Regulon — RI-SB-2499 · RI SB 2499 (AI & Fair Employment Practices)

WHAT THIS BILL REGULATES · 5 REQUIREMENT TYPES

How Is This Bill Enforced

Enforcement Authority

Department of Labor and Training has rulemaking authority for implementation. Office of the Attorney General has rulemaking authority for consumer and privacy protection aspects. Employees may file complaints with the attorney general or other departments. Anti-retaliation protections enforced through penalties as provided in Title 28.

Private Right of Action

No private right of action. Enforcement is exclusive to the designated authority.

Penalties

Violations subject to penalties as provided in Title 28 of the Rhode Island General Laws. The bill does not specify independent monetary damages, statutory minimums or maximums, or attorney fee recovery. No private right of action is explicitly created; employees are protected from retaliation and adverse action, with enforcement penalties cross-referenced to existing Title 28 provisions.

Verbatim statutory text on the left; plain-language analysis and a per-section checklist on the right. Numbered markers cross-link to the matching checklist row.

Statutory Text

Analysis & Obligations

R.I. Gen. Laws § 28-5.2-1

Definitions

(a)(1)–(20) As used in this chapter, the following words shall have the following meanings unless the context clearly requires otherwise: (1) "Authorized representative" means any person or organization appointed by the worker to serve as a representative of the worker including, but not limited to, a labor organization as defined in the Rhode Island labor relations act § 28-7-3, the National Labor Relations Act 29 U.S.C. § 152(5) and 5 U.S.C. § 7103(a)(4), and 45 U.S.C. § 151. "Authorized representative" shall not include a worker's employer. (2) "Automated decision system (ADS)" means any computational process, automated system, or algorithm utilizing machine learning, statistical modeling, data analytics, artificial intelligence, or similar methods, that issues an output, including a score, classification, ranking, or recommendation, that is used to assist or replace human decision making, on issues that impact natural persons. "ADS" does not include a tool that does not assist or replace employment decision processes and that does not materially impact natural persons including, but not limited to, a junk email filter, firewall, antivirus software, calculator, spreadsheet, database, data set, or other compilation of data. (3) "Automated decision system (ADS) output" means any information, data, assumptions, predictions, scoring, recommendations, decisions, or conclusions generated by an ADS. (4) "Biometric information" means data generated by automatic measurements of an individual's biological characteristics, such as a fingerprint, a voiceprint, eye retinas, irises, gait, or other unique biological patterns or characteristics that can be used, singly or in combination with other data, to identify a specific individual. "Biometric information" does not include: (i) A digital or physical photograph; (ii) An audio or video recording; or (iii) Any data generated from a digital or physical photograph, or an audio or video recording, unless such data is generated to identify a specific individual. (5) "Candidate" means any natural person or their authorized representative seeking employment through an application, or who is screened or evaluated for recruitment, for a position of employment by a business operating in this state. (6) "Continuous incremental time-tracking tool" means any system, application or instrument that continuously measures, records and/or tallies increments of time within a day during which an employee is or is not doing a particular activity or set of activities. (7) "Department" means the department of labor and training. (8) "De-identified employee data" means employee data that an employer has sought from their own electronic systems, from a vendor, or from a third-party source, aggregated, combined, or collected together, in a summary or other form so that the employee data cannot be identified as belonging to any specific employee. (9) "Egregious misconduct" means intentional or grossly negligent conduct that creates an imminent and substantial risk of serious physical harm to the individual, co-workers, customers, or other persons, or that results in significant, demonstrable harm to the employer's or customers' property or business interests, including discrimination against or harassment of co-workers, customers, or other persons, or involves criminal conduct directly related to the employee's job duties. (10) "Electronic monitoring tool" means any system, application, or instrument that facilitates the collection of data concerning worker activities or communications by any means other than direct observation by a natural person including, but not limited to, the use of a computer, telephone, wire, radio, camera, electromagnetic, photoelectronic, or photo-optical system, or obtaining employee data from a third-party. (11) "Employee" shall have the same meaning as contained in § 28-7-3. (12) "Employee information" (also referred to as "information" or "employee data") means any information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular employee, regardless of how the information is collected, inferred, or obtained. (13) "Employer" means any person acting on behalf of or in the interest of an employer, directly or indirectly, with or without their knowledge, but a labor organization or any officer or its agent, shall only be considered an employer of individuals employed by the organization. (14) "Employment-related decision" means a decision made by the employer that affects wages, benefits, other compensation, hours, schedule, performance evaluation, hiring, recruitment, discipline, promotion, termination, duties, assignment of work, access to work opportunities, productivity requirements, workplace health and safety, or other terms or conditions of employment. For persons classified as independent contractors or for candidates for employment, this means the equivalent of these decisions based on their contract with or relationship to the employer. (15) "Essential job functions" means the fundamental duties of a position, based upon work duties actually performed over the duration of employment, as revealed by objective evidence. (16) "Impact assessment" means an impartial evaluation by an independent auditor that complies with § 28-5.2-2. (17) "Independent auditor" means a person or entity that conducts an impact assessment of an automated decision system in a manner that exercises objective and impartial judgment on all issues within the scope of such evaluation or assessment. (18) "Meaningful human oversight" means a process that includes, at a minimum: (i) The designation of at least one internal reviewer with sufficient expertise in the operation of automated decision systems, sufficient familiarity with the results of the most recent impact assessment of the employer's system, and sufficient understanding of the outputs of the employer's system to identify potential biases, errors, discrepancies, or inaccuracies produced by the tool; (ii) That sufficient authority and discretion be granted to the designated internal reviewer to dispute, rerun, or recommend the rejection of an output suspected to be invalid, inaccurate, or discriminatory; and (iii) That the designated internal reviewer has the time and resources available to review and evaluate the tool output in accordance with § 28-5.2-2. (19) "Periodic assessment of worker performance" means assessing worker performance over the course of units of time equal to or greater than one calendar day. (20) "Vendor" means any person or entity who sells, distributes, or develops for sale an automated decision system to be used in an employment decision made by an employer in the state. "Vendor" includes any of the vendor's agents, contractors, or subcontractors.

Section 28-5.2-1 establishes the definitions governing the entire chapter. Key defined terms include Automated decision system (ADS), Electronic monitoring tool, Employee information, Employer, Vendor, Meaningful human oversight, Impact assessment, and Independent auditor. The ADS definition is broad — covering any computational process using ML, statistical modeling, data analytics, or AI that issues outputs used to assist or replace human decisions affecting natural persons — but explicitly excludes tools that do not assist or replace employment decisions. The Electronic monitoring tool definition is similarly expansive, covering any non-direct-observation data collection system.

The Meaningful human oversight definition is notable for its specificity, requiring an internal reviewer with expertise in the ADS, familiarity with the most recent impact assessment, and authority to dispute or reject outputs. The Independent auditor definition imposes a five-year lookback conflict-of-interest standard.

R.I. Gen. Laws § 28-5.2-2

Electronic monitoring tools

Deployer

(a) 1 It shall be unlawful for an employer to use an electronic monitoring tool to collect employee information unless: (1) The electronic monitoring tool is primarily used to accomplish any of the following legitimate purposes: (i) Allowing a worker to accomplish or facilitating the accomplishment of an essential job function; (ii) Ensuring the quality of goods and services; (iii) Conducting periodic assessment of worker performance; (iv) Ensuring or facilitating compliance with employment, labor, or other relevant laws; (v) Protecting the health, safety, or security of workers, or the security of the employer's facilities or computer networks; or (vi) Administering wages and benefits. (2) The department of labor and training standards may establish additional exceptions under this subsection, pursuant to chapter 35 of title 42 ("administrative procedures act.")

(b)(1)–(3) 2 The specific type and activated capabilities of an electronic monitoring tool shall be narrowly tailored to accomplish the employer's intended, legitimate purpose specified under subsection (a)(1) of this section; (2) The electronic monitoring tool shall only be used to accomplish the employer's intended, legitimate purpose specified in subsection (a)(1) of this section, and shall be customized and implemented in a manner ensuring that the execution of its duties are undertaken in the manner least invasive to employees of the employer, while still accomplishing the employer's legitimate purposes as defined by subsection (a)(1) of this section; (3) The specific form of electronic monitoring is limited to the smallest number of workers, collection of the least amount of data which shall be collected no more frequently than is necessary to accomplish the purpose, and the data collected, shall be deleted once the purpose has been achieved;

(b)(4)–(6) 2 The employer shall ensure that any employee data that is collected utilizing an electronic monitoring tool that is not necessary to accomplish the employer's intended, legitimate purpose shall not be disclosed to the employer and shall be promptly disposed of by the vendor; (5) The employer shall ensure that employee data is not collected when the employee is off-duty; and (6) The employer shall ensure that any employee data collected utilizing an electronic monitoring tool that is necessary to accomplish the employer's intended, legitimate purpose, is stored consistent with the state's data and cyber privacy laws, promptly disposed of as soon as the data is no longer needed, and is not utilized by the employer, the vendor or any other third party for any reason except, as provided in subsection (c) of this section.

(c) 3 Any employer that uses an electronic monitoring tool shall give prior written notice and shall obtain written acknowledgment from all candidates and employees subject to electronic monitoring and shall also post said notice in a conspicuous place which is readily available for viewing by candidates for employment and employees. Such notice shall include, at a minimum, the following: (1) A description of the purpose for which the electronic monitoring tool will be used, as specified in subsection (a)(1) of this section; (2) A description of the specific employee data to be collected, stored, secured, and disposed of (and the schedule therefor), and the activities, locations, communications, and job roles that will be electronically monitored by the tool; (3) A description of the dates, times, and frequency that electronic monitoring will occur; (4) Whether and how any employee data collected by the electronic monitoring tool will be used as an input in an automated decision system; (5) Whether and how any employee data collected by the electronic monitoring tool will alone or in conjunction with an automated decision system be used to make an employment decision by the employer or employment agency; (6) Whether and how any employee data collected by the electronic monitoring tool may be stored and utilized in discipline, in internal policy compliance, in administrative agency adjudications, in litigation (whether or not it involves the employee or not as a party); (7) Whether any employee data collected by the electronic monitoring tool will be used to assess employees' productivity performance or to set productivity standards, and if so, how; (8) A description of where any employee data collected by the electronic monitoring tool will be stored and the length of time it will be retained; (9) An explanation for how the specific electronic monitoring practice is the least invasive means available to accomplish the monitoring purpose; (10) That an employee is entitled to notice and maintains the right to refuse the sale, transfer, or disclosure of their employee data, subject to the provisions of subsection (g) of this section; and (11) A clear and reasonably understandable description of how an employee can exercise the rights described in this chapter.

(d) 4 An employer shall establish, maintain, and preserve for five (5) years contemporaneous, true, and accurate records of data gathered through the use of an electronic monitoring tool and used in a hiring, promotion, termination, disciplinary or compensation decision to ensure compliance with the employee or their authorized representative or the department requests for data. The employer shall destroy any employee information collected via an electronic monitoring tool no later than sixty-one (61) months after collection unless the employee has provided written and informed consent to the retention of their data by the employer. An employer shall establish, implement and maintain reasonable administrative, technical and physical data security practices to protect the confidentiality, integrity and accessibility of employee data, appropriate to the volume and nature of the employee data at issue. An employee shall have the right to request corrections to erroneous employee data.

(e)(1)–(5) 5 Notwithstanding the allowable purposes for electronic monitoring described in subsection (a) of this section, an employer shall not: (1) Use an electronic monitoring tool in such a manner that results in a violation of labor, employment, civil rights law or any other law of the state; (2) Use an electronic monitoring tool or data collected via an electronic monitoring tool in such a manner as to threaten the health, welfare, safety, or legal rights of employees or the general public; (3) Use an electronic monitoring tool to monitor employees who are off-duty or not performing work-related tasks; (4) Use an electronic monitoring tool in order to obtain information about an employee's health, including health status and health conditions, the race, color, religious creed, national origin, sex, gender identity, sexual orientation, genetic information, pregnancy or a condition related to said pregnancy including, but not limited to, lactation or the need to express breast milk for a nursing child, ancestry or status as a veteran or membership in any group protected from employment discrimination under title 28 or any other applicable law; (5) Use an electronic monitoring tool in order to identify, punish, or obtain information about employees engaging in activity protected under labor or employment law;

(e)(6)–(9) 5 Conduct audio or visual monitoring of bathrooms or other similarly private areas, including locker rooms, changing areas, breakrooms, smoking areas, employee cafeterias, lounges, and areas designated to express breast milk, or areas designated for prayer or other religious activity, including data collection on the frequency of use of those private areas; (7) Conduct audio or visual monitoring of a workplace in an employee's residence, an employee's personal vehicle, or property owned or leased by an employee; (8) Use an electronic monitoring tool that incorporates facial recognition; (9) Use an electronic monitoring tool that incorporates gait, voice analysis, or emotion recognition technology;

(e)(10)–(12) 5 Take adverse action against an employee, based, in whole or in part, on their opposition or refusal to submit to a practice that the employee believes in good faith violates this section; (11) Take adverse employment action against an employee on the basis of data collected via continuous incremental time-tracking tools, except in the case of egregious misconduct; or (12) Take adverse employment action against an employee based on any data collected via electronic monitoring, if such data measures an employee's performance in relation to a performance standard that has not been previously, clearly, and unmistakably disclosed to such employee, as well as to all other classes of employees to whom it applies in violation of this section, or if such data was collected without proper notice to employees or candidates pursuant to this section.

(f) 6 An employer shall not use employee data collected via an electronic monitoring tool for purposes other than those specified in the notice provided pursuant to subsection (c) of this section.

(g) 7 An employer shall not sell, transfer, or disclose employee data collected via an electronic monitoring tool to any other entity unless it is required to do so under federal law or the laws of the state, or necessary to do so to comply with an impact assessment of an automated decision system used pursuant to this section.

(h) 8 An employer shall not require employees to: (1) Physically implant devices that collect or transmit data, including devices that are installed subcutaneously or incorporated into items of clothing or personal accessories; (2) Install applications on personal devices that collect or transmit employee data or to wear or embed those devices; or (3) Carry or use any device with location tracking applications or services enabled, unless the location tracking is: (i) Conducted during work hours only; and (ii) Strictly necessary to accomplish essential job functions and narrowly limited to only the activities and times required to accomplish essential job functions.

(i) 9 An employer shall not rely primarily on employee data collected through electronic monitoring, when making hiring, promotion, disciplinary decisions up to and including termination, or compensation decisions. For an employer to satisfy the requirements of this subsection: (1) An employer shall establish meaningful human oversight of such decisions that are based, in whole or in part, on data collected through electronic monitoring. (2) A human decision-maker shall review any information collected through electronic monitoring, verify that such information is accurate and up to date, review any pending employee requests to correct erroneous data, and exercise independent judgment in making each such decision; and (3) The human decision-maker shall consider information other than information collected through electronic monitoring, when making each such decision including, but not limited to, supervisory or managerial evaluations, personnel files, employee work products, or peer reviews.

(j) 10 When an employer makes a hiring, promotion, termination, disciplinary or compensation decision, based, in whole or in part, on data gathered through the use of electronic monitoring, it shall disclose to affected employees and their authorized representative within thirty (30) days of the decision being made or going into effect, whichever is sooner: (1) That the decision was based, in whole or in part, on data gathered through electronic monitoring; (2) The specific electronic monitoring tool or tools used to gather such data, how the tools work to gather and analyze the data, and the increments of time in which the data is gathered; (3) The specific data, and judgments based upon such data, used in the decision-making process; and (4) Any information used in the decision-making process gathered through sources other than electronic monitoring.

(k) 11 It shall be unlawful for an employer to use electronic monitoring, alone or in conjunction with an automated decision system, unless the employer's proposed use of electronic monitoring has been the subject of an impact assessment. Such impact assessments shall: (1) Be conducted no more than one year prior to the use of such electronic monitoring, or where the electronic monitoring began before the effective date of this section, within six (6) months of the effective date of this chapter; (2) Be conducted by an independent and impartial party with no financial or legal conflicts of interest; (3) Evaluate whether the data protection and security practices surrounding the electronic monitoring are consistent with applicable law and cybersecurity industry's best practices; (4) Identify the allowable purpose(s) as defined in this chapter; (5) Consider and describe any other ways in which the electronic monitoring could result in a violation of applicable law and, for any finding that a violation of law may occur, any necessary or appropriate steps to prevent such violation of law; (6) Consider and describe whether the electronic monitoring may negatively impact employees' privacy and job quality, including wages, hours, and working conditions; and (7) Be disclosed in full, in plain language, to all affected workers and their authorized representatives within thirty (30) days of the employer's receipt of the impact assessment.

(k)(i) 11 Workers and their authorized representatives shall have the right to comment on, challenge and bargain over the proposed monitoring based on the assessment's findings.

Section 28-5.2-2 is the operational core of the bill and imposes the full range of obligations on employers using electronic monitoring tools. It restricts electronic monitoring to enumerated legitimate purposes (subsection (a)), requires narrow tailoring and data minimization (subsection (b)), mandates detailed prior written notice and employee acknowledgment (subsection (c)), requires recordkeeping and data security (subsection (d)), and enumerates twelve categorical prohibitions on monitoring practices (subsection (e)), including facial recognition, gait analysis, voice analysis, and emotion recognition.

Subsections (f)–(h) impose additional use-limitation, data-transfer, and device-implantation restrictions. Subsection (i) requires meaningful human oversight of employment decisions based on monitoring data. Subsection (j) requires post-decision disclosure of the data and tools used. Subsection (k) requires independent impact assessments before electronic monitoring may be used, with mandatory disclosure to workers and a right to comment, challenge, and bargain over proposed monitoring.

Compliance actions 11 items

Employers must not use an electronic monitoring tool to collect employee information unless the tool is primarily used to accomplish one of six enumerated legitimate purposes: (1) allowing or facilitating the accomplishment of an essential job function; (2) ensuring the quality of goods and services; (3) conducting periodic assessment of worker performance; (4) ensuring or facilitating compliance with employment, labor, or other relevant laws; (5) protecting the health, safety, or security of workers or the security of the employer's facilities or computer networks; or (6) administering wages and benefits.

D-01.4

Employers must ensure that electronic monitoring tools are narrowly tailored to the stated legitimate purpose, implemented in the least invasive manner, limited to the smallest number of workers and least amount of data collected no more frequently than necessary, and that collected data is deleted once the purpose is achieved. Employee data not necessary for the stated purpose must not be disclosed to the employer and must be promptly disposed of by the vendor. Employee data must not be collected when the employee is off-duty. Necessary employee data must be stored consistent with state data and cyber privacy laws, promptly disposed of when no longer needed, and not used by the employer, vendor, or any third party for any reason other than as provided in the notice under subsection (c).

D-01.4

Employers must provide prior written notice to and obtain written acknowledgment from all candidates and employees subject to electronic monitoring, and must also post the notice in a conspicuous place readily available for viewing. The notice must include, at a minimum: (1) the purpose of the monitoring; (2) the specific employee data to be collected, stored, secured, and disposed of, and the activities, locations, communications, and job roles to be monitored; (3) the dates, times, and frequency of monitoring; (4) whether and how data will be used as an input in an ADS; (5) whether and how data will be used in employment decisions; (6) whether and how data may be stored and used in discipline, litigation, or adjudications; (7) whether data will be used to assess productivity or set productivity standards, and how; (8) where data will be stored and for how long; (9) an explanation of how the monitoring is the least invasive means available; (10) that the employee has the right to refuse sale, transfer, or disclosure of their data; and (11) a clear description of how to exercise their rights under the chapter.

D-01.1

Employers must establish, maintain, and preserve for five years contemporaneous, true, and accurate records of data gathered through electronic monitoring and used in hiring, promotion, termination, disciplinary, or compensation decisions, and must produce such records upon request by the employee, their authorized representative, or the department. Employers must destroy employee information collected via electronic monitoring no later than sixty-one months after collection unless the employee provides written and informed consent to continued retention. Employers must establish, implement, and maintain reasonable administrative, technical, and physical data security practices to protect the confidentiality, integrity, and accessibility of employee data. Employees have the right to request corrections to erroneous employee data.

G-01.3

Employers must not: (1) use electronic monitoring in a manner that violates labor, employment, civil rights, or any other state law; (2) use electronic monitoring or monitoring data in a manner that threatens the health, welfare, safety, or legal rights of employees or the public; (3) use electronic monitoring to monitor off-duty employees or employees not performing work-related tasks; (4) use electronic monitoring to obtain information about an employee's health, race, color, religious creed, national origin, sex, gender identity, sexual orientation, genetic information, pregnancy or related conditions, ancestry, veteran status, or membership in any group protected from employment discrimination; (5) use electronic monitoring to identify, punish, or obtain information about employees engaging in protected activity; (6) conduct audio or visual monitoring of bathrooms, locker rooms, changing areas, breakrooms, smoking areas, cafeterias, lounges, breast-milk expression areas, or prayer areas; (7) conduct audio or visual monitoring of workplaces in employee residences, personal vehicles, or employee-owned property; (8) use an electronic monitoring tool incorporating facial recognition; (9) use an electronic monitoring tool incorporating gait, voice analysis, or emotion recognition technology; (10) take adverse action against an employee for good-faith opposition to practices they believe violate this section; (11) take adverse action based on data from continuous incremental time-tracking tools except for egregious misconduct; or (12) take adverse action based on monitoring data measuring performance against an undisclosed standard or data collected without proper notice.

D-01.5

Employers must not use employee data collected via an electronic monitoring tool for purposes other than those specified in the notice provided to employees under subsection (c).

D-01.4

Employers must not sell, transfer, or disclose employee data collected via an electronic monitoring tool to any other entity unless required by federal or state law, or necessary to comply with an impact assessment of an automated decision system.

D-01.4

Employers must not require employees to: (1) physically implant devices that collect or transmit data, including subcutaneous devices or devices incorporated into clothing or personal accessories; (2) install applications on personal devices that collect or transmit employee data, or wear or embed those devices; or (3) carry or use any device with location tracking enabled, unless the tracking is conducted during work hours only and strictly necessary to accomplish essential job functions.

D-01

Employers must not rely primarily on employee data collected through electronic monitoring when making hiring, promotion, disciplinary (including termination), or compensation decisions. Employers must: (1) establish meaningful human oversight of such decisions, including designating at least one internal reviewer with expertise in ADS operation, familiarity with the most recent impact assessment, and authority to dispute, rerun, or recommend rejection of outputs suspected to be invalid, inaccurate, or discriminatory; (2) ensure a human decision-maker reviews all monitoring-sourced information for accuracy, reviews pending correction requests, and exercises independent judgment; and (3) ensure the human decision-maker considers non-monitoring information — including supervisory evaluations, personnel files, employee work products, or peer reviews — in each decision.

H-01.4

Employers must, within 30 days of making or implementing a hiring, promotion, termination, disciplinary, or compensation decision based in whole or in part on electronic monitoring data, disclose to the affected employee and their authorized representative: (1) that the decision was based on electronic monitoring data; (2) the specific monitoring tools used, how they gather and analyze data, and the time increments of data collection; (3) the specific data and data-based judgments used in the decision; and (4) any information used in the decision gathered through sources other than electronic monitoring.

H-01.1

Employers must not use electronic monitoring, alone or in conjunction with an ADS, unless the proposed use has been the subject of an impact assessment. The impact assessment must: (1) be conducted no more than one year before use begins, or within six months of the chapter's effective date for pre-existing monitoring; (2) be conducted by an independent and impartial party with no financial or legal conflicts of interest; (3) evaluate whether data protection and security practices are consistent with applicable law and cybersecurity best practices; (4) identify the allowable purposes under this chapter; (5) describe any ways the monitoring could violate applicable law and the steps to prevent such violations; (6) describe whether the monitoring may negatively impact employees' privacy and job quality, including wages, hours, and working conditions; and (7) be disclosed in full, in plain language, to all affected workers and their authorized representatives within 30 days of the employer's receipt. Workers and their authorized representatives have the right to comment on, challenge, and bargain over the proposed monitoring based on the assessment's findings.

H-02.3

R.I. Gen. Laws § 28-5.2-3

Anti-retaliation provisions for impacted workers

Deployer

(a) 12 An employee shall be protected from termination, disciplinary action, retaliation, or other adverse employment action for refusing to follow the output of an artificial intelligence system, automated decision system, algorithm, or other similar technology if the following conditions are met: (1) The employee holds independent judgment and discretion in executing their work duties, or the work duties to be performed by the employee require licensure or certification by the state, as a condition of employment, or independent accreditation by the employer; (2) The employee has notified a supervisor, manager, or their employer that the output from the artificial intelligence system, automated decision system, algorithm, or other similar technology may, in their professional opinion and/or educational or work related- experience, lead to the harm of a natural person, damage to physical property, an illegal action, an action contrary to the licensure or certification requirements of the federal government, state, or an applicable private licensing or certifying authority, or an outcome contrary to the goal of the employer, and the employer refused or otherwise failed to adjust the output; (3) The employee has refused to follow the output in good faith and with the knowledge or reasonable belief, based upon training, education, or experience, that the output would cause harm or have an adverse impact; or (4) Due to the urgency of the potential harm or adverse impact, there is not enough time for the output to be corrected through department action.

(b) The department of labor and training shall promulgate procedures, rules, or regulations regarding the implementation of this chapter.

(c)–(d) The office of the attorney general shall promulgate procedures, rules, or regulations necessary to further the state's interest in protecting consumers and the public good, from violations of privacy rights and harms, resulting from the use of artificial intelligence and automated-decision systems. (d) Such regulations shall consider, but are not limited to, bias testing, appropriate disclosures, clear, conspicuous, and reasonably understandable notice, whether there exists a client-professional relationship, best and current practices and models utilized by other states and the federal government, to ensure the regulations are responsive to emerging technologies, and appropriate additional documentation that is reasonably necessary to assist the office of the attorney general to evaluate the inputs and outputs and monitor the performance of artificial intelligence and automated decision-making systems, for the risk of bias or consumer harm.

Section 28-5.2-3 creates anti-retaliation protections for employees who refuse to follow AI or ADS outputs, and delegates rulemaking authority to the Department of Labor and Training and the Office of the Attorney General. The anti-retaliation protection is conditional — it applies when the employee exercises independent professional judgment or holds a state license or certification, has notified the employer of potential harm, and refuses in good faith with a reasonable belief of adverse impact.

The AG's rulemaking mandate is notable for its breadth — covering bias testing, disclosures, client-professional relationships, best practices from other jurisdictions, and documentation requirements — signaling that the chapter is intended as a regulatory framework to be filled in by administrative rulemaking rather than a self-executing statute.

Compliance actions 1 item

Employers must not terminate, discipline, retaliate against, or take any other adverse employment action against an employee for refusing to follow the output of an AI system, ADS, algorithm, or similar technology, when all of the following conditions are met: (1) the employee exercises independent judgment and discretion, or holds a required state license, certification, or employer accreditation; (2) the employee has notified their supervisor, manager, or employer that the output may lead to harm to a person, property damage, an illegal action, a licensure violation, or an outcome contrary to the employer's goals, and the employer refused or failed to adjust the output; (3) the employee refused in good faith with a reasonable belief the output would cause harm; or (4) the urgency of potential harm left insufficient time for correction through department action.

G-03.3

R.I. Gen. Laws § 28-5.2-4

Civil claims for adverse employment action taken based on prohibited conduct

Deployer

(a) 13 No employee shall be penalized by an employer in any way as a result of any action on the part of an employee to seek their rights under the provisions of this chapter.

(b) 13 Any employer who discharges or in any other manner discriminates against any employee because such employee has made a complaint to the attorney general or any other department, agency, or person, or assists in any investigation under this chapter, or has instituted, or caused to be instituted any proceeding under or related to this chapter, or has testified or is about to testify in any such proceedings, commits a violation of this section and shall be subject to penalties as provided in title 28.

Section 28-5.2-4 establishes enforcement protections for employees who exercise their rights under the chapter. Subsection (a) is a broad anti-penalty provision. Subsection (b) specifically prohibits retaliation against employees who file complaints, assist investigations, or testify in proceedings under the chapter, with violations subject to Title 28 penalties. Subsection (c) is a savings clause preserving all other employer obligations under state and federal law.

Compliance actions 1 item

Employers must not penalize any employee in any way for seeking their rights under this chapter. Employers must not discharge or discriminate against any employee for filing a complaint with the attorney general or any other agency, assisting in an investigation under this chapter, instituting or causing to be instituted any proceeding under this chapter, or testifying or being about to testify in such proceedings. Violations are subject to penalties as provided in Title 28.

G-03.3

Data Controls Data sale restrictions · deidentification

7 items

D-01.4

D-01.1

D-01.5

D-01.4

Employers must not use employee data collected via an electronic monitoring tool for purposes other than those specified in the notice provided to employees under subsection (c).

D-01.4