WHAT THIS BILL REGULATES · 4 REQUIREMENT TYPES
How Is This Bill Enforced
Verbatim statutory text on the left; plain-language analysis and a per-section checklist on the right. Numbered markers cross-link to the matching checklist row.
As used in this chapter: "Algorithmic decision systemAlgorithmic decision system"Algorithmic decision system" means any machine-based system or computational process that uses statistical modeling, data analytics, artificial intelligence, or machine learning to generate a simplified output, including scores, classifications, or recommendations, or is capable, for a given set of human-defined objectives, of making predictions or recommendations and is used to assist, inform, or replace human decision-making. "Algorithmic decision system" does not include the following: (1) Databases, spreadsheets, or other tools that merely organize data already in the possession of the human user of the system; (2) Junk email filters; (3) Firewalls; (4) Anti-virus software; (5) Calculators; (6) Spell-checking; (7) Anti-malware; (8) Artificial-intelligence-enabled video games; (9) Cybersecurity; (10) Data storage; (11) Internet domain registration; (12) Internet website loading; (13) Networking; (14) Spam call and robocall filtering; (15) Web caching; (16) Web hosting or similar technology; or (17) Technologies that are solely used to order office supplies, schedule meetings, automate inventory tracking, or perform, assist, or administer similar ministerial administrative support functions.§ -1" means any machine-based system or computational process that uses statistical modeling, data analytics, artificial intelligence, or machine learning to generate a simplified output, including scores, classifications, or recommendations, or is capable, for a given set of human-defined objectives, of making predictions or recommendations and is used to assist, inform, or replace human decision-making. "Algorithmic decision systemAlgorithmic decision system"Algorithmic decision system" means any machine-based system or computational process that uses statistical modeling, data analytics, artificial intelligence, or machine learning to generate a simplified output, including scores, classifications, or recommendations, or is capable, for a given set of human-defined objectives, of making predictions or recommendations and is used to assist, inform, or replace human decision-making. "Algorithmic decision system" does not include the following: (1) Databases, spreadsheets, or other tools that merely organize data already in the possession of the human user of the system; (2) Junk email filters; (3) Firewalls; (4) Anti-virus software; (5) Calculators; (6) Spell-checking; (7) Anti-malware; (8) Artificial-intelligence-enabled video games; (9) Cybersecurity; (10) Data storage; (11) Internet domain registration; (12) Internet website loading; (13) Networking; (14) Spam call and robocall filtering; (15) Web caching; (16) Web hosting or similar technology; or (17) Technologies that are solely used to order office supplies, schedule meetings, automate inventory tracking, or perform, assist, or administer similar ministerial administrative support functions.§ -1" does not include the following: (1) Databases, spreadsheets, or other tools that merely organize data already in the possession of the human user of the system; (2) Junk email filters; (3) Firewalls; (4) Anti-virus software; (5) Calculators; (6) Spell-checking; (7) Anti-malware; (8) Artificial-intelligence-enabled video games; (9) Cybersecurity; (10) Data storage; (11) Internet domain registration; (12) Internet website loading; (13) Networking; (14) Spam call and robocall filtering; (15) Web caching; (16) Web hosting or similar technology; or (17) Technologies that are solely used to order office supplies, schedule meetings, automate inventory tracking, or perform, assist, or administer similar ministerial administrative support functions. "Biometric identifierBiometric identifier"Biometric identifier" means data generated by the technological processing, measurement, or analysis of an individual's biological, physical, or behavioral characteristics, which data can be processed for the purpose of uniquely identifying the individual. "Biometric identifier" includes: (1) A fingerprint; (2) A voiceprint; (3) A scan or record of an eye retina or iris; (4) A facial map, facial geometry, or facial template; or (5) Other unique biological, physical, or behavioral patterns or characteristics.§ -1" means data generated by the technological processing, measurement, or analysis of an individual's biological, physical, or behavioral characteristics, which data can be processed for the purpose of uniquely identifying the individual. "Biometric identifierBiometric identifier"Biometric identifier" means data generated by the technological processing, measurement, or analysis of an individual's biological, physical, or behavioral characteristics, which data can be processed for the purpose of uniquely identifying the individual. "Biometric identifier" includes: (1) A fingerprint; (2) A voiceprint; (3) A scan or record of an eye retina or iris; (4) A facial map, facial geometry, or facial template; or (5) Other unique biological, physical, or behavioral patterns or characteristics.§ -1" includes: (1) A fingerprint; (2) A voiceprint; (3) A scan or record of an eye retina or iris; (4) A facial map, facial geometry, or facial template; or (5) Other unique biological, physical, or behavioral patterns or characteristics. "DeployDeploy"Deploy" means to use an algorithmic decision system.§ -1" means to use an algorithmic decision systemAlgorithmic decision system"Algorithmic decision system" means any machine-based system or computational process that uses statistical modeling, data analytics, artificial intelligence, or machine learning to generate a simplified output, including scores, classifications, or recommendations, or is capable, for a given set of human-defined objectives, of making predictions or recommendations and is used to assist, inform, or replace human decision-making. "Algorithmic decision system" does not include the following: (1) Databases, spreadsheets, or other tools that merely organize data already in the possession of the human user of the system; (2) Junk email filters; (3) Firewalls; (4) Anti-virus software; (5) Calculators; (6) Spell-checking; (7) Anti-malware; (8) Artificial-intelligence-enabled video games; (9) Cybersecurity; (10) Data storage; (11) Internet domain registration; (12) Internet website loading; (13) Networking; (14) Spam call and robocall filtering; (15) Web caching; (16) Web hosting or similar technology; or (17) Technologies that are solely used to order office supplies, schedule meetings, automate inventory tracking, or perform, assist, or administer similar ministerial administrative support functions.§ -1. "DeployerDeployer"Deployer" means a person doing business in the State that deploys an algorithmic decision system.§ -1" means a person doing business in the State that deploysDeploy"Deploy" means to use an algorithmic decision system.§ -1 an algorithmic decision systemAlgorithmic decision system"Algorithmic decision system" means any machine-based system or computational process that uses statistical modeling, data analytics, artificial intelligence, or machine learning to generate a simplified output, including scores, classifications, or recommendations, or is capable, for a given set of human-defined objectives, of making predictions or recommendations and is used to assist, inform, or replace human decision-making. "Algorithmic decision system" does not include the following: (1) Databases, spreadsheets, or other tools that merely organize data already in the possession of the human user of the system; (2) Junk email filters; (3) Firewalls; (4) Anti-virus software; (5) Calculators; (6) Spell-checking; (7) Anti-malware; (8) Artificial-intelligence-enabled video games; (9) Cybersecurity; (10) Data storage; (11) Internet domain registration; (12) Internet website loading; (13) Networking; (14) Spam call and robocall filtering; (15) Web caching; (16) Web hosting or similar technology; or (17) Technologies that are solely used to order office supplies, schedule meetings, automate inventory tracking, or perform, assist, or administer similar ministerial administrative support functions.§ -1. "DevelopDevelop"Develop" means to design, build, or train an algorithmic decision system or to knowingly and materially modify, adapt, or combine an existing machine-based system or computational process for use as an algorithmic decision system.§ -1" means to design, build, or train an algorithmic decision systemAlgorithmic decision system"Algorithmic decision system" means any machine-based system or computational process that uses statistical modeling, data analytics, artificial intelligence, or machine learning to generate a simplified output, including scores, classifications, or recommendations, or is capable, for a given set of human-defined objectives, of making predictions or recommendations and is used to assist, inform, or replace human decision-making. "Algorithmic decision system" does not include the following: (1) Databases, spreadsheets, or other tools that merely organize data already in the possession of the human user of the system; (2) Junk email filters; (3) Firewalls; (4) Anti-virus software; (5) Calculators; (6) Spell-checking; (7) Anti-malware; (8) Artificial-intelligence-enabled video games; (9) Cybersecurity; (10) Data storage; (11) Internet domain registration; (12) Internet website loading; (13) Networking; (14) Spam call and robocall filtering; (15) Web caching; (16) Web hosting or similar technology; or (17) Technologies that are solely used to order office supplies, schedule meetings, automate inventory tracking, or perform, assist, or administer similar ministerial administrative support functions.§ -1 or to knowingly and materially modify, adapt, or combine an existing machine-based system or computational process for use as an algorithmic decision systemAlgorithmic decision system"Algorithmic decision system" means any machine-based system or computational process that uses statistical modeling, data analytics, artificial intelligence, or machine learning to generate a simplified output, including scores, classifications, or recommendations, or is capable, for a given set of human-defined objectives, of making predictions or recommendations and is used to assist, inform, or replace human decision-making. "Algorithmic decision system" does not include the following: (1) Databases, spreadsheets, or other tools that merely organize data already in the possession of the human user of the system; (2) Junk email filters; (3) Firewalls; (4) Anti-virus software; (5) Calculators; (6) Spell-checking; (7) Anti-malware; (8) Artificial-intelligence-enabled video games; (9) Cybersecurity; (10) Data storage; (11) Internet domain registration; (12) Internet website loading; (13) Networking; (14) Spam call and robocall filtering; (15) Web caching; (16) Web hosting or similar technology; or (17) Technologies that are solely used to order office supplies, schedule meetings, automate inventory tracking, or perform, assist, or administer similar ministerial administrative support functions.§ -1. "DeveloperDeveloper"Developer" means a person or the person's agent doing business in the State that: (1) Develops an algorithmic decision system; or (2) Sells, leases, distributes, or otherwise makes available an algorithmic decision system to a deployer.§ -1" means a person or the person's agent doing business in the State that: (1) DevelopsDevelop"Develop" means to design, build, or train an algorithmic decision system or to knowingly and materially modify, adapt, or combine an existing machine-based system or computational process for use as an algorithmic decision system.§ -1 an algorithmic decision systemAlgorithmic decision system"Algorithmic decision system" means any machine-based system or computational process that uses statistical modeling, data analytics, artificial intelligence, or machine learning to generate a simplified output, including scores, classifications, or recommendations, or is capable, for a given set of human-defined objectives, of making predictions or recommendations and is used to assist, inform, or replace human decision-making. "Algorithmic decision system" does not include the following: (1) Databases, spreadsheets, or other tools that merely organize data already in the possession of the human user of the system; (2) Junk email filters; (3) Firewalls; (4) Anti-virus software; (5) Calculators; (6) Spell-checking; (7) Anti-malware; (8) Artificial-intelligence-enabled video games; (9) Cybersecurity; (10) Data storage; (11) Internet domain registration; (12) Internet website loading; (13) Networking; (14) Spam call and robocall filtering; (15) Web caching; (16) Web hosting or similar technology; or (17) Technologies that are solely used to order office supplies, schedule meetings, automate inventory tracking, or perform, assist, or administer similar ministerial administrative support functions.§ -1; or (2) Sells, leases, distributes, or otherwise makes available an algorithmic decision systemAlgorithmic decision system"Algorithmic decision system" means any machine-based system or computational process that uses statistical modeling, data analytics, artificial intelligence, or machine learning to generate a simplified output, including scores, classifications, or recommendations, or is capable, for a given set of human-defined objectives, of making predictions or recommendations and is used to assist, inform, or replace human decision-making. "Algorithmic decision system" does not include the following: (1) Databases, spreadsheets, or other tools that merely organize data already in the possession of the human user of the system; (2) Junk email filters; (3) Firewalls; (4) Anti-virus software; (5) Calculators; (6) Spell-checking; (7) Anti-malware; (8) Artificial-intelligence-enabled video games; (9) Cybersecurity; (10) Data storage; (11) Internet domain registration; (12) Internet website loading; (13) Networking; (14) Spam call and robocall filtering; (15) Web caching; (16) Web hosting or similar technology; or (17) Technologies that are solely used to order office supplies, schedule meetings, automate inventory tracking, or perform, assist, or administer similar ministerial administrative support functions.§ -1 to a deployerDeployer"Deployer" means a person doing business in the State that deploys an algorithmic decision system.§ -1. "Generative artificial intelligence systemGenerative artificial intelligence system"Generative artificial intelligence system" means an artificial intelligence system that: (1) Is trained on data; (2) Interacts with an individual using text, audio, or visual communication; and (3) Generates unscripted outputs similar to outputs created by a human, with limited or no human oversight.§ -1" means an artificial intelligence system that: (1) Is trained on data; (2) Interacts with an individual using text, audio, or visual communication; and (3) Generates unscripted outputs similar to outputs created by a human, with limited or no human oversight. "Personal characteristicsPersonal characteristics"Personal characteristics" include: (1) Personal data; (2) Genetic information; (3) Biometric identifiers; (4) An individual's economic situation, health, personal preferences, affiliations, interests, reliability, behavior, location, or movements; and (5) Inferences associated with a group, band, class, or tier of individuals to which the individual belongs.§ -1" include: (1) Personal data; (2) Genetic information; (3) Biometric identifiersBiometric identifier"Biometric identifier" means data generated by the technological processing, measurement, or analysis of an individual's biological, physical, or behavioral characteristics, which data can be processed for the purpose of uniquely identifying the individual. "Biometric identifier" includes: (1) A fingerprint; (2) A voiceprint; (3) A scan or record of an eye retina or iris; (4) A facial map, facial geometry, or facial template; or (5) Other unique biological, physical, or behavioral patterns or characteristics.§ -1; (4) An individual's economic situation, health, personal preferences, affiliations, interests, reliability, behavior, location, or movements; and (5) Inferences associated with a group, band, class, or tier of individuals to which the individual belongs. "Plain languagePlain language"Plain language" means communication that is: (1) Clear, concise, and easy to understand for the intended audience, including people with disabilities, people with limited education, and English language learners; and (2) Available in English and any other relevant languages required by the attorney general by rule.§ -1" means communication that is: (1) Clear, concise, and easy to understand for the intended audience, including people with disabilities, people with limited education, and English language learners; and (2) Available in English and any other relevant languages required by the attorney general by rule.
This section establishes the defined terms for the new chapter. The two key platform-level definitions — algorithmic decision system and generative artificial intelligence system — define separate regulatory tracks. The algorithmic decision system definition is broad, covering any machine-based system using statistical modeling, data analytics, AI, or machine learning to generate scores, classifications, or recommendations used in human decision-making, but includes an extensive 17-item carve-out for routine IT functions. Personal characteristics is defined expansively to include not only personal data and biometric identifiers but also inferences drawn from group membership.
1 Beginning January 1, 2027, a developerDeveloper"Developer" means a person or the person's agent doing business in the State that: (1) Develops an algorithmic decision system; or (2) Sells, leases, distributes, or otherwise makes available an algorithmic decision system to a deployer.§ -1 shall, consistent with any form and manner prescribed by the attorney general, provide to each deployer of the developerDeveloper"Developer" means a person or the person's agent doing business in the State that: (1) Develops an algorithmic decision system; or (2) Sells, leases, distributes, or otherwise makes available an algorithmic decision system to a deployer.§ -1's algorithmic decision systemAlgorithmic decision system"Algorithmic decision system" means any machine-based system or computational process that uses statistical modeling, data analytics, artificial intelligence, or machine learning to generate a simplified output, including scores, classifications, or recommendations, or is capable, for a given set of human-defined objectives, of making predictions or recommendations and is used to assist, inform, or replace human decision-making. "Algorithmic decision system" does not include the following: (1) Databases, spreadsheets, or other tools that merely organize data already in the possession of the human user of the system; (2) Junk email filters; (3) Firewalls; (4) Anti-virus software; (5) Calculators; (6) Spell-checking; (7) Anti-malware; (8) Artificial-intelligence-enabled video games; (9) Cybersecurity; (10) Data storage; (11) Internet domain registration; (12) Internet website loading; (13) Networking; (14) Spam call and robocall filtering; (15) Web caching; (16) Web hosting or similar technology; or (17) Technologies that are solely used to order office supplies, schedule meetings, automate inventory tracking, or perform, assist, or administer similar ministerial administrative support functions.§ -1: (1) An analysis of whether and how any intended uses, or reasonably foreseeable uses or misuses, of the algorithmic decision systemAlgorithmic decision system"Algorithmic decision system" means any machine-based system or computational process that uses statistical modeling, data analytics, artificial intelligence, or machine learning to generate a simplified output, including scores, classifications, or recommendations, or is capable, for a given set of human-defined objectives, of making predictions or recommendations and is used to assist, inform, or replace human decision-making. "Algorithmic decision system" does not include the following: (1) Databases, spreadsheets, or other tools that merely organize data already in the possession of the human user of the system; (2) Junk email filters; (3) Firewalls; (4) Anti-virus software; (5) Calculators; (6) Spell-checking; (7) Anti-malware; (8) Artificial-intelligence-enabled video games; (9) Cybersecurity; (10) Data storage; (11) Internet domain registration; (12) Internet website loading; (13) Networking; (14) Spam call and robocall filtering; (15) Web caching; (16) Web hosting or similar technology; or (17) Technologies that are solely used to order office supplies, schedule meetings, automate inventory tracking, or perform, assist, or administer similar ministerial administrative support functions.§ -1 pose a known or reasonably foreseeable risk of violating this chapter and any applicable state or federal law; (2) A description of any steps taken by the developerDeveloper"Developer" means a person or the person's agent doing business in the State that: (1) Develops an algorithmic decision system; or (2) Sells, leases, distributes, or otherwise makes available an algorithmic decision system to a deployer.§ -1 to mitigate any identified risks of violations of this chapter and any applicable state or federal law; (3) A statement describing the intended uses and reasonably foreseeable uses and misuses of the algorithmic decision systemAlgorithmic decision system"Algorithmic decision system" means any machine-based system or computational process that uses statistical modeling, data analytics, artificial intelligence, or machine learning to generate a simplified output, including scores, classifications, or recommendations, or is capable, for a given set of human-defined objectives, of making predictions or recommendations and is used to assist, inform, or replace human decision-making. "Algorithmic decision system" does not include the following: (1) Databases, spreadsheets, or other tools that merely organize data already in the possession of the human user of the system; (2) Junk email filters; (3) Firewalls; (4) Anti-virus software; (5) Calculators; (6) Spell-checking; (7) Anti-malware; (8) Artificial-intelligence-enabled video games; (9) Cybersecurity; (10) Data storage; (11) Internet domain registration; (12) Internet website loading; (13) Networking; (14) Spam call and robocall filtering; (15) Web caching; (16) Web hosting or similar technology; or (17) Technologies that are solely used to order office supplies, schedule meetings, automate inventory tracking, or perform, assist, or administer similar ministerial administrative support functions.§ -1; and (4) All other information necessary to allow the deployerDeployer"Deployer" means a person doing business in the State that deploys an algorithmic decision system.§ -1 to comply with the deployerDeployer"Deployer" means a person doing business in the State that deploys an algorithmic decision system.§ -1's obligations under this chapter.
This section requires developers to furnish deployers with four categories of information about their algorithmic decision systems: a risk analysis covering intended uses and foreseeable misuses, a description of mitigation steps taken, a statement of intended and foreseeable uses and misuses, and all other information the deployer needs for its own chapter compliance. The obligation operates as a mandatory supply-chain disclosure — developers cannot simply ship a system without documentation. The form and manner of disclosures may be prescribed by the attorney general. The obligation takes effect January 1, 2027.
(a) 2 Beginning January 1, 2027, a deployerDeployer"Deployer" means a person doing business in the State that deploys an algorithmic decision system.§ -1 shall, either directly or through a developerDeveloper"Developer" means a person or the person's agent doing business in the State that: (1) Develops an algorithmic decision system; or (2) Sells, leases, distributes, or otherwise makes available an algorithmic decision system to a deployer.§ -1 or other third party, provide the disclosures required by subsection (b) directly to an individual who is or will be affected by a decision made, informed, or influenced by an algorithmic decision systemAlgorithmic decision system"Algorithmic decision system" means any machine-based system or computational process that uses statistical modeling, data analytics, artificial intelligence, or machine learning to generate a simplified output, including scores, classifications, or recommendations, or is capable, for a given set of human-defined objectives, of making predictions or recommendations and is used to assist, inform, or replace human decision-making. "Algorithmic decision system" does not include the following: (1) Databases, spreadsheets, or other tools that merely organize data already in the possession of the human user of the system; (2) Junk email filters; (3) Firewalls; (4) Anti-virus software; (5) Calculators; (6) Spell-checking; (7) Anti-malware; (8) Artificial-intelligence-enabled video games; (9) Cybersecurity; (10) Data storage; (11) Internet domain registration; (12) Internet website loading; (13) Networking; (14) Spam call and robocall filtering; (15) Web caching; (16) Web hosting or similar technology; or (17) Technologies that are solely used to order office supplies, schedule meetings, automate inventory tracking, or perform, assist, or administer similar ministerial administrative support functions.§ -1, which decision has a material legal or similarly significant effect on the provision or denial to the individual of, or the cost or terms of: (1) Education enrollment or an education opportunity; (2) Employment or an employment opportunity; (3) A financial or lending service; (4) An essential government service; (5) A health care service; (6) Housing; (7) Insurance; or (8) A legal service.
(b) 2 Before a deployerDeployer"Deployer" means a person doing business in the State that deploys an algorithmic decision system.§ -1 deploysDeploy"Deploy" means to use an algorithmic decision system.§ -1 an algorithmic decision systemAlgorithmic decision system"Algorithmic decision system" means any machine-based system or computational process that uses statistical modeling, data analytics, artificial intelligence, or machine learning to generate a simplified output, including scores, classifications, or recommendations, or is capable, for a given set of human-defined objectives, of making predictions or recommendations and is used to assist, inform, or replace human decision-making. "Algorithmic decision system" does not include the following: (1) Databases, spreadsheets, or other tools that merely organize data already in the possession of the human user of the system; (2) Junk email filters; (3) Firewalls; (4) Anti-virus software; (5) Calculators; (6) Spell-checking; (7) Anti-malware; (8) Artificial-intelligence-enabled video games; (9) Cybersecurity; (10) Data storage; (11) Internet domain registration; (12) Internet website loading; (13) Networking; (14) Spam call and robocall filtering; (15) Web caching; (16) Web hosting or similar technology; or (17) Technologies that are solely used to order office supplies, schedule meetings, automate inventory tracking, or perform, assist, or administer similar ministerial administrative support functions.§ -1 to make, inform, or influence a decision affecting an individual pursuant to subsection (a), the deployerDeployer"Deployer" means a person doing business in the State that deploys an algorithmic decision system.§ -1 shall provide the individual with a notice, in plain languagePlain language"Plain language" means communication that is: (1) Clear, concise, and easy to understand for the intended audience, including people with disabilities, people with limited education, and English language learners; and (2) Available in English and any other relevant languages required by the attorney general by rule.§ -1 and consistent with any form and manner prescribed by the attorney general, that the deployerDeployer"Deployer" means a person doing business in the State that deploys an algorithmic decision system.§ -1 will be using an algorithmic decision systemAlgorithmic decision system"Algorithmic decision system" means any machine-based system or computational process that uses statistical modeling, data analytics, artificial intelligence, or machine learning to generate a simplified output, including scores, classifications, or recommendations, or is capable, for a given set of human-defined objectives, of making predictions or recommendations and is used to assist, inform, or replace human decision-making. "Algorithmic decision system" does not include the following: (1) Databases, spreadsheets, or other tools that merely organize data already in the possession of the human user of the system; (2) Junk email filters; (3) Firewalls; (4) Anti-virus software; (5) Calculators; (6) Spell-checking; (7) Anti-malware; (8) Artificial-intelligence-enabled video games; (9) Cybersecurity; (10) Data storage; (11) Internet domain registration; (12) Internet website loading; (13) Networking; (14) Spam call and robocall filtering; (15) Web caching; (16) Web hosting or similar technology; or (17) Technologies that are solely used to order office supplies, schedule meetings, automate inventory tracking, or perform, assist, or administer similar ministerial administrative support functions.§ -1 to make, inform, or influence a decision concerning the individual; provided that the notice shall include: (1) The name of the developerDeveloper"Developer" means a person or the person's agent doing business in the State that: (1) Develops an algorithmic decision system; or (2) Sells, leases, distributes, or otherwise makes available an algorithmic decision system to a deployer.§ -1 or developers of the algorithmic decision systemAlgorithmic decision system"Algorithmic decision system" means any machine-based system or computational process that uses statistical modeling, data analytics, artificial intelligence, or machine learning to generate a simplified output, including scores, classifications, or recommendations, or is capable, for a given set of human-defined objectives, of making predictions or recommendations and is used to assist, inform, or replace human decision-making. "Algorithmic decision system" does not include the following: (1) Databases, spreadsheets, or other tools that merely organize data already in the possession of the human user of the system; (2) Junk email filters; (3) Firewalls; (4) Anti-virus software; (5) Calculators; (6) Spell-checking; (7) Anti-malware; (8) Artificial-intelligence-enabled video games; (9) Cybersecurity; (10) Data storage; (11) Internet domain registration; (12) Internet website loading; (13) Networking; (14) Spam call and robocall filtering; (15) Web caching; (16) Web hosting or similar technology; or (17) Technologies that are solely used to order office supplies, schedule meetings, automate inventory tracking, or perform, assist, or administer similar ministerial administrative support functions.§ -1; (2) The trade name and version number of the algorithmic decision systemAlgorithmic decision system"Algorithmic decision system" means any machine-based system or computational process that uses statistical modeling, data analytics, artificial intelligence, or machine learning to generate a simplified output, including scores, classifications, or recommendations, or is capable, for a given set of human-defined objectives, of making predictions or recommendations and is used to assist, inform, or replace human decision-making. "Algorithmic decision system" does not include the following: (1) Databases, spreadsheets, or other tools that merely organize data already in the possession of the human user of the system; (2) Junk email filters; (3) Firewalls; (4) Anti-virus software; (5) Calculators; (6) Spell-checking; (7) Anti-malware; (8) Artificial-intelligence-enabled video games; (9) Cybersecurity; (10) Data storage; (11) Internet domain registration; (12) Internet website loading; (13) Networking; (14) Spam call and robocall filtering; (15) Web caching; (16) Web hosting or similar technology; or (17) Technologies that are solely used to order office supplies, schedule meetings, automate inventory tracking, or perform, assist, or administer similar ministerial administrative support functions.§ -1; (3) The nature of the decision and the stage in the decision-making process during which the algorithmic decision systemAlgorithmic decision system"Algorithmic decision system" means any machine-based system or computational process that uses statistical modeling, data analytics, artificial intelligence, or machine learning to generate a simplified output, including scores, classifications, or recommendations, or is capable, for a given set of human-defined objectives, of making predictions or recommendations and is used to assist, inform, or replace human decision-making. "Algorithmic decision system" does not include the following: (1) Databases, spreadsheets, or other tools that merely organize data already in the possession of the human user of the system; (2) Junk email filters; (3) Firewalls; (4) Anti-virus software; (5) Calculators; (6) Spell-checking; (7) Anti-malware; (8) Artificial-intelligence-enabled video games; (9) Cybersecurity; (10) Data storage; (11) Internet domain registration; (12) Internet website loading; (13) Networking; (14) Spam call and robocall filtering; (15) Web caching; (16) Web hosting or similar technology; or (17) Technologies that are solely used to order office supplies, schedule meetings, automate inventory tracking, or perform, assist, or administer similar ministerial administrative support functions.§ -1 will be used; and (4) The contact information for the deployerDeployer"Deployer" means a person doing business in the State that deploys an algorithmic decision system.§ -1.
(c) 3 As soon as practicable, and no later than thirty days after the deployment of an algorithmic decision systemAlgorithmic decision system"Algorithmic decision system" means any machine-based system or computational process that uses statistical modeling, data analytics, artificial intelligence, or machine learning to generate a simplified output, including scores, classifications, or recommendations, or is capable, for a given set of human-defined objectives, of making predictions or recommendations and is used to assist, inform, or replace human decision-making. "Algorithmic decision system" does not include the following: (1) Databases, spreadsheets, or other tools that merely organize data already in the possession of the human user of the system; (2) Junk email filters; (3) Firewalls; (4) Anti-virus software; (5) Calculators; (6) Spell-checking; (7) Anti-malware; (8) Artificial-intelligence-enabled video games; (9) Cybersecurity; (10) Data storage; (11) Internet domain registration; (12) Internet website loading; (13) Networking; (14) Spam call and robocall filtering; (15) Web caching; (16) Web hosting or similar technology; or (17) Technologies that are solely used to order office supplies, schedule meetings, automate inventory tracking, or perform, assist, or administer similar ministerial administrative support functions.§ -1 to make, inform, or influence a decision pursuant to subsection (a), a deployerDeployer"Deployer" means a person doing business in the State that deploys an algorithmic decision system.§ -1 shall provide an affected individual, in plain languagePlain language"Plain language" means communication that is: (1) Clear, concise, and easy to understand for the intended audience, including people with disabilities, people with limited education, and English language learners; and (2) Available in English and any other relevant languages required by the attorney general by rule.§ -1 and consistent with any form and manner prescribed by the attorney general, with: (1) A list of the types, categories, and sources of personal characteristicsPersonal characteristics"Personal characteristics" include: (1) Personal data; (2) Genetic information; (3) Biometric identifiers; (4) An individual's economic situation, health, personal preferences, affiliations, interests, reliability, behavior, location, or movements; and (5) Inferences associated with a group, band, class, or tier of individuals to which the individual belongs.§ -1 associated with the individual that were analyzed, predicted, input into, inferred, or collected by the algorithmic decision systemAlgorithmic decision system"Algorithmic decision system" means any machine-based system or computational process that uses statistical modeling, data analytics, artificial intelligence, or machine learning to generate a simplified output, including scores, classifications, or recommendations, or is capable, for a given set of human-defined objectives, of making predictions or recommendations and is used to assist, inform, or replace human decision-making. "Algorithmic decision system" does not include the following: (1) Databases, spreadsheets, or other tools that merely organize data already in the possession of the human user of the system; (2) Junk email filters; (3) Firewalls; (4) Anti-virus software; (5) Calculators; (6) Spell-checking; (7) Anti-malware; (8) Artificial-intelligence-enabled video games; (9) Cybersecurity; (10) Data storage; (11) Internet domain registration; (12) Internet website loading; (13) Networking; (14) Spam call and robocall filtering; (15) Web caching; (16) Web hosting or similar technology; or (17) Technologies that are solely used to order office supplies, schedule meetings, automate inventory tracking, or perform, assist, or administer similar ministerial administrative support functions.§ -1; (2) A list of the twenty personal characteristics of the individual that most substantially influenced the output of the algorithmic decision systemAlgorithmic decision system"Algorithmic decision system" means any machine-based system or computational process that uses statistical modeling, data analytics, artificial intelligence, or machine learning to generate a simplified output, including scores, classifications, or recommendations, or is capable, for a given set of human-defined objectives, of making predictions or recommendations and is used to assist, inform, or replace human decision-making. "Algorithmic decision system" does not include the following: (1) Databases, spreadsheets, or other tools that merely organize data already in the possession of the human user of the system; (2) Junk email filters; (3) Firewalls; (4) Anti-virus software; (5) Calculators; (6) Spell-checking; (7) Anti-malware; (8) Artificial-intelligence-enabled video games; (9) Cybersecurity; (10) Data storage; (11) Internet domain registration; (12) Internet website loading; (13) Networking; (14) Spam call and robocall filtering; (15) Web caching; (16) Web hosting or similar technology; or (17) Technologies that are solely used to order office supplies, schedule meetings, automate inventory tracking, or perform, assist, or administer similar ministerial administrative support functions.§ -1 or, if the algorithmic decision systemAlgorithmic decision system"Algorithmic decision system" means any machine-based system or computational process that uses statistical modeling, data analytics, artificial intelligence, or machine learning to generate a simplified output, including scores, classifications, or recommendations, or is capable, for a given set of human-defined objectives, of making predictions or recommendations and is used to assist, inform, or replace human decision-making. "Algorithmic decision system" does not include the following: (1) Databases, spreadsheets, or other tools that merely organize data already in the possession of the human user of the system; (2) Junk email filters; (3) Firewalls; (4) Anti-virus software; (5) Calculators; (6) Spell-checking; (7) Anti-malware; (8) Artificial-intelligence-enabled video games; (9) Cybersecurity; (10) Data storage; (11) Internet domain registration; (12) Internet website loading; (13) Networking; (14) Spam call and robocall filtering; (15) Web caching; (16) Web hosting or similar technology; or (17) Technologies that are solely used to order office supplies, schedule meetings, automate inventory tracking, or perform, assist, or administer similar ministerial administrative support functions.§ -1's output was influenced by fewer than twenty personal characteristicsPersonal characteristics"Personal characteristics" include: (1) Personal data; (2) Genetic information; (3) Biometric identifiers; (4) An individual's economic situation, health, personal preferences, affiliations, interests, reliability, behavior, location, or movements; and (5) Inferences associated with a group, band, class, or tier of individuals to which the individual belongs.§ -1, a list of all personal characteristicsPersonal characteristics"Personal characteristics" include: (1) Personal data; (2) Genetic information; (3) Biometric identifiers; (4) An individual's economic situation, health, personal preferences, affiliations, interests, reliability, behavior, location, or movements; and (5) Inferences associated with a group, band, class, or tier of individuals to which the individual belongs.§ -1 that influenced the output; and (3) Information on how the individual can exercise rights pursuant to section -4.
This section creates a two-stage disclosure obligation for deployers in high-stakes decision contexts. The scope trigger is a decision with a material legal or similarly significant effect in eight enumerated domains: education, employment, financial/lending services, essential government services, healthcare, housing, insurance, and legal services.
The first stage (subsection (b)) is a pre-decision notice: before deploying the system to make or influence a decision, the deployer must tell the affected individual that an algorithmic decision system will be used, identify the developer, and provide the system's trade name, version number, decision nature, and deployer contact information. The second stage (subsection (c)) is a post-decision disclosure within 30 days, requiring the deployer to list the types, categories, and sources of personal characteristics analyzed and disclose the top 20 personal characteristics that most substantially influenced the output. This post-decision disclosure must also inform the individual of their rights under § -4.
(a) 4 An individual affected by a decision made, informed, or influenced by an algorithmic decision systemAlgorithmic decision system"Algorithmic decision system" means any machine-based system or computational process that uses statistical modeling, data analytics, artificial intelligence, or machine learning to generate a simplified output, including scores, classifications, or recommendations, or is capable, for a given set of human-defined objectives, of making predictions or recommendations and is used to assist, inform, or replace human decision-making. "Algorithmic decision system" does not include the following: (1) Databases, spreadsheets, or other tools that merely organize data already in the possession of the human user of the system; (2) Junk email filters; (3) Firewalls; (4) Anti-virus software; (5) Calculators; (6) Spell-checking; (7) Anti-malware; (8) Artificial-intelligence-enabled video games; (9) Cybersecurity; (10) Data storage; (11) Internet domain registration; (12) Internet website loading; (13) Networking; (14) Spam call and robocall filtering; (15) Web caching; (16) Web hosting or similar technology; or (17) Technologies that are solely used to order office supplies, schedule meetings, automate inventory tracking, or perform, assist, or administer similar ministerial administrative support functions.§ -1, as described in section -3(a), has a right to: (1) Access any personal characteristics of the individual that were analyzed by, predicted by, input into, inferred by, or collected by an algorithmic decision systemAlgorithmic decision system"Algorithmic decision system" means any machine-based system or computational process that uses statistical modeling, data analytics, artificial intelligence, or machine learning to generate a simplified output, including scores, classifications, or recommendations, or is capable, for a given set of human-defined objectives, of making predictions or recommendations and is used to assist, inform, or replace human decision-making. "Algorithmic decision system" does not include the following: (1) Databases, spreadsheets, or other tools that merely organize data already in the possession of the human user of the system; (2) Junk email filters; (3) Firewalls; (4) Anti-virus software; (5) Calculators; (6) Spell-checking; (7) Anti-malware; (8) Artificial-intelligence-enabled video games; (9) Cybersecurity; (10) Data storage; (11) Internet domain registration; (12) Internet website loading; (13) Networking; (14) Spam call and robocall filtering; (15) Web caching; (16) Web hosting or similar technology; or (17) Technologies that are solely used to order office supplies, schedule meetings, automate inventory tracking, or perform, assist, or administer similar ministerial administrative support functions.§ -1; and (2) Challenge and correct any inaccurate data.
(b) 4 A deployerDeployer"Deployer" means a person doing business in the State that deploys an algorithmic decision system.§ -1 or developerDeveloper"Developer" means a person or the person's agent doing business in the State that: (1) Develops an algorithmic decision system; or (2) Sells, leases, distributes, or otherwise makes available an algorithmic decision system to a deployer.§ -1 that has access to an individual's data shall create reasonable, accessible, and concise procedures in plain languagePlain language"Plain language" means communication that is: (1) Clear, concise, and easy to understand for the intended audience, including people with disabilities, people with limited education, and English language learners; and (2) Available in English and any other relevant languages required by the attorney general by rule.§ -1 to allow the individual to exercise the individual's right pursuant to subsection (a).
This section creates individual rights to access and correct personal data used by algorithmic decision systems in covered high-stakes decisions. The access right extends to all personal characteristics that were analyzed, predicted, input, inferred, or collected by the system. The correction right covers inaccurate data. Both developers and deployers that have access to an individual's data must create reasonable, accessible, and concise procedures — in plain language — to enable individuals to exercise these rights.
5 Pursuant to any requirements established by the attorney general, a person that deploysDeploy"Deploy" means to use an algorithmic decision system.§ -1, offers, sells, leases, licenses, gives, or otherwise makes available a generative artificial intelligence systemGenerative artificial intelligence system"Generative artificial intelligence system" means an artificial intelligence system that: (1) Is trained on data; (2) Interacts with an individual using text, audio, or visual communication; and (3) Generates unscripted outputs similar to outputs created by a human, with limited or no human oversight.§ -1 that is intended to interact with an individual shall disclose to each individual who interacts with the generative artificial intelligence systemGenerative artificial intelligence system"Generative artificial intelligence system" means an artificial intelligence system that: (1) Is trained on data; (2) Interacts with an individual using text, audio, or visual communication; and (3) Generates unscripted outputs similar to outputs created by a human, with limited or no human oversight.§ -1 the fact that the individual is interacting with a generative artificial intelligence systemGenerative artificial intelligence system"Generative artificial intelligence system" means an artificial intelligence system that: (1) Is trained on data; (2) Interacts with an individual using text, audio, or visual communication; and (3) Generates unscripted outputs similar to outputs created by a human, with limited or no human oversight.§ -1.
This section imposes a standalone AI identity disclosure obligation on any person that deploys, offers, sells, leases, licenses, gives, or otherwise makes available a generative artificial intelligence system intended to interact with individuals. The obligation is unconditional — disclosure is required for every interacting individual, not only when a reasonable person could be misled. The attorney general may establish further requirements by rule. Unlike the algorithmic decision system provisions, this section is not limited to high-stakes domains and applies broadly to any generative AI interaction.
(a) 6 Notwithstanding any other law to the contrary, beginning January 1, 2027, the developerDeveloper"Developer" means a person or the person's agent doing business in the State that: (1) Develops an algorithmic decision system; or (2) Sells, leases, distributes, or otherwise makes available an algorithmic decision system to a deployer.§ -1 and deployer of an algorithmic decision systemAlgorithmic decision system"Algorithmic decision system" means any machine-based system or computational process that uses statistical modeling, data analytics, artificial intelligence, or machine learning to generate a simplified output, including scores, classifications, or recommendations, or is capable, for a given set of human-defined objectives, of making predictions or recommendations and is used to assist, inform, or replace human decision-making. "Algorithmic decision system" does not include the following: (1) Databases, spreadsheets, or other tools that merely organize data already in the possession of the human user of the system; (2) Junk email filters; (3) Firewalls; (4) Anti-virus software; (5) Calculators; (6) Spell-checking; (7) Anti-malware; (8) Artificial-intelligence-enabled video games; (9) Cybersecurity; (10) Data storage; (11) Internet domain registration; (12) Internet website loading; (13) Networking; (14) Spam call and robocall filtering; (15) Web caching; (16) Web hosting or similar technology; or (17) Technologies that are solely used to order office supplies, schedule meetings, automate inventory tracking, or perform, assist, or administer similar ministerial administrative support functions.§ -1 shall be jointly and severally liable for a violation of any law facilitated by the deployerDeployer"Deployer" means a person doing business in the State that deploys an algorithmic decision system.§ -1's use of the algorithmic decision systemAlgorithmic decision system"Algorithmic decision system" means any machine-based system or computational process that uses statistical modeling, data analytics, artificial intelligence, or machine learning to generate a simplified output, including scores, classifications, or recommendations, or is capable, for a given set of human-defined objectives, of making predictions or recommendations and is used to assist, inform, or replace human decision-making. "Algorithmic decision system" does not include the following: (1) Databases, spreadsheets, or other tools that merely organize data already in the possession of the human user of the system; (2) Junk email filters; (3) Firewalls; (4) Anti-virus software; (5) Calculators; (6) Spell-checking; (7) Anti-malware; (8) Artificial-intelligence-enabled video games; (9) Cybersecurity; (10) Data storage; (11) Internet domain registration; (12) Internet website loading; (13) Networking; (14) Spam call and robocall filtering; (15) Web caching; (16) Web hosting or similar technology; or (17) Technologies that are solely used to order office supplies, schedule meetings, automate inventory tracking, or perform, assist, or administer similar ministerial administrative support functions.§ -1; provided that a developerDeveloper"Developer" means a person or the person's agent doing business in the State that: (1) Develops an algorithmic decision system; or (2) Sells, leases, distributes, or otherwise makes available an algorithmic decision system to a deployer.§ -1 shall not be jointly and severally liable if the developerDeveloper"Developer" means a person or the person's agent doing business in the State that: (1) Develops an algorithmic decision system; or (2) Sells, leases, distributes, or otherwise makes available an algorithmic decision system to a deployer.§ -1 can demonstrate that the violation of law resulted from a misuse of the algorithmic decision systemAlgorithmic decision system"Algorithmic decision system" means any machine-based system or computational process that uses statistical modeling, data analytics, artificial intelligence, or machine learning to generate a simplified output, including scores, classifications, or recommendations, or is capable, for a given set of human-defined objectives, of making predictions or recommendations and is used to assist, inform, or replace human decision-making. "Algorithmic decision system" does not include the following: (1) Databases, spreadsheets, or other tools that merely organize data already in the possession of the human user of the system; (2) Junk email filters; (3) Firewalls; (4) Anti-virus software; (5) Calculators; (6) Spell-checking; (7) Anti-malware; (8) Artificial-intelligence-enabled video games; (9) Cybersecurity; (10) Data storage; (11) Internet domain registration; (12) Internet website loading; (13) Networking; (14) Spam call and robocall filtering; (15) Web caching; (16) Web hosting or similar technology; or (17) Technologies that are solely used to order office supplies, schedule meetings, automate inventory tracking, or perform, assist, or administer similar ministerial administrative support functions.§ -1 by the deployerDeployer"Deployer" means a person doing business in the State that deploys an algorithmic decision system.§ -1, the developerDeveloper"Developer" means a person or the person's agent doing business in the State that: (1) Develops an algorithmic decision system; or (2) Sells, leases, distributes, or otherwise makes available an algorithmic decision system to a deployer.§ -1 took all reasonable steps available, contractual or otherwise, to prevent the misuse, and the developerDeveloper"Developer" means a person or the person's agent doing business in the State that: (1) Develops an algorithmic decision system; or (2) Sells, leases, distributes, or otherwise makes available an algorithmic decision system to a deployer.§ -1: (1) Did not intend and could not have reasonably foreseen the misuse; or (2) Specifically disallowed the misuse in disclosures pursuant to section -2.
(b) Nothing in this section shall limit, displace, or otherwise affect any liability that a developerDeveloper"Developer" means a person or the person's agent doing business in the State that: (1) Develops an algorithmic decision system; or (2) Sells, leases, distributes, or otherwise makes available an algorithmic decision system to a deployer.§ -1 may have in the developerDeveloper"Developer" means a person or the person's agent doing business in the State that: (1) Develops an algorithmic decision system; or (2) Sells, leases, distributes, or otherwise makes available an algorithmic decision system to a deployer.§ -1's own right, separate and apart from liability under this section, for a violation of state or federal law. Compliance with this chapter shall not be a defense to, and shall not otherwise excuse, noncompliance with any applicable law.
This section establishes joint and several liability between developers and deployers for any violation of law facilitated by the deployer's use of the algorithmic decision system. The developer has a safe harbor: it is not jointly liable if it can demonstrate that the violation resulted from deployer misuse, that the developer took all reasonable steps (contractual or otherwise) to prevent the misuse, and that the developer either could not have reasonably foreseen the misuse or specifically disallowed it in disclosures under § -2. Subsection (b) is a savings clause preserving any independent developer liability and confirming that chapter compliance does not excuse other law violations.
(a) A violation of this chapter shall constitute an unfair or deceptive act or practice in the conduct of trade or commerce within the meaning of section 480-2.
(b) No private right of action at law shall arise under this chapter.
(c) Nothing in this chapter shall preempt or otherwise affect any other right, claim, remedy, presumption, or defense available at law or in equity, including any right available pursuant to laws governing anti-discrimination, competition, privacy, or unfair and deceptive acts and practices.
This section designates violations of the chapter as unfair or deceptive acts or practices under HRS § 480-2, channeling enforcement through Hawaii's existing consumer protection framework. Subsection (b) expressly bars any private right of action at law under this chapter. Subsection (c) is a savings clause preserving all existing rights, claims, remedies, presumptions, and defenses under anti-discrimination, competition, privacy, and UDAP law.
The attorney general shall adopt rules as necessary pursuant to chapter 91 to implement and enforce this chapter.
This section grants the attorney general rulemaking authority under HRS Chapter 91 (Hawaii Administrative Procedure Act) to implement and enforce the chapter. This delegates significant operational detail — including potentially the form and manner of required disclosures — to the attorney general.