1 It shall be an unlawful discriminatory practice for a developerDeveloper"Developer" means a person, partnership, or corporation that trained or initiated the training of an AI system, or creates a substantial change with respect to an AI system, whether for its own use in the state of New York or for use by a third party. A deployer may also be considered a developer if its actions satisfy this definition.Civil Rights Law § 105(8) or deployerDeployer"Deployer" means any person, partnership, association or corporation that uses or makes an AI system available to one or more third parties including the general public for use, modification, copying, or a combination thereof with their software. A deployer shall not include any natural person using an AI system for personal use. A developer may also be considered a deployer if its actions satisfy this definition.Civil Rights Law § 105(6) to fail to take reasonable care to prevent foreseeable risk of algorithmic discriminationAlgorithmic discrimination"Algorithmic discrimination" means any condition in which the use of an AI system contributes to unjustified differential treatment or impacts, disfavoring people based on their actual or perceived age, race, ethnicity, creed, religion, color, national origin, citizenship or immigration status, sexual orientation, gender identity, gender expression, military status, sex, disability, predisposing genetic characteristics, familial status, marital status, status as a victim of domestic violence or other classification protected under state or federal laws. Algorithmic discrimination shall not include: (a) a developer's or deployer's testing of their own AI system to identify, mitigate, and prevent discriminatory bias; (b) expanding an applicant, customer, or participant pool to increase diversity or redress historical discrimination; or (c) an act or omission by or on behalf of a private club or other establishment that is not in fact open to the public, as set forth in Title II of the federal Civil Rights Act of 1964, 42 U.S.C. section 2000a(e), as amended.Civil Rights Law § 105(1) that is a consequence of the use, sale, or sharing of a high-risk AI systemHigh-risk AI system"High-risk AI system" means any AI system that, when deployed: (a) is a substantial factor in making a consequential decision; or (b) will have a material impact on the statutory or constitutional rights, civil liberties, safety, or welfare of an individual in the state.Civil Rights Law § 105(14) or a product featuring a high-risk AI systemHigh-risk AI system"High-risk AI system" means any AI system that, when deployed: (a) is a substantial factor in making a consequential decision; or (b) will have a material impact on the statutory or constitutional rights, civil liberties, safety, or welfare of an individual in the state.Civil Rights Law § 105(14).

1 This article applies to developersDeveloper"Developer" means a person, partnership, or corporation that trained or initiated the training of an AI system, or creates a substantial change with respect to an AI system, whether for its own use in the state of New York or for use by a third party. A deployer may also be considered a developer if its actions satisfy this definition.Civil Rights Law § 105(8) and deployersDeployer"Deployer" means any person, partnership, association or corporation that uses or makes an AI system available to one or more third parties including the general public for use, modification, copying, or a combination thereof with their software. A deployer shall not include any natural person using an AI system for personal use. A developer may also be considered a deployer if its actions satisfy this definition.Civil Rights Law § 105(6) that conduct business in New York or produce products or services that are targeted to residents of New York.

2 This article does not apply to any developerDeveloper"Developer" means a person, partnership, or corporation that trained or initiated the training of an AI system, or creates a substantial change with respect to an AI system, whether for its own use in the state of New York or for use by a third party. A deployer may also be considered a developer if its actions satisfy this definition.Civil Rights Law § 105(8) or deployerDeployer"Deployer" means any person, partnership, association or corporation that uses or makes an AI system available to one or more third parties including the general public for use, modification, copying, or a combination thereof with their software. A deployer shall not include any natural person using an AI system for personal use. A developer may also be considered a deployer if its actions satisfy this definition.Civil Rights Law § 105(6) that is: (a) the New York state government, including any department, public authority, board, bureau, commission, division, office, council, committee or officer of the state; (b) a local government, including any county, city, town, village, school district, board of cooperative educational services, county vocational education and extension board, district corporation or municipal corporation; or (c) the state university of New York, the city university of New York or a community college.

1 2 Any covered deployerCovered deployer"Covered deployer" means a deployer that uses a high-risk AI system to make one or more consequential decisions with respect to covered subjects.Civil Rights Law § 105(5) shall inform the covered subjectCovered subject"Covered subject" means any individual or group of individuals that is the subject of a consequential decision made entirely by or with the assistance of an AI system.Civil Rights Law § 105(12) and covered agentCovered agent"Covered agent" means any individual that interacts, directly or indirectly, with a relevant AI system, developer, or deployer on behalf of a covered subject with the express consent of such covered subject.Civil Rights Law § 105(11), if applicable, at the immediate onset of an engagement between the covered subjectCovered subject"Covered subject" means any individual or group of individuals that is the subject of a consequential decision made entirely by or with the assistance of an AI system.Civil Rights Law § 105(12) and the covered deployerCovered deployer"Covered deployer" means a deployer that uses a high-risk AI system to make one or more consequential decisions with respect to covered subjects.Civil Rights Law § 105(5) as to the use of a high-risk AI systemHigh-risk AI system"High-risk AI system" means any AI system that, when deployed: (a) is a substantial factor in making a consequential decision; or (b) will have a material impact on the statutory or constitutional rights, civil liberties, safety, or welfare of an individual in the state.Civil Rights Law § 105(14) for the making of a consequential decisionConsequential decision"Consequential decision" means a decision or judgment that has a material, legal or similarly significant effect on an individual's access to, or the cost, terms, or availability of, any of the following: (a) Employment, workers' management, or self-employment, including, but not limited to, all of the following: (i) Pay or promotion; and (ii) Hiring or termination. (b) Education and vocational training, including, but not limited to, all of the following: (i) Accreditation; (ii) Certification; (iii) Admissions; and (iv) Financial aid or scholarships. (c) Housing or lodging, including rental or short-term housing or lodging. (d) Family planning, including adoption services or reproductive services, as well as assessments related to child protective services. (e) Health care or health insurance, including mental health care, dental, or vision, except for radiology. (f) Financial services, including a financial service provided by a mortgage company, mortgage broker, or creditor. (g) Legal services.Civil Rights Law § 105(4) in clear, conspicuous, and consumer-friendly terms, made available in each of the languages in which the company offers its end services, that AI systems will be used to make a decision or to assist in making a decision; provided, however, that where there is an urgent necessity for a decision to be made to confer a benefit to the covered subjectCovered subject"Covered subject" means any individual or group of individuals that is the subject of a consequential decision made entirely by or with the assistance of an AI system.Civil Rights Law § 105(12), including, but not limited to, social benefits, housing access, or dispending of emergency funds, and compliance with this section would cause imminent detriment to the welfare of the covered subjectCovered subject"Covered subject" means any individual or group of individuals that is the subject of a consequential decision made entirely by or with the assistance of an AI system.Civil Rights Law § 105(12), such obligation shall be considered waived; provided further, that nothing in this section shall be construed to waive a natural person's option to request human review of the decision.

2 3 Any covered deployerCovered deployer"Covered deployer" means a deployer that uses a high-risk AI system to make one or more consequential decisions with respect to covered subjects.Civil Rights Law § 105(5) shall inform the covered subjectCovered subject"Covered subject" means any individual or group of individuals that is the subject of a consequential decision made entirely by or with the assistance of an AI system.Civil Rights Law § 105(12) and covered agentCovered agent"Covered agent" means any individual that interacts, directly or indirectly, with a relevant AI system, developer, or deployer on behalf of a covered subject with the express consent of such covered subject.Civil Rights Law § 105(11), if applicable, within ten days in a clear, conspicuous and consumer-friendly manner that a high-risk AI systemHigh-risk AI system"High-risk AI system" means any AI system that, when deployed: (a) is a substantial factor in making a consequential decision; or (b) will have a material impact on the statutory or constitutional rights, civil liberties, safety, or welfare of an individual in the state.Civil Rights Law § 105(14) has been used to make a consequential decisionConsequential decision"Consequential decision" means a decision or judgment that has a material, legal or similarly significant effect on an individual's access to, or the cost, terms, or availability of, any of the following: (a) Employment, workers' management, or self-employment, including, but not limited to, all of the following: (i) Pay or promotion; and (ii) Hiring or termination. (b) Education and vocational training, including, but not limited to, all of the following: (i) Accreditation; (ii) Certification; (iii) Admissions; and (iv) Financial aid or scholarships. (c) Housing or lodging, including rental or short-term housing or lodging. (d) Family planning, including adoption services or reproductive services, as well as assessments related to child protective services. (e) Health care or health insurance, including mental health care, dental, or vision, except for radiology. (f) Financial services, including a financial service provided by a mortgage company, mortgage broker, or creditor. (g) Legal services.Civil Rights Law § 105(4). The deployerDeployer"Deployer" means any person, partnership, association or corporation that uses or makes an AI system available to one or more third parties including the general public for use, modification, copying, or a combination thereof with their software. A deployer shall not include any natural person using an AI system for personal use. A developer may also be considered a deployer if its actions satisfy this definition.Civil Rights Law § 105(6) shall then provide and explain a process for the covered subjectCovered subject"Covered subject" means any individual or group of individuals that is the subject of a consequential decision made entirely by or with the assistance of an AI system.Civil Rights Law § 105(12) or covered agentCovered agent"Covered agent" means any individual that interacts, directly or indirectly, with a relevant AI system, developer, or deployer on behalf of a covered subject with the express consent of such covered subject.Civil Rights Law § 105(11) to appeal the decision, which shall at minimum allow the covered subjectCovered subject"Covered subject" means any individual or group of individuals that is the subject of a consequential decision made entirely by or with the assistance of an AI system.Civil Rights Law § 105(12) or covered agentCovered agent"Covered agent" means any individual that interacts, directly or indirectly, with a relevant AI system, developer, or deployer on behalf of a covered subject with the express consent of such covered subject.Civil Rights Law § 105(11) to (i) formally contest the decision, (ii) provide information to support their position, and (iii) obtain meaningful human review of the decision. A deployerDeployer"Deployer" means any person, partnership, association or corporation that uses or makes an AI system available to one or more third parties including the general public for use, modification, copying, or a combination thereof with their software. A deployer shall not include any natural person using an AI system for personal use. A developer may also be considered a deployer if its actions satisfy this definition.Civil Rights Law § 105(6) shall respond to a covered subjectCovered subject"Covered subject" means any individual or group of individuals that is the subject of a consequential decision made entirely by or with the assistance of an AI system.Civil Rights Law § 105(12)'s or covered agentCovered agent"Covered agent" means any individual that interacts, directly or indirectly, with a relevant AI system, developer, or deployer on behalf of a covered subject with the express consent of such covered subject.Civil Rights Law § 105(11)'s appeal within forty-five days of receipt of the appeal. That period may be extended once by forty-five additional days where reasonably necessary, taking into account the complexity and number of appeals. The deployerDeployer"Deployer" means any person, partnership, association or corporation that uses or makes an AI system available to one or more third parties including the general public for use, modification, copying, or a combination thereof with their software. A deployer shall not include any natural person using an AI system for personal use. A developer may also be considered a deployer if its actions satisfy this definition.Civil Rights Law § 105(6) shall inform the covered subjectCovered subject"Covered subject" means any individual or group of individuals that is the subject of a consequential decision made entirely by or with the assistance of an AI system.Civil Rights Law § 105(12) or covered agentCovered agent"Covered agent" means any individual that interacts, directly or indirectly, with a relevant AI system, developer, or deployer on behalf of a covered subject with the express consent of such covered subject.Civil Rights Law § 105(11), if applicable, of any such extension within forty-five days of receipt of the appeal, together with the reasons for the delay. (b) A covered subjectCovered subject"Covered subject" means any individual or group of individuals that is the subject of a consequential decision made entirely by or with the assistance of an AI system.Civil Rights Law § 105(12) shall be entitled to no more than one appeal with respect to the same consequential decisionConsequential decision"Consequential decision" means a decision or judgment that has a material, legal or similarly significant effect on an individual's access to, or the cost, terms, or availability of, any of the following: (a) Employment, workers' management, or self-employment, including, but not limited to, all of the following: (i) Pay or promotion; and (ii) Hiring or termination. (b) Education and vocational training, including, but not limited to, all of the following: (i) Accreditation; (ii) Certification; (iii) Admissions; and (iv) Financial aid or scholarships. (c) Housing or lodging, including rental or short-term housing or lodging. (d) Family planning, including adoption services or reproductive services, as well as assessments related to child protective services. (e) Health care or health insurance, including mental health care, dental, or vision, except for radiology. (f) Financial services, including a financial service provided by a mortgage company, mortgage broker, or creditor. (g) Legal services.Civil Rights Law § 105(4) in a six-month period.

3 The covered deployerCovered deployer"Covered deployer" means a deployer that uses a high-risk AI system to make one or more consequential decisions with respect to covered subjects.Civil Rights Law § 105(5) or covered developerCovered developer"Covered developer" means a developer that trained or initiated the training of an AI system that is used to make one or more consequential decisions with respect to covered subjects.Civil Rights Law § 105(7) is legally responsible for quality and accuracy of all consequential decisionsConsequential decision"Consequential decision" means a decision or judgment that has a material, legal or similarly significant effect on an individual's access to, or the cost, terms, or availability of, any of the following: (a) Employment, workers' management, or self-employment, including, but not limited to, all of the following: (i) Pay or promotion; and (ii) Hiring or termination. (b) Education and vocational training, including, but not limited to, all of the following: (i) Accreditation; (ii) Certification; (iii) Admissions; and (iv) Financial aid or scholarships. (c) Housing or lodging, including rental or short-term housing or lodging. (d) Family planning, including adoption services or reproductive services, as well as assessments related to child protective services. (e) Health care or health insurance, including mental health care, dental, or vision, except for radiology. (f) Financial services, including a financial service provided by a mortgage company, mortgage broker, or creditor. (g) Legal services.Civil Rights Law § 105(4) made, including any bias or algorithmic discriminationAlgorithmic discrimination"Algorithmic discrimination" means any condition in which the use of an AI system contributes to unjustified differential treatment or impacts, disfavoring people based on their actual or perceived age, race, ethnicity, creed, religion, color, national origin, citizenship or immigration status, sexual orientation, gender identity, gender expression, military status, sex, disability, predisposing genetic characteristics, familial status, marital status, status as a victim of domestic violence or other classification protected under state or federal laws. Algorithmic discrimination shall not include: (a) a developer's or deployer's testing of their own AI system to identify, mitigate, and prevent discriminatory bias; (b) expanding an applicant, customer, or participant pool to increase diversity or redress historical discrimination; or (c) an act or omission by or on behalf of a private club or other establishment that is not in fact open to the public, as set forth in Title II of the federal Civil Rights Act of 1964, 42 U.S.C. section 2000a(e), as amended.Civil Rights Law § 105(1) resulting from the operation of the AI system on their behalf.

4 4 Each covered deployerCovered deployer"Covered deployer" means a deployer that uses a high-risk AI system to make one or more consequential decisions with respect to covered subjects.Civil Rights Law § 105(5) shall conduct meaningful human review of each consequential decisionConsequential decision"Consequential decision" means a decision or judgment that has a material, legal or similarly significant effect on an individual's access to, or the cost, terms, or availability of, any of the following: (a) Employment, workers' management, or self-employment, including, but not limited to, all of the following: (i) Pay or promotion; and (ii) Hiring or termination. (b) Education and vocational training, including, but not limited to, all of the following: (i) Accreditation; (ii) Certification; (iii) Admissions; and (iv) Financial aid or scholarships. (c) Housing or lodging, including rental or short-term housing or lodging. (d) Family planning, including adoption services or reproductive services, as well as assessments related to child protective services. (e) Health care or health insurance, including mental health care, dental, or vision, except for radiology. (f) Financial services, including a financial service provided by a mortgage company, mortgage broker, or creditor. (g) Legal services.Civil Rights Law § 105(4) made with a high-risk AI systemHigh-risk AI system"High-risk AI system" means any AI system that, when deployed: (a) is a substantial factor in making a consequential decision; or (b) will have a material impact on the statutory or constitutional rights, civil liberties, safety, or welfare of an individual in the state.Civil Rights Law § 105(14).

5 The rights and obligations under this section may not be waived by any person, partnership, association or corporation.

6 5 If a developerDeveloper"Developer" means a person, partnership, or corporation that trained or initiated the training of an AI system, or creates a substantial change with respect to an AI system, whether for its own use in the state of New York or for use by a third party. A deployer may also be considered a developer if its actions satisfy this definition.Civil Rights Law § 105(8) intends that an AI system shall not be used as a high-risk AI systemHigh-risk AI system"High-risk AI system" means any AI system that, when deployed: (a) is a substantial factor in making a consequential decision; or (b) will have a material impact on the statutory or constitutional rights, civil liberties, safety, or welfare of an individual in the state.Civil Rights Law § 105(14), such developerDeveloper"Developer" means a person, partnership, or corporation that trained or initiated the training of an AI system, or creates a substantial change with respect to an AI system, whether for its own use in the state of New York or for use by a third party. A deployer may also be considered a developer if its actions satisfy this definition.Civil Rights Law § 105(8) shall: (i) enter into a written and fully executed contractual agreement with each deployerDeployer"Deployer" means any person, partnership, association or corporation that uses or makes an AI system available to one or more third parties including the general public for use, modification, copying, or a combination thereof with their software. A deployer shall not include any natural person using an AI system for personal use. A developer may also be considered a deployer if its actions satisfy this definition.Civil Rights Law § 105(6) authorized to use the artificial intelligence systemArtificial intelligence system"Artificial intelligence system" or "AI system" means a machine-based system or combination of systems, that for a given set of human-defined objectives, makes predictions, recommendations, or decisions influencing real or virtual environments, and that uses machine- and human-based inputs to perceive real and virtual environments, abstracts such perceptions into models through analysis in an automated manner, and uses model inference to formulate options for information or action. Artificial intelligence system shall not include: (a) any system that (i) is used by a business entity solely for internal purposes and (ii) is not used as a substantial factor in a consequential decision; or (b) any software used primarily for narrow procedural tasks or basic computerized processes, such as anti-malware, anti-virus, auto-correct functions, calculators, databases, data storage, electronic communications, firewall, internet domain registration, internet website loading, networking, spam and robocall-filtering, spellcheck tools, spreadsheets, web caching, web hosting, or any tool that relates only to internal management affairs such as ordering office supplies or processing payments, and that do not materially affect the rights, liberties, benefits, safety or welfare of any individual within the state.Civil Rights Law § 105(2) developed by such developerDeveloper"Developer" means a person, partnership, or corporation that trained or initiated the training of an AI system, or creates a substantial change with respect to an AI system, whether for its own use in the state of New York or for use by a third party. A deployer may also be considered a developer if its actions satisfy this definition.Civil Rights Law § 105(8), including the developerDeveloper"Developer" means a person, partnership, or corporation that trained or initiated the training of an AI system, or creates a substantial change with respect to an AI system, whether for its own use in the state of New York or for use by a third party. A deployer may also be considered a developer if its actions satisfy this definition.Civil Rights Law § 105(8) if they are also a deployerDeployer"Deployer" means any person, partnership, association or corporation that uses or makes an AI system available to one or more third parties including the general public for use, modification, copying, or a combination thereof with their software. A deployer shall not include any natural person using an AI system for personal use. A developer may also be considered a deployer if its actions satisfy this definition.Civil Rights Law § 105(6), that such artificial intelligence systemArtificial intelligence system"Artificial intelligence system" or "AI system" means a machine-based system or combination of systems, that for a given set of human-defined objectives, makes predictions, recommendations, or decisions influencing real or virtual environments, and that uses machine- and human-based inputs to perceive real and virtual environments, abstracts such perceptions into models through analysis in an automated manner, and uses model inference to formulate options for information or action. Artificial intelligence system shall not include: (a) any system that (i) is used by a business entity solely for internal purposes and (ii) is not used as a substantial factor in a consequential decision; or (b) any software used primarily for narrow procedural tasks or basic computerized processes, such as anti-malware, anti-virus, auto-correct functions, calculators, databases, data storage, electronic communications, firewall, internet domain registration, internet website loading, networking, spam and robocall-filtering, spellcheck tools, spreadsheets, web caching, web hosting, or any tool that relates only to internal management affairs such as ordering office supplies or processing payments, and that do not materially affect the rights, liberties, benefits, safety or welfare of any individual within the state.Civil Rights Law § 105(2) will not be used as a high-risk AI systemHigh-risk AI system"High-risk AI system" means any AI system that, when deployed: (a) is a substantial factor in making a consequential decision; or (b) will have a material impact on the statutory or constitutional rights, civil liberties, safety, or welfare of an individual in the state.Civil Rights Law § 105(14); (ii) implement reasonable technical safeguards designed to prevent or detect high-risk AI systemHigh-risk AI system"High-risk AI system" means any AI system that, when deployed: (a) is a substantial factor in making a consequential decision; or (b) will have a material impact on the statutory or constitutional rights, civil liberties, safety, or welfare of an individual in the state.Civil Rights Law § 105(14) use cases or otherwise demonstrate reasonable steps taken to ensure that any unauthorized deployments of its AI systems are not being used as a high-risk AI systemHigh-risk AI system"High-risk AI system" means any AI system that, when deployed: (a) is a substantial factor in making a consequential decision; or (b) will have a material impact on the statutory or constitutional rights, civil liberties, safety, or welfare of an individual in the state.Civil Rights Law § 105(14); (iii) prominently display on its website, in marketing materials, and in all licensing agreements offered to prospective deployers of its AI system that the AI system cannot be used as a high-risk AI systemHigh-risk AI system"High-risk AI system" means any AI system that, when deployed: (a) is a substantial factor in making a consequential decision; or (b) will have a material impact on the statutory or constitutional rights, civil liberties, safety, or welfare of an individual in the state.Civil Rights Law § 105(14); and (iv) maintain records of deployerDeployer"Deployer" means any person, partnership, association or corporation that uses or makes an AI system available to one or more third parties including the general public for use, modification, copying, or a combination thereof with their software. A deployer shall not include any natural person using an AI system for personal use. A developer may also be considered a deployer if its actions satisfy this definition.Civil Rights Law § 105(6) agreements for a period of not less than five years. (b) DevelopersDeveloper"Developer" means a person, partnership, or corporation that trained or initiated the training of an AI system, or creates a substantial change with respect to an AI system, whether for its own use in the state of New York or for use by a third party. A deployer may also be considered a developer if its actions satisfy this definition.Civil Rights Law § 105(8) that have fully executed contractual agreements in force and effect with deployersDeployer"Deployer" means any person, partnership, association or corporation that uses or makes an AI system available to one or more third parties including the general public for use, modification, copying, or a combination thereof with their software. A deployer shall not include any natural person using an AI system for personal use. A developer may also be considered a deployer if its actions satisfy this definition.Civil Rights Law § 105(6) as of the effective date of this section governing deployment of an AI system shall: (i) be deemed to be in compliance with paragraph (a) of this subdivision for a period of eighteen months following the effective date of this section and (ii) beginning eighteen months following the effective date of this section, comply with this subdivision by amendment of the existing contractual agreement or by creation of a new fully executed contractual agreement that satisfies the requirements of paragraph (a) of this subdivision.

1 6 Covered developersCovered developer"Covered developer" means a developer that trained or initiated the training of an AI system that is used to make one or more consequential decisions with respect to covered subjects.Civil Rights Law § 105(7) and covered deployersCovered deployer"Covered deployer" means a deployer that uses a high-risk AI system to make one or more consequential decisions with respect to covered subjects.Civil Rights Law § 105(5) shall not: (a) prevent any of their employeesEmployee"Employee" means an individual who performs services for and under the control and direction of an employer for wages or other remuneration, including former employees, or natural persons employed as independent contractors to carry out work in furtherance of an employer's business enterprise who are not themselves employers.Civil Rights Law § 105(9) from disclosing information to the attorney general, including through terms and conditions of employment or seeking to enforce terms and conditions of employment, if the employeeEmployee"Employee" means an individual who performs services for and under the control and direction of an employer for wages or other remuneration, including former employees, or natural persons employed as independent contractors to carry out work in furtherance of an employer's business enterprise who are not themselves employers.Civil Rights Law § 105(9) has reasonable cause to believe the information indicates a violation of this article; or (b) retaliate against an employeeEmployee"Employee" means an individual who performs services for and under the control and direction of an employer for wages or other remuneration, including former employees, or natural persons employed as independent contractors to carry out work in furtherance of an employer's business enterprise who are not themselves employers.Civil Rights Law § 105(9) for disclosing information to the attorney general pursuant to this section.

2 An employeeEmployee"Employee" means an individual who performs services for and under the control and direction of an employer for wages or other remuneration, including former employees, or natural persons employed as independent contractors to carry out work in furtherance of an employer's business enterprise who are not themselves employers.Civil Rights Law § 105(9) harmed by a violation of this article may petition a court for appropriate relief as provided in subdivision five of section seven hundred forty of the labor law.

3 7 Covered developersCovered developer"Covered developer" means a developer that trained or initiated the training of an AI system that is used to make one or more consequential decisions with respect to covered subjects.Civil Rights Law § 105(7) and covered deployersCovered deployer"Covered deployer" means a deployer that uses a high-risk AI system to make one or more consequential decisions with respect to covered subjects.Civil Rights Law § 105(5) shall provide a clear notice to all of their employeesEmployee"Employee" means an individual who performs services for and under the control and direction of an employer for wages or other remuneration, including former employees, or natural persons employed as independent contractors to carry out work in furtherance of an employer's business enterprise who are not themselves employers.Civil Rights Law § 105(9) working on such AI systems of their rights and responsibilities under this article, including the right of employees of contractors and subcontractors to use, as relevant, the developerDeveloper"Developer" means a person, partnership, or corporation that trained or initiated the training of an AI system, or creates a substantial change with respect to an AI system, whether for its own use in the state of New York or for use by a third party. A deployer may also be considered a developer if its actions satisfy this definition.Civil Rights Law § 105(8)'s or deployerDeployer"Deployer" means any person, partnership, association or corporation that uses or makes an AI system available to one or more third parties including the general public for use, modification, copying, or a combination thereof with their software. A deployer shall not include any natural person using an AI system for personal use. A developer may also be considered a deployer if its actions satisfy this definition.Civil Rights Law § 105(6)'s internal process for making protected disclosures pursuant to subdivision four of this section. A developerDeveloper"Developer" means a person, partnership, or corporation that trained or initiated the training of an AI system, or creates a substantial change with respect to an AI system, whether for its own use in the state of New York or for use by a third party. A deployer may also be considered a developer if its actions satisfy this definition.Civil Rights Law § 105(8) or deployerDeployer"Deployer" means any person, partnership, association or corporation that uses or makes an AI system available to one or more third parties including the general public for use, modification, copying, or a combination thereof with their software. A deployer shall not include any natural person using an AI system for personal use. A developer may also be considered a deployer if its actions satisfy this definition.Civil Rights Law § 105(6) is presumed to be in compliance with the requirements of this subdivision if the developerDeveloper"Developer" means a person, partnership, or corporation that trained or initiated the training of an AI system, or creates a substantial change with respect to an AI system, whether for its own use in the state of New York or for use by a third party. A deployer may also be considered a developer if its actions satisfy this definition.Civil Rights Law § 105(8) or deployerDeployer"Deployer" means any person, partnership, association or corporation that uses or makes an AI system available to one or more third parties including the general public for use, modification, copying, or a combination thereof with their software. A deployer shall not include any natural person using an AI system for personal use. A developer may also be considered a deployer if its actions satisfy this definition.Civil Rights Law § 105(6) does either of the following: (a) at all times post and display within all workplaces maintained by the developerDeveloper"Developer" means a person, partnership, or corporation that trained or initiated the training of an AI system, or creates a substantial change with respect to an AI system, whether for its own use in the state of New York or for use by a third party. A deployer may also be considered a developer if its actions satisfy this definition.Civil Rights Law § 105(8) or deployerDeployer"Deployer" means any person, partnership, association or corporation that uses or makes an AI system available to one or more third parties including the general public for use, modification, copying, or a combination thereof with their software. A deployer shall not include any natural person using an AI system for personal use. A developer may also be considered a deployer if its actions satisfy this definition.Civil Rights Law § 105(6) a notice to all employees of their rights and responsibilities under this article, ensure that all new employeesEmployee"Employee" means an individual who performs services for and under the control and direction of an employer for wages or other remuneration, including former employees, or natural persons employed as independent contractors to carry out work in furtherance of an employer's business enterprise who are not themselves employers.Civil Rights Law § 105(9) receive equivalent notice, and ensure that employeesEmployee"Employee" means an individual who performs services for and under the control and direction of an employer for wages or other remuneration, including former employees, or natural persons employed as independent contractors to carry out work in furtherance of an employer's business enterprise who are not themselves employers.Civil Rights Law § 105(9) who work remotely periodically receive an equivalent notice; or (b) no less frequently than once every year, provide written notice to all employees of their rights and responsibilities under this article and ensure that the notice is received and acknowledged by all of those employeesEmployee"Employee" means an individual who performs services for and under the control and direction of an employer for wages or other remuneration, including former employees, or natural persons employed as independent contractors to carry out work in furtherance of an employer's business enterprise who are not themselves employers.Civil Rights Law § 105(9).

4 8 Each covered developerCovered developer"Covered developer" means a developer that trained or initiated the training of an AI system that is used to make one or more consequential decisions with respect to covered subjects.Civil Rights Law § 105(7) and covered deployerCovered deployer"Covered deployer" means a deployer that uses a high-risk AI system to make one or more consequential decisions with respect to covered subjects.Civil Rights Law § 105(5) shall provide a reasonable internal process through which an employeeEmployee"Employee" means an individual who performs services for and under the control and direction of an employer for wages or other remuneration, including former employees, or natural persons employed as independent contractors to carry out work in furtherance of an employer's business enterprise who are not themselves employers.Civil Rights Law § 105(9) may anonymously disclose information to the developerDeveloper"Developer" means a person, partnership, or corporation that trained or initiated the training of an AI system, or creates a substantial change with respect to an AI system, whether for its own use in the state of New York or for use by a third party. A deployer may also be considered a developer if its actions satisfy this definition.Civil Rights Law § 105(8) or deployerDeployer"Deployer" means any person, partnership, association or corporation that uses or makes an AI system available to one or more third parties including the general public for use, modification, copying, or a combination thereof with their software. A deployer shall not include any natural person using an AI system for personal use. A developer may also be considered a deployer if its actions satisfy this definition.Civil Rights Law § 105(6) if the employeeEmployee"Employee" means an individual who performs services for and under the control and direction of an employer for wages or other remuneration, including former employees, or natural persons employed as independent contractors to carry out work in furtherance of an employer's business enterprise who are not themselves employers.Civil Rights Law § 105(9) believes in good faith that the information indicates that the developerDeveloper"Developer" means a person, partnership, or corporation that trained or initiated the training of an AI system, or creates a substantial change with respect to an AI system, whether for its own use in the state of New York or for use by a third party. A deployer may also be considered a developer if its actions satisfy this definition.Civil Rights Law § 105(8) or deployerDeployer"Deployer" means any person, partnership, association or corporation that uses or makes an AI system available to one or more third parties including the general public for use, modification, copying, or a combination thereof with their software. A deployer shall not include any natural person using an AI system for personal use. A developer may also be considered a deployer if its actions satisfy this definition.Civil Rights Law § 105(6) has violated any provision of this article or any other law, or has made false or materially misleading statements related to its risk management policy and programRisk management policy and program"Risk management policy and program" means the risk management policy and program created pursuant to section one hundred twelve of this article.Civil Rights Law § 105(16), or failed to disclose known risks to employeesEmployee"Employee" means an individual who performs services for and under the control and direction of an employer for wages or other remuneration, including former employees, or natural persons employed as independent contractors to carry out work in furtherance of an employer's business enterprise who are not themselves employers.Civil Rights Law § 105(9), including, at a minimum, a monthly update to the person who made the disclosure regarding the status of the developerDeveloper"Developer" means a person, partnership, or corporation that trained or initiated the training of an AI system, or creates a substantial change with respect to an AI system, whether for its own use in the state of New York or for use by a third party. A deployer may also be considered a developer if its actions satisfy this definition.Civil Rights Law § 105(8)'s or deployerDeployer"Deployer" means any person, partnership, association or corporation that uses or makes an AI system available to one or more third parties including the general public for use, modification, copying, or a combination thereof with their software. A deployer shall not include any natural person using an AI system for personal use. A developer may also be considered a deployer if its actions satisfy this definition.Civil Rights Law § 105(6)'s investigation of the disclosure and the actions taken by the developerDeveloper"Developer" means a person, partnership, or corporation that trained or initiated the training of an AI system, or creates a substantial change with respect to an AI system, whether for its own use in the state of New York or for use by a third party. A deployer may also be considered a developer if its actions satisfy this definition.Civil Rights Law § 105(8) or deployerDeployer"Deployer" means any person, partnership, association or corporation that uses or makes an AI system available to one or more third parties including the general public for use, modification, copying, or a combination thereof with their software. A deployer shall not include any natural person using an AI system for personal use. A developer may also be considered a deployer if its actions satisfy this definition.Civil Rights Law § 105(6) in response to the disclosure.

5 This section does not limit protections provided to employeesEmployee"Employee" means an individual who performs services for and under the control and direction of an employer for wages or other remuneration, including former employees, or natural persons employed as independent contractors to carry out work in furtherance of an employer's business enterprise who are not themselves employers.Civil Rights Law § 105(9) under section seven hundred forty of the labor law.

1 9 Covered developersCovered developer"Covered developer" means a developer that trained or initiated the training of an AI system that is used to make one or more consequential decisions with respect to covered subjects.Civil Rights Law § 105(7) shall cause to be conducted audits in accordance with this section. (a) A covered developerCovered developer"Covered developer" means a developer that trained or initiated the training of an AI system that is used to make one or more consequential decisions with respect to covered subjects.Civil Rights Law § 105(7) shall complete at least: (i) a first audit within six months after completion of development of the high-risk AI systemHigh-risk AI system"High-risk AI system" means any AI system that, when deployed: (a) is a substantial factor in making a consequential decision; or (b) will have a material impact on the statutory or constitutional rights, civil liberties, safety, or welfare of an individual in the state.Civil Rights Law § 105(14) and the initial offering of the high-risk AI systemHigh-risk AI system"High-risk AI system" means any AI system that, when deployed: (a) is a substantial factor in making a consequential decision; or (b) will have a material impact on the statutory or constitutional rights, civil liberties, safety, or welfare of an individual in the state.Civil Rights Law § 105(14) to a deployerDeployer"Deployer" means any person, partnership, association or corporation that uses or makes an AI system available to one or more third parties including the general public for use, modification, copying, or a combination thereof with their software. A deployer shall not include any natural person using an AI system for personal use. A developer may also be considered a deployer if its actions satisfy this definition.Civil Rights Law § 105(6) for deployment or, if the developerDeveloper"Developer" means a person, partnership, or corporation that trained or initiated the training of an AI system, or creates a substantial change with respect to an AI system, whether for its own use in the state of New York or for use by a third party. A deployer may also be considered a developer if its actions satisfy this definition.Civil Rights Law § 105(8) is first deployerDeployer"Deployer" means any person, partnership, association or corporation that uses or makes an AI system available to one or more third parties including the general public for use, modification, copying, or a combination thereof with their software. A deployer shall not include any natural person using an AI system for personal use. A developer may also be considered a deployer if its actions satisfy this definition.Civil Rights Law § 105(6) to deploy the high-risk AI systemHigh-risk AI system"High-risk AI system" means any AI system that, when deployed: (a) is a substantial factor in making a consequential decision; or (b) will have a material impact on the statutory or constitutional rights, civil liberties, safety, or welfare of an individual in the state.Civil Rights Law § 105(14), after initial deployment; and (ii) one audit every one year following the submission of the first audit. (b) A developerDeveloper"Developer" means a person, partnership, or corporation that trained or initiated the training of an AI system, or creates a substantial change with respect to an AI system, whether for its own use in the state of New York or for use by a third party. A deployer may also be considered a developer if its actions satisfy this definition.Civil Rights Law § 105(8) audit under this section shall include: (i) an evaluation and determination of whether the developerDeveloper"Developer" means a person, partnership, or corporation that trained or initiated the training of an AI system, or creates a substantial change with respect to an AI system, whether for its own use in the state of New York or for use by a third party. A deployer may also be considered a developer if its actions satisfy this definition.Civil Rights Law § 105(8) has taken reasonable care to prevent foreseeable risk of algorithmic discriminationAlgorithmic discrimination"Algorithmic discrimination" means any condition in which the use of an AI system contributes to unjustified differential treatment or impacts, disfavoring people based on their actual or perceived age, race, ethnicity, creed, religion, color, national origin, citizenship or immigration status, sexual orientation, gender identity, gender expression, military status, sex, disability, predisposing genetic characteristics, familial status, marital status, status as a victim of domestic violence or other classification protected under state or federal laws. Algorithmic discrimination shall not include: (a) a developer's or deployer's testing of their own AI system to identify, mitigate, and prevent discriminatory bias; (b) expanding an applicant, customer, or participant pool to increase diversity or redress historical discrimination; or (c) an act or omission by or on behalf of a private club or other establishment that is not in fact open to the public, as set forth in Title II of the federal Civil Rights Act of 1964, 42 U.S.C. section 2000a(e), as amended.Civil Rights Law § 105(1) with respect to such high-risk AI systemHigh-risk AI system"High-risk AI system" means any AI system that, when deployed: (a) is a substantial factor in making a consequential decision; or (b) will have a material impact on the statutory or constitutional rights, civil liberties, safety, or welfare of an individual in the state.Civil Rights Law § 105(14); and (ii) an evaluation of the developerDeveloper"Developer" means a person, partnership, or corporation that trained or initiated the training of an AI system, or creates a substantial change with respect to an AI system, whether for its own use in the state of New York or for use by a third party. A deployer may also be considered a developer if its actions satisfy this definition.Civil Rights Law § 105(8)'s documented risk management policy and programRisk management policy and program"Risk management policy and program" means the risk management policy and program created pursuant to section one hundred twelve of this article.Civil Rights Law § 105(16) required under section one hundred twelve of this article for conformity with subdivision one of such section one hundred twelve. (c) Notwithstanding paragraph (b) of this subdivision, satisfactory audits under ISO 42001ISO 42001"ISO 42001" means international standard ISO/IEC 42001:2023 (Information technology -- Artificial intelligence -- Management system), published by the International Organization for Standardization on December eighteenth, two thousand twenty-three.Civil Rights Law § 105(15) completed in accordance with paragraph (a) of this subdivision shall be deemed to satisfy a developerDeveloper"Developer" means a person, partnership, or corporation that trained or initiated the training of an AI system, or creates a substantial change with respect to an AI system, whether for its own use in the state of New York or for use by a third party. A deployer may also be considered a developer if its actions satisfy this definition.Civil Rights Law § 105(8)'s duty under this subdivision.

2 10 Covered deployersCovered deployer"Covered deployer" means a deployer that uses a high-risk AI system to make one or more consequential decisions with respect to covered subjects.Civil Rights Law § 105(5) shall cause to be conducted audits in accordance with this section. (a) A covered deployerCovered deployer"Covered deployer" means a deployer that uses a high-risk AI system to make one or more consequential decisions with respect to covered subjects.Civil Rights Law § 105(5) shall complete at least: (i) a first audit within six months after initial deployment; (ii) a second audit within one year following the submission of the first audit; and (iii) one audit every two years following the submission of the second audit. (b) A deployerDeployer"Deployer" means any person, partnership, association or corporation that uses or makes an AI system available to one or more third parties including the general public for use, modification, copying, or a combination thereof with their software. A deployer shall not include any natural person using an AI system for personal use. A developer may also be considered a deployer if its actions satisfy this definition.Civil Rights Law § 105(6) audit under this section shall include: (i) an evaluation and determination of whether the deployerDeployer"Deployer" means any person, partnership, association or corporation that uses or makes an AI system available to one or more third parties including the general public for use, modification, copying, or a combination thereof with their software. A deployer shall not include any natural person using an AI system for personal use. A developer may also be considered a deployer if its actions satisfy this definition.Civil Rights Law § 105(6) has taken reasonable care to prevent foreseeable risk of algorithmic discriminationAlgorithmic discrimination"Algorithmic discrimination" means any condition in which the use of an AI system contributes to unjustified differential treatment or impacts, disfavoring people based on their actual or perceived age, race, ethnicity, creed, religion, color, national origin, citizenship or immigration status, sexual orientation, gender identity, gender expression, military status, sex, disability, predisposing genetic characteristics, familial status, marital status, status as a victim of domestic violence or other classification protected under state or federal laws. Algorithmic discrimination shall not include: (a) a developer's or deployer's testing of their own AI system to identify, mitigate, and prevent discriminatory bias; (b) expanding an applicant, customer, or participant pool to increase diversity or redress historical discrimination; or (c) an act or omission by or on behalf of a private club or other establishment that is not in fact open to the public, as set forth in Title II of the federal Civil Rights Act of 1964, 42 U.S.C. section 2000a(e), as amended.Civil Rights Law § 105(1) with respect to such high-risk AI systemHigh-risk AI system"High-risk AI system" means any AI system that, when deployed: (a) is a substantial factor in making a consequential decision; or (b) will have a material impact on the statutory or constitutional rights, civil liberties, safety, or welfare of an individual in the state.Civil Rights Law § 105(14); (ii) an evaluation of system accuracy and reliability with respect to such high-risk AI systemHigh-risk AI system"High-risk AI system" means any AI system that, when deployed: (a) is a substantial factor in making a consequential decision; or (b) will have a material impact on the statutory or constitutional rights, civil liberties, safety, or welfare of an individual in the state.Civil Rights Law § 105(14)'s deployerDeployer"Deployer" means any person, partnership, association or corporation that uses or makes an AI system available to one or more third parties including the general public for use, modification, copying, or a combination thereof with their software. A deployer shall not include any natural person using an AI system for personal use. A developer may also be considered a deployer if its actions satisfy this definition.Civil Rights Law § 105(6)-intended and actual use cases; and (iii) an evaluation of the deployerDeployer"Deployer" means any person, partnership, association or corporation that uses or makes an AI system available to one or more third parties including the general public for use, modification, copying, or a combination thereof with their software. A deployer shall not include any natural person using an AI system for personal use. A developer may also be considered a deployer if its actions satisfy this definition.Civil Rights Law § 105(6)'s documented risk management policy and programRisk management policy and program"Risk management policy and program" means the risk management policy and program created pursuant to section one hundred twelve of this article.Civil Rights Law § 105(16) required under section one hundred twelve of this article for conformity with subdivision one of such section one hundred twelve. (c) Notwithstanding paragraph (b) of this subdivision, satisfactory audits under ISO 42001ISO 42001"ISO 42001" means international standard ISO/IEC 42001:2023 (Information technology -- Artificial intelligence -- Management system), published by the International Organization for Standardization on December eighteenth, two thousand twenty-three.Civil Rights Law § 105(15) completed in accordance with paragraph (a) of this subdivision shall be deemed to satisfy a covered deployerCovered deployer"Covered deployer" means a deployer that uses a high-risk AI system to make one or more consequential decisions with respect to covered subjects.Civil Rights Law § 105(5)'s duty under this subdivision.

3-4 11 3. (a) Audits under this section shall be conducted by one or more thirty-party auditorsAuditor"Auditor" shall refer to an independent entity including but not limited to an individual, non-profit, firm, corporation, partnership, cooperative, association, academic institution, or group affiliated with an academic institution, commissioned to perform an audit.Civil Rights Law § 105(3). A deployerDeployer"Deployer" means any person, partnership, association or corporation that uses or makes an AI system available to one or more third parties including the general public for use, modification, copying, or a combination thereof with their software. A deployer shall not include any natural person using an AI system for personal use. A developer may also be considered a deployer if its actions satisfy this definition.Civil Rights Law § 105(6) or developerDeveloper"Developer" means a person, partnership, or corporation that trained or initiated the training of an AI system, or creates a substantial change with respect to an AI system, whether for its own use in the state of New York or for use by a third party. A deployer may also be considered a developer if its actions satisfy this definition.Civil Rights Law § 105(8) may hire more than one auditorAuditor"Auditor" shall refer to an independent entity including but not limited to an individual, non-profit, firm, corporation, partnership, cooperative, association, academic institution, or group affiliated with an academic institution, commissioned to perform an audit.Civil Rights Law § 105(3) to fulfill the requirements of this section. (b) An auditorAuditor"Auditor" shall refer to an independent entity including but not limited to an individual, non-profit, firm, corporation, partnership, cooperative, association, academic institution, or group affiliated with an academic institution, commissioned to perform an audit.Civil Rights Law § 105(3) shall be an independent entity including, but not limited to, an individual, non-profit, firm, corporation, partnership, cooperative, or association. (c) For the purposes of this article, no auditorAuditor"Auditor" shall refer to an independent entity including but not limited to an individual, non-profit, firm, corporation, partnership, cooperative, association, academic institution, or group affiliated with an academic institution, commissioned to perform an audit.Civil Rights Law § 105(3) may be commissioned by a covered developerCovered developer"Covered developer" means a developer that trained or initiated the training of an AI system that is used to make one or more consequential decisions with respect to covered subjects.Civil Rights Law § 105(7) or covered deployerCovered deployer"Covered deployer" means a deployer that uses a high-risk AI system to make one or more consequential decisions with respect to covered subjects.Civil Rights Law § 105(5) if such entity: (i) has already been commissioned to provide any auditing or non-auditing service including, but not limited, to financial auditing, cybersecurity auditing, or consulting services of any type, to the commissioning company in the past twelve months; or (ii) is, will be, or plans to be engaged in the business of developing or deploying an AI system that can compete commercially with such developerDeveloper"Developer" means a person, partnership, or corporation that trained or initiated the training of an AI system, or creates a substantial change with respect to an AI system, whether for its own use in the state of New York or for use by a third party. A deployer may also be considered a developer if its actions satisfy this definition.Civil Rights Law § 105(8)'s or deployerDeployer"Deployer" means any person, partnership, association or corporation that uses or makes an AI system available to one or more third parties including the general public for use, modification, copying, or a combination thereof with their software. A deployer shall not include any natural person using an AI system for personal use. A developer may also be considered a deployer if its actions satisfy this definition.Civil Rights Law § 105(6)'s AI system in the five years following an audit. (d) Fees paid to auditorsAuditor"Auditor" shall refer to an independent entity including but not limited to an individual, non-profit, firm, corporation, partnership, cooperative, association, academic institution, or group affiliated with an academic institution, commissioned to perform an audit.Civil Rights Law § 105(3) may not be contingent on the result of the audit and the commissioning company shall not provide any incentives or bonuses for a positive audit result. 4. Notwithstanding subdivision three of this section, a covered developerCovered developer"Covered developer" means a developer that trained or initiated the training of an AI system that is used to make one or more consequential decisions with respect to covered subjects.Civil Rights Law § 105(7) or covered deployerCovered deployer"Covered deployer" means a deployer that uses a high-risk AI system to make one or more consequential decisions with respect to covered subjects.Civil Rights Law § 105(5) may conduct audits under this section using an auditorAuditor"Auditor" shall refer to an independent entity including but not limited to an individual, non-profit, firm, corporation, partnership, cooperative, association, academic institution, or group affiliated with an academic institution, commissioned to perform an audit.Civil Rights Law § 105(3) that is an employee of such developerDeveloper"Developer" means a person, partnership, or corporation that trained or initiated the training of an AI system, or creates a substantial change with respect to an AI system, whether for its own use in the state of New York or for use by a third party. A deployer may also be considered a developer if its actions satisfy this definition.Civil Rights Law § 105(8) or deployerDeployer"Deployer" means any person, partnership, association or corporation that uses or makes an AI system available to one or more third parties including the general public for use, modification, copying, or a combination thereof with their software. A deployer shall not include any natural person using an AI system for personal use. A developer may also be considered a deployer if its actions satisfy this definition.Civil Rights Law § 105(6), if the cost of an audit that complies with subdivision three exceeds one percent of the fair market value of such developerDeveloper"Developer" means a person, partnership, or corporation that trained or initiated the training of an AI system, or creates a substantial change with respect to an AI system, whether for its own use in the state of New York or for use by a third party. A deployer may also be considered a developer if its actions satisfy this definition.Civil Rights Law § 105(8) or deployerDeployer"Deployer" means any person, partnership, association or corporation that uses or makes an AI system available to one or more third parties including the general public for use, modification, copying, or a combination thereof with their software. A deployer shall not include any natural person using an AI system for personal use. A developer may also be considered a deployer if its actions satisfy this definition.Civil Rights Law § 105(6).

5 At the attorney general's discretion, the attorney general may: (a) promulgate further rules as necessary to ensure that audits under this section assess whether or not AI systems produce algorithmic discriminationAlgorithmic discrimination"Algorithmic discrimination" means any condition in which the use of an AI system contributes to unjustified differential treatment or impacts, disfavoring people based on their actual or perceived age, race, ethnicity, creed, religion, color, national origin, citizenship or immigration status, sexual orientation, gender identity, gender expression, military status, sex, disability, predisposing genetic characteristics, familial status, marital status, status as a victim of domestic violence or other classification protected under state or federal laws. Algorithmic discrimination shall not include: (a) a developer's or deployer's testing of their own AI system to identify, mitigate, and prevent discriminatory bias; (b) expanding an applicant, customer, or participant pool to increase diversity or redress historical discrimination; or (c) an act or omission by or on behalf of a private club or other establishment that is not in fact open to the public, as set forth in Title II of the federal Civil Rights Act of 1964, 42 U.S.C. section 2000a(e), as amended.Civil Rights Law § 105(1) and otherwise comply with the provisions of this article; and (b) recommend an updated AI system auditing framework to the legislature, where such recommendations are based on a standard or framework (i) designed to evaluate the risks of AI systems, and (ii) that is nationally or internationally recognized and consensus-driven, including but not limited to a relevant framework or standard created by the International Organization for Standardization.

6-9 12 6. The independent auditorAuditor"Auditor" shall refer to an independent entity including but not limited to an individual, non-profit, firm, corporation, partnership, cooperative, association, academic institution, or group affiliated with an academic institution, commissioned to perform an audit.Civil Rights Law § 105(3) shall have complete and unredacted copies of all reports previously filed by the deployerDeployer"Deployer" means any person, partnership, association or corporation that uses or makes an AI system available to one or more third parties including the general public for use, modification, copying, or a combination thereof with their software. A deployer shall not include any natural person using an AI system for personal use. A developer may also be considered a deployer if its actions satisfy this definition.Civil Rights Law § 105(6) ordeveloper under section one hundred eleven of this article. 7. An audit conducted under this section may be completed in part, but shall not be completed entirely, with the assistance of an AI system. (a) Acceptable auditorAuditor"Auditor" shall refer to an independent entity including but not limited to an individual, non-profit, firm, corporation, partnership, cooperative, association, academic institution, or group affiliated with an academic institution, commissioned to perform an audit.Civil Rights Law § 105(3) uses of an AI system include, but are not limited to: (i) use of an audited high-risk AI systemHigh-risk AI system"High-risk AI system" means any AI system that, when deployed: (a) is a substantial factor in making a consequential decision; or (b) will have a material impact on the statutory or constitutional rights, civil liberties, safety, or welfare of an individual in the state.Civil Rights Law § 105(14) in a controlled environment without impacts on covered subjectsCovered subject"Covered subject" means any individual or group of individuals that is the subject of a consequential decision made entirely by or with the assistance of an AI system.Civil Rights Law § 105(12) for system testing purposes; or (ii) detecting patterns in the behavior of an audited AI system. (b) An auditorAuditor"Auditor" shall refer to an independent entity including but not limited to an individual, non-profit, firm, corporation, partnership, cooperative, association, academic institution, or group affiliated with an academic institution, commissioned to perform an audit.Civil Rights Law § 105(3) shall not: (i) use a different high-risk AI systemHigh-risk AI system"High-risk AI system" means any AI system that, when deployed: (a) is a substantial factor in making a consequential decision; or (b) will have a material impact on the statutory or constitutional rights, civil liberties, safety, or welfare of an individual in the state.Civil Rights Law § 105(14) that is not the subject of an audit to complete an audit; or (ii) use an AI system to draft an audit under this section without meaningful human reviewMeaningful human review"Meaningful human review" shall mean review, oversight and control of the AI system by one or more individuals who understand the risks, limitations, and functionality of, and are trained to use, the AI system and who have the authority to intervene or alter the decision under review, including but not limited to the ability to approve, deny, or modify any decision recommended or made by the AI system.Civil Rights Law § 105(19) and oversight. 8. The attorney general may promulgate further rules to ensure (a) the independence of auditorsAuditor"Auditor" shall refer to an independent entity including but not limited to an individual, non-profit, firm, corporation, partnership, cooperative, association, academic institution, or group affiliated with an academic institution, commissioned to perform an audit.Civil Rights Law § 105(3) under this section, and (b) that teams conducting audits incorporate feedback from communities that may foreseeably be the subject of algorithmic discriminationAlgorithmic discrimination"Algorithmic discrimination" means any condition in which the use of an AI system contributes to unjustified differential treatment or impacts, disfavoring people based on their actual or perceived age, race, ethnicity, creed, religion, color, national origin, citizenship or immigration status, sexual orientation, gender identity, gender expression, military status, sex, disability, predisposing genetic characteristics, familial status, marital status, status as a victim of domestic violence or other classification protected under state or federal laws. Algorithmic discrimination shall not include: (a) a developer's or deployer's testing of their own AI system to identify, mitigate, and prevent discriminatory bias; (b) expanding an applicant, customer, or participant pool to increase diversity or redress historical discrimination; or (c) an act or omission by or on behalf of a private club or other establishment that is not in fact open to the public, as set forth in Title II of the federal Civil Rights Act of 1964, 42 U.S.C. section 2000a(e), as amended.Civil Rights Law § 105(1) with respect to the AI system being audited. 9. If a developerDeveloper"Developer" means a person, partnership, or corporation that trained or initiated the training of an AI system, or creates a substantial change with respect to an AI system, whether for its own use in the state of New York or for use by a third party. A deployer may also be considered a developer if its actions satisfy this definition.Civil Rights Law § 105(8) or deployerDeployer"Deployer" means any person, partnership, association or corporation that uses or makes an AI system available to one or more third parties including the general public for use, modification, copying, or a combination thereof with their software. A deployer shall not include any natural person using an AI system for personal use. A developer may also be considered a deployer if its actions satisfy this definition.Civil Rights Law § 105(6) has an audit completed for the purpose of complying with another applicable federal, state, or local law or regulation, and the audit otherwise satisfies all other requirements of this section, such audit shall be deemed to satisfy the requirements of this section.

1-2 13 1. Every covered developerCovered developer"Covered developer" means a developer that trained or initiated the training of an AI system that is used to make one or more consequential decisions with respect to covered subjects.Civil Rights Law § 105(7) and covered deployerCovered deployer"Covered deployer" means a deployer that uses a high-risk AI system to make one or more consequential decisions with respect to covered subjects.Civil Rights Law § 105(5) shall comply with the reporting requirements of this section. 2. Together with each report required to be filed under this section, every covered developerCovered developer"Covered developer" means a developer that trained or initiated the training of an AI system that is used to make one or more consequential decisions with respect to covered subjects.Civil Rights Law § 105(7) and covered deployerCovered deployer"Covered deployer" means a deployer that uses a high-risk AI system to make one or more consequential decisions with respect to covered subjects.Civil Rights Law § 105(5) shall file with the department of financial services a copy of the last completed audit required by this article.

3 14 Covered developersCovered developer"Covered developer" means a developer that trained or initiated the training of an AI system that is used to make one or more consequential decisions with respect to covered subjects.Civil Rights Law § 105(7) of high-risk AI systemsHigh-risk AI system"High-risk AI system" means any AI system that, when deployed: (a) is a substantial factor in making a consequential decision; or (b) will have a material impact on the statutory or constitutional rights, civil liberties, safety, or welfare of an individual in the state.Civil Rights Law § 105(14) shall complete and file with the department of financial services reports in accordance with this subdivision. (a) A covered developerCovered developer"Covered developer" means a developer that trained or initiated the training of an AI system that is used to make one or more consequential decisions with respect to covered subjects.Civil Rights Law § 105(7) shall complete and file with the department of financial services at least: (i) a first report within six months after completion of development of the high-risk AI systemHigh-risk AI system"High-risk AI system" means any AI system that, when deployed: (a) is a substantial factor in making a consequential decision; or (b) will have a material impact on the statutory or constitutional rights, civil liberties, safety, or welfare of an individual in the state.Civil Rights Law § 105(14) and the initial offering of the high-risk AI systemHigh-risk AI system"High-risk AI system" means any AI system that, when deployed: (a) is a substantial factor in making a consequential decision; or (b) will have a material impact on the statutory or constitutional rights, civil liberties, safety, or welfare of an individual in the state.Civil Rights Law § 105(14) to a deployerDeployer"Deployer" means any person, partnership, association or corporation that uses or makes an AI system available to one or more third parties including the general public for use, modification, copying, or a combination thereof with their software. A deployer shall not include any natural person using an AI system for personal use. A developer may also be considered a deployer if its actions satisfy this definition.Civil Rights Law § 105(6) for deployment or, if the developerDeveloper"Developer" means a person, partnership, or corporation that trained or initiated the training of an AI system, or creates a substantial change with respect to an AI system, whether for its own use in the state of New York or for use by a third party. A deployer may also be considered a developer if its actions satisfy this definition.Civil Rights Law § 105(8) is first deployerDeployer"Deployer" means any person, partnership, association or corporation that uses or makes an AI system available to one or more third parties including the general public for use, modification, copying, or a combination thereof with their software. A deployer shall not include any natural person using an AI system for personal use. A developer may also be considered a deployer if its actions satisfy this definition.Civil Rights Law § 105(6) to deploy the high-risk AI systemHigh-risk AI system"High-risk AI system" means any AI system that, when deployed: (a) is a substantial factor in making a consequential decision; or (b) will have a material impact on the statutory or constitutional rights, civil liberties, safety, or welfare of an individual in the state.Civil Rights Law § 105(14), after initial deployment; (ii) one report annually following the submission of the first report; and (iii) one report within six months of any substantial changeSubstantial change"Substantial change" means any new version, new release, or any other intentional update to an AI system that results in significant and material changes to such AI system's appropriate use cases, key functionality, or expected outcomes, including but not limited to: (a) significant and material changes to the AI system's training data; (b) significant and material changes to the AI system's decision criteria in an appropriate use case; and (c) significant and material expansions or contractions of the AI system's appropriate use cases.Civil Rights Law § 105(17) to the high-risk AI systemHigh-risk AI system"High-risk AI system" means any AI system that, when deployed: (a) is a substantial factor in making a consequential decision; or (b) will have a material impact on the statutory or constitutional rights, civil liberties, safety, or welfare of an individual in the state.Civil Rights Law § 105(14). (b) A developerDeveloper"Developer" means a person, partnership, or corporation that trained or initiated the training of an AI system, or creates a substantial change with respect to an AI system, whether for its own use in the state of New York or for use by a third party. A deployer may also be considered a developer if its actions satisfy this definition.Civil Rights Law § 105(8) report under this section shall include: (i) a description of the system including: (A) the uses of the high-risk AI systemHigh-risk AI system"High-risk AI system" means any AI system that, when deployed: (a) is a substantial factor in making a consequential decision; or (b) will have a material impact on the statutory or constitutional rights, civil liberties, safety, or welfare of an individual in the state.Civil Rights Law § 105(14) that the developerDeveloper"Developer" means a person, partnership, or corporation that trained or initiated the training of an AI system, or creates a substantial change with respect to an AI system, whether for its own use in the state of New York or for use by a third party. A deployer may also be considered a developer if its actions satisfy this definition.Civil Rights Law § 105(8) intends; and (B) any explicitly unintended or disallowed uses of the high-risk AI systemHigh-risk AI system"High-risk AI system" means any AI system that, when deployed: (a) is a substantial factor in making a consequential decision; or (b) will have a material impact on the statutory or constitutional rights, civil liberties, safety, or welfare of an individual in the state.Civil Rights Law § 105(14); (ii) an overview of how the high-risk AI systemHigh-risk AI system"High-risk AI system" means any AI system that, when deployed: (a) is a substantial factor in making a consequential decision; or (b) will have a material impact on the statutory or constitutional rights, civil liberties, safety, or welfare of an individual in the state.Civil Rights Law § 105(14) was developed; (iii) an overview of the high-risk AI systemHigh-risk AI system"High-risk AI system" means any AI system that, when deployed: (a) is a substantial factor in making a consequential decision; or (b) will have a material impact on the statutory or constitutional rights, civil liberties, safety, or welfare of an individual in the state.Civil Rights Law § 105(14)'s training data; and (iv) if the developerDeveloper"Developer" means a person, partnership, or corporation that trained or initiated the training of an AI system, or creates a substantial change with respect to an AI system, whether for its own use in the state of New York or for use by a third party. A deployer may also be considered a developer if its actions satisfy this definition.Civil Rights Law § 105(8) conducted an audit in accordance with subdivision four of section one hundred ten of this article, an overview of the audit, including how the audit was structured, how the audit was conducted, and information on the auditorAuditor"Auditor" shall refer to an independent entity including but not limited to an individual, non-profit, firm, corporation, partnership, cooperative, association, academic institution, or group affiliated with an academic institution, commissioned to perform an audit.Civil Rights Law § 105(3); and (v) any other information necessary to allow a covered deployerCovered deployer"Covered deployer" means a deployer that uses a high-risk AI system to make one or more consequential decisions with respect to covered subjects.Civil Rights Law § 105(5) to: (A) understand the outputs and monitor the system for compliance with this article; and (B) fulfill its duties under this article.

4 15 Covered deployersCovered deployer"Covered deployer" means a deployer that uses a high-risk AI system to make one or more consequential decisions with respect to covered subjects.Civil Rights Law § 105(5) shall complete and file with the department of financial services reports in accordance with this subdivision. (a) A covered deployerCovered deployer"Covered deployer" means a deployer that uses a high-risk AI system to make one or more consequential decisions with respect to covered subjects.Civil Rights Law § 105(5) shall complete and file with the department of financial services at least: (i) a first report within six months after initial deployment; (ii) a second report within one year following the completion and filing of the first report; (iii) one report every two years following the completion and filing of the second report; and (iv) one report within six months of any substantial changeSubstantial change"Substantial change" means any new version, new release, or any other intentional update to an AI system that results in significant and material changes to such AI system's appropriate use cases, key functionality, or expected outcomes, including but not limited to: (a) significant and material changes to the AI system's training data; (b) significant and material changes to the AI system's decision criteria in an appropriate use case; and (c) significant and material expansions or contractions of the AI system's appropriate use cases.Civil Rights Law § 105(17) to the high-risk AI systemHigh-risk AI system"High-risk AI system" means any AI system that, when deployed: (a) is a substantial factor in making a consequential decision; or (b) will have a material impact on the statutory or constitutional rights, civil liberties, safety, or welfare of an individual in the state.Civil Rights Law § 105(14). (b) A deployerDeployer"Deployer" means any person, partnership, association or corporation that uses or makes an AI system available to one or more third parties including the general public for use, modification, copying, or a combination thereof with their software. A deployer shall not include any natural person using an AI system for personal use. A developer may also be considered a deployer if its actions satisfy this definition.Civil Rights Law § 105(6) report under this section shall include: (i) a description of the system including: (A) the deployerDeployer"Deployer" means any person, partnership, association or corporation that uses or makes an AI system available to one or more third parties including the general public for use, modification, copying, or a combination thereof with their software. A deployer shall not include any natural person using an AI system for personal use. A developer may also be considered a deployer if its actions satisfy this definition.Civil Rights Law § 105(6)'s actual, intended, or planned uses of the high-risk AI systemHigh-risk AI system"High-risk AI system" means any AI system that, when deployed: (a) is a substantial factor in making a consequential decision; or (b) will have a material impact on the statutory or constitutional rights, civil liberties, safety, or welfare of an individual in the state.Civil Rights Law § 105(14) with respect to consequential decisionsConsequential decision"Consequential decision" means a decision or judgment that has a material, legal or similarly significant effect on an individual's access to, or the cost, terms, or availability of, any of the following: (a) Employment, workers' management, or self-employment, including, but not limited to, all of the following: (i) Pay or promotion; and (ii) Hiring or termination. (b) Education and vocational training, including, but not limited to, all of the following: (i) Accreditation; (ii) Certification; (iii) Admissions; and (iv) Financial aid or scholarships. (c) Housing or lodging, including rental or short-term housing or lodging. (d) Family planning, including adoption services or reproductive services, as well as assessments related to child protective services. (e) Health care or health insurance, including mental health care, dental, or vision, except for radiology. (f) Financial services, including a financial service provided by a mortgage company, mortgage broker, or creditor. (g) Legal services.Civil Rights Law § 105(4); and (B) whether the deployerDeployer"Deployer" means any person, partnership, association or corporation that uses or makes an AI system available to one or more third parties including the general public for use, modification, copying, or a combination thereof with their software. A deployer shall not include any natural person using an AI system for personal use. A developer may also be considered a deployer if its actions satisfy this definition.Civil Rights Law § 105(6) is using the high-risk AI systemHigh-risk AI system"High-risk AI system" means any AI system that, when deployed: (a) is a substantial factor in making a consequential decision; or (b) will have a material impact on the statutory or constitutional rights, civil liberties, safety, or welfare of an individual in the state.Civil Rights Law § 105(14) for any developerDeveloper"Developer" means a person, partnership, or corporation that trained or initiated the training of an AI system, or creates a substantial change with respect to an AI system, whether for its own use in the state of New York or for use by a third party. A deployer may also be considered a developer if its actions satisfy this definition.Civil Rights Law § 105(8) unintended or disallowed uses; and (ii) an impact assessment including: (A) whether the high-risk AI systemHigh-risk AI system"High-risk AI system" means any AI system that, when deployed: (a) is a substantial factor in making a consequential decision; or (b) will have a material impact on the statutory or constitutional rights, civil liberties, safety, or welfare of an individual in the state.Civil Rights Law § 105(14) poses a risk of algorithmic discriminationAlgorithmic discrimination"Algorithmic discrimination" means any condition in which the use of an AI system contributes to unjustified differential treatment or impacts, disfavoring people based on their actual or perceived age, race, ethnicity, creed, religion, color, national origin, citizenship or immigration status, sexual orientation, gender identity, gender expression, military status, sex, disability, predisposing genetic characteristics, familial status, marital status, status as a victim of domestic violence or other classification protected under state or federal laws. Algorithmic discrimination shall not include: (a) a developer's or deployer's testing of their own AI system to identify, mitigate, and prevent discriminatory bias; (b) expanding an applicant, customer, or participant pool to increase diversity or redress historical discrimination; or (c) an act or omission by or on behalf of a private club or other establishment that is not in fact open to the public, as set forth in Title II of the federal Civil Rights Act of 1964, 42 U.S.C. section 2000a(e), as amended.Civil Rights Law § 105(1) and the steps taken to address the risk of algorithmic discriminationAlgorithmic discrimination"Algorithmic discrimination" means any condition in which the use of an AI system contributes to unjustified differential treatment or impacts, disfavoring people based on their actual or perceived age, race, ethnicity, creed, religion, color, national origin, citizenship or immigration status, sexual orientation, gender identity, gender expression, military status, sex, disability, predisposing genetic characteristics, familial status, marital status, status as a victim of domestic violence or other classification protected under state or federal laws. Algorithmic discrimination shall not include: (a) a developer's or deployer's testing of their own AI system to identify, mitigate, and prevent discriminatory bias; (b) expanding an applicant, customer, or participant pool to increase diversity or redress historical discrimination; or (c) an act or omission by or on behalf of a private club or other establishment that is not in fact open to the public, as set forth in Title II of the federal Civil Rights Act of 1964, 42 U.S.C. section 2000a(e), as amended.Civil Rights Law § 105(1); (B) if the high-risk AI systemHigh-risk AI system"High-risk AI system" means any AI system that, when deployed: (a) is a substantial factor in making a consequential decision; or (b) will have a material impact on the statutory or constitutional rights, civil liberties, safety, or welfare of an individual in the state.Civil Rights Law § 105(14) is or will be monetized, how it is or is planned to be monetized; and (C) an evaluation of the costs and benefits to consumers and other covered subjectsCovered subject"Covered subject" means any individual or group of individuals that is the subject of a consequential decision made entirely by or with the assistance of an AI system.Civil Rights Law § 105(12); and (iii) if the deployerDeployer"Deployer" means any person, partnership, association or corporation that uses or makes an AI system available to one or more third parties including the general public for use, modification, copying, or a combination thereof with their software. A deployer shall not include any natural person using an AI system for personal use. A developer may also be considered a deployer if its actions satisfy this definition.Civil Rights Law § 105(6) conducted an audit in accordance with subdivision four of section one hundred ten of this article, an overview of the audit, including how the audit was structured, how the audit was conducted, and information on the auditorAuditor"Auditor" shall refer to an independent entity including but not limited to an individual, non-profit, firm, corporation, partnership, cooperative, association, academic institution, or group affiliated with an academic institution, commissioned to perform an audit.Civil Rights Law § 105(3). (c) A covered deployerCovered deployer"Covered deployer" means a deployer that uses a high-risk AI system to make one or more consequential decisions with respect to covered subjects.Civil Rights Law § 105(5) that is also a covered developerCovered developer"Covered developer" means a developer that trained or initiated the training of an AI system that is used to make one or more consequential decisions with respect to covered subjects.Civil Rights Law § 105(7) and is required to submit reports under subdivision three of this section may submit a single joint report provided it contains the information required in this subdivision.

5 The attorney general shall promulgate rules for a process whereby covered developersCovered developer"Covered developer" means a developer that trained or initiated the training of an AI system that is used to make one or more consequential decisions with respect to covered subjects.Civil Rights Law § 105(7) and covered deployersCovered deployer"Covered deployer" means a deployer that uses a high-risk AI system to make one or more consequential decisions with respect to covered subjects.Civil Rights Law § 105(5) may request redaction of portions of reports required under this section to ensure that they are not required to disclose sensitive and protected information.

6 For high-risk AI systemsHigh-risk AI system"High-risk AI system" means any AI system that, when deployed: (a) is a substantial factor in making a consequential decision; or (b) will have a material impact on the statutory or constitutional rights, civil liberties, safety, or welfare of an individual in the state.Civil Rights Law § 105(14) which are already in deployment at the time of the effective date of this article, covered developersCovered developer"Covered developer" means a developer that trained or initiated the training of an AI system that is used to make one or more consequential decisions with respect to covered subjects.Civil Rights Law § 105(7) and covered deployersCovered deployer"Covered deployer" means a deployer that uses a high-risk AI system to make one or more consequential decisions with respect to covered subjects.Civil Rights Law § 105(5) shall have eighteen months from such effective date to complete and file the first report and associated independent audit required by this article. (a) Each covered developerCovered developer"Covered developer" means a developer that trained or initiated the training of an AI system that is used to make one or more consequential decisions with respect to covered subjects.Civil Rights Law § 105(7) shall thereafter file at least one report annually following the submission of the first report under this subdivision. (b) Each covered deployerCovered deployer"Covered deployer" means a deployer that uses a high-risk AI system to make one or more consequential decisions with respect to covered subjects.Civil Rights Law § 105(5) shall thereafter file at least one report every two years following the submission of the first report under this subdivision.

1 16 Each covered developerCovered developer"Covered developer" means a developer that trained or initiated the training of an AI system that is used to make one or more consequential decisions with respect to covered subjects.Civil Rights Law § 105(7) or covered deployerCovered deployer"Covered deployer" means a deployer that uses a high-risk AI system to make one or more consequential decisions with respect to covered subjects.Civil Rights Law § 105(5) shall plan, document, and implement a risk management policy and programRisk management policy and program"Risk management policy and program" means the risk management policy and program created pursuant to section one hundred twelve of this article.Civil Rights Law § 105(16) to govern development or deployment, as applicable, of such high-risk AI systemHigh-risk AI system"High-risk AI system" means any AI system that, when deployed: (a) is a substantial factor in making a consequential decision; or (b) will have a material impact on the statutory or constitutional rights, civil liberties, safety, or welfare of an individual in the state.Civil Rights Law § 105(14). The risk management policy and programRisk management policy and program"Risk management policy and program" means the risk management policy and program created pursuant to section one hundred twelve of this article.Civil Rights Law § 105(16) shall specify and incorporate the principles, processes, and personnel that the developerDeveloper"Developer" means a person, partnership, or corporation that trained or initiated the training of an AI system, or creates a substantial change with respect to an AI system, whether for its own use in the state of New York or for use by a third party. A deployer may also be considered a developer if its actions satisfy this definition.Civil Rights Law § 105(8) or deployerDeployer"Deployer" means any person, partnership, association or corporation that uses or makes an AI system available to one or more third parties including the general public for use, modification, copying, or a combination thereof with their software. A deployer shall not include any natural person using an AI system for personal use. A developer may also be considered a deployer if its actions satisfy this definition.Civil Rights Law § 105(6) uses to identify, document, and mitigate known or reasonably foreseeable risks of algorithmic discriminationAlgorithmic discrimination"Algorithmic discrimination" means any condition in which the use of an AI system contributes to unjustified differential treatment or impacts, disfavoring people based on their actual or perceived age, race, ethnicity, creed, religion, color, national origin, citizenship or immigration status, sexual orientation, gender identity, gender expression, military status, sex, disability, predisposing genetic characteristics, familial status, marital status, status as a victim of domestic violence or other classification protected under state or federal laws. Algorithmic discrimination shall not include: (a) a developer's or deployer's testing of their own AI system to identify, mitigate, and prevent discriminatory bias; (b) expanding an applicant, customer, or participant pool to increase diversity or redress historical discrimination; or (c) an act or omission by or on behalf of a private club or other establishment that is not in fact open to the public, as set forth in Title II of the federal Civil Rights Act of 1964, 42 U.S.C. section 2000a(e), as amended.Civil Rights Law § 105(1) covered under subdivision one of section one hundred six of this article. The risk management policy and programRisk management policy and program"Risk management policy and program" means the risk management policy and program created pursuant to section one hundred twelve of this article.Civil Rights Law § 105(16) shall be an iterative process planned, implemented, and regularly and systematically reviewed and updated over the life cycle of a high-risk AI systemHigh-risk AI system"High-risk AI system" means any AI system that, when deployed: (a) is a substantial factor in making a consequential decision; or (b) will have a material impact on the statutory or constitutional rights, civil liberties, safety, or welfare of an individual in the state.Civil Rights Law § 105(14), requiring regular, systematic review and updates, including updates to documentation. A risk management policy and programRisk management policy and program"Risk management policy and program" means the risk management policy and program created pursuant to section one hundred twelve of this article.Civil Rights Law § 105(16) implemented and maintained pursuant to this section shall be reasonable considering: (a) The guidance and standards set forth in: (i) version 1.0 of the "Artificial Intelligence Risk Management Framework" published by the National Institute of Standards and Technology in the United States department of commerce, (ii) ISO 42001ISO 42001"ISO 42001" means international standard ISO/IEC 42001:2023 (Information technology -- Artificial intelligence -- Management system), published by the International Organization for Standardization on December eighteenth, two thousand twenty-three.Civil Rights Law § 105(15), or (iii) another substantially equivalent framework selected at the discretion of the attorney general, if such framework was designed to manage risks associated with AI systems, is nationally or internationally recognized and consensus-driven, and is at least as stringent as version 1.0 of the "Artificial Intelligence Risk Management Framework" published by the National Institute of Standards and Technology or ISO 42001ISO 42001"ISO 42001" means international standard ISO/IEC 42001:2023 (Information technology -- Artificial intelligence -- Management system), published by the International Organization for Standardization on December eighteenth, two thousand twenty-three.Civil Rights Law § 105(15); (b) The size and complexity of the developerDeveloper"Developer" means a person, partnership, or corporation that trained or initiated the training of an AI system, or creates a substantial change with respect to an AI system, whether for its own use in the state of New York or for use by a third party. A deployer may also be considered a developer if its actions satisfy this definition.Civil Rights Law § 105(8) or deployerDeployer"Deployer" means any person, partnership, association or corporation that uses or makes an AI system available to one or more third parties including the general public for use, modification, copying, or a combination thereof with their software. A deployer shall not include any natural person using an AI system for personal use. A developer may also be considered a deployer if its actions satisfy this definition.Civil Rights Law § 105(6); (c) The nature, scope, and intended uses of the high-risk AI systemHigh-risk AI system"High-risk AI system" means any AI system that, when deployed: (a) is a substantial factor in making a consequential decision; or (b) will have a material impact on the statutory or constitutional rights, civil liberties, safety, or welfare of an individual in the state.Civil Rights Law § 105(14) developed or deployed; and (d) The sensitivity and volume of data processed in connection with the high-risk AI systemHigh-risk AI system"High-risk AI system" means any AI system that, when deployed: (a) is a substantial factor in making a consequential decision; or (b) will have a material impact on the statutory or constitutional rights, civil liberties, safety, or welfare of an individual in the state.Civil Rights Law § 105(14).

2 A risk management policy and programRisk management policy and program"Risk management policy and program" means the risk management policy and program created pursuant to section one hundred twelve of this article.Civil Rights Law § 105(16) implemented pursuant to subdivision one of this section may cover multiple high-risk AI systemsHigh-risk AI system"High-risk AI system" means any AI system that, when deployed: (a) is a substantial factor in making a consequential decision; or (b) will have a material impact on the statutory or constitutional rights, civil liberties, safety, or welfare of an individual in the state.Civil Rights Law § 105(14) developed by the same developerDeveloper"Developer" means a person, partnership, or corporation that trained or initiated the training of an AI system, or creates a substantial change with respect to an AI system, whether for its own use in the state of New York or for use by a third party. A deployer may also be considered a developer if its actions satisfy this definition.Civil Rights Law § 105(8) or deployed by the same deployerDeployer"Deployer" means any person, partnership, association or corporation that uses or makes an AI system available to one or more third parties including the general public for use, modification, copying, or a combination thereof with their software. A deployer shall not include any natural person using an AI system for personal use. A developer may also be considered a deployer if its actions satisfy this definition.Civil Rights Law § 105(6) if sufficient.

3 The attorney general may require a covered developerCovered developer"Covered developer" means a developer that trained or initiated the training of an AI system that is used to make one or more consequential decisions with respect to covered subjects.Civil Rights Law § 105(7) or a covered deployerCovered deployer"Covered deployer" means a deployer that uses a high-risk AI system to make one or more consequential decisions with respect to covered subjects.Civil Rights Law § 105(5) to disclose the risk management policy and programRisk management policy and program"Risk management policy and program" means the risk management policy and program created pursuant to section one hundred twelve of this article.Civil Rights Law § 105(16) implemented pursuant to subdivision one of this section in a form and manner prescribed by the attorney general. The attorney general may evaluate the risk management policy and programRisk management policy and program"Risk management policy and program" means the risk management policy and program created pursuant to section one hundred twelve of this article.Civil Rights Law § 105(16) to ensure compliance with this section.

4 Notwithstanding subdivision one of this section, a developerDeveloper"Developer" means a person, partnership, or corporation that trained or initiated the training of an AI system, or creates a substantial change with respect to an AI system, whether for its own use in the state of New York or for use by a third party. A deployer may also be considered a developer if its actions satisfy this definition.Civil Rights Law § 105(8) that is in compliance with the duties under section fourteen hundred twenty-two of the general business law shall be deemed in compliance with this section.

17 No person, partnership, association or corporation shall develop, deploy, use, or sell an AI system which evaluates or classifies the trustworthiness of natural persons over a certain period of time based on their social behavior or known or predicted personal or personality characteristics, with the social score leading to any of the following: 1. differential treatment of certain natural persons or whole groups thereof in social contexts which are unrelated to the contexts in which the data was originally generated or collected; 2. differential treatment of certain natural persons or whole groups thereof that is unjustified or disproportionate to their social behavior or its gravity; or 3. the infringement of any right guaranteed under the United States constitution, the New York constitution, or state or federal law.

1 Whenever there shall be a violation of section one hundred seven, one hundred eight, one hundred ten, one hundred eleven, one hundred twelve, or one hundred thirteen of this article, an application may be made by the attorney general in the name of the people of the state of New York, to the supreme court having jurisdiction to issue an injunction, and upon notice to the respondent of not less than ten days, to enjoin and restrain the continuance of such violation; and if it shall appear to the satisfaction of the court that the respondent has, in fact, violated this article, an injunction may be issued by the court, enjoining and restraining any further violations, without requiring proof that any person has, in fact, been injured or damaged thereby. In any such proceeding, the court may make allowances to the attorney general as provided in paragraph six of subdivision (a) of section eighty-three hundred three of the civil practice law and rules, and direct restitution. Whenever the court shall determine that a violation of this article has occurred: (a) by a developerDeveloper"Developer" means a person, partnership, or corporation that trained or initiated the training of an AI system, or creates a substantial change with respect to an AI system, whether for its own use in the state of New York or for use by a third party. A deployer may also be considered a developer if its actions satisfy this definition.Civil Rights Law § 105(8), the court may impose a civil penalty of not more than twenty-five thousand dollars for each violation; or (b) by a deployerDeployer"Deployer" means any person, partnership, association or corporation that uses or makes an AI system available to one or more third parties including the general public for use, modification, copying, or a combination thereof with their software. A deployer shall not include any natural person using an AI system for personal use. A developer may also be considered a deployer if its actions satisfy this definition.Civil Rights Law § 105(6), the court may impose a civil penalty of not more than ten thousand dollars for each violation.

2 In evaluating any motion to dismiss a proceeding commenced pursuant to this section, the court shall presume the specified AI system was created and/or operated in violation of a specified law or laws and that such violation caused the harm or harms alleged. (a) A defendant can rebut presumptions made pursuant to this subdivision through clear and convincing evidence that the specified AI system did not cause the harm or harms alleged and/or did not violate the alleged law or laws. An algorithmic audit can be considered as evidence in rebutting such presumptions, but the mere existence of such an audit, without additional evidence, shall not be considered clear and convincing evidence. (b) Where such presumptions are not rebutted pursuant to this subdivision, the action shall not be dismissed. (c) Where such presumptions are rebutted pursuant to this subdivision, a motion to dismiss an action shall be adjudicated without any consideration of this section.

3 The supreme court in the state shall have jurisdiction over any action, claim, or lawsuit to enforce the provisions of this article.

If any clause, sentence, paragraph, subdivision, section or part of this article shall be adjudged by any court of competent jurisdiction to be invalid, such judgment shall not affect, impair, or invalidate the remainder thereof, but shall be confined in its operation to the clause, sentence, paragraph, subdivision, section, or part thereof directly involved in the controversy in which such judgment shall have been made.

23 18 It shall be an unlawful discriminatory practice under this section for a deployerDeployer"Deployer" means any person, partnership, association or corporation that uses or makes an AI system available to one or more third parties including the general public for use, modification, copying, or a combination thereof with their software. A deployer shall not include any natural person using an AI system for personal use. A developer may also be considered a deployer if its actions satisfy this definition.Civil Rights Law § 105(6) or a developerDeveloper"Developer" means a person, partnership, or corporation that trained or initiated the training of an AI system, or creates a substantial change with respect to an AI system, whether for its own use in the state of New York or for use by a third party. A deployer may also be considered a developer if its actions satisfy this definition.Civil Rights Law § 105(8), as such terms are defined in section one hundred five of the civil rights law, to engage in an unlawful discriminatory practice under section one hundred six of the civil rights law.