§ 1711. Professional oversight requirement. 1. Any developer of an artificial intelligence technology intended for use in a professional domain regulated under title eight of the education law shall demonstrate that at least one professional domain expert has been directly and substantially involved in at least, but not limited to: (a) the technology design phase; (b) the data selection and training process; (c) validation and testing of system outputs; and (d) ongoing risk assessment and post-deployment evaluation. 2. The provisions of subdivision one of this section shall apply to artificial intelligence technology used in areas such as, but not limited to: (a) health care diagnostics, treatment recommendations, or patient monitoring; (b) legal decision-making or document generation; (c) financial advising or lending tools; (d) educational curriculum or assessment tools; (e) construction, architecture, or structural safety systems; and (f) public safety, law enforcement, or surveillance technologies.

§ 1712. Documentation and compliance. 1. Developers of artificial intelligence technologies shall submit documentation to the attorney general affirming: (a) The identities and qualifications of professional domain experts involved in the AI technology, pursuant to section seventeen hundred eleven of this article; (b) The specific phases of development in which such professional domain experts contributed; and (c) Any known risks, limitations, or ethical concerns disclosed during development. 2. The attorney general or a duly authorized representative of the attorney general shall issue certificates of compliance to developers who have submitted documentation pursuant to subdivision one of this section and are found to be in compliance. Any technology and developers found to be not in compliance may be subject to investigation and penalties pursuant to section seventeen hundred thirteen of this article.

§ 1713. Enforcement. 1. The attorney general shall have exclusive authority to enforce the provisions of this article. 2. Nothing in this article shall be construed as providing the basis for a private right of action for violations of the provisions of this article. 3. A violation of the requirements established in this article shall constitute an unfair trade practice for purposes of section three hundred forty-nine of this chapter and shall be enforced solely by the attorney general; provided, however, that subdivision (h) of section three hundred forty-nine of this chapter shall not apply to any such violation. 4. (a) In any action commenced by the attorney general for any violation of this article, it shall be an affirmative defense that the developer, deployer, or other person: (i) discovers a violation of any provision of this article through red-teaming; (ii) no later than sixty days after discovering such violation through red-teaming: (A) cures such violation; and (B) provides to the attorney general, in a form and manner prescribed by the attorney general, notice that such violation has been cured and evidence that any harm caused by such violation has been mitigated; and (iii) is otherwise in compliance with the latest version of: (A) the Artificial Intelligence Risk Management Framework published by the national institute of standards and technology; (B) ISO/IEC 42001 of the international organization for standardization and the international electrotechnical commission; (C) a nationally or internationally recognized risk management framework for artificial intelligence decision technology, other than the risk management frameworks described in clauses (A) and (B) of this subparagraph, that imposes requirements that are substantially equivalent to, and at least as stringent as, the requirements established pursuant to this article; or (D) any risk management framework for artificial intelligence decision technology that is substantially equivalent to, and at least as stringent as, the risk management frameworks described in clauses (A), (B), and (C) of this subparagraph. (b) The developer, deployer, or other person bears the burden of demonstrating to the attorney general that the requirements established pursuant to paragraph (a) of this subdivision have been satisfied. (c) Nothing in this article, including, but not limited to, the enforcement authority granted to the attorney general pursuant to this section, shall be construed to preempt or otherwise affect any right, claim, remedy, presumption, or defense available at law or in equity. Any rebuttable presumption or affirmative defense established pursuant to this article shall apply only to an enforcement action brought by the attorney general pursuant to this section and shall not apply to any right, claim, remedy, presumption, or defense available at law or in equity. 3. Any developer found to be in violation of this article may be subject to: (a) Civil penalties not to exceed fifty thousand dollars per violation; (b) Injunctive relief to halt deployment of an AI technology; or (c) Public disclosure of non-compliant practices.

§ 1714. Rulemaking authority. The attorney general shall promulgate such rules and regulations as are necessary to effectuate and enforce the provisions of this article.