Regulon — NY-SB-8115 · NY SB 8115 (Automated Lending Decision Tools)

WHAT THIS BILL REGULATES · 5 REQUIREMENT TYPES

How Is This Bill Enforced

Enforcement Authority

The Superintendent of the Department of Financial Services has exclusive enforcement authority. The superintendent may conduct investigations, compel attendance and testimony under oath, and compel production of books, records, accounts, and documents. Upon finding discriminatory or biased outcomes, the superintendent may direct a covered entity to cease use of the tool and require additional reporting. No private right of action is created.

Private Right of Action

No private right of action. Enforcement is exclusive to the designated authority.

Penalties

The bill does not specify monetary penalties, statutory damages, or private remedies. The superintendent's enforcement powers include investigative authority, the power to compel cessation of a discriminatory tool, and the power to require additional reporting. Specific civil penalties are not enumerated in the bill text.

Verbatim statutory text on the left; plain-language analysis and a per-section checklist on the right. Numbered markers cross-link to the matching checklist row.

Statutory Text

Analysis & Obligations

Banking Law § 103-a(1)

Definitions

(1)(a) "Automated lending decision-making tool" means any software that uses algorithms, computational models, or artificial intelligence techniques, or a combination thereof, to materially automate or replace human decision-making regarding lending decisions that impact natural persons. "Automated lending decision-making tool" shall not include any software used primarily for basic computerized processes, such as calculators, spellcheck tools, autocorrect functions, spreadsheets, electronic communications, or any tool that relates only to internal management affairs such as ordering office supplies or processing payments, and that do not materially impact any lending decisions relating to natural persons.

(1)(b) "Lending decision" means any determination made by a covered entity or its agent, whether automated, manual or a combination thereof, that affects the approval, denial, offer, counteroffer, or modification of the terms or conditions of a loan or credit application, including decisions regarding creditworthiness, loan amounts, interest rates, collateral requirements, repayment, or any other material term, and any determination that considers any factor that results or may result in "adverse action" as such term is defined in the federal Fair Credit Reporting Act 15 U.S.C. 1681a(k).

(1)(c) "Covered entity" means any banking organization, foreign banking corporation licensed by the superintendent to transact business in this state pursuant to article five of this chapter, interstate branch authorized by the superintendent to transact business in this state pursuant to article five-C of this chapter, and licensed lender. Covered entity shall not include any national bank, federal savings bank, federal savings and loan association, federal credit union, federal trust company or foreign banking corporation organized under the laws of the United States.

(1)(d) "Material change" means any modification to an automated lending decision-making tool which directly impacts the tool's outputs.

Subdivision 1 establishes the four defined terms that frame the bill's scope. Automated lending decision-making tool is defined broadly to include any software using algorithms, computational models, or AI to materially automate or replace human lending decisions affecting natural persons, but explicitly carves out basic office tools such as calculators, spreadsheets, and spellcheck. Covered entity is limited to state-chartered banking organizations, foreign banking corporations licensed in New York, interstate branches authorized in New York, and licensed lenders — with an express exclusion for all federally chartered institutions. Lending decision encompasses the full lifecycle from approval through modification and incorporates the federal Fair Credit Reporting Act definition of adverse action.

Banking Law § 103-a(2)

Impact assessment and public disclosure requirements

Deployer

(2) 1 No less than annually, each covered entity that uses automated lending decision-making tools shall conduct an impact assessment substantially completed and bearing the signature of one or more individuals responsible for meaningful human review for the lawful application and use of such automated lending decision-making tools. An impact assessment shall be conducted prior to any material change to any automated lending decision-making tool that may change the outcome or effect of such tool. An impact assessment final report summarizing the conclusions of the initial impact assessment shall be posted on such covered entity's website prior to the implementation and use of such automated lending decision-making tool and updated on the entity's website following each subsequent assessment. Such impact assessment final report shall include: (a) a description of the objectives of the automated lending decision-making tool; (b) an evaluation of the ability of the automated lending decision-making tool to achieve its stated objectives; (c) a description and evaluation of the objectives and development of the automated lending decision-making tool including: (i) a summary of the underlying algorithms, computational modes, and artificial intelligence tools that are used within the automated lending decision-making tool; and (ii) the design and training data used to develop the automated lending decision-making tool process; (d) testing for: (i) accuracy, fairness, bias and discrimination, and an assessment of whether the use of the automated lending decision-making tool produces discriminatory results on the basis of a consumer's or a class of consumers' actual or perceived race, color, ethnicity, religion, national origin, sex, gender, gender identity, sexual orientation, familial status, biometric information, lawful source of income, age, or disability and, outlines mitigations for any identified performance differences in outcomes across relevant groups impacted by such use; (ii) any cybersecurity vulnerabilities and privacy risks resulting from the deployment and use of the automated lending decision-making tool, and the development or existence of safeguards to mitigate the risks; (iii) any public health or safety risks resulting from the deployment and use of the automated lending decision-making tool; and (iv) any reasonably foreseeable misuse of the automated lending decision-making tool and the development or existence of safeguards against such misuse; (e) the extent to which the deployment and use of the automated lending decision-making tool requires input of sensitive and personal data, how that data is used and stored, and any control users may have over their data; and (f) the notification mechanism or procedure, if any, by which individuals impacted by the utilization of the automated lending decision-making tool may be notified of the use of such automated lending decision-making tool and of the individual's personal data, and informed of their rights and options relating to such use.

Subdivision 2 imposes the bill's core governance obligation: covered entities must conduct an impact assessment at least annually, and additionally before any material change to the tool. The assessment must be signed by one or more individuals responsible for meaningful human review, creating a personal accountability link. A summary of findings must be published on the covered entity's website before the tool is first deployed and updated after each subsequent assessment.

The required assessment content is comprehensive: it must cover the tool's objectives and performance, the underlying algorithms and training data, testing for accuracy, fairness, bias, and discrimination across an extensive list of protected characteristics, cybersecurity and privacy risks, public health and safety risks, reasonably foreseeable misuse and safeguards, sensitive data handling practices, and the mechanism for notifying affected individuals. The protected characteristics enumerated — including biometric information and lawful source of income — go beyond typical federal protected classes.

Compliance actions 1 item

Covered entities must conduct at least annual impact assessments of each automated lending decision-making tool — signed by a responsible human reviewer — covering accuracy, fairness, bias, discrimination across protected characteristics, cybersecurity, privacy, safety, misuse risks, data practices, and notification mechanisms, and must publish a summary report on their website before deployment and after each subsequent assessment. An additional assessment is required before any material change to the tool.

H-02.1

Banking Law § 103-a(3)

Record retention and regulatory production

Deployer

(3) 2 In addition to the powers conferred to the superintendent in subdivision six of this section, a covered entity shall retain the full impact assessment and summary for a period of seven years and shall, upon notice by the superintendent, provide such full assessment and summary to the department within seven days.

Subdivision 3 requires covered entities to retain the full impact assessment and summary for seven years and to produce the documents to the Department of Financial Services within seven days upon notice from the superintendent. This creates both a long-tail retention obligation and a rapid-production requirement that covered entities must plan for operationally.

Compliance actions 1 item

Covered entities must retain the full impact assessment and summary for seven years and produce them to the Department of Financial Services within seven days of notice from the superintendent.

G-01.3

Banking Law § 103-a(4)

Discriminatory outcome reporting and cessation

Deployer

(4) 3 Notwithstanding the provisions of this article or any other law, if an impact assessment finds that the automated lending decision-making tool produces discriminatory or biased outcomes, such covered entity shall, within thirty days of such findings, report such findings to the department. Upon such report being received by the department, the department shall direct such covered entity to cease any utilization, application, or function of such automated lending decision-making tool, and of any information produced using such tool.

Subdivision 4 creates a mandatory escalation pathway when an impact assessment reveals discriminatory or biased outcomes. The covered entity must report findings to the department within 30 days, and upon receipt the department must direct the covered entity to cease all use of the tool and any information produced by it. The cessation directive is mandatory — the department has no discretion once a report is filed. This creates an unusually strong enforcement mechanism: the covered entity's own self-assessment triggers an automatic shutdown order.

Compliance actions 1 item

Covered entities must report to the Department of Financial Services within 30 days if an impact assessment finds the automated lending decision-making tool produces discriminatory or biased outcomes. Upon receipt, the department must direct the covered entity to cease all use of the tool and of any information produced by it.

R-01.3

Banking Law § 103-a(5)

Applicant notification, denial disclosure, and correction rights

Deployer

(5)(a)(i)–(iii), (5)(b) first sentence 4 Any covered entity that uses an automated lending decision-making tool to screen applicants for a loan shall notify each such applicant of the following: (i) That an automated lending decision-making tool will be used in connection with the assessment or evaluation of such applicant; (ii) The criteria that such automated lending decision-making tool will use in the assessment of such applicant; (iii) Information about the type of data collected for such automated lending decision-making tool, the source of such data, and the covered entity's data retention policy; (b) The notice required by paragraph (a), with the exception of the information required in subparagraph (iv) of such paragraph, of this subdivision shall be made no less than twenty-four hours before the use of such automated lending decision-making tool.

(5)(a)(iv), (5)(b) second sentence 5 If an application for a loan is denied through use of the automated lending decision-making tool, to the extent practicable, the reason for such denial. The notice required by subparagraph (iv) of such paragraph (a) shall be made within twenty-four hours after such denial.

(5)(c) 6 If an application for a loan is denied based on personal information that is incorrect, the applicant, upon receipt of the notice required by subparagraph (iv) of paragraph (a) of this subdivision, shall have thirty days to correct such information and appeal such denial.

Subdivision 5 establishes three distinct applicant-facing obligations. First, covered entities must provide pre-use notice at least 24 hours before the automated lending tool is used, disclosing that the tool will be used, the criteria it applies, and the data it collects including sources and retention policies. Second, if the tool produces a denial, the covered entity must disclose the reason for denial within 24 hours to the extent practicable. Third, when a denial is based on incorrect personal information, the applicant has 30 days to correct the information and appeal the denial — creating a substantive data correction and appeal right.

Compliance actions 3 items

Covered entities must notify each loan applicant at least 24 hours before using an automated lending decision-making tool, disclosing (1) that the tool will be used, (2) the criteria the tool will apply, and (3) the type and source of data collected and the entity's data retention policy.

H-01.3

Covered entities must, to the extent practicable, notify a loan applicant of the reason for denial within 24 hours after a loan application is denied through use of an automated lending decision-making tool.

H-01.1

Covered entities must provide loan applicants denied based on incorrect personal information a 30-day window to correct the information and appeal the denial.

H-01.2

Banking Law § 103-a(6)

Superintendent investigative powers

(6) The superintendent shall have the power to make such investigations as the superintendent deems necessary to determine whether any covered entity has violated any of the provisions of this section. To the extent necessary therefor, the superintendent may require the attendance of and examine any person under oath, and shall have the power to compel the production of all relevant books, records, accounts, and documents. The superintendent shall have the power to make such examinations of the books, records, accounts and documents used in the business of any covered entity as the superintendent deems necessary to determine whether any such covered entity has violated any of the provisions of this section, or to secure information lawfully required by the superintendent.

Subdivision 6 grants the superintendent broad investigative authority to determine whether any covered entity has violated the section. The superintendent may require attendance and examine persons under oath, compel production of all relevant books, records, accounts, and documents, and conduct examinations as deemed necessary. This creates the enforcement backbone for the bill but does not impose a new compliance obligation on covered entities beyond cooperating with lawful investigations.

Banking Law § 103-a(7)

Enhanced reporting for entities with discriminatory outcomes

Deployer

(7) 7 Notwithstanding the provisions of subdivision two of this section, the superintendent may, upon a finding that a covered entity has deployed an automated lending decision-making tool which produced discriminatory or biased outcomes, require, in accordance with the rules and regulations promulgated by the superintendent, (a) additional annual reports, (b) annual reports with additional information, (c) a combination of paragraphs (a) and (b) of this subdivision, and/or (d) that such covered entity provide any and all additional reports to the department directly.

Subdivision 7 grants the superintendent discretionary authority to impose enhanced reporting requirements on covered entities that have deployed tools producing discriminatory or biased outcomes. The superintendent may require additional annual reports, reports with additional information, or a combination thereof, and may require direct submission to the department. This is a regulator-facing power rather than an independent covered-entity obligation — it is triggered by a superintendent finding, not by the entity's own discovery.

Compliance actions 1 item

Covered entities found by the superintendent to have deployed a tool producing discriminatory or biased outcomes must comply with any enhanced reporting requirements imposed by the superintendent, which may include additional annual reports, reports with additional information, or direct submission to the department.

R-02.1

Banking Law § 103-a(8)

Severability

(8) The provisions of this section shall be severable, and if any phrase, clause, sentence, or provision is declared to be invalid, or is preempted by federal law or regulation, the validity of the remainder of this section shall not be affected thereby. If any provision of this section, or its application to any person or circumstance, is held to be invalid or preempted by federal law, the remainder of this section and its application to other persons or circumstances shall not be affected and shall continue in full force and effect to the maximum extent permitted by law.

Subdivision 8 is a standard severability provision that expressly contemplates potential federal preemption. If any phrase, clause, sentence, or provision is declared invalid or preempted by federal law, the remainder of the section continues in full force.

§ 2

Effective date

This act shall take effect on the ninetieth day after it shall have become a law.

The act takes effect on the ninetieth day after it becomes law. Because the bill has not yet been enacted, the specific effective date cannot be determined.

Human Oversight Decision review · appeal pathways

4 items

H-02.1

H-01.3

H-01.1

H-01.2

Covered entities must provide loan applicants denied based on incorrect personal information a 30-day window to correct the information and appeal the denial.

Governance Risk management · accountability programs

1 item

G-01.3

Covered entities must retain the full impact assessment and summary for seven years and produce them to the Department of Financial Services within seven days of notice from the superintendent.

Regulatory Reporting · disclosure · audit

2 items

R-01.3

R-02.1

Passage Likelihood

Low

Status Introduced

Chamber No passage

Committee No action

Majority party Yes

Bipartisan No

Prior session None

Legislative History

2025-05-15 REFERRED TO BANKS

2025-05-27 REPORTED AND COMMITTED TO INTERNET AND TECHNOLOGY

2025-06-02 AMEND (T) AND RECOMMIT TO INTERNET AND TECHNOLOGY

2025-06-02 PRINT NUMBER 8115A

2025-06-05 AMEND AND RECOMMIT TO INTERNET AND TECHNOLOGY

2025-06-05 PRINT NUMBER 8115B

2026-01-07 REFERRED TO BANKS

2026-04-30 AMEND AND RECOMMIT TO BANKS

2026-04-30 PRINT NUMBER 8115C

2026-05-12 REPORTED AND COMMITTED TO INTERNET AND TECHNOLOGY

Sources

Full Text ↗

Entry Last Reviewed

2026-05-20

AI generated