legal claims, security incidents, scientific research, pre-market R&D, product recalls, technical error repair, FDA/FAA-approved systems, federal defense/commerce/NASA contracts (except for employment and housing AI), HIPAA-covered entities providing non-high-risk health care recommendations, regulatory sandbox participants, insurers complying with Insurance Commissioner requirements, banks subject to equivalent prudential regulator guidance, and activities protected by the First Amendment or state evidentiary privileges. The section also preserves existing rights, claims, and remedies at law or equity, and clarifies that the act's presumptions and defenses apply only to AG enforcement actions.

Section 9
AG small business education program

Not later than January 1, 2026, the Attorney General shall, within available appropriations, develop and implement a comprehensive public education, outreach and assistance program for developersDeveloper"Developer" means any person doing business in this state that develops, or intentionally and substantially modifies, an artificial intelligence system;Section 1(7), integratorsIntegrator"Integrator" means any person doing business in this state that, with respect to a given high-risk artificial intelligence system, (A) neither develops nor intentionally and substantially modifies the high-risk artificial intelligence system, and (B) integrates the high-risk artificial intelligence system into a product or service such person offers to any other person;Section 1(10) and deployersDeployer"Deployer" means any person doing business in this state that deploys a high-risk artificial intelligence system in this state;Section 1(6) that are small businesses, as defined in section 4-168a of the general statutes. Such program shall, at a minimum, disseminate educational materials concerning (1) the requirements established in sections 1 to 10, inclusive, of this act, including, but not limited to, the duties of developersDeveloper"Developer" means any person doing business in this state that develops, or intentionally and substantially modifies, an artificial intelligence system;Section 1(7), integratorsIntegrator"Integrator" means any person doing business in this state that, with respect to a given high-risk artificial intelligence system, (A) neither develops nor intentionally and substantially modifies the high-risk artificial intelligence system, and (B) integrates the high-risk artificial intelligence system into a product or service such person offers to any other person;Section 1(10) and deployersDeployer"Deployer" means any person doing business in this state that deploys a high-risk artificial intelligence system in this state;Section 1(6) under sections 1 to 10, inclusive, of this act, (2) the impact assessments required under subsection (c) of section 4 of this act, (3) the Attorney General's powers under sections 1 to 10, inclusive, of this act, and (4) any other matters the Attorney General, in the Attorney General's discretion, deems relevant for the purposes of such program.

Section 9 directs the Attorney General to develop and implement, by January 1, 2026, a comprehensive public education, outreach, and assistance program for small-business developers, integrators, and deployers covering the act's requirements, impact assessments, AG enforcement powers, and related matters.

Section 10
Enforcement

(a)–(f) The Attorney General shall have exclusive authority to enforce the provisions of sections 1 to 9, inclusive, of this act. (b) Except as provided in subsection (f) of this section, during the period beginning on October 1, 2026, and ending on September 30, 2027, the Attorney General shall, prior to initiating any action for a violation of any provision of sections 1 to 9, inclusive, of this act, issue a notice of violation to the developerDeveloper"Developer" means any person doing business in this state that develops, or intentionally and substantially modifies, an artificial intelligence system;Section 1(7), integratorIntegrator"Integrator" means any person doing business in this state that, with respect to a given high-risk artificial intelligence system, (A) neither develops nor intentionally and substantially modifies the high-risk artificial intelligence system, and (B) integrates the high-risk artificial intelligence system into a product or service such person offers to any other person;Section 1(10), deployerDeployer"Deployer" means any person doing business in this state that deploys a high-risk artificial intelligence system in this state;Section 1(6) or other person if the Attorney General determines that it is possible to cure such violation. If the developerDeveloper"Developer" means any person doing business in this state that develops, or intentionally and substantially modifies, an artificial intelligence system;Section 1(7), integratorIntegrator"Integrator" means any person doing business in this state that, with respect to a given high-risk artificial intelligence system, (A) neither develops nor intentionally and substantially modifies the high-risk artificial intelligence system, and (B) integrates the high-risk artificial intelligence system into a product or service such person offers to any other person;Section 1(10), deployerDeployer"Deployer" means any person doing business in this state that deploys a high-risk artificial intelligence system in this state;Section 1(6) or other person fails to cure such violation not later than sixty days after receipt of the notice of violation, the Attorney General may bring an action pursuant to this section. (c) Except as provided in subsection (f) of this section, beginning on October 1, 2027, the Attorney General may, in determining whether to grant a developerDeveloper"Developer" means any person doing business in this state that develops, or intentionally and substantially modifies, an artificial intelligence system;Section 1(7), integratorIntegrator"Integrator" means any person doing business in this state that, with respect to a given high-risk artificial intelligence system, (A) neither develops nor intentionally and substantially modifies the high-risk artificial intelligence system, and (B) integrates the high-risk artificial intelligence system into a product or service such person offers to any other person;Section 1(10), deployerDeployer"Deployer" means any person doing business in this state that deploys a high-risk artificial intelligence system in this state;Section 1(6) or other person the opportunity to cure a violation described in subsection (b) of this section, consider: (1) The number of violations; (2) the size and complexity of the developerDeveloper"Developer" means any person doing business in this state that develops, or intentionally and substantially modifies, an artificial intelligence system;Section 1(7), integratorIntegrator"Integrator" means any person doing business in this state that, with respect to a given high-risk artificial intelligence system, (A) neither develops nor intentionally and substantially modifies the high-risk artificial intelligence system, and (B) integrates the high-risk artificial intelligence system into a product or service such person offers to any other person;Section 1(10), deployerDeployer"Deployer" means any person doing business in this state that deploys a high-risk artificial intelligence system in this state;Section 1(6) or other person; (3) the nature and extent of the developerDeveloper"Developer" means any person doing business in this state that develops, or intentionally and substantially modifies, an artificial intelligence system;Section 1(7)'s, integratorIntegrator"Integrator" means any person doing business in this state that, with respect to a given high-risk artificial intelligence system, (A) neither develops nor intentionally and substantially modifies the high-risk artificial intelligence system, and (B) integrates the high-risk artificial intelligence system into a product or service such person offers to any other person;Section 1(10)'s, deployerDeployer"Deployer" means any person doing business in this state that deploys a high-risk artificial intelligence system in this state;Section 1(6)'s or other person's business; (4) the substantial likelihood of injury to the public; (5) the safety of persons or property; and (6) whether such violation was likely caused by human or technical error. (d) Nothing in sections 1 to 9, inclusive, of this act shall be construed as providing the basis for a private right of action for violations of said sections. (e) Except as provided in subsections (a) to (d), inclusive, of this section and subsection (f) of this section, a violation of the requirements established in sections 1 to 9, inclusive, of this act shall constitute an unfair trade practice for purposes of section 42-110b of the general statutes and shall be enforced solely by the Attorney General. The provisions of section 42-110g of the general statutes shall not apply to any such violation. (f) (1) In any action commenced by the Attorney General for any violation of sections 1 to 9, inclusive, of this act, it shall be an affirmative defense that the developerDeveloper"Developer" means any person doing business in this state that develops, or intentionally and substantially modifies, an artificial intelligence system;Section 1(7), integratorIntegrator"Integrator" means any person doing business in this state that, with respect to a given high-risk artificial intelligence system, (A) neither develops nor intentionally and substantially modifies the high-risk artificial intelligence system, and (B) integrates the high-risk artificial intelligence system into a product or service such person offers to any other person;Section 1(10), deployerDeployer"Deployer" means any person doing business in this state that deploys a high-risk artificial intelligence system in this state;Section 1(6) or other person: (A) Discovers a violation of any provision of sections 1 to 9, inclusive, of this act through red-teamingRed-teaming"Red-teaming" means an exercise that is conducted to identify the potential adverse behaviors or outcomes of an artificial intelligence system, how such behaviors or outcomes occur and stress test the safeguards against such behaviors or outcomes;Section 1(13); (B) Not later than sixty days after discovering the violation as set forth in subparagraph (A) of this subdivision: (i) Cures such violation; and (ii) provides to the Attorney General, in a form and manner prescribed by the Attorney General, notice that such violation has been cured and evidence that any harm caused by such violation has been mitigated; and (C) Is otherwise in compliance with the latest version of: (i) The "Artificial Intelligence Risk Management Framework" published by the National Institute of Standards and Technology; (ii) ISO or IEC 42001 of the International Organization for Standardization; (iii) a nationally or internationally recognized risk management framework for artificial intelligence systemsArtificial intelligence system"Artificial intelligence system" means any machine-based system that, for any explicit or implicit objective, infers from the inputs such system receives how to generate outputs, including, but not limited to, content, decisions, predictions or recommendations, that can influence physical or virtual environments;Section 1(2) ... or (iv) any risk management framework for artificial intelligence systemsArtificial intelligence system"Artificial intelligence system" means any machine-based system that, for any explicit or implicit objective, infers from the inputs such system receives how to generate outputs, including, but not limited to, content, decisions, predictions or recommendations, that can influence physical or virtual environments;Section 1(2) that is substantially equivalent to, and at least as stringent as, the risk management frameworks described in subparagraphs (C)(i) to (C)(iii), inclusive, of this subdivision. (3) Nothing in this section or sections 1 to 9, inclusive, of this act, including, but not limited to, the enforcement authority granted to the Attorney General under this section, shall be construed to preempt or otherwise affect any right, claim, remedy, presumption or defense available at law or in equity. Any rebuttable presumption or affirmative defense established under this section or sections 1 to 9, inclusive, of this act shall apply only to an enforcement action brought by the Attorney General pursuant to this section and shall not apply to any right, claim, remedy, presumption or defense available at law or in equity.

Section 10 vests exclusive enforcement authority in the Attorney General and expressly excludes any private right of action. During the first year of operative effect (October 1, 2026 – September 30, 2027), the AG must issue a notice of violation and allow 60 days to cure before initiating an action when cure is possible. After September 30, 2027, the cure opportunity is discretionary. An affirmative defense is available for entities that discover a violation through red-teaming, cure it within 60 days while notifying the AG, and are otherwise compliant with NIST AI RMF, ISO/IEC 42001, or an equivalent framework. Violations constitute unfair trade practices under Conn. Gen. Stat. § 42-110b enforceable solely by the AG; the private enforcement provisions of § 42-110g are expressly excluded. The section preserves all existing common-law rights, claims, remedies, presumptions, and defenses.

Section 25
State agency AI inventory and assessment
Government

(b)–(d) 21 Not later than December 31, 2023, and annually thereafter, the Commissioner of Administrative Services shall conduct an inventory of all systems that employ artificial intelligence and are in use by any state agency. Each such inventory shall include at least the following information for each such system: (A) The name of such system and the vendor, if any, that provided such system; (B) A description of the general capabilities and uses of such system; (C) Whether such system was used to independently make, inform or materially support a conclusion, decision or judgment; and (D) Whether such system underwent an impact assessment prior to implementation. (2) The Commissioner of Administrative Services shall make each inventory conducted pursuant to subdivision (1) of this subsection publicly available on the state's open data portal. (c) Beginning on February 1, 2024, the Commissioner of Administrative Services shall perform ongoing assessments of systems that employ artificial intelligence and are in use by state agencies to ensure that no such system shall result in any unlawful discrimination or disparate impact described in subparagraph (B) of subdivision (1) of subsection (b) of section 4-68jj. (d) The Commissioner of Administrative Services shall, in consultation with other state agencies, collective bargaining units that represent state agency employees and industry experts, develop trainings for state agency employees on (1) the use of generative artificial intelligence tools that are determined by the commissioner, pursuant to the assessment performed under subsection (c) of this section, to achieve equitable outcomes, and (2) methods for identifying and mitigating potential output inaccuracies, fabricated text, hallucinations and biases of generative artificial intelligence while respecting the privacy of the public and complying with all applicable state laws and policies. Beginning on July 1, 2026, the commissioner shall make such trainings available to state agency employees not less frequently than annually.

Section 25 amends the existing state AI inventory statute (Conn. Gen. Stat. § 4a-2e) to update the AI definition to align with section 1, add a generative-AI definition, require the Commissioner of Administrative Services (rather than the Department) to conduct the annual inventory, publish it on the state open data portal, perform ongoing anti-discrimination assessments, and — new in this bill — develop and offer annual employee trainings on generative AI use, output-accuracy identification, hallucination mitigation, and bias awareness.

Compliance actions 1 item
21
The Commissioner of Administrative Services must annually inventory all AI systems used by state agencies (including vendor, capabilities, decision-making role, and impact-assessment status), publish the inventory on the state open data portal, perform ongoing discrimination assessments, and beginning July 1, 2026, provide annual employee trainings on generative AI use and bias mitigation.
PS-01.1
Section 27
Unlawful dissemination of intimate images — synthetic images
Publisher

(a)–(e) 22 A person is guilty of unlawful dissemination of an intimate image when (1) such person intentionally disseminates by electronic or other means a photograph, film, videotape or other recorded image or synthetic image of (A) the genitals, pubic area or buttocks of another person with less than a fully opaque covering of such body part, or the breast of such other person who is female with less than a fully opaque covering of any portion of such breast below the top of the nipple, or (B) another person engaged in sexual intercourse, as defined in section 53a-193, (2) such person disseminates such image knowing that such other person did not consent to such dissemination, and (3) such other person suffers harm as a result of such dissemination. (b) For purposes of this section: (1) "Disseminate" means to sell, give, provide, lend, trade, mail, deliver, transfer, publish, distribute, circulate, present, exhibit, advertise or otherwise offer; (2) "Harm" includes, but is not limited to, subjecting such other person to hatred, contempt, ridicule, physical injury, financial injury, psychological harm or serious emotional distress; and (3) "Synthetic image" means any photograph, film, videotape or other image that (A) is not wholly recorded by a camera, (B) is either partially or wholly generated by a computer system, and (C) depicts, and is virtually indistinguishable from an actual representation of, an identifiable person.

Section 27 amends Connecticut's existing criminal intimate-image dissemination statute (§ 53a-189c) to extend coverage to synthetic images — images not wholly recorded by a camera, partially or wholly generated by a computer system, that depict and are virtually indistinguishable from an actual representation of an identifiable person. The amendment also changes the consent element from knowledge that the image would not be disseminated to knowledge that the person did not consent to dissemination. Existing penalties apply: class A misdemeanor for dissemination to one person, class D felony for dissemination to more than one person via an interactive computer service.

Compliance actions 1 item
22
No person may intentionally disseminate a synthetic intimate image — an image partially or wholly generated by a computer system that is virtually indistinguishable from an actual representation of an identifiable person — depicting intimate body parts or sexual intercourse, knowing the depicted person did not consent, where harm results. Violation is a class A misdemeanor (single recipient) or class D felony (multiple recipients via electronic service).
CP-02.1

Passage Likelihood

Failed
Status Failed
Final action House Calendar Number 599

Legislative History

2025-01-08 Referred to Joint Committee on General Law
2025-01-22 Vote to Draft
2025-02-19 Drafted by Committee
2025-02-20 Referred to Joint Committee on General Law
2025-02-21 Public Hearing 02/26
2025-03-21 Joint Favorable Substitute
2025-03-24 Filed with Legislative Commissioners' Office
2025-04-03 Referred to Office of Legislative Research and Office of Fiscal Analysis 04/08/25 5:00 PM
2025-04-09 Reported Out of Legislative Commissioners' Office
2025-04-09 Favorable Report, Tabled for the Calendar, Senate
2025-04-09 Senate Calendar Number 328
2025-04-09 File Number 603
2025-05-01 Referred by Senate to Committee on Judiciary
2025-05-06 Joint Favorable
2025-05-06 Filed with Legislative Commissioners' Office
2025-05-07 Reported Out of Legislative Commissioners' Office
2025-05-07 No New File by Committee on Judiciary
2025-05-07 Favorable Report, Tabled for the Calendar, Senate
2025-05-08 Referred by Senate to Committee on Appropriations
2025-05-08 Immediate Transmittal
2025-05-12 Joint Favorable
2025-05-13 Filed with Legislative Commissioners' Office
2025-05-13 Reported Out of Legislative Commissioners' Office
2025-05-13 No New File by Committee on Appropriations
2025-05-13 Favorable Report, Tabled for the Calendar, Senate
2025-05-14 Senate Adopted Senate Amendment Schedule A 8540
2025-05-14 Senate Adopted Senate Amendment Schedule B 8554
2025-05-14 Senate Passed as Amended by Senate Amendment Schedule A,B
2025-05-16 Favorable Report, Tabled for the Calendar, House
2025-05-16 House Calendar Number 599

Entry Last Reviewed

2026-05-20
AI generated