Regulon — NM-HB-60 · NM HB 60 (Artificial Intelligence Act)

WHAT THIS BILL REGULATES · 8 REQUIREMENT TYPES

How Is This Bill Enforced

Enforcement Authority

State Department of Justice has primary enforcement authority upon promulgation of rules (required by January 1, 2027). Consumers may bring civil actions in district court for declaratory or injunctive relief and attorney fees. Violations are also unfair practices enforceable under the Unfair Practices Act. An affirmative defense is available in DOJ enforcement actions where the developer or deployer discovered and cured the violation through feedback, adversarial testing, red teaming, or internal review, and is in compliance with a DOJ-designated risk management framework.

Private Right of Action

may bring civil actions in district court for declaratory or injunctive relief and attorney fees.

Penalties

Consumers may obtain declaratory relief, injunctive relief, and attorney fees. No statutory damages are specified. Violations are also unfair practices enforceable under the Unfair Practices Act, which provides its own remedies. No punitive damages are explicitly made available under this act.

Verbatim statutory text on the left; plain-language analysis and a per-section checklist on the right. Numbered markers cross-link to the matching checklist row.

Statutory Text

Analysis & Obligations

Section 1

Short Title

This act may be cited as the "Artificial Intelligence Act".

Establishes the short title of the act as the "Artificial Intelligence Act." No compliance obligations are created.

Section 2

Definitions

A–P As used in the Artificial Intelligence Act: A. "algorithmic discrimination" means any condition in which the use of an artificial intelligence system results in an unlawful differential treatment or impact that disfavors a person on the basis of the person's actual or perceived age, color, disability, ethnicity, gender, genetic information, proficiency in the English language, national origin, race, religion, reproductive health, veteran status or other status protected by state or federal law, but does not include: (1) the offer, license or use of a high-risk artificial intelligence system by a developer or deployer for the sole purpose of: (a) the developer's or deployer's self-testing to identify, mitigate or ensure compliance with state and federal law; or (b) expanding an applicant, customer or participant pool to increase diversity or redress historical discrimination; or (2) an act or omission by or on behalf of a private club or other entity that is not open to the public pursuant to federal law; B. "artificial intelligence system" means any machine-based system that for an explicit or implicit objective infers from the inputs the system receives how to generate outputs, including content, decisions, predictions or recommendations, that can influence physical or virtual environments; C. "consequential decision" means a decision that has a material legal or similarly significant effect on the provision or denial to a consumer of or the cost or terms of: (1) education enrollment or an educational opportunity; (2) employment or an employment opportunity; (3) a financial or lending service; (4) health care service; (5) housing; (6) insurance; or (7) legal service; D. "consumer" means a resident of New Mexico; E. "deploy" means to use an artificial intelligence system; F. "deployer" means a person who deploys an artificial intelligence system; G. "developer" means a person who develops or intentionally and substantially modifies an artificial intelligence system; H. "health care services" means treatment, services or research designed to promote the improved health of a person, including primary care, prenatal care, dental care, behavioral health care, alcohol or drug detoxification and rehabilitation, hospital care, the provision of prescription drugs, preventive care or health outreach; I. "high-level summary" means information about the data and data sets used to train the high-risk artificial intelligence system, including: (1) the sources or owners of the data sets and whether the data sets were purchased or licensed by the developer; (2) the factors in the data, including attributes or other information about a consumer, that the system uses to produce its outputs, scores or recommendations; (3) the demographic groups represented in the data sets and the proportion of each age, ethnic, gender or racial group in each dataset; (4) a description of the types of data points within the data sets, including, for data sets that include labels, a description of the types of labels used; (5) whether the data sets include any data protected by copyright, trademark or patent or whether the data sets are entirely in the public domain; (6) whether there was any cleaning, processing or other modification to the data sets by the developer, including the intended purpose of those efforts in relation to the high-risk artificial intelligence system; (7) the time period during which the data in the data sets were collected, including a notice when data collection is ongoing; (8) the geographical regions or jurisdictions in which the data sets were collected, including whether the data sets were collected solely in New Mexico, solely in other states or in New Mexico in combination with other states; and (9) other information as required by the state department of justice by rule; J. "high-risk artificial intelligence system" means any artificial intelligence system that when deployed makes or is a substantial factor in making a consequential decision, but does not include: (1) an artificial intelligence system intended to: (a) perform a narrow procedural task; or (b) detect decision-making patterns or deviations from prior decision-making patterns and is not intended to replace or influence a previously completed human assessment without sufficient human review; or (2) the following technologies, unless the technologies make or are a substantial factor in making a consequential decision when the technologies are deployed: (a) anti-fraud technology that does not use facial recognition technology; (b) anti-malware; (c) antivirus; (d) artificial-intelligence-enabled video games; (e) calculators; (f) cybersecurity; (g) databases; (h) data storage; (i) firewalls; (j) internet domain registration; (k) internet website loading; (l) networking; (m) spam and robocall filtering; (n) spell checking; (o) spreadsheets; (p) web caching; (q) web hosting or similar technology; or (r) technology that communicates with consumers in natural language for the purpose of providing users with information, making referrals or recommendations and answering questions and is subject to an accepted use policy that prohibits generating content that is discriminatory or harmful; K. "intentional and substantial modification" and "intentionally and substantially modifies" means a deliberate change made to an artificial intelligence system that results in a new reasonably foreseeable risk of algorithmic discrimination, but does not include a change made to a high-risk artificial intelligence system or the performance of a high-risk artificial intelligence system when: (1) the high-risk artificial intelligence system continues to learn after the system is: (a) offered, sold, leased, licensed, given or otherwise made available to a deployer; or (b) deployed; (2) the change is made as a result of system learning after being made available to a deployer or being deployed; (3) the change was predetermined by the deployer or a third party contracted by the deployer when the deployer or third party completed an impact assessment of the high-risk artificial intelligence system pursuant to Section 6 of the Artificial Intelligence Act; or (4) the change is included in technical documentation for the high-risk artificial intelligence system; L. "offered or made available" includes a gift, lease, sale or other conveyance of an artificial intelligence system to a recipient deployer or a developer other than the original system developer; M. "recipient" means a deployer who has received an artificial intelligence system from a developer or a developer who has received an artificial intelligence system from another developer; N. "risk incident" means an incident when a developer discovers or receives a credible report from a deployer that a high-risk artificial intelligence system offered or made available by the developer has caused or is reasonably likely to have caused algorithmic discrimination; O. "substantial factor" means: (1) a factor that: (a) assists in making a consequential decision; (b) is capable of altering, advising or influencing the outcome of a consequential decision; and (c) is generated by an artificial intelligence system; or (2) content, decisions, labels, predictions, recommendations or scores generated by an artificial intelligence system concerning a consumer that are used as a basis, partial basis or recommendation to make a consequential decision concerning the consumer; and P. "trade secret" means information, including a formula, pattern, compilation, program, device, method, technique or process, that: (1) derives independent economic value, actual or potential, from not being generally known to and not being readily ascertainable by proper means by other persons who could obtain economic value from the information's disclosure or use; and (2) is the subject of efforts that are reasonable under the circumstances to maintain its secrecy.

Section 2 establishes the defined terms used throughout the Artificial Intelligence Act. Key definitions include algorithmic discrimination (unlawful differential treatment on the basis of protected characteristics), consequential decision (a decision with material legal or similar effect in education, employment, financial services, healthcare, housing, insurance, or legal services), high-risk artificial intelligence system (any AI system that makes or is a substantial factor in making a consequential decision, with extensive carve-outs for enumerated low-risk technologies), and high-level summary (a detailed nine-element training data disclosure).

The definition of high-risk AI system is notable for its broad chatbot carve-out: natural-language systems used for information, referrals, and recommendations are excluded when subject to an acceptable use policy prohibiting discriminatory or harmful content.

Section 3

Developer Duty of Care, Disclosure of Risk, and Provision of Documentation

Developer

A 1 A developer shall use reasonable care to protect consumers from known or foreseeable risks of algorithmic discrimination arising from intended and contracted uses of a high-risk artificial intelligence system;

B 2 except for information excluded pursuant to Subsection C of Section 4 of the Artificial Intelligence Act, make the following available to a recipient of the developer's high-risk artificial intelligence system: (1) a general summary describing the reasonably foreseeable uses and known harmful or inappropriate uses of the system; and (2) documentation disclosing: (a) the purpose, intended uses and benefits of the system; (b) a high-level summary of the type of data used to train the system; (c) known or reasonable foreseeable limitations of the system, including the risk of algorithmic discrimination arising from the intended use of the system; (d) how the system was evaluated for performance and mitigation of algorithmic discrimination prior to being offered or made available to the deployer, including: 1) the metrics of performance and bias that were used; 2) how the metrics were measured; 3) any independent studies carried out to evaluate the system for performance and risk of discrimination; and 4) whether the studies are publicly available or peer-reviewed; (e) the measures governing the data sets used to train the system, the suitability of data sources, possible biases and bias mitigation; (f) the intended outputs of the system; (g) the measures the developer has taken to mitigate known or reasonably foreseeable risks of algorithmic discrimination that are reasonably foreseeable from the use of the system; (h) how the system should be used and monitored by the deployer; (i) any additional information that is reasonably necessary to assist the deployer in understanding the outputs and monitoring the performance of the system for risks of algorithmic discrimination; and (j) any other information necessary to allow the deployer to comply with the requirements of this section;

C 3 except for information excluded pursuant to Subsection C of Section 4 of the Artificial Intelligence Act, to the extent feasible make available to the recipient the necessary information to conduct an impact assessment as required pursuant to Section 6 of the Artificial Intelligence Act. Such information shall include model cards, dataset cards or previous impact assessments relevant to the system, its development or use;

D–E 4 D. post on the developer's website in a clear and readily available manner a statement or public-use case inventory that summarizes: (1) the types of high-risk artificial intelligence systems that the developer has developed or intentionally and substantially modified and currently offers or makes available to recipients; and (2) how the developer manages known or reasonably foreseeable risks of algorithmic discrimination that may arise from the use or intentional and substantial modification of the systems listed on the developer's website pursuant to this subsection; and E. ensure that the statement or public-use case inventory posted pursuant to this section remains accurate and is updated within ninety days of an intentional and substantial modification of a high-risk artificial intelligence system offered or made available by the developer to recipients.

Section 3 imposes the bill's core developer-side obligations. Developers must exercise reasonable care to protect consumers from algorithmic discrimination risks arising from intended uses of high-risk AI systems. They must provide recipients (deployers) with detailed documentation covering intended uses, training data summaries, known limitations, bias evaluation methodology, data governance measures, intended outputs, discrimination mitigation steps, monitoring guidance, and all information the deployer needs for compliance.

Developers must also post a publicly available statement or use-case inventory on their website summarizing the types of high-risk AI systems they offer and how they manage algorithmic discrimination risk, and must update this inventory within 90 days of any intentional and substantial modification.

Compliance actions 4 items

Developers must use reasonable care to protect consumers from known or foreseeable risks of algorithmic discrimination arising from intended and contracted uses of a high-risk AI system.

H-02

Developers must provide recipients (deployers) with a general summary of foreseeable and harmful uses and detailed documentation covering purpose, training data summary, known limitations and discrimination risks, bias evaluation methodology, data governance measures, intended outputs, mitigation steps, monitoring guidance, and all information necessary for deployer compliance.

G-02.1

Developers must make available to recipients the information necessary for impact assessments, including model cards, dataset cards, and previous impact assessments relevant to the system.

T-03.3

Developers must post on their website a public-use case inventory summarizing the types of high-risk AI systems they offer, how they manage algorithmic discrimination risks, and must update it within 90 days of any intentional and substantial modification.

G-02.4

Section 4

Risk Incidents — Required Disclosure and Submission — Exceptions

Developer

A 5 Within ninety days of a risk incident and in a form and manner prescribed by the state department of justice, a developer shall disclose to the department and all known recipients of the high-risk artificial intelligence system that is the basis of the risk incident the known and foreseeable risks of algorithmic discrimination that may arise from the intended uses of the system.

B 6 Within ninety days of a request by the state department of justice, a developer shall submit to the department a copy of the summary and documentation the developer has made available to recipients pursuant to Section 3 of the Artificial Intelligence Act. A developer may designate the summary or documentation as including proprietary information or a trade secret. To the extent that information contained in the summary or documentation includes information subject to attorney-client privilege or work-product protection, compliance with this section does not constitute a waiver of the privilege or protection.

C As part of a disclosure, notice or submission pursuant to the Artificial Intelligence Act, a developer shall not be required to disclose a trade secret, information protected from disclosure by state or federal law or information that would create a security risk to the developer. Such disclosure, notice or submission shall be exempt from disclosure pursuant to the Inspection of Public Records Act.

Section 4 requires developers to report risk incidents — instances where a high-risk AI system has caused or is reasonably likely to have caused algorithmic discrimination — to both the State Department of Justice and all known deployer-recipients within 90 days. Developers must also produce documentation to the DOJ within 90 days of a request, with protections for trade secrets, attorney-client privilege, and work-product. A developer is not required to disclose trade secrets, information protected by state or federal law, or information that would create a security risk; such materials are exempt from the Inspection of Public Records Act.

Compliance actions 2 items

Developers must, within 90 days of a risk incident, disclose to the State Department of Justice and all known deployer-recipients the known and foreseeable risks of algorithmic discrimination arising from the intended uses of the system involved.

R-01.3

Developers must submit to the State Department of Justice within 90 days of a request a copy of the summary and documentation previously made available to deployer-recipients, with trade secret and privilege protections preserved.

R-02.2

Section 5

Deployer Risk-Management Policy Required

Deployer

A 7 A deployer shall use reasonable care to protect consumers from known or reasonably foreseeable risks of algorithmic discrimination.

B–C 8 B. A deployer shall implement a risk management policy and program to govern the deployer's deployment of a high-risk artificial intelligence system. The risk management policy and program shall: (1) specify and incorporate the principles, processes and personnel that the deployer uses to identify, document and mitigate known or reasonably foreseeable risks of algorithmic discrimination; and (2) be an iterative process planned, implemented and regularly and systematically updated over the life cycle of a high-risk artificial intelligence system and include regular systematic review and updates. C. A risk management policy shall meet standards established by the state department of justice by rule.

Section 5 imposes a general duty of reasonable care on deployers and requires them to implement a risk management policy and program governing their deployment of high-risk AI systems. The program must specify principles, processes, and personnel for identifying, documenting, and mitigating algorithmic discrimination risks, and must be iterative, regularly reviewed, and systematically updated over the system's lifecycle. The policy must also meet standards to be established by the State Department of Justice by rule.

Compliance actions 2 items

Deployers must use reasonable care to protect consumers from known or reasonably foreseeable risks of algorithmic discrimination.

H-02

Deployers must implement a risk management policy and program that specifies principles, processes, and personnel for identifying, documenting, and mitigating algorithmic discrimination risks, must be iterative and regularly updated over the system lifecycle, and must meet standards established by DOJ rule.

G-01.1

Section 6

Deployer Impact Assessments

Deployer

A–B 9 A. Except as provided in Subsections D, E and H of this section, a deployer shall conduct an impact assessment for any high-risk artificial intelligence system deployed by the deployer: (1) annually; and (2) within ninety days of an intentional and substantial modification to the system. B. An impact assessment of a high-risk artificial intelligence system completed pursuant to this section shall include, to the extent reasonably known by or available to the deployer: (1) a statement of the intended uses, deployment contexts and benefits of the system; (2) an analysis of any known or reasonably foreseeable risks of algorithmic discrimination posed by the system, and when a risk exists, the nature of the algorithmic discrimination and the steps that have been taken to mitigate the risk; (3) a description of the categories of data the system processes as inputs and the outputs the system produces; (4) a summary of categories of any data used to customize the system; (5) the metrics used to evaluate the performance and known limitations of the system, including: (a) whether the evaluation was carried out using test data; (b) whether the test data sets were collected solely in New Mexico, solely in other states or in New Mexico in combination with other states; (c) the demographic groups represented in the test data sets and the proportion of each age, ethnic, gender or racial group in each data set; and (d) any independent studies carried out to evaluate the system for performance and risk of discrimination and whether the studies are publicly available or peer-reviewed; (6) a description of any transparency measures taken concerning the system, including measures taken to disclose to a consumer when the system is in use; and (7) a description of the post-deployment monitoring and user safeguards provided for the system, including oversight, use and learning processes used by the deployer to address issues arising from deployment of the system.

C 9 An impact assessment conducted due to an intentional and substantial modification of a high-risk artificial intelligence system shall include a disclosure of the extent to which the system was used in a manner consistent with, or that varied from, the developer's intended uses of the system.

D 9 A deployer may use a single impact assessment to address a set of comparable high-risk artificial intelligence systems.

E 9 An impact assessment conducted for the purpose of complying with another applicable law or rule shall satisfy the requirement of this section when the assessment: (1) meets the requirements of this section; and (2) is reasonably similar in scope and effect to an assessment that would otherwise be conducted pursuant to this section.

F 10 For at least three years following the final deployment of a high-risk artificial intelligence system, a deployer shall maintain records of the most recently conducted impact assessment for the system, including all records concerning the assessment and all prior assessments for the system.

G 11 On or before March 1, 2027, a deployer shall review each high-risk artificial intelligence system that the deployer has deployed to ensure that the system is not causing algorithmic discrimination.

H 9 This section is not applicable when: (1) a deployer using a high-risk artificial intelligence system: (a) employs fewer than fifty full-time employees; (b) does not use the deployer's own data to train the system; (c) uses the system solely for the system's intended uses as disclosed by a developer pursuant to the Artificial Intelligence Act; and (d) makes any impact assessment of the system that has been provided by the developer pursuant to the Artificial Intelligence Act available to consumers; and (2) the system continues learning based on data derived from sources other than the deployer's own data.

Section 6 requires deployers to conduct impact assessments for each deployed high-risk AI system annually and within 90 days of an intentional and substantial modification. The assessment must cover intended uses, algorithmic discrimination risks and mitigation, input and output data categories, customization data, performance evaluation metrics (including demographic test data breakdowns and independent studies), transparency measures, and post-deployment monitoring safeguards. Deployers must retain all assessment records for at least three years following final deployment. By March 1, 2027, deployers must review all already-deployed high-risk systems to confirm they are not causing algorithmic discrimination.

Small deployers (fewer than 50 employees, not using their own data to train, using the system solely for intended purposes, and making developer-provided assessments available to consumers) are exempt, provided the system continues learning from non-deployer data sources.

Compliance actions 3 items

Deployers must conduct an impact assessment for each deployed high-risk AI system (1) annually and (2) within 90 days of an intentional and substantial modification, covering intended uses, discrimination risks and mitigation, data categories, performance metrics including demographic test data breakdowns, transparency measures, and post-deployment monitoring. A single assessment may cover comparable systems. An exempt small deployer (fewer than 50 employees, no own-data training, intended-use-only deployment, consumer-accessible developer assessment) is excused.

H-02.3

Deployers must retain impact assessment records — including the most recent assessment, all supporting records, and all prior assessments — for at least three years following final deployment of a high-risk AI system.

H-02.10

Deployers must review each deployed high-risk AI system by March 1, 2027 to ensure it is not causing algorithmic discrimination.

H-02.8

Section 7

Deployer General Notice to Consumers

Deployer

A–B 12 A. A deployer shall make readily available to its consumers and on its website: (1) a summary of the types of high-risk artificial intelligence systems that the deployer currently deploys and how known or reasonably foreseeable risks of algorithmic discrimination from the deployment of each system are managed; and (2) a detailed explanation of the nature, source and extent of the information collected and used by the deployer. B. At a minimum, a deployer shall update the information posted on its website pursuant to this section annually and when the deployer deploys a new high-risk artificial intelligence system.

Section 7 requires deployers to publish and maintain on their website a summary of the types of high-risk AI systems they deploy, how they manage algorithmic discrimination risks, and a detailed explanation of the information they collect and use. This disclosure must be updated at least annually and whenever a new high-risk AI system is deployed.

Compliance actions 1 item

Deployers must publish on their website and make readily available to consumers (1) a summary of deployed high-risk AI systems and how algorithmic discrimination risks are managed, and (2) a detailed explanation of the information collected and used. The disclosure must be updated at least annually and upon deployment of a new high-risk AI system.

G-02.4

Section 8

Use of AI Systems When Making Consequential Decisions — Notice, Adverse Decisions, and Appeal

Deployer

A 13 Except as provided in Subsection E of this section, before a high-risk artificial intelligence system is used to make or is a substantial factor in making a consequential decision concerning a consumer, a deployer shall provide directly to the consumer: (1) notice that the system will be used to make or be a substantial factor in making the decision; and (2) information describing: (a) the system and how to access the deployer's notice required pursuant to Section 7 of the Artificial Intelligence Act; (b) the purpose of the system and the nature of the consequential decision being made; and (c) the deployer's contact information.

B 14 Except as provided in Subsection E of this section, when a high-risk artificial intelligence system has been used to make or has been a substantial factor in making a consequential decision concerning a consumer that is adverse to the consumer, the deployer shall provide directly to the consumer: (1) a statement explaining: (a) the principal reason or reasons for the decision; (b) the degree and manner in which the system contributed to the decision; and (c) the source and type of data that was processed by the system to make or that was a substantial factor in making the decision; (2) an opportunity to correct any incorrect personal data that the system processed to make or that was a substantial factor in making the decision; and (3) an opportunity to appeal the adverse decision except in instances where an appeal is not in the best interest of the consumer, such as creating a delay that may pose a risk of life or safety to the consumer.

C 14 If technically feasible, an appeal of an adverse decision pursuant to this section shall allow for human review.

D 13 All information, notices and statements to a consumer as required by this section shall be provided: (1) in plain language and in all languages in which the deployer in the ordinary course of business provides contracts, disclaimers, sale announcements and other information to consumers; and (2) in a format that is accessible to consumers with disabilities.

E 13 When a deployer is unable to provide information, notice or a statement required pursuant to this section directly to a consumer, the deployer shall make such information, notices or statements available in a manner that is reasonably calculated to ensure that the consumer receives the information, notice or statement.

Section 8 establishes the bill's core consumer-facing notice and individual-rights framework for consequential automated decisions. Before a high-risk AI system is used in a consequential decision, deployers must directly notify the consumer that AI will be used, describe the system and its purpose, and provide contact information. After an adverse consequential decision, deployers must explain the principal reasons, the AI system's contribution, the data processed, and must offer the consumer the opportunity to correct incorrect personal data and to appeal (with human review if technically feasible). All notices must be in plain language, in all business languages, and accessible to persons with disabilities. When direct notice is impracticable, deployers must use a method reasonably calculated to reach the consumer.

Compliance actions 2 items

Deployers must, before using a high-risk AI system to make or substantially factor in a consequential decision, directly notify the consumer that the system will be used, describe the system and its purpose, explain how to access the deployer's public notice, and provide the deployer's contact information. All notices must be in plain language, in all business languages, and accessible to consumers with disabilities.

H-01.3

Deployers must, after an adverse consequential decision, provide the consumer with (1) an explanation of the principal reasons, the degree and manner of AI contribution, and the source and type of data processed, (2) an opportunity to correct incorrect personal data, and (3) an opportunity to appeal with human review if technically feasible.

H-01.1

Section 9

Use of High-Risk AI System — Notice and Disclosure to the State Department of Justice

Deployer

A 15 When a deployer discovers that a high-risk artificial intelligence system that has been used has caused algorithmic discrimination, the deployer shall as expeditiously as possible but at a maximum within ninety days notify the state department of justice of the discovery. The notice shall be in a form and manner prescribed by the department.

B 16 Upon request by the state department of justice, a deployer shall within ninety days submit to the state department of justice any risk management policy, impact assessment or records conducted, implemented, maintained or received pursuant to the Artificial Intelligence Act. The submission shall be in a form and manner prescribed by the department.

C The state department of justice may evaluate risk management policies, impact assessments or records submitted pursuant to this section for compliance with the Artificial Intelligence Act.

D–E D. A risk management policy, impact assessment or record submitted to the state department of justice pursuant to this section is exempt from disclosure pursuant to the Inspection of Public Records Act. E. In a submission pursuant to this section, a deployer may designate a portion of the submission as including proprietary information or a trade secret and to the extent that a submission contains information subject to attorney-client privilege or work-product protection, the submission does not constitute a waiver of the privilege or protection.

Section 9 imposes deployer-side reporting obligations to the State Department of Justice. When a deployer discovers that a deployed high-risk AI system has caused algorithmic discrimination, it must notify the DOJ within 90 days. Upon request, deployers must produce risk management policies, impact assessments, and related records within 90 days. Submissions are exempt from the Inspection of Public Records Act, and deployers may designate portions as proprietary or trade-secret materials with attorney-client privilege and work-product protections preserved.

Compliance actions 2 items

Deployers must notify the State Department of Justice as expeditiously as possible but within 90 days of discovering that a deployed high-risk AI system has caused algorithmic discrimination.

R-01.3

Deployers must submit to the State Department of Justice within 90 days of a request any risk management policy, impact assessment, or records conducted, implemented, maintained, or received under the Act, with trade secret designations preserved.

R-02.2

Section 10

Interaction of AI System with Consumers — Required Disclosure

Developer

17 A developer that offers or makes available an artificial intelligence system intended to interact with consumers shall ensure that a consumer is informed that the consumer is interacting with an artificial intelligence system. This section does not apply when it would be obvious to a reasonable person that the consumer is interacting with an artificial intelligence system.

Section 10 requires developers who offer or make available an AI system intended to interact with consumers to ensure those consumers are informed they are interacting with an AI system. The obligation applies to developers, not deployers, and is excused when it would be obvious to a reasonable person that the consumer is interacting with an AI system.

Compliance actions 1 item

Developers must ensure that consumers interacting with an AI system are informed they are interacting with artificial intelligence, unless it would be obvious to a reasonable person.

T-01.1

Section 11

Exemption from Disclosure — Trade Secrets and Other Protected Information — Notice to Consumer

DeployerDeveloper

A Nothing in the Artificial Intelligence Act shall require a deployer or developer to disclose a trade secret or other information protected from disclosure by state or federal law.

B 18 To the extent that a deployer or developer withholds information pursuant to this section that would otherwise be part of a disclosure pursuant to the Artificial Intelligence Act, the deployer or developer shall notify a consumer and provide a basis for the withholding.

Section 11 provides a trade-secret savings clause: no disclosure under the Act requires revealing trade secrets or information protected by state or federal law. However, when information is withheld, the deployer or developer must notify the consumer and provide a basis for the withholding. This creates a notice obligation when trade-secret exemptions are invoked.

Compliance actions 1 item

Developers and deployers who withhold information under the trade-secret exemption must notify the consumer and provide a basis for the withholding.

—

Section 12

Applicability Exemptions — Other Law, Security and Testing, Federal Use, Insurance Providers

A–I A. No provision of the Artificial Intelligence Act shall be construed to restrict a person's ability to: (1) comply with federal, state or municipal laws or regulations; (2) comply with a civil, criminal or regulatory inquiry, investigation, subpoena or summons by a governmental authority; (3) cooperate with a law enforcement agency concerning activity that the person reasonably and in good faith believes may violate other laws or regulations; (4) defend, exercise or investigate legal claims; (5) act to protect an interest that is essential for the life or physical safety of a person; (6) by means other than the use of facial recognition technology: (a) detect, prevent, protect against or respond to deceptive, illegal or malicious activity, fraud, identity theft, harassment or security incidents; or (b) investigate, prosecute or report persons responsible for the actions listed in Subparagraph (a) of this paragraph; (7) preserve the integrity or security of artificial intelligence, computer, electronic or internet connection systems; (8) engage in public or peer-reviewed scientific or statistical research that adheres to and is conducted in accordance with applicable federal and state law; (9) engage in pre-market testing other than testing conductedunder real-world conditions, including development, research and testing of artificial intelligence systems; or (10) assist another person with compliance with the Artificial Intelligence Use Act. B. No provision of the Artificial Intelligence Act shall be construed to restrict: (1) a product recall; or (2) identification or repair of technical errors that impair the functionality of an artificial intelligence system. C. The Artificial Intelligence Act shall not apply in circumstances where compliance would violate an evidentiary privilege pursuant to law. D. No provision of the Artificial Intelligence Act shall be construed so as to limit a person's rights to free speech or freedom of the press pursuant to the first amendment to the United States constitution or Article 2, Section 17 of the constitution of New Mexico. E. The Artificial Intelligence Act shall not apply to a developer, deployer or other person who: (1) uses or intentionally and substantially modifies a high-risk artificial intelligence system that: (a) has been authorized by a federal agency in accordance with federal law; and (b) is in compliance with standards established by a federal agency in accordance with federal law when such standards are substantially equivalent or more stringent than the requirements of the Artificial Intelligence Act; (2) conducts research to support an application for certification or review by a federal agency pursuant to federal law; (3) performs work under or in connection with a contract with a federal agency, unless the work is on a high-risk artificial intelligence system used to make or as a substantial factor in making a decision concerning employment or housing; or (4) is a covered entity pursuant to federal health insurance law and is providing health care recommendations: (a) generated by an artificial intelligence system; (b) that require a health care provider to take action to implement the recommendations; and (c) that are not considered to be high risk. F. The Artificial Intelligence Act shall not apply to an artificial intelligence system acquired by the federal government, except for a high-risk artificial intelligence system used to make or as a substantial factor in making a decision concerning employment or housing. G. A financial institution or affiliate or subsidiary of a financial institution that is subject to prudential regulation by another state or by the federal government pursuant to laws that apply to the use of high-risk artificial intelligence systems shall be deemed to be in compliance with the Artificial Intelligence Act when the applicable laws: (1) impose requirements that are substantially equivalent to or more stringent than the requirements imposed by the Artificial Intelligence Act; and (2) at a minimum, require the financial institution to: (a) regularly audit the institution's use of high-risk artificial intelligence systems for compliance with state and federal antidiscrimination laws; and (b) mitigate any algorithmic discrimination caused by the use of a high-risk artificial intelligence system. H. As used in this section, "financial institution" means an insured state or national bank, a state or federal savings and loan association or savings bank, a state or federal credit union or authorized branches of each of the foregoing. I. A developer, deployer or other person who engages in an action pursuant to an exemption set forth in this section shall bear the burden of demonstrating that the action qualifies for the exemption.

Section 12 sets out extensive applicability exemptions. The Act does not restrict compliance with other laws, law enforcement cooperation, legal defenses, life-safety actions, security activities (excluding facial recognition), system integrity preservation, peer-reviewed research, pre-market testing, or product recalls. It does not apply to federally authorized systems meeting substantially equivalent standards, research for federal certification, federal contractor work (except employment/housing), covered HIPAA entities providing non-high-risk AI healthcare recommendations requiring provider action, or AI systems acquired by the federal government (except for employment/housing). Prudentially regulated financial institutions subject to substantially equivalent federal or state AI laws are deemed compliant. Persons claiming exemptions bear the burden of proof.

Section 13

Enforcement — State Department of Justice — Consumer Civil Actions

A Upon the promulgation of rules pursuant to Section 14 of the Artificial Intelligence Act: (1) the state department of justice shall have authority to enforce that act; and (2) a consumer may bring a civil action in district court against a developer or deployer for declaratory or injunctive relief and attorney fees for a violation of that act.

B–C B. In an action by the state department of justice to enforce the Artificial Intelligence Act, it is an affirmative defense when: (1) the developer, deployer or other person discovers and cures a violation of the Artificial Intelligence Act as a result of: (a) feedback that the developer, deployer or other person encourages the deployer or users to provide; or (b) adversarial testing, red teaming or an internal review process; and (2) the developer, deployer or other person is in compliance with a risk management framework for artificial intelligence systems designated by the state department of justice by rule. C. In an action by the state department of justice to enforce the Artificial Intelligence Act, the developer, deployer or other person who is the subject of the enforcement shall bear the burden of demonstrating that the requirements for an affirmative defense pursuant to this section have been met.

D–G D. Nothing within the Artificial Intelligence Act, including the enforcement authority granted to the state department of justice pursuant to this section, preempts or otherwise affects any right, claim, remedy, presumption or defense available in law or equity. E. An affirmative defense or rebuttable presumption established by the Artificial Intelligence Act applies only to an enforcement action by the state department of justice and does not apply to any right, claim, remedy, presumption or defense available in law or equity. F. A violation of the Artificial Intelligence Act is an unfair practice and may be enforced pursuant to the Unfair Practices Act. G. As used in this section: (1) "adversarial testing" means to proactively try to break an application by providing it with data most likely to elicit problematic output, or as defined by the state department of justice by rule; and (2) "red teaming" means the practice of simulating attack scenarios on an artificial intelligence application to pinpoint weaknesses and plan preventive measures or as defined by the state department of justice by rule.

Section 13 establishes the enforcement framework. Upon promulgation of rules by the DOJ (required by January 1, 2027), the Department has authority to enforce the Act, and consumers may bring civil actions for declaratory or injunctive relief and attorney fees. An affirmative defense is available in DOJ enforcement actions where the entity discovered and cured the violation through user feedback, adversarial testing, red teaming, or internal review, and is in compliance with a DOJ-designated AI risk management framework. The burden of proving the affirmative defense rests on the defendant. Violations are also unfair practices enforceable under the Unfair Practices Act. The Act does not preempt other legal rights, claims, or remedies, and affirmative defenses apply only to DOJ enforcement actions, not to other causes of action.

Section 14

Rulemaking

On or before January 1, 2027, the state department of justice shall promulgate rules to implement the Artificial Intelligence Act and shall post them prominently on the state department of justice's website.

Section 14 requires the State Department of Justice to promulgate implementing rules by January 1, 2027 and post them prominently on the DOJ website. This is a prerequisite to enforcement under Section 13.

Section 15

Effective Date

The effective date of the provisions of this act is July 1, 2026.

The effective date of all provisions of the Act is July 1, 2026.

Transparency AI identity disclosure · periodic reminders

2 items

T-03.3

Developers must make available to recipients the information necessary for impact assessments, including model cards, dataset cards, and previous impact assessments relevant to the system.

T-01.1

Developers must ensure that consumers interacting with an AI system are informed they are interacting with artificial intelligence, unless it would be obvious to a reasonable person.

Human Oversight Decision review · appeal pathways

7 items

H-02

Developers must use reasonable care to protect consumers from known or foreseeable risks of algorithmic discrimination arising from intended and contracted uses of a high-risk AI system.

H-02

Deployers must use reasonable care to protect consumers from known or reasonably foreseeable risks of algorithmic discrimination.

H-02.3

H-02.10

H-02.8

Beginning Mar 1, 2027 Deployers must review each deployed high-risk AI system by March 1, 2027 to ensure it is not causing algorithmic discrimination.

H-01.3

H-01.1

Governance Risk management · accountability programs

4 items

G-02.1

G-02.4

G-01.1

G-02.4

Regulatory Reporting · disclosure · audit

4 items

R-01.3

R-02.2

R-01.3

Deployers must notify the State Department of Justice as expeditiously as possible but within 90 days of discovering that a deployed high-risk AI system has caused algorithmic discrimination.

R-02.2

—

Other

1 item

—

Developers and deployers who withhold information under the trade-secret exemption must notify the consumer and provide a basis for the withholding.

Passage Likelihood

Failed

Status Failed

Final action HJC: Reported by committee with Do Not Pass but with a Do Pass recommendation on Committee Substitution

Legislative History

2025-01-21 Sent to HPREF - Referrals: HPREF

2025-01-22 Sent to HCPAC - Referrals: HCPAC/HJC

2025-02-03 HCPAC: Reported by committee with Do Pass recommendation

2025-02-25 HJC: Reported by committee with Do Not Pass but with a Do Pass recommendation on Committee Substitution

Sources

Full Text ↗

Entry Last Reviewed

2026-05-20

AI generated