Regulon — NE-LB-642 · NE LB 642 (AI Consumer Protection)

WHAT THIS BILL REGULATES · 7 REQUIREMENT TYPES

How Is This Bill Enforced

Enforcement Authority

Attorney General has exclusive enforcement authority. Prior to initiating any action, the AG must issue a notice of violation describing the alleged violation and required cure actions. If the violation is not cured within 90 days of receipt, the AG may bring an enforcement action. The AG may also demand documentation from developers and deployers in connection with ongoing investigations. No private right of action is created.

Private Right of Action

No private right of action. Enforcement is exclusive to the designated authority.

Penalties

The Act does not specify statutory damages, penalty amounts, or fee-shifting. Enforcement is exclusively through the Attorney General. The Act expressly does not provide the basis for any private right of action. However, the Act shall not be construed to preempt or otherwise affect any right, claim, remedy, presumption, or defense available at law or in equity. Rebuttable presumptions and affirmative defenses under the Act apply only to AG enforcement actions.

Verbatim statutory text on the left; plain-language analysis and a per-section checklist on the right. Numbered markers cross-link to the matching checklist row.

Statutory Text

Analysis & Obligations

Sec. 1

Short title

Sections 1 to 7 of this act shall be known and may be cited as the Artificial Intelligence Consumer Protection Act.

This section establishes the short title of the Act as the Artificial Intelligence Consumer Protection Act. It creates no compliance obligations.

Sec. 2

Definitions

(1)–(16) For purposes of the Artificial Intelligence Consumer Protection Act: (1)(a) Algorithmic discrimination means any use of an artificial intelligence system that violates state or federal anti-discrimination laws, including federal statutes prohibiting discrimination on the basis of citizenship status, color, disability, national origin, race, or sex, or any other classification protected under the laws of this state or federal law; and (b) Algorithmic discrimination does not include: (i) The offer, license, or use of a high-risk artificial intelligence system by a developer or deployer for the sole purpose of: (A) The developer's or deployer's self-testing to identify, mitigate, or prevent discrimination or otherwise ensure compliance with state and federal law; or (B) Expanding an applicant, customer, or participant pool to increase diversity or redress historical discrimination; or (ii) An act or omission by or on behalf of a private club or other establishment that is not in fact open to the public, pursuant to the federal Civil Rights Act of 1964, 42 U.S.C. 2000a(e), as such section existed on January 1, 2025; (2) Artificial intelligence system means any machine-based system that, for any explicit or implicit objective, infers from the inputs the system receives how to generate outputs, including content, decisions, predictions, or recommendations, that can influence physical or virtual environments; (3) Consequential decision means a decision that has a material legal or similarly significant effect on the provision or denial to any consumer of any, or the cost or terms of any: (a) Education enrollment or an education opportunity; (b) Employment; (c) Lending decision; (d) Essential government service; (e) Health care services; (f) Housing; (g) Insurance; (h) Legal service; or (i) Pardon, parole, probation, or release decision; (4) Consumer means any individual who is a resident of this state; (5) Deploy means to use a high-risk artificial intelligence system; (6) Deployer means a person doing business in this state that deploys a high-risk artificial intelligence system in this state; (7) Developer means a person doing business in this state that develops or intentionally and substantially modifies a high-risk artificial intelligence system in this state; (8) Health care services has the same meaning as in 42 U.S.C. 234(d)(2), as such section existed on January 1, 2025; (9)(a) High-risk artificial intelligence system means any artificial intelligence system that, when deployed, makes a consequential decision without human review or intervention; and (b) High-risk artificial intelligence system does not include: (i) Any artificial intelligence system if the artificial intelligence system is intended to: (A) Perform a narrow procedural task; (B) Improve the result of a previously completed human activity; (C) Perform a preparatory task to an assessment that is relevant to a consequential decision; or (D) Detect decisionmaking patterns or deviations from preexisting decisionmaking patterns and is not intended to replace or influence a previously completed human assessment without sufficient human review; and (ii) Any of the following technology: (A) Antifraud technology; (B) Antimalware; (C) Antivirus; (D) Artificial intelligence-enabled video game; (E) Calculator; (F) Cybersecurity; (G) Database; (H) Data storage; (I) Firewall; (J) Internet domain registration; (K) Internet website loading; (L) Networking; (M) Spam-filtering; (N) Robocall-filtering; (O) Spell-checking; (P) Spreadsheet; (Q) Web caching; (R) Web hosting or any similar technology; or (S) Technology that: (I) Communicates with any consumer in natural language for the purpose of providing such consumer with information, making any referral or recommendation, or answering any question; and (II) Is subject to an acceptable use policy that prohibits generating content that is unlawful or harmful; (10) Insurer means any person engaged as principal, indemnitor, surety, or contractor in the business of making contracts of insurance; (11)(a) Intentional and substantial modification means a deliberate and material change made to an artificial intelligence system that materially increases the known risk of algorithmic discrimination; and (b) Intentional and substantial modification does not include any change made to any high-risk artificial intelligence system, or the performance of any high-risk artificial intelligence system, if: (i) The high-risk artificial intelligence system continues to learn after the high-risk artificial intelligence system is: (A) Offered, sold, leased, licensed, given, or otherwise made available to a deployer; or (B) Deployed; (ii) The change is made to the high-risk artificial intelligence system as a result of any learning described in subdivision (10)(b)(i) of this section; (iii) The change was predetermined by the deployer, or a third party contracted by the deployer, when the deployer or third party completed an initial impact assessment of such high-risk artificial intelligence system pursuant to subsection (3) of section 4 of this act; and (iv) The change is included in technical documentation for the high-risk artificial intelligence system; (12) Intentionally and substantially modifies means intentional and substantial modification as defined in this section; (13) Principal basis means the use of an output of a high-risk artificial intelligence system to make a decision without: (a) Human review, oversight, involvement, or intervention; or (b) Meaningful consideration by a human; (14) Red teaming means an exercise that is conducted to identify the potential adverse behaviors or outcomes of an artificial intelligence system, identify how such behaviors or outcomes occur, and stress test the safeguards against such behaviors or outcomes; (15)(a) Substantial factor means any factor that: (i) Is the principal basis for making a consequential decision; (ii) Is capable of altering the outcome of a consequential decision; and (iii) Is generated by an artificial intelligence system; and (b) Substantial factor includes any use of any artificial intelligence system to generate any content, decision, prediction, or recommendation concerning any consumer that is used as a basis to make a consequential decision concerning the consumer; and (16) Trade secret has the same meaning as in section 87-502.

Section 2 defines the key terms used throughout the Act, including algorithmic discrimination, artificial intelligence system, consequential decision, consumer, deployer, developer, high-risk artificial intelligence system, intentional and substantial modification, principal basis, red teaming, substantial factor, and trade secret. The definitions are comprehensive and include significant carve-outs — notably, the definition of high-risk AI system excludes a broad list of technologies (antivirus, calculators, cybersecurity, spam filtering, etc.) and also excludes natural-language consumer-facing systems subject to an acceptable use policy prohibiting unlawful or harmful content.

The definition of consequential decision covers nine domains: education, employment, lending, essential government services, healthcare, housing, insurance, legal services, and pardon/parole/probation decisions. The definition of algorithmic discrimination is keyed to violations of existing state or federal anti-discrimination law rather than creating a new standard.

Sec. 3

Developer obligations

Developer

(1)(a)–(b) 1 On and after February 1, 2026, a developer of a high-risk artificial intelligence system shall use reasonable care to protect consumers from any known risks of algorithmic discrimination arising from the intended and contracted uses of the high-risk artificial intelligence system. (b) In any enforcement action brought on or after February 1, 2026, by the Attorney General pursuant to section 7 of this act, there is a rebuttable presumption that a developer used reasonable care as required under this section if the developer complied with this section.

(2)(a)–(d) 2 Except as otherwise provided in subsection (6) of this section, on and after February 1, 2026, each developer of a high-risk artificial intelligence system shall make available to the deployer or other developer of the high-risk artificial intelligence system: (a) A general statement describing the uses and known harmful or inappropriate uses of the high-risk artificial intelligence system; (b) Documentation disclosing: (i) A high-level summary of the types of data used to train the high-risk artificial intelligence system; (ii) Each known limitation of the high-risk artificial intelligence system, including each known or reasonably foreseeable risk of algorithmic discrimination arising from the intended use of the high-risk artificial intelligence system; (iii) The purpose of the high-risk artificial intelligence system; (iv) Any intended benefit and use of the high-risk artificial intelligence system; and (v) Information necessary to allow the deployer to comply with the requirements of section 4 of this act; (c) Documentation describing: (i) How the high-risk artificial intelligence system was evaluated for performance and mitigation of algorithmic discrimination before the high-risk artificial intelligence system was offered, sold, leased, licensed, given, or otherwise made available to the deployer; (ii) The data governance measures used to cover the training datasets and the measures used to examine the suitability of data sources, possible biases, and appropriate mitigation; (iii) Intended outputs of the high-risk artificial intelligence system; (iv) The measures the developer has taken to mitigate known risks of algorithmic discrimination that could arise from the deployment of the high-risk artificial intelligence system; and (v) How the high-risk artificial intelligence system should be used, not be used, and be monitored by an individual when the high-risk artificial intelligence system is used to make, or is a substantial factor in making, a consequential decision; and (d) Documentation that is reasonably necessary to assist the deployer in understanding each output and monitor the performance of the high-risk artificial intelligence system for each risk of algorithmic discrimination.

(3)(a)–(b) 3 Except as otherwise provided in subsection (6) of this section, on or after February 1, 2026, a developer that offers, sells, leases, licenses, gives, or otherwise makes any high-risk artificial intelligence system available to a deployer or other developer shall to the extent feasible make available to the deployer or other developer the documentation and information necessary for the deployer or a third party contracted by the deployer to complete an impact assessment pursuant to subsection (3) of section 4 of this act. Such documentation and information includes any model card or other impact assessment. (b) A developer that also serves as a deployer for a high-risk artificial intelligence system is not required to generate the documentation required by this section unless the high-risk artificial intelligence system is provided to an unaffiliated entity acting as a deployer.

(4)(a)–(b) 4 On and after February 1, 2026, a developer shall make a statement summarizing the following available in a manner that is clear and readily available in a public use case inventory: (i) The types of high-risk artificial intelligence systems that the developer has developed and currently makes available to a deployer or other developer; (ii) The types of high-risk artificial intelligence system that the developer has intentionally and substantially modified and currently makes available to a deployer or other developer; and (iii) How the developer manages known risks of algorithmic discrimination that could arise from the development or intentional and substantial modification of the types of high-risk artificial intelligence systems described in subdivisions (4)(a)(i) and (ii) of this section. (b) A developer shall update the statement described in subdivision (4)(a) of this section: (i) As necessary to ensure that the statement remains accurate; and (ii) No later than ninety days after the developer intentionally and substantially modifies any high-risk artificial intelligence system described in subdivision (4)(a)(ii) of this section.

(5)(a)–(b) 5 On and after February 1, 2026, a developer of a high-risk artificial intelligence system shall disclose to all known deployers or other developers of the high-risk artificial intelligence system, each known risk of algorithmic discrimination arising from any intended use of the high-risk artificial intelligence system without unreasonable delay after the date on which: (i) The developer discovers through the developer's ongoing testing and analysis that the developer's high-risk artificial intelligence system has been deployed and has caused or is reasonably likely to have caused algorithmic discrimination; or (ii) The developer receives from a deployer a credible report that the high-risk artificial intelligence system has been deployed and has caused algorithmic discrimination. (b) The Attorney General shall prescribe the form and manner of the disclosure described in subdivision (a) of this subsection.

(6) Nothing in subsections (2) through (5) of this section requires a developer to disclose any: (a) Trade secret; (b) Information protected from disclosure by state or federal law; or (c) Information that would create a security risk to the developer.

(7)(a)–(d) 6 On and after February 1, 2026, the Attorney General may provide a written demand to any developer to disclose to the Attorney General the statement or documentation described in subsection (2) of this section if such a statement or documentation is relevant to an investigation related to the developer conducted by the Attorney General. Such statement or documentation shall be provided to the Attorney General in a form and manner prescribed by the Attorney General. (b) The Attorney General may evaluate such statement or documentation, if it is relevant to an investigation conducted by the Attorney General regarding a violation of the Artificial Intelligence Consumer Protection Act, to ensure compliance with the Artificial Intelligence Consumer Protection Act. (c) In any disclosure pursuant to this subsection, any developer may designate the statement or documentation as including proprietary information or a trade secret. (d) To the extent any such statement or documentation includes any proprietary information or any trade secret, such statement or documentation shall be exempt from disclosure.

(8) If a developer completes documentation for the purpose of complying with another applicable law or regulation, such documentation shall be deemed to satisfy this section if such documentation is reasonably similar in scope and effect to the documentation that would otherwise be completed pursuant to this section.

Section 3 imposes the Act's core developer-side obligations. Subsection (1) establishes the overarching reasonable-care standard for developers to protect consumers from known risks of algorithmic discrimination, with a rebuttable presumption of compliance for developers who meet the section's requirements. Subsection (2) requires developers to make detailed documentation available to deployers covering system uses, training data summaries, known limitations, discrimination risks, data governance measures, evaluation methodology, and monitoring guidance. Subsection (3) requires developers to make impact-assessment-supporting documentation available to deployers. Subsection (4) mandates a public use case inventory describing the types of high-risk AI systems developed or substantially modified and how discrimination risks are managed, with update obligations. Subsection (5) requires disclosure of known algorithmic discrimination risks to deployers without unreasonable delay. Subsection (6) carves out trade secrets and security-sensitive information. Subsections (7)–(8) address AG investigative access and cross-compliance equivalence.

Compliance actions 6 items

Developers of high-risk AI systems must use reasonable care to protect consumers from any known risks of algorithmic discrimination arising from the intended and contracted uses of the system. Compliance with all of Section 3's requirements creates a rebuttable presumption of reasonable care in AG enforcement actions.

H-02

Developers must make available to deployers or other developers of each high-risk AI system: (1) a general statement describing uses and known harmful or inappropriate uses; (2) documentation disclosing a high-level summary of training data types, each known limitation including reasonably foreseeable algorithmic discrimination risks, the system's purpose, intended benefits and uses, and information necessary for deployer compliance; (3) documentation describing pre-deployment performance and discrimination evaluation methodology, data governance measures covering training datasets including suitability of data sources and bias mitigation, intended outputs, measures taken to mitigate known discrimination risks, and guidance on how the system should be used, not be used, and be monitored by a human in consequential-decision contexts; and (4) documentation reasonably necessary to assist the deployer in understanding each output and monitoring performance for algorithmic discrimination risk. Trade secrets and legally protected or security-sensitive information may be withheld.

G-02.1

Developers that make a high-risk AI system available to deployers or other developers must, to the extent feasible, provide the documentation and information necessary for the deployer or a third party contracted by the deployer to complete an impact assessment, including any model card or other impact assessment. A developer that also serves as deployer for the same system need not generate this documentation unless the system is provided to an unaffiliated deployer.

G-02.1

Developers must publish and maintain a public use case inventory that is clear and readily available, summarizing: (1) the types of high-risk AI systems developed and currently made available; (2) the types of high-risk AI systems intentionally and substantially modified and currently made available; and (3) how the developer manages known risks of algorithmic discrimination from those systems. The inventory must be updated as necessary for accuracy and no later than 90 days after any intentional and substantial modification.

G-02.4

Developers must disclose to all known deployers or other developers each known risk of algorithmic discrimination arising from any intended use of their high-risk AI system, without unreasonable delay after: (1) the developer discovers through ongoing testing and analysis that the system has been deployed and has caused or is reasonably likely to have caused algorithmic discrimination; or (2) the developer receives a credible report from a deployer that the deployed system has caused algorithmic discrimination. The Attorney General shall prescribe the form and manner of this disclosure.

R-01.3

Developers must, upon written demand from the Attorney General in connection with an investigation, disclose the documentation described in Section 3(2) in a form and manner prescribed by the Attorney General. Developers may designate disclosed materials as including proprietary information or trade secrets, and materials so designated are exempt from public disclosure.

R-02.2

Sec. 4

Deployer obligations

Deployer

(1)(a)–(b) 7 On and after February 1, 2026, a deployer of any high-risk artificial intelligence system shall use reasonable care to protect consumers from each known risk of algorithmic discrimination. (b) In any enforcement action brought on or after February 1, 2026, by the Attorney General pursuant to section 7 of this act, there is a rebuttable presumption that a deployer of a high-risk artificial intelligence system used reasonable care as required under this section if the deployer complied with this section.

(2)(a)–(b) 8 Except as otherwise provided in subsection (6) of this section, on and after February 1, 2026, a deployer of a high-risk artificial intelligence system shall implement a risk management policy and program to govern the deployer's deployment of the high-risk artificial intelligence system. High-risk artificial intelligence systems that are in conformity with the guidance and standards set forth in the following as of January 1, 2025, shall be presumed to be in conformity with this section: (i) The Artificial Intelligence Risk Management Framework published by the National Institute of Standards and Technology; or (ii) The standard ISO/IEC 42001 of the International Organization for Standardization. (b) Any risk management policy and program implemented pursuant to subdivision (a) of this subsection may cover multiple high-risk artificial intelligence systems deployed by the deployer.

(3)(a)–(f) 9 Except as otherwise provided in this subsection or subsection (6) of this section: (i) An impact assessment shall be completed for each high-risk artificial intelligence system deployed on or after February 1, 2026. Such impact assessment shall be completed by the deployer or by a third party contracted by the deployer; and (ii) On and after February 1, 2026, for each deployed high-risk artificial intelligence system, a deployer or a third party contracted by the deployer shall complete an impact assessment within ninety days after any intentional and substantial modification to such high-risk artificial intelligence system is made available. (b) An impact assessment completed pursuant to this subsection shall include to the extent reasonably known by or available to the deployer: (i) A statement by the deployer disclosing: (A) The purpose of the high-risk artificial intelligence system; (B) Any intended-use case for the high-risk artificial intelligence system; (C) The deployment context of the high-risk artificial intelligence system; and (D) Any benefit afforded by the high-risk artificial intelligence system; (ii) An analysis of whether the deployment of the high-risk artificial intelligence system poses any known risk of algorithmic discrimination and, if so, the nature of the algorithmic discrimination and the steps that have been taken to mitigate any such risk; (iii) A high-level summary of the categories of data the high-risk artificial intelligence system processes as inputs and the outputs the high-risk artificial intelligence system produces; (iv) If the deployer used data to customize the high-risk artificial intelligence system, an overview of the categories of data the deployer used to customize the high-risk artificial intelligence system; (v) Any metric used to evaluate the performance and any known limitation of the high-risk artificial intelligence system; (vi) A description of any transparency measure taken concerning the high-risk artificial intelligence system, including any measure taken to disclose to a consumer when the high-risk artificial intelligence system is in use; and (vii) A description of each postdeployment monitoring and user safeguard provided concerning the high-risk artificial intelligence system, including the oversight, use, and learning process established by the deployer to address any issue that arises from the deployment of the high-risk artificial intelligence system. (c) Any impact assessment completed pursuant to this subsection following an intentional and substantial modification to a high-risk artificial intelligence system on or after February 1, 2026, shall include a statement that discloses the extent to which the high-risk artificial intelligence system was used in a manner that was consistent with or varied from any use of the high-risk artificial intelligence system intended by the developer. (d) A single impact assessment may address a comparable set of high-risk artificial intelligence systems deployed by a deployer. (e) Any impact assessment completed to comply with another applicable law or regulation by a deployer or by a third party contracted by the deployer shall satisfy this subsection if such impact assessment is reasonably similar in scope and effect to the impact assessment that would otherwise be completed pursuant to this subsection. (f) A deployer shall maintain: (i) The most recently completed impact assessment required under this subsection for each high-risk artificial intelligence system of the deployer; (ii) Each record concerning each such impact assessment; and (iii) For at least three years following the final deployment of each high-risk artificial intelligence system, each prior impact assessment, if any, and each record concerning such impact assessment.

(4)(a) 10 On and after February 1, 2026, prior to deploying any high-risk artificial intelligence system to make or be a substantial factor in making any consequential decision concerning any consumer, the deployer shall: (i) Notify the consumer that the deployer has deployed a high-risk artificial intelligence system to make or be a substantial factor in making a consequential decision; (ii) Provide to the consumer: (A) A statement that discloses the purpose of the high-risk artificial intelligence system and the nature of the consequential decision; (B) The contact information for the deployer; (C) A description written in plain language that describes the high-risk artificial intelligence system; and (D) Instructions on how to access the statement described in subdivision (5)(a) of this section; and (iii) If applicable, provide information to the consumer regarding the consumer's right to opt out of the processing of personal data concerning the consumer for any purpose of profiling in furtherance of decisions that produce legal or similarly significant effects concerning the consumer under subdivision (2)(e)(iii) of section 87-1107.

(4)(b)–(c) 11 On and after February 1, 2026, for each high-risk artificial intelligence system that makes or is a substantial factor in making any consequential decision that is adverse to any consumer, the deployer of such high-risk artificial intelligence system shall provide to such consumer: (i) A statement that discloses each principal reason for the consequential decision, including: (A) The degree to and manner in which the high-risk artificial intelligence system contributed to the consequential decision; (B) The type of data that was processed by the high-risk artificial intelligence system in making the consequential decision; and (C) Each source of the data described in subdivision (b)(i)(B) of this subsection; (ii) An opportunity to correct any incorrect personal data that the high-risk artificial intelligence system processed in making or processed as a substantial factor in making the consequential decision; and (iii) An opportunity to appeal any adverse consequential decision concerning the consumer arising from the deployment of the high-risk artificial intelligence system unless providing the opportunity for appeal is not in the best interest of the consumer, including instances when any delay might pose a risk to the life or safety of such consumer. Any such appeal shall allow for human review if technically feasible. (c)(i) Except as provided in subdivision (c)(ii) of this subsection, a deployer shall provide the notice, statement, contact information, and description required under subdivisions (4)(a) and (b) of this section: (A) Directly to the consumer; (B) In plain language; (C) In each language in which the deployer in the ordinary course of business provides any contract, disclaimer, sale announcement, or other information to any consumer; and (D) In a format that is accessible to any consumer with any disability. (ii) If the deployer is unable to provide the notice, statement, contact information, and description required under subdivisions (a) and (b) of this subsection directly to the consumer, the deployer shall make the notice, statement, contact information, and description available in a manner that is reasonably calculated to ensure that the consumer receives the notice, statement, contact information, and description.

(5)(a)–(b) 12 Except as provided in subsection (6) of this section, on and after February 1, 2026, a deployer shall make a statement with the following information available in a manner that is clear and readily available: (i) The types of high-risk artificial intelligence systems that are currently deployed by the deployer; (ii) How the deployer manages known risks of algorithmic discrimination that may arise from the deployment of the types of high-risk artificial intelligence systems described in subdivision (a)(ii) of this subsection; and (iii) A description of the nature, source, and extent of the information collected and used by the deployer. (b) A deployer shall update the statement described in subdivision (a) of this subsection at least once each year.

(6) Subsections (2), (3), and (5) of this section do not apply to a deployer if when deploying a high-risk artificial intelligence system and at all times while the high-risk artificial intelligence system is deployed: (a) The deployer: (i) Employs fewer than fifty full-time equivalent employees; and (ii) Does not use the deployer's own data to train the high-risk artificial intelligence system; (b) The high-risk artificial intelligence system: (i) Is used for any intended use that is disclosed to the deployer as required under subdivision (2)(a) of section 3 of this act; and (ii) Continues learning based on data derived from sources other than the deployer's own data; and (c) The deployer makes available to consumers any impact assessment that: (i) The developer of the high-risk artificial intelligence system has completed and provided to the deployer; and (ii) Includes information that is substantially similar to the information in the impact assessment required under subdivision (3)(b) of this section.

(7) Nothing in this section requires a deployer to disclose a trade secret or information protected from disclosure by state or federal law. To the extent that a deployer withholds information pursuant to this subsection or subsection (5) of section 6 of this act, the deployer shall notify the consumer and provide a basis for such withholding.

(8)(a)–(d) 13 On and after February 1, 2026, in connection with an ongoing investigation related to the deployer, the Attorney General may require any deployer or third party contracted by a deployer to disclose any of the following to the Attorney General no later than ninety days after such request in a form and manner prescribed by the Attorney General: (i) The risk management policy implemented pursuant to subsection (2) of this section; (ii) The impact assessment completed pursuant to subsection (3) of this section; or (iii) The records maintained pursuant to subdivision (3)(f) of this section. (b) If such risk management policy, impact assessment, or record is relevant to an investigation conducted by the Attorney General regarding a violation of the Artificial Intelligence Consumer Protection Act, the Attorney General may evaluate the risk management policy, impact assessment, or records disclosed pursuant to subdivision (a) of this subsection to ensure compliance with the Artificial Intelligence Consumer Protection Act. (c) Any disclosure under this subsection shall not be a public record subject to disclosure pursuant to sections 84-712 to 84-712.09. (d) A deployer may designate any statement or documentation disclosed under this subsection as including proprietary information or a trade secret.

(9) If a deployer completes documentation for the purpose of complying with another applicable law or regulation, such documentation shall be deemed to satisfy this section if such documentation is reasonably similar in scope and effect to the documentation that would otherwise be completed pursuant to this section.

Section 4 imposes the Act's core deployer-side obligations. Subsection (1) establishes the reasonable-care duty for deployers to protect consumers from known risks of algorithmic discrimination, with a rebuttable presumption tied to full compliance. Subsection (2) mandates a risk management policy and program, with a safe harbor for systems conforming to the NIST AI RMF or ISO/IEC 42001 as of January 1, 2025. Subsection (3) requires detailed impact assessments for each deployed high-risk AI system and following any intentional and substantial modification, with specified content requirements and a three-year record retention obligation. Subsection (4) imposes pre-decision consumer notifications and post-adverse-decision obligations including explanation of principal reasons, opportunity to correct data, and opportunity to appeal with human review. Subsection (5) requires a public transparency statement updated annually. Subsection (6) provides a small-deployer exemption (fewer than 50 employees, no proprietary training data, intended use, and developer impact assessment available). Subsection (8) authorizes AG investigative access to risk management policies, impact assessments, and records within 90 days of request.

Compliance actions 7 items

Deployers of high-risk AI systems must use reasonable care to protect consumers from each known risk of algorithmic discrimination. Compliance with all of Section 4's requirements creates a rebuttable presumption of reasonable care in AG enforcement actions.

H-02

Deployers must implement a risk management policy and program to govern their deployment of each high-risk AI system. A single policy may cover multiple high-risk systems. Systems conforming to the NIST AI Risk Management Framework or ISO/IEC 42001 as of January 1, 2025, are presumed to satisfy this requirement.

G-01.1

Deployers must complete an impact assessment for each high-risk AI system deployed on or after February 1, 2026, and within 90 days after any intentional and substantial modification. The impact assessment must include, to the extent reasonably known: (1) a statement disclosing the system's purpose, intended use cases, deployment context, and benefits; (2) an analysis of whether deployment poses known risks of algorithmic discrimination and the mitigation steps taken; (3) a high-level summary of input data categories and outputs; (4) if the deployer used data to customize the system, an overview of the customization data categories; (5) any performance evaluation metrics and known limitations; (6) a description of transparency measures including consumer disclosure of AI use; and (7) a description of post-deployment monitoring and user safeguards. Impact assessments following substantial modifications must also disclose whether the system was used consistently with the developer's intended use. A single impact assessment may address a comparable set of systems. Deployers must maintain: the most recent impact assessment for each system, all records concerning the assessment, and for at least three years following final deployment, each prior impact assessment and associated records.

H-02.3

Deployers must, prior to deploying a high-risk AI system to make or be a substantial factor in making any consequential decision concerning a consumer: (1) notify the consumer that a high-risk AI system will be used; (2) provide a statement disclosing the system's purpose and the nature of the consequential decision; (3) provide the deployer's contact information; (4) provide a plain-language description of the system; (5) provide instructions on how to access the deployer's public transparency statement; and (6) if applicable, inform the consumer of the right to opt out of processing of personal data for profiling in furtherance of legally significant decisions under Nebraska's data privacy law (section 87-1107(2)(e)(iii)).

H-01.3

Deployers must, for each high-risk AI system that makes or is a substantial factor in making an adverse consequential decision concerning a consumer, provide to that consumer: (1) a statement disclosing each principal reason for the decision, including the degree and manner in which the AI system contributed to the decision, the type of data processed, and each source of that data; (2) an opportunity to correct any incorrect personal data that the system processed in making or contributing to the decision; and (3) an opportunity to appeal the adverse decision, unless an appeal is not in the consumer's best interest (e.g., where delay would risk life or safety), with human review if technically feasible. All notices, statements, and descriptions must be provided directly to the consumer, in plain language, in each language the deployer ordinarily uses in business communications, and in a format accessible to consumers with disabilities. If direct provision is not possible, the deployer must make the information available in a manner reasonably calculated to ensure the consumer receives it.

H-01.1

Deployers must publish and maintain a clear and readily available public statement disclosing: (1) the types of high-risk AI systems currently deployed; (2) how the deployer manages known risks of algorithmic discrimination from those systems; and (3) a description of the nature, source, and extent of information collected and used by the deployer. The statement must be updated at least annually.

G-02.4

Deployers must, upon AG request in connection with an ongoing investigation, disclose the risk management policy, impact assessment, and/or maintained records to the Attorney General within 90 days, in a form and manner the AG prescribes. Disclosures are not public records. Deployers may designate materials as proprietary or trade secret.

R-02.2

Sec. 5

AI interaction disclosure

DeployerDeveloper

(1)–(2) 14 On and after February 1, 2026, and except as otherwise provided in subsection (2) of this section, a deployer or other developer that deploys, offers, sells, leases, licenses, gives, or otherwise makes available any artificial intelligence system that is intended to interact with any consumer shall include in the disclosure to each consumer who interacts with such artificial intelligence system that the consumer is interacting with an artificial intelligence system. (2) Disclosure is not required under subsection (1) of this section under any circumstance when it would be obvious to a reasonable person that the person is interacting with an artificial intelligence system.

Section 5 requires deployers and other developers that make available any AI system intended to interact with consumers to disclose to each consumer that the consumer is interacting with an AI system. This obligation applies to all AI systems — not just high-risk systems — but only when the system is intended to interact with a consumer. The obligation does not apply when it would be obvious to a reasonable person that they are interacting with an AI system.

Compliance actions 1 item

Deployers or other developers that make available any AI system intended to interact with consumers must disclose to each interacting consumer that the consumer is interacting with an AI system. This disclosure is not required when it would be obvious to a reasonable person that the person is interacting with an AI system.

T-01.1

Sec. 6

Exemptions and limitations

(1)–(10) The Artificial Intelligence Consumer Protection Act does not restrict the ability of any developer, deployer, or other person to: (a) Comply with federal, state, or municipal laws, ordinances, or regulations; (b) Comply with any civil, criminal, or regulatory inquiry, investigation, subpoena, or summons by any federal, state, municipal, or other governmental authority; (c) Cooperate with any law enforcement agency concerning conduct or activity that the developer, deployer, or other person reasonably and in good faith believes may violate any federal, state, or municipal law, ordinance, or regulation; (d) Investigate, establish, exercise, prepare for, or defend any legal claim; (e) Take immediate action to protect any interest that is essential for the life or physical safety of any consumer or another individual; (f) By any means: (i) Prevent, detect, protect against, or respond to any security incident, identity theft, fraud, harassment, malicious or deceptive activity, or illegal activity; (ii) Investigate, report, or prosecute any person responsible for any action described in subdivision (f)(i) of this subsection; or (iii) Preserve the integrity or security of any system of the developer, deployer, or other person; (g) Engage in public or peer-reviewed scientific or statistical research in the public interest that: (i) Adheres to each applicable ethics or privacy law; and (ii) Is conducted in accordance with 45 C.F.R. part 46, as such section existed on January 1, 2025, or any relevant requirement established by the federal Food and Drug Administration; (h) Conduct any research, testing, or development activity regarding any artificial intelligence system or model, other than testing conducted under real-world conditions, before the artificial intelligence system or model is placed on the market, deployed, or put into service; or (i) Provide assistance complying with the Artificial Intelligence Consumer Protection Act to any other developer, deployer, or person. (2) The Artificial Intelligence Consumer Protection Act does not restrict the ability of any developer, deployer, or other person to: (a) Effectuate a product recall; or (b) Identify and repair any technical error that impairs existing or intended functionality of any artificial intelligence system. (3) The Artificial Intelligence Consumer Protection Act does not apply to any instance in which compliance with such act would violate any evidentiary privilege under the laws of this state. (4) The Artificial Intelligence Consumer Protection Act does not and shall not be construed to impose any obligation on any developer, deployer, or other person that adversely affects any right or freedom of any person, including the rights of a personto freedom of speech or freedom of the press. (5) The Artificial Intelligence Consumer Protection Act does not apply to any developer, deployer, or other person: (a) If the developer, deployer, or other person develops, deploys, puts into service, or intentionally and substantially modifies any high-risk artificial intelligence system: (i) That has been approved, authorized, certified, cleared, developed, deployed, or granted by any federal agency acting within the scope of authority of such federal agency; or (ii) In compliance with standards established by any federal agency, if the standards are substantially equivalent or more stringent than the requirements of the Artificial Intelligence Consumer Protection Act; (b) Conducting research to support an application: (i) For approval or certification from any federal agency, federal administration, or federal commission; or (ii) That is subject to review by any federal agency, federal administration, or federal commission; (c) Performing work under or in connection with any contract with the United States Department of Commerce, the United States Department of Defense, or the National Aeronautics and Space Administration, unless such work relates to any high-risk artificial intelligence system that is used to make or is a substantial factor in making a decision concerning employment or housing; or (d) That is providing or facilitating any health care recommendation that: (i) Is generated by any artificial intelligence system; and (ii) Includes a health care provider in the process to implement the recommendation. (6) The Artificial Intelligence Consumer Protection Act does not apply to any artificial intelligence system that is acquired by or for the federal government or any federal agency or department, unless the artificial intelligence system is a high-risk artificial intelligence system that is used to make or is a substantial factor in making a decision concerning employment or housing. (7) The Artificial Intelligence Consumer Protection Act does not apply to any of the following that are subject to the Unfair Insurance Trade Practices Act: (a) Any insurer; (b) Any fraternal benefit society as described in section 44-1072; and (c) Any developer of an artificial intelligence system used by an insurer. (8)(a) For purposes of this subsection: (i) Affiliate has the same meaning as in section 8-916; (ii) Bank has the same meaning as in section 8-909; and (iii) Credit union has the same meaning as in section 21-1705. (b) The Artificial Intelligence Consumer Protection Act does not apply to any bank, credit union, affiliate or subsidiary of any bank or credit union, or service provider that is subject to examination by any state or federal prudential regulator under any published guidance or regulations that apply to the use of high-risk artificial intelligence systems and the guidance or regulations: (i) Impose requirements that are substantially equivalent to or more stringent than the requirements imposed in the Artificial Intelligence Consumer Protection Act as determined by the Attorney General; and (ii) At a minimum, require the bank, credit union, affiliate or subsidiary of the bank or credit union, or service provider to: (A) Regularly audit the use of any high-risk artificial intelligence system by the bank, credit union, or affiliate or subsidiary of the bank or credit union for compliance with state and federal antidiscrimination laws and regulations applicable to the bank, credit union, affiliate or subsidiary of the bank or credit union, or service provider; and (B) Mitigate any algorithmic discrimination caused by the use of any high-risk artificial intelligence system or any risk of algorithmic discrimination that is a result of the use of any high-risk artificial intelligence system. (9) If any developer, deployer, or other person engages in any action pursuant to an exemption set forth in this section, the developer, deployer, or other person bears the burden of demonstrating that the action qualifies for the exemption. (10) This section does not apply to: (a) Artificial intelligence systems, including their output, specifically developed and put into service for the sole purpose of scientific research and development; (b) A regulated entity subject to the supervision and regulation of the Federal Housing Finance Agency; or (c) A creditor as defined by and subject to the federal Equal Credit Opportunity Act, 15 U.S.C. 1691 et seq., or the regulations adopted pursuant to such act.

Section 6 provides an extensive set of exemptions and carve-outs from the Act's obligations. Subsection (1) preserves the ability to comply with other laws, cooperate with law enforcement, investigate legal claims, protect life safety, respond to security incidents, conduct public-interest research, perform pre-market R&D, and provide compliance assistance. Subsection (2) preserves product recall and error-repair abilities. Subsections (3)–(4) protect evidentiary privileges and free speech/press rights. Subsection (5) exempts systems approved by federal agencies, research supporting federal applications, certain federal contractor work (except employment/housing), and health care recommendations with provider involvement. Subsection (6) exempts federal government AI acquisitions (except employment/housing). Subsection (7) exempts insurers, fraternal benefit societies, and their AI developers if subject to the Unfair Insurance Trade Practices Act. Subsection (8) exempts banks, credit unions, and their affiliates subject to prudential regulator guidance substantially equivalent to the Act. Subsection (9) places the burden on the entity claiming an exemption. Subsection (10) excludes scientific R&D systems, FHFA-regulated entities, and ECOA creditors.

Sec. 7

Enforcement

(1)–(2) The Attorney General has exclusive authority to enforce the Artificial Intelligence Consumer Protection Act. (2) Except as provided in subsection (5) of this section, the Attorney General shall, prior to initiating any action for a violation of the Artificial Intelligence Consumer Protection Act, issue a notice of violation to the developer, deployer, or other person describing with specificity the alleged violation and the actions that shall be taken by the recipient of the notice to cure the violation. If the developer, deployer, or other person fails to cure such violation not later than ninety days after receipt of the notice of violation, the Attorney General may bring an action under the Artificial Intelligence Consumer Protection Act.

(3)–(4) In any action commenced by the Attorney General to enforce the Artificial Intelligence Consumer Protection Act, it is an affirmative defense that the developer, deployer, or other person: (a) Discovers and cures a violation of the Artificial Intelligence Consumer Protection Act as a result of: (i) Feedback that the developer, deployer, or other person encourages deployers or users to provide to the developer, deployer, or other person; (ii) Adversarial testing or red teaming; or (iii) An internal review process; and (b) Is otherwise in compliance with: (i) The Artificial Intelligence Risk Management Framework published by the National Institute of Standards and Technology and standard ISO/IEC 42001 of the International Organization for Standardization, as such framework and standard existed on January 1, 2025; (ii) Another nationally or internationally recognized risk management framework for artificial intelligence systems, if the standards are substantially equivalent to or more stringent than the requirements of the Artificial Intelligence Consumer Protection Act as determined by the Attorney General; or (iii) Any risk management framework for artificial intelligence systems designated and publicly disseminated by the Attorney General. (4) Any developer, deployer, or other person bears the burden of demonstrating to the Attorney General that the requirements of subsection (3) of this section have been satisfied.

(5)–(6) The Artificial Intelligence Consumer Protection Act shall not be construed to preempt or otherwise affect any right, claim, remedy, presumption, or defense available at law or in equity. (b) Any rebuttable presumption or affirmative defense under the Artificial Intelligence Consumer Protection Act applies only to an enforcement action brought by the Attorney General pursuant to this section and shall not apply to any right, claim, remedy, presumption, or defense available at law or in equity. (6) The Artificial Intelligence Consumer Protection Act does not provide the basis for and is not subject to any private right of action for any violation of the Artificial Intelligence Consumer Protection Act or any other law.

Section 7 establishes the enforcement framework. The Attorney General has exclusive enforcement authority. Before initiating any action, the AG must issue a notice of violation describing the alleged violation and required cure, with a 90-day cure period. An affirmative defense is available to developers, deployers, or other persons who discover and cure violations through user feedback, adversarial testing/red teaming, or internal review and are otherwise in compliance with the NIST AI RMF and ISO/IEC 42001, an equivalent risk management framework, or an AG-designated framework. The burden of proving the affirmative defense falls on the entity asserting it. The Act expressly does not provide the basis for any private right of action, but it does not preempt other rights, claims, remedies, presumptions, or defenses available at law or in equity. Rebuttable presumptions and affirmative defenses under the Act apply only to AG enforcement actions.

Sec. 8

Severability

If any section in this act or any part of any section is declared invalid or unconstitutional, the declaration shall not affect the validity or constitutionality of the remaining portions.

Standard severability provision. If any section or part of a section is declared invalid or unconstitutional, the remaining portions remain in effect.

Transparency AI identity disclosure · periodic reminders

1 item

T-01.1