Regulon — RI-SB-627 · RI SB 627 (Artificial Intelligence Act)

WHAT THIS BILL REGULATES · 7 REQUIREMENT TYPES

How Is This Bill Enforced

Enforcement Authority

Attorney general has exclusive enforcement authority. No private right of action. During the first year (October 1, 2026 – September 30, 2027), the attorney general must issue a notice of violation and allow a 60-day cure period before initiating an action. After that period, the attorney general has discretion on whether to grant a cure opportunity. Violations constitute unfair trade practices under R.I. Gen. Laws § 6-13.1-5. An affirmative defense is available where a violation is discovered through red-teaming, cured within 60 days, and the entity is in compliance with NIST AI RMF or equivalent.

Private Right of Action

No private right of action. Enforcement is exclusive to the designated authority.

Penalties

Violations constitute unfair trade practices under R.I. Gen. Laws § 6-13.1-5, which provides for injunctive relief and civil penalties available to the attorney general. No statutory damages schedule is specified in the bill itself; remedies are those available under the existing unfair trade practices statute. No private damages or attorney fees provision.

Verbatim statutory text on the left; plain-language analysis and a per-section checklist on the right. Numbered markers cross-link to the matching checklist row.

Statutory Text

Analysis & Obligations

R.I. Gen. Laws § 6-61-1

Short title

This act shall be known and may be cited as the "Artificial Intelligence Act"

This section establishes the short title of the act as the "Artificial Intelligence Act." It creates no compliance obligations.

R.I. Gen. Laws § 6-61-2

Definitions

(1)–(16) As used in this chapter: (1) "Algorithmic discrimination" means: (i) Any use of an artificial intelligence system that results in any unlawful differential treatment or impact that disfavors any individual or group of individuals on the basis of one or more classifications protected under the laws of this state or federal law; and (ii) Does not include: (A) The offer, license or use of a high-risk artificial intelligence system by a developer, integrator or deployer for the sole purpose of: (I) The developer's, integrator's or deployer's self-testing to identify, mitigate or prevent discrimination or otherwise ensure compliance with state and federal law; (II) Expanding an applicant, customer or participant pool to increase diversity or redress historic discrimination; or (B) An act or omission by or on behalf of a private club or other establishment not in fact open to the public, as set forth in Title II of the Civil Rights Act of 1964, 42 USC § 2000a(e), as amended from time to time. (2) "Artificial intelligence system" means any machine-based system that, for any explicit or implicit objective, infers from the inputs such system receives how to generate outputs including, but not limited to, content, decisions, predictions or recommendations, that can influence physical or virtual environments. (3) "Consequential decision" means any decision or judgment that has a legal, material or similarly significant effect on a consumer with respect to: (i) Employment; (ii) Education or vocational training; (iii) The provision or denial, or terms and conditions, of financial lending or credit services, housing or lodging, insurance, or legal services; or (iv) The provision or denial of essential government services or healthcare services. (4) "Consumer" means any individual who is a resident of this state. (5) "Deploy" means to use a high-risk artificial intelligence system to make, or as a substantial factor in making, a consequential decision. (6) "Deployer" means any person doing business in this state that deploys a high-risk artificial intelligence system in this state. (7) "Developer" means any person doing business in this state that develops, or intentionally and substantially modifies, an artificial intelligence system. (8) "General-purpose artificial intelligence model" means: (i) Any form of artificial intelligence system that: (A) Displays significant generality; (B) Is capable of competently performing a wide range of distinct tasks; (C) Can be integrated into a variety of downstream applications or systems; and (ii) Does not include any artificial intelligence model that is used for development, prototyping and research activities before such artificial intelligence model is released on the market. (9) "High-risk artificial intelligence system" means: (i) Any artificial intelligence system that, when deployed, makes, or is a substantial factor in making, a consequential decision; and (ii) Does not include [enumerated carve-outs]. (10) "Integrator" means any person doing business in this state that, with respect to a given high-risk artificial intelligence system: (i) Neither develops nor intentionally and substantially modifies the high-risk artificial intelligence system; and (ii) Integrates the high-risk artificial intelligence system into a product or service such person offers to any other person. (11) "Intentional and substantial modification" means [definition]. (12) "Person" means any individual, association, corporation, limited liability company, partnership, trust or other legal entity. (13) "Red-teaming" means an exercise that is conducted to identify the potential adverse behaviors or outcomes of an artificial intelligence system, how such behaviors or outcomes occur and stress test the safeguards against such behaviors or outcomes. (14) "Substantial factor" means [definition]. (15) "Synthetic digital content" means any digital content including, but not limited to, any audio, image, text or video, that is produced or manipulated by an artificial intelligence system including, but not limited to, a general-purpose artificial intelligence model. (16) "Trade secret" means [definition].

This section defines the key terms used throughout the Artificial Intelligence Act. It establishes the scope of the bill by defining covered entities (developer, deployer, integrator), covered platforms (high-risk artificial intelligence system, general-purpose artificial intelligence model), and core concepts such as algorithmic discrimination, consequential decision, and substantial factor. The definition of high-risk artificial intelligence system includes extensive carve-outs for narrow procedural tasks, anti-fraud technology, video games, internal management tools, and informational chatbots with acceptable use policies.

R.I. Gen. Laws § 6-61-3

Artificial intelligence developers

Developer

(a) 1 Beginning on October 1, 2026, a developer of a high-risk artificial intelligence system shall use reasonable care to protect consumers from any known or reasonably foreseeable risks of algorithmic discrimination arising from the intended and contracted uses of the high-risk artificial intelligence system. In any enforcement action brought on or after said date by the attorney general pursuant to the provisions of this chapter, there shall be a rebuttable presumption that a developer used reasonable care as required under this section if the developer complied with the provisions of this section or, if the developer enters into a contract with an integrator as set forth in § 6-61-4(b), the developer and integrator complied with the provisions of this section and § 6-61-4.

(b)(1)–(4) 2 Except as provided in § 6-61-4(c), a developer of a high-risk artificial intelligence system shall, beginning on October 1, 2026, make available to each deployer, or other developer, of the high-risk artificial intelligence system: (1) A general statement describing the reasonably foreseeable uses, and the known harmful or inappropriate uses, of such high-risk artificial intelligence system; (2) Documentation disclosing: (i) High-level summaries of the type of data used to train such high-risk artificial intelligence system; (ii) The known or reasonably foreseeable limitations of such high-risk artificial intelligence system including, but not limited to, the known or reasonably foreseeable risks of algorithmic discrimination arising from the intended uses of such high-risk artificial intelligence system; (iii) The purpose of such high-risk artificial intelligence system; (iv) The intended benefits and uses of such high-risk artificial intelligence system; and (v) All other information necessary to enable such deployer to comply with the provisions of this chapter; (3) Documentation describing: (i) How such high-risk artificial intelligence system was evaluated for performance, and mitigation of algorithmic discrimination, before such high-risk artificial intelligence system was offered, sold, leased, licensed, given or otherwise made available to such deployer; (ii) The data governance measures used to cover the training datasets and the measures used to examine the suitability of data sources, possible biases and appropriate mitigation; (iii) The intended outputs of such high-risk artificial intelligence system; (iv) The measures the developer has taken to mitigate any known or reasonably foreseeable risks of algorithmic discrimination that may arise from deployment of such high-risk artificial intelligence system; and (v) How such high-risk artificial intelligence system should be used, not be used and be monitored by an individual when such high-risk artificial intelligence system is used to make, or as a substantial factor in making, a consequential decision. (4) Any additional documentation that is reasonably necessary to assist a deployer to: (i) Understand the outputs of such high-risk artificial intelligence system; and (ii) Monitor the performance of such high-risk artificial intelligence system for risks of algorithmic discrimination.

(c) 3 Except as provided in § 6-61-4(c), any developer that, on or after October 1, 2026, offers, sells, leases, licenses, gives or otherwise makes available to a deployer or another developer a high-risk artificial intelligence system shall, to the extent feasible, make available to the deployers and other developers of such high-risk artificial intelligence system the documentation and information necessary for a deployer, or the third party contracted by a deployer, to complete an impact assessment pursuant to § 6-61-5(c). The developer shall make such documentation and information available through artifacts such as model cards, dataset cards or other impact assessments. (2) A developer that also serves as a deployer for any high-risk artificial intelligence system shall not be required to generate the documentation required by this section unless such high-risk artificial intelligence system is provided to an unaffiliated entity acting as a deployer.

(d) 4 Beginning on October 1, 2026, each developer shall make available, in a manner that is clear and readily available on such developer's Internet website or in a public use case inventory, a statement summarizing: (i) The types of high-risk artificial intelligence systems that such developer: (A) Has developed or intentionally and substantially modified; and (B) Currently makes available to a deployer or another developer; and (ii) How such developer manages any known or reasonably foreseeable risks of algorithmic discrimination that may arise from development or intentional and substantial modification of the types of high-risk artificial intelligence systems described in subsection (d)(1)(i)(A) of this section. (2) Each developer shall update the statement described in subsection (b)(1) of this section as necessary to ensure that such statement remains accurate, and not later than ninety (90) days after the developer intentionally and substantially modifies any high-risk artificial intelligence system described in subsection (d)(1)(i) of this section.

(e) 5 Beginning on October 1, 2026, a developer of a high-risk artificial intelligence system shall disclose to the attorney general, in a form and manner prescribed by the attorney general, and to all known deployers or other developers of the high-risk artificial intelligence system, any known or reasonably foreseeable risks of algorithmic discrimination arising from the intended uses of such high-risk artificial intelligence system. The developer shall make such disclosures without unreasonable delay but in no event later than ninety (90) days after the date on which: (1) The developer discovers, through the developer's ongoing testing and analysis, that the high-risk artificial intelligence system has: (i) Been deployed; and (ii) Caused, or is reasonably likely to have caused, algorithmic discrimination to at least one thousand (1,000) consumers; or (2) The developer receives, from a deployer of the high-risk artificial intelligence system, a credible report disclosing that such high-risk artificial intelligence system has: (i) Been deployed; and (ii) Caused algorithmic discrimination to at least one thousand (1,000) consumers.

(f) The provisions of subsections (b) through (e), inclusive, of this section shall not be construed to require a developer to disclose any information: (1) That is a trade secret or otherwise protected from disclosure under state or federal law; or (2) The disclosure of which would present a security risk to the developer.

(g) 6 Beginning on October 1, 2026, the attorney general may require that a developer disclose to the attorney general, as part of an investigation conducted by the attorney general and in a form and manner prescribed by the attorney general, the general statement or documentation described in subsection (b) of this section. The attorney general may evaluate such general statement or documentation to ensure compliance with the provisions of this section. In disclosing such general statement or documentation to the attorney general pursuant to this subsection, the developer may designate such general statement or documentation as including any information that is exempt from disclosure under subsection (f) of this section or the provisions of title 38 ("access to public records"). To the extent such general statement or documentation includes such information, such general statement or documentation shall be exempt from disclosure pursuant to the provisions of this chapter or title 38. To the extent any information contained in such general statement or documentation is subject to the attorney-client privilege or work product protection, such disclosure shall not constitute a waiver of such privilege or protection.

This section imposes the bill's core obligations on developers of high-risk AI systems. Developers must use reasonable care to protect consumers from known or reasonably foreseeable risks of algorithmic discrimination, with a rebuttable presumption of compliance for those who satisfy the section's requirements. Developers must provide deployers and downstream developers with detailed documentation covering foreseeable uses, training data, performance evaluations, data governance, and bias mitigation measures. A separate obligation requires developers to provide documentation necessary for deployers to complete impact assessments. Developers must also publish and maintain a public summary of their high-risk AI systems and algorithmic discrimination risk management on their website. A disclosure obligation to the attorney general and all known deployers is triggered when the developer discovers the system has caused or is reasonably likely to have caused algorithmic discrimination to at least 1,000 consumers. Trade secret and security-risk carve-outs apply.

Compliance actions 6 items

Developers of high-risk AI systems must use reasonable care to protect consumers from known or reasonably foreseeable risks of algorithmic discrimination arising from the intended and contracted uses of the system.

H-02.1

Developers must provide each deployer or downstream developer with documentation covering foreseeable uses, known harmful uses, training data summaries, system limitations, algorithmic discrimination risks, performance evaluation methods, data governance measures, bias mitigation steps, intended outputs, and human monitoring instructions.

G-02.1

Developers must make available to deployers and downstream developers the documentation and information necessary for the deployer to complete an impact assessment, delivered through artifacts such as model cards, dataset cards, or other impact assessments.

G-02.1

Developers must publish on their website or in a public use case inventory a statement summarizing the types of high-risk AI systems they currently offer, and how they manage known or reasonably foreseeable risks of algorithmic discrimination, updated within 90 days of any intentional and substantial modification.

G-02.4

Developers must disclose to the attorney general and all known deployers or other developers any known or reasonably foreseeable risks of algorithmic discrimination, within 90 days of discovering that the system has caused or is reasonably likely to have caused algorithmic discrimination to at least 1,000 consumers.

R-01.3

Developers must produce documentation to the attorney general upon request as part of an investigation, with trade secret and attorney-client privilege protections preserved.

R-02.2

R.I. Gen. Laws § 6-61-4

High-risk artificial intelligence system (integrator obligations)

Deployer

(a) 7 Beginning on October 1, 2026, if an integrator integrates a high-risk artificial intelligence system into a product or service the integrator offers to any other person, such integrator shall use reasonable care to protect consumers from any known or reasonably foreseeable risks of algorithmic discrimination arising from the intended and contracted uses of such integrated high-risk artificial intelligence system. In any enforcement action brought on or after said date by the attorney general pursuant to the provisions of this chapter, there shall be a rebuttable presumption that the integrator used reasonable care as required under this section if the integrator complied with the provisions of this chapter.

(b) 8 Beginning on October 1, 2026, no integrator shall integrate a high-risk artificial intelligence system into a product or service the integrator offers to any other person unless the integrator has entered into a contract with the developer of the high-risk artificial intelligence system. The contract shall be binding and clearly set forth the duties of the developer and integrator with respect to the integrated high-risk artificial intelligence system including, but not limited to, whether the developer or integrator shall be responsible for performing the developer's duties of § 6-61-3(b) and (c).

(c) The provisions of § 6-61-3(b) and (c) shall not apply to a developer of an integrated high-risk artificial intelligence system if, at all times while the integrated high-risk artificial intelligence system is integrated into a product or service an integrator offers to any other person, the developer has entered into a contract with the integrator in which such integrator has agreed to assume the developer's duties under § 6-61-3(b) and (c).

(d) 9 Beginning on October 1, 2026, each integrator shall make available, in a manner that is clear and readily available on such integrator's Internet website or in a public use case inventory, a statement summarizing: (i) The types of high-risk artificial intelligence systems that such integrator has integrated into products or services such integrator currently offers to any other person; and (ii) How such integrator manages any known or reasonably foreseeable risks of algorithmic discrimination that may arise from the types of high-risk artificial intelligence systems described in this chapter. (2) Each integrator shall update the statement described in subsection (d)(1) of this section: (i) As necessary to ensure that such statement remains accurate; and (ii) Not later than ninety (90) days after any intentional and substantial modification is made to any high-risk artificial intelligence system described in subsection (d)(1) of this section.

(e)–(f) The provisions of subsections (b) through (d), inclusive, of this section shall not be construed to require a developer or integrator to disclose any information: (1) That is a trade secret or otherwise protected from disclosure under state or federal law; or (2) The disclosure of which would present a security risk to the developer or integrator. (f) Beginning on October 1, 2026, the attorney general may require that a developer disclose to the attorney general, as part of an investigation conducted by the attorney general and in a form and manner prescribed by the attorney general, the general statement or documentation described in subsection (b) of this section. The attorney general may evaluate such general statement or documentation to ensure compliance with the provisions of this section. In disclosing such general statement or documentation to the attorney general pursuant to this subsection, the developer may designate such general statement or documentation as including any information that is exempt from disclosure under subsection (e) of this section or the provisions of title 38 ("access to public records"). To the extent such general statement or documentation includes such information, such general statement or documentation shall be exempt from disclosure pursuant to the provisions of this chapter or title 38. To the extent any information contained in such general statement or documentation is subject to the attorney-client privilege or work product protection, such disclosure shall not constitute a waiver of such privilege or protection.

This section creates a distinct role — the integrator — for entities that neither develop nor substantially modify an AI system but integrate it into a product or service offered to others. Integrators bear their own reasonable-care duty to prevent algorithmic discrimination and must enter into a binding contract with the developer that allocates § 6-61-3(b) and (c) duties between them. Integrators must also publish and maintain a public summary of their high-risk AI systems and discrimination risk management. The section includes a delegation mechanism: if the integrator contractually assumes the developer's documentation duties, the developer is relieved of those duties. Trade secret and security-risk carve-outs apply, and the attorney general may require production of integrator documentation during an investigation.

Compliance actions 3 items

Integrators must use reasonable care to protect consumers from known or reasonably foreseeable risks of algorithmic discrimination arising from the intended and contracted uses of integrated high-risk AI systems.

H-02.1

Integrators must enter into a binding contract with the developer before integrating a high-risk AI system into a product or service, clearly allocating developer and integrator duties including responsibility for documentation and impact assessment support obligations.

—

Integrators must publish on their website or in a public use case inventory a statement summarizing the types of high-risk AI systems they have integrated and how they manage algorithmic discrimination risks, updated within 90 days of any intentional and substantial modification.

G-02.4

R.I. Gen. Laws § 6-61-5

Reasonable care to protect from foreseeable risks (deployer obligations)

Deployer

(a) 10 Beginning on October 1, 2026, each deployer of a high-risk artificial intelligence system shall use reasonable care to protect consumers from any known or reasonably foreseeable risks of algorithmic discrimination. In any enforcement action brought on or after said date by the attorney general pursuant to the provisions of this chapter, there shall be a rebuttable presumption that a section of a high-risk artificial intelligence system used reasonable care as required under this subsection if the deployer complied with the provisions of this chapter.

(b) 11 Beginning on October 1, 2026, and except as provided in subsection (g) of this section, each deployer of a high-risk artificial intelligence system shall implement and maintain a risk management policy and program to govern such deployer's deployment of the high-risk artificial intelligence system. The risk management policy and program shall specify and incorporate the principles, processes and personnel that the deployer shall use to identify, document and mitigate any known or reasonably foreseeable risks of algorithmic discrimination. The risk management policy shall be the product of an iterative process, the risk management program shall be an iterative process and both the risk management policy and program shall be planned, implemented and regularly and systematically reviewed and updated over the lifecycle of the high-risk artificial intelligence system. Each risk management policy and program implemented and maintained pursuant to this subsection shall be reasonable, considering: (i) The guidance and standards set forth in the latest version of: (A) The "Artificial Intelligence Risk Management Framework" published by the National Institute of Standards and Technology; (B) ISO or IEC 42001 of the International Organization for Standardization; or (C) A nationally or internationally recognized risk management framework for artificial intelligence systems, other than the guidance and standards specified in this subsection, that imposes requirements that are substantially equivalent to, and at least as stringent as, the requirements set forth in this section for risk management policies and programs; (ii) The size and complexity of the deployer; (iii) The nature and scope of the high-risk artificial intelligence systems deployed by the deployer including, but not limited to, the intended uses of such high-risk artificial intelligence systems; and (iv) The sensitivity and volume of data processed in connection with the high-risk artificial intelligence systems deployed by the deployer. (2) A risk management policy and program implemented and maintained pursuant to subsection (b)(1) of this section may cover multiple high-risk artificial intelligence systems deployed by the deployer.

(c)(1)–(2) 12 Except as provided in subsections (c)(3), (c)(4) and (g) of this section: (i) A deployer that deploys a high-risk artificial intelligence system on or after October 1, 2026, or a third party contracted by the deployer, shall complete an impact assessment of the high-risk artificial intelligence system; and (ii) Beginning on October 1, 2026, a deployer, or a third party contracted by the deployer, shall complete an impact assessment of a deployed high-risk artificial intelligence system: (A) At least annually; and (B) Not later than ninety (90) days after an intentional and substantial modification to such high-risk artificial intelligence system is made available. (2)(i) Each impact assessment completed pursuant to this subsection shall include, at a minimum and to the extent reasonably known by, or available to, the deployer: (A) A statement by the deployer disclosing the purpose, intended use cases and deployment context of, and benefits afforded by, the high-risk artificial intelligence system; (B) An analysis of whether the deployment of the high-risk artificial intelligence system poses any known or reasonably foreseeable risks of algorithmic discrimination and, if so, the nature of such algorithmic discrimination and the steps that have been taken to mitigate such risks; (C) A description of: (I) The categories of data the high-risk artificial intelligence system processes as inputs; and (II) The outputs such high-risk artificial intelligence system produces; (D) If the deployer used data to customize the high-risk artificial intelligence system, an overview of the categories of data the deployer used to customize such high-risk artificial intelligence system; (E) Any metrics used to evaluate the performance and known limitations of the high-risk artificial intelligence system; (F) A description of any transparency measures taken concerning the high-risk artificial intelligence system including, but not limited to, any measures taken to disclose to a consumer that such high-risk artificial intelligence system is in use when such high-risk artificial intelligence system is in use; and (G) A description of the post-deployment monitoring and user safeguards provided concerning such high-risk artificial intelligence system including, but not limited to, the oversight, use and learning process established by the deployer to address issues arising from deployment of such high-risk artificial intelligence system. (ii) In addition to the statement, analysis, descriptions, overview and metrics required under subsection (c)(2) of this section, an impact assessment completed pursuant to this subsection following an intentional and substantial modification made to a high-risk artificial intelligence system on or after October 1, 2026, shall include a statement disclosing the extent to which the high-risk artificial intelligence system was used in a manner that was consistent with, or varied from, the developer's intended uses of such high-risk artificial intelligence system.

(c)(3)–(5) 13 A single impact assessment may address a comparable set of high-risk artificial intelligence systems deployed by a deployer. (iv) If a deployer, or a third party contracted by the deployer, completes an impact assessment for the purpose of complying with another applicable law or regulation, such impact assessment shall be deemed to satisfy the requirements established in this subsection if such impact assessment is reasonably similar in scope and effect to the impact assessment that would otherwise be completed pursuant to this subsection. (v) A deployer shall maintain the most recently completed impact assessment of a high-risk artificial intelligence system as required under this subsection, all records concerning each such impact assessment and all prior impact assessments, if any, for a period of at least three (3) years following the final deployment of the high-risk artificial intelligence system.

(d) 14 Except as provided in subsection (g) of this section, a deployer, or a third party contracted by the deployer, shall review, not later than October 1, 2026, and at least annually thereafter, the deployment of each high-risk artificial intelligence system deployed by the deployer to ensure that such high-risk artificial intelligence system is not causing algorithmic discrimination.

(e)(1) 15 Beginning on October 1, 2026, and before a deployer deploys a high-risk artificial intelligence system to make, or be a substantial factor in making, a consequential decision concerning a consumer, the deployer shall: (i) Notify the consumer that the deployer has deployed a high-risk artificial intelligence system to make, or be a substantial factor in making, such consequential decision; and (ii) Provide to the consumer: (A) A statement disclosing: (I) The purpose of such high-risk artificial intelligence system; and (II) The nature of such consequential decision; (B) The right to opt-out of any automated decision-making based on the consumer's personal data; (C) Contact information for such deployer; (D) A description, in plain language, of such high-risk artificial intelligence system; and (E) Instructions on how to access the statement made available pursuant to subsection (f) of this section.

(e)(2)–(3) 16 Beginning on October 1, 2026, a deployer that has deployed a high-risk artificial intelligence system to make, or as a substantial factor in making, a consequential decision concerning a consumer shall, if such consequential decision is adverse to the consumer, provide to such consumer: (i) A statement disclosing the principal reason or reasons for such adverse consequential decision including, but not limited to: (A) The degree to which, and manner in which, the high-risk artificial intelligence system contributed to such adverse consequential decision; (B) The type of data that were processed by such high-risk artificial intelligence system in making such adverse consequential decision; and (C) The source of the data described in this subsection; (ii) An opportunity to: (A) Examine the personal data that the high-risk artificial intelligence system processed in making, or as a substantial factor in making, such adverse consequential decision; and (B) Correct any incorrect personal data described in this subsection; and (3)(i) Except as provided in this subsection, an opportunity to appeal such adverse consequential decision if such adverse consequential decision is based upon inaccurate personal data, taking into account both the nature of such personal data and the purpose for which such personal data was processed. Such appeal shall, if technically feasible, allow for human review. (ii) No deployer shall be required to provide an opportunity to appeal pursuant to subsection (e)(3)(i) of this section in any instance in which providing such opportunity to appeal is not in the best interest of the consumer including, but not limited to, in any instance in which any delay might pose a risk to the life or safety of the consumer. (iii) The deployer shall provide the notice, statements, information, description and instructions required under the provisions of this subsection: (A) Directly to the consumer; (B) In plain language; (C) In all languages in which such deployer, in the ordinary course of such deployer's business, provides contracts, disclaimers, sale announcements and other information to consumers; and (D) In a format that is accessible to consumers with disabilities.

(f) 17 Beginning on October 1, 2026, and except as provided in subsection (g) of this section, each deployer shall make available, in a manner that is clear and readily available on such deployer's Internet website, a statement summarizing: (i) The types of high-risk artificial intelligence systems that are currently deployed by such deployer; (ii) How such deployer manages any known or reasonably foreseeable risks of algorithmic discrimination that may arise from deployment of each high-risk artificial intelligence system described in this subsection; and (iii) In detail, the nature, source and extent of the information collected and used by such deployer. (2) Each deployer shall periodically update the statement described in subsection(f)(1) of this section.

(g) The provisions of subsections (b) through (d), inclusive, of this section and subsection (f) of this section shall not apply to a deployer if, at the time the deployer deploys a high-risk artificial intelligence system and at all times while the high-risk artificial intelligence system is deployed: (1) The deployer: (i) Has entered into a contract with the developer in which the developer has agreed to assume the deployer's duties under subsections (b) through (d), inclusive, of this section and subsection (f) of this section and (ii) Does not exclusively use such deployer's own data to train such high-risk artificial intelligence system; (2) Such high-risk artificial intelligence system: (i) Is used for the intended uses that are disclosed to such deployer; and (ii) Continues learning based on a broad range of data sources and not solely based on the deployer's own data; and (3) Such deployer makes available to consumers any impact assessment that: (i) The developer of such high-risk artificial intelligence system has completed and provided to such deployer; and (ii) Includes information that is substantially similar to the information included in the statement, analysis, descriptions, overview and metrics required pursuant to the provisions of this section.

(h) 18 If a deployer deploys a high-risk artificial intelligence system on or after October 1, 2026, and subsequently discovers that the high-risk artificial intelligence system has caused algorithmic discrimination to at least one thousand (1,000) consumers, the deployer shall send to the attorney general, in a form and manner prescribed by the attorney general, a notice disclosing such discovery. The deployer shall send such notice to the attorney general without unreasonable delay but in no event later than ninety (90) days after the date on which the deployer discovered such algorithmic discrimination.

(i) Nothing in subsections (b) through (h), inclusive, of this section shall be construed to require a deployer to disclose any information that is a trade secret or otherwise protected from disclosure under state or federal law. If a deployer withholds any information from a consumer under this subsection, the deployer shall send notice to the consumer disclosing: (A) That the deployer is withholding such information from such consumer; and (B) The basis for the deployer's decision to withhold such information from such consumer.

(j) 19 Beginning on October 1, 2026, the attorney general may require that a deployer, or a third party contracted by the deployer as set forth in subsection (c) of this section, as applicable, disclose to the attorney general, as part of an investigation conducted by the attorney general, not later than ninety (90) days after a request by the attorney general and in a form and manner prescribed by the attorney general, the risk management policy implemented pursuant to subsection (b) of this section, impact assessment completed pursuant to subsection (c) of this section or records maintained pursuant to the provisions of subsection (c) of this section. The attorney general may evaluate such risk management policy, impact assessment or records to ensure compliance with the provisions of this section. In disclosing such risk management policy, impact assessment or records to the attorney general pursuant to this subsection, the deployer or third-party contractor, as applicable, may designate such risk management policy, impact assessment or records as including any information that is exempt from disclosure under subsection (i) of this section or chapter 2 of title 38 ("access to public records"). To the extent such risk management policy, impact assessment or records include such information, such risk management policy, impact assessment or records shall be exempt from disclosure pursuant to the provisions of this chapter or title 38. To the extent any information contained in such risk management policy, impact assessment or record is subject to the attorney-client privilege or work product protection, such disclosure shall not constitute a waiver of such privilege or protection.

This section imposes the bill's most extensive obligations on deployers of high-risk AI systems. It requires deployers to use reasonable care to prevent algorithmic discrimination, implement and maintain a risk management policy and program conforming to NIST AI RMF, ISO/IEC 42001, or equivalent, and conduct impact assessments before deployment and annually thereafter. Impact assessments must cover purpose, discrimination risk analysis, data categories, performance metrics, transparency measures, and post-deployment monitoring. Deployers must notify consumers before using a high-risk AI system in a consequential decision, providing the system's purpose, the nature of the decision, an opt-out right, and contact information. When an adverse consequential decision is made, the deployer must explain the principal reasons, disclose contributing data, allow the consumer to examine and correct personal data, and offer an appeal with human review where feasible. Deployers must publish a website statement summarizing deployed systems, discrimination risk management, and data collection practices. A contractual delegation safe harbor allows deployers to shift the risk management, impact assessment, review, and public-posting duties to the developer under specified conditions. Deployers must notify the attorney general within 90 days of discovering algorithmic discrimination affecting at least 1,000 consumers. The attorney general may require production of risk management policies, impact assessments, and records.

Compliance actions 10 items

Deployers of high-risk AI systems must use reasonable care to protect consumers from known or reasonably foreseeable risks of algorithmic discrimination.

H-02.1

Deployers must implement and maintain an iterative risk management policy and program covering principles, processes, and personnel for identifying, documenting, and mitigating algorithmic discrimination risks, conforming to NIST AI RMF, ISO/IEC 42001, or an equivalent framework, and regularly reviewed and updated over the system lifecycle.

G-01.1

Deployers must complete an impact assessment of each high-risk AI system before deployment and at least annually thereafter (and within 90 days of any intentional and substantial modification), covering purpose, discrimination risk analysis, data categories, customization data, performance metrics, transparency measures, and post-deployment monitoring.

H-02.3

Deployers must retain the most recently completed impact assessment, all associated records, and all prior impact assessments for at least three years following the final deployment of the high-risk AI system.

H-02.10

Deployers must review the deployment of each high-risk AI system at least annually to ensure it is not causing algorithmic discrimination.

H-02.8

Deployers must, before deploying a high-risk AI system to make or substantially factor in a consequential decision about a consumer, (1)notify the consumer of the AI system's use, (2) disclose the system's purpose and the nature of the decision, (3) provide the right to opt out of automated decision-making based on personal data, (4) provide deployer contact information, (5) provide a plain-language system description, and (6) provide instructions to access the deployer's public website statement.

H-01.3

Deployers must, when a consequential decision is adverse to a consumer, (1) explain the principal reasons including the degree and manner of AI contribution, data types, and data sources, (2) allow the consumer to examine and correct personal data used, and (3) provide an opportunity to appeal based on inaccurate personal data with human review where technically feasible. All notices must be provided directly to the consumer, in plain language, in all languages the deployer ordinarily uses, and in formats accessible to consumers with disabilities.

H-01.1

Deployers must publish on their website a periodically updated statement summarizing the types of high-risk AI systems they deploy, how they manage algorithmic discrimination risks, and the nature, source, and extent of information collected and used.

G-02.4

Deployers must notify the attorney general within 90 days of discovering that a deployed high-risk AI system has caused algorithmic discrimination to at least 1,000 consumers.

R-01.3

Deployers must produce risk management policies, impact assessments, and related records to the attorney general within 90 days of a request as part of an investigation, with trade secret and attorney-client privilege protections preserved.

R-02.2

R.I. Gen. Laws § 6-61-6

Technical documentation (general-purpose AI models)

Developer

(a)(1) 20 Beginning on October 1, 2026, each developer of a general-purpose artificial intelligence model shall, except as provided in subsection (b) of this section: (1)(i) Create and maintain technical documentation for the general-purpose artificial intelligence model, which technical documentation shall: (A) Include the training and testing processes for such general-purpose artificial intelligence model; (B) Include at least the following information, as appropriate, considering the size and risk profile of such general-purpose artificial intelligence model: (I) The tasks such general-purpose artificial intelligence model is intended to perform; (II) The type and nature of artificial intelligence systems in which such general-purpose artificial intelligence model is intended to be integrated; (III) Acceptable use policies for such general-purpose artificial intelligence model; (IV) The date such general-purpose artificial intelligence model is released; (V) The methods by which such general-purpose artificial intelligence model is distributed; and (VI) The modality and format of inputs and outputs for such general-purpose artificial intelligence model. (C) Include a description of the data that were used for purposes of training, testing and validation of such general-purpose artificial intelligence model, which description shall be appropriate considering the size and risk profile of such general-purpose artificial intelligence model and include, at a minimum, a description of the following: (I) The type and provenance of such data; (II) Curation methodologies used for such data; (III) How such data were obtained and selected; (IV) All measures used to identify unsuitable data sources; and (V) Where applicable, methods used to detect identifiable biases; (D) Be reviewed and revised at least annually or more frequently as necessary to maintain the accuracy of such technical documentation; (E) Establish, implement and maintain a policy to comply with federal and state copyright laws;

(a)(F)–(4) 21 Create, implement, maintain and make available to persons that intend to integrate such general-purpose artificial intelligence model into such persons' artificial intelligence systems documentation and information that: (2) Enables such persons to: (i) Understand the capabilities and limitations of such general-purpose artificial intelligence model; and (ii) Comply with such persons' obligations under this chapter; (3) Discloses, at a minimum: (i) The technical means required for such general-purpose artificial intelligence model to be integrated into such persons' artificial intelligence systems; (ii) The information listed in subsection (a)(1) of this section; and (iii) The description required under subsection (a)(1)(i)(C) of this section; and (4) Except as provided in subsection (b) of this section, is reviewed and revised at least annually or more frequently as necessary to maintain the accuracy of such documentation and information.

(b)(1)–(5) 22 The provisions of subsection (a)(1) and (a)(2)(c) of this section shall not apply to a developer that develops, or intentionally and substantially modifies, a general-purpose artificial intelligence model on or after October 1, 2026, if: (i) The developer releases such general-purpose artificial intelligence model under a free and open-source license that allows for: (A) Access to, and modification, distribution and usage of, such general-purpose artificial intelligence model; and (B) The parameters of such general-purpose artificial intelligence model to be made publicly available as set forth in this subsection; and (ii) Unless such general-purpose artificial intelligence model is deployed as a high-risk artificial intelligence system, the parameters of such general-purpose artificial intelligence model including, but not limited to, the weights and information concerning the model architecture and model usage for such general-purpose artificial intelligence model, are made publicly available; or (iii) The general-purpose artificial intelligence model is: (A) Not offered for sale in the market; (B) Not intended to interact with consumers; and (C) Solely utilized: (I) For an entity's internal purposes; or (II) Under an agreement between multiple entities for such entities' internal purposes. (3) The provisions of this section shall not apply to a developer that develops, or intentionally and substantially modifies, a general-purpose artificial intelligence model on or after October 1, 2026, if such general purpose artificial intelligence model performs tasks exclusively related to an entity's internal management affairs including, but not limited to, ordering office supplies or processing payments. (4) A developer that takes any action under an exemption established in this subsection shall bear the burden of demonstrating that such action qualifies for such exemption. (5) A developer that is exempt under this subsection shall establish and maintain an artificial intelligence risk management framework, which framework shall: (i) Be the product of an iterative process and ongoing efforts; and (ii) Include, at a minimum: (A) An internal governance function; (B) A map function that shall establish the context to frame risks; (C) A risk management function; and (D) A function to measure identified risks by assessing, analyzing and tracking such risks.

(c)–(d) 23 Nothing in subsection (a) of this section shall be construed to require a developer to disclose any information that is a trade secret or otherwise protected from disclosure under state or federal law. (d) Beginning on October 1, 2026, the attorney general may require that a developer disclose to the attorney general, as part of an investigation conducted by the attorney general, not later than ninety (90) days after a request by the attorney general and in a form and manner prescribed by the attorney general, any documentation maintained pursuant to this section. The attorney general may evaluate such documentation to ensure compliance with the provisions of this section. In disclosing any documentation to the attorney general pursuant to this subsection, the developer may designate such documentation as including any information that is exempt from disclosure under subsection (c) of this section or chapter 2 of title 38 ("access to public records"). To the extent such documentation includes such information, such documentation shall be exempt from disclosure under the provision of this chapter or chapter 2 of title 38. To the extent any information contained in such documentation is subject to the attorney-client privilege or work product protection, such disclosure shall not constitute a waiver of such privilege or protection.

This section establishes a parallel documentation track for developers of general-purpose AI models — distinct from the high-risk AI system obligations in §§ 6-61-3 through 6-61-5. Developers must create and maintain technical documentation covering training and testing processes, intended tasks, acceptable use policies, release dates, distribution methods, input/output modalities, and detailed training data descriptions including provenance, curation methodologies, and bias detection methods. Documentation must be reviewed at least annually. Developers must also provide downstream integrators with documentation enabling them to understand model capabilities and limitations and comply with their own chapter obligations. The section includes exemptions for open-source models (where parameters are publicly available), internal-use-only models, and models performing exclusively internal management tasks. Even exempt developers must maintain an AI risk management framework with governance, risk mapping, risk management, and measurement functions. The attorney general may require production of documentation within 90 days during an investigation.

Compliance actions 4 items

Developers of general-purpose AI models must create and maintain technical documentation covering training and testing processes, intended tasks, integration targets, acceptable use policies, release date, distribution methods, input/output modalities, and a detailed training data description including data type and provenance, curation methodologies, selection methods, unsuitable data source identification, and bias detection methods. Documentation must be reviewed and revised at least annually.

G-01.1

Developers of general-purpose AI models must create, maintain, and make available to downstream integrators documentation enabling them to understand model capabilities and limitations, comply with chapter obligations, and integrate the model, including technical integration requirements, model information, and training data descriptions, reviewed at least annually.

G-02.1

Developers exempt from technical documentation requirements (open-source, internal-use, or internal-management models) must still establish and maintain an AI risk management framework that includes an internal governance function, a risk-context mapping function, a risk management function, and a risk measurement and tracking function.

G-01.1

Developers of general-purpose AI models must produce technical documentation to the attorney general within 90 days of a request as part of an investigation, with trade secret and attorney-client privilege protections preserved.

R-02.2

R.I. Gen. Laws § 6-61-7

Artificial intelligence system designation (synthetic content labeling)

Developer

(a) 24 Beginning on October 1, 2026, and except as provided in subsections (b) and (c) of this section, the developer of an artificial intelligence system including, but not limited to, a general-purpose artificial intelligence model, that generates or manipulates synthetic digital content shall: (1) Ensure that the outputs of such artificial intelligence system are marked and detectable as synthetic digital content, and that such outputs are so marked and detectable: (i) Not later than the time that consumers who did not create such outputs first interact with, or are exposed to, such outputs; and (ii) In a manner that: (A) Is detectable by consumers; and (B) Complies with any applicable accessibility requirements; and (2) As far as technically feasible and in a manner that is consistent with any nationally or internationally recognized technical standards, ensure that such developer's technical solutions are effective, interoperable, robust and reliable, considering: (i) The specificities and limitations of different types of synthetic digital content; (ii) The implementation costs; and (iii) The generally acknowledged state of the art.

(b)–(c) If the synthetic digital content described in subsection (a) of this section is in an audio, image or video format, and such synthetic digital content forms part of an evidently artistic, creative, satirical, fictional analogous work or program, the disclosure required under said subsection shall be limited to a disclosure that does not hinder the display or enjoyment of such work or program. (c) The provisions of subsection (a) of this section shall not apply to: (1) Any synthetic digital content that: (i) Consists exclusively of text; (ii) Is published to inform the public on any matter of public interest; or (iii) Is unlikely to mislead a reasonable person consuming such synthetic digital content; or (2) To the extent that any artificial intelligence system described in subsection (a) of this section: (i) Performs an assistive function for standard editing; (ii) Does not substantially alter the input data provided by the developer or the semantics thereof; or (iii) Is used to detect, prevent a violation of the provisions of this chapter or other laws or regulations.

This section requires developers of AI systems (including general-purpose AI models) that generate or manipulate synthetic digital content to ensure outputs are marked and detectable as synthetic. Marking must occur before consumers who did not create the content first interact with or are exposed to it, must be consumer-detectable and accessibility-compliant, and must use technical solutions that are effective, interoperable, robust, and reliable consistent with recognized technical standards. An exception applies for artistic, creative, satirical, or fictional works, where the disclosure must not hinder display or enjoyment. Additional exemptions cover text-only content, content published to inform the public, content unlikely to mislead a reasonable person, assistive editing functions, content that does not substantially alter input data, and compliance-detection tools.

Compliance actions 1 item

Developers of AI systems that generate or manipulate synthetic digital content must ensure outputs are marked and detectable as synthetic before consumers first interact with or are exposed to them, in a consumer-detectable and accessibility-compliant manner, using technical solutions that are effective, interoperable, robust, and reliable consistent with recognized technical standards. Exemptions apply for text-only content, public-interest informational content, content unlikely to mislead a reasonable person, assistive editing, and compliance-detection tools.

T-02.1

R.I. Gen. Laws § 6-61-8

Compliance with other laws (exemptions and savings clauses)

(a)–(h) Nothing in this chapter shall be construed to restrict a developer's, integrator's, deployer's or other person's ability to: (1) Comply with federal, state or municipal law; (2) Comply with a civil, criminal or regulatory inquiry, investigation, subpoena or summons by a federal, state, municipal or other governmental authority; (3) Cooperate with a law enforcement agency concerning conduct or activity that the developer, integrator, deployer or other person reasonably and in good faith believes may violate federal, state or municipal law; (4) Investigate, establish, exercise, prepare for or defend a legal claim; (5) Take immediate steps to protect an interest that is essential for the life or physical safety of a consumer or another individual; (6)(i) By any means other than facial recognition technology, prevent, detect, protect against or respond to: (A) A security incident; (B) A malicious or deceptive activity; or (C) Identity theft, fraud, harassment or any other illegal activity. (ii) Investigate, report or prosecute the persons responsible for any action described in a security incident; or (iii) Preserve the integrity or security of systems; (7) Engage in public or peer-reviewed scientific or statistical research in the public interest that: (i) Adheres to all other applicable ethics and privacy laws; and (ii) Is conducted in accordance with: (A) The provisions of 45 CFR Part 46, as amended from time to time; or (B) Relevant requirements established by the federal Food and Drug Administration; (8) Conduct research, testing, development and integration activities regarding an artificial intelligence system or model, other than testing conducted under real world conditions, before such artificial intelligence system or model is placed on the market, deployed or put into service, as applicable; (9) Effectuate a product recall; (10) Identify and repair technical errors that impair existing or intended functionality; or (11) Assist another developer, integrator, deployer or person with any of the obligations imposed pursuant to the provisions of this chapter. (b) The obligations imposed on developers, integrators, deployers or other persons under this chapter shall not apply where compliance by the developer, integrator, deployer or other person with said provisions of this chapter shall violate an evidentiary privilege under the laws of this state. (c) Nothing in this chapter shall be construed to impose any obligation on a developer, integrator, deployer or other person that adversely affects the rights or freedoms of any person including, but not limited to, the rights of any person to freedom of speech or freedom of the press guaranteed in: (1) The First Amendment to the United States Constitution; and (2) The Rhode Island Constitution, Article 1, § 21. (d) Nothing in this chapter shall be construed to apply to any developer, integrator, deployer, or other person: (1) Insofar as such developer, integrator, deployer or other person develops, integrates, deploys, puts into service or intentionally and substantially modifies, as applicable, a high-risk artificial intelligence system: (i) That has been approved, authorized, certified, cleared, developed, integrated or granted by: (A) A federal agency, such as the federal Food and Drug Administration or the Federal Aviation Administration, acting within the scope of such federal agency's authority; or (B) A regulated entity subject to supervision and regulation by the Federal Housing Finance Agency; or (ii) In compliance with standards that are: (A) Established by: (I) Any federal agency including, but not limited to, the federal Office of the National Coordinator for Health Information Technology; or (II) A regulated entity subject to supervision and regulation by the Federal Housing Finance Agency; and (B) Substantially equivalent to, and at least as stringent as, the standards established in this chapter; (2) Conducting research to support an application: (i) For approval or certification from any federal agency including, but not limited to, the Federal Aviation Administration, the Federal Communications Commission, or the federal Food and Drug Administration; or (ii) That is otherwise subject to review by any federal agency; (3) Performing work under, or in connection with, a contract with the United States Department of Commerce, the United States Department of Defense, or the National Aeronautics and Space Administration, unless such developer, integrator, deployer or other person is performing such work on a high-risk artificial intelligence system that is used to make, or as a substantial factor in making, a decision concerning employment or housing; or (4) That is a covered entity within the meaning of the Health Insurance Portability and Accountability Act of 1996, Pub. L. 104-191, and the regulations promulgated thereunder, as both may be amended from time to time, and providing healthcare recommendations that: (i) Are generated by an artificial intelligence system; (ii) Require a healthcare provider to take action to implement such recommendations; and (iii) Are not considered to be high risk. (e) Nothing in this chapter shall be construed to apply to any artificial intelligence system that is acquired by or for the federal government or any federal agency or department including, but not limited to, the United States Department of Commerce, the United States Department of Defense, or the National Aeronautics and Space Administration, unless such artificial intelligence system is a high-risk artificial intelligence system that is used to make, or as a substantial factor in making, a decision concerning employment or housing. (f) Any insurer, subject to the provisions of title 27, fraternal benefit society, within the meaning of § 27-25-1, or health carrier, as defined in § 27-18.6-2, shall be deemed to be in full compliance with the provisions of this chapter if such insurer, fraternal benefit society or health carrier has implemented and maintains a written artificial intelligence systems program in accordance with all requirements established by the insurance commissioner defined in § 27-2.4-2. (g)(1) Any financial institution, out-of-state financial institution, Rhode Island credit union, federal credit union or out-of-state credit union, or any branch or subsidiary thereof, shall be deemed to be in full compliance with the provisions of this chapter if such financial institution, out-of-state financial institution, Rhode Island credit union, federal credit union, out-of-state credit union, branch or subsidiary is subject to examination by any state or federal prudential regulator under any published guidance or regulations that apply to the use of high-risk artificial intelligence systems and such guidance or regulations: (i) Impose requirements that are substantially equivalent to, and at least as stringent as, the requirements set forth in this chapter; and (ii) At a minimum, require such financial institution to: (A) Regularly audit such institution's use of high-risk artificial intelligence systems for compliance with state and federal anti-discrimination laws; and (B) Mitigate any algorithmic discrimination caused by the use of a high-risk artificial intelligence system or any risk of algorithmic discrimination that is reasonably foreseeable as a result of the use of a high-risk artificial intelligence system. (h) If a developer, integrator, deployer or other person engages in any action pursuant to an exemption set forth in subsections (a) through (g), inclusive, of this section, the developer, integrator, deployer or other person bears the burden of demonstrating that such action qualifies for such exemption.

This section establishes an extensive set of exemptions and savings clauses. It preserves the ability of covered entities to comply with other laws, cooperate with law enforcement, defend legal claims, protect life safety, conduct security operations, engage in ethical research, conduct pre-market testing, effectuate recalls, and fix technical errors. It explicitly protects First Amendment and Rhode Island constitutional free speech rights. Federal preemption carve-outs apply for systems approved by FDA, FAA, FHFA, or meeting equivalent federal standards, and for work under DoD, Commerce, or NASA contracts (except for employment and housing high-risk systems). Insurance entities in compliance with state insurance commissioner AI requirements, and financial institutions subject to equivalent prudential regulation, are deemed in full compliance. Burden of proof for exemption claims falls on the claiming party.

R.I. Gen. Laws § 6-61-9

Enforcement

(a)–(f) The attorney general shall have exclusive authority to enforce the provisions of this chapter. (b) Except as provided in subsection (f) of this section, during the period beginning on October 1, 2026, and ending on September 30, 2027, the attorney general shall, prior to initiating any action for a violation of any provision of this chapter, issue a notice of violation to the developer, integrator, deployer, or other person if the attorney general determines that it is possible to cure such violation. If the developer, integrator, deployer or other person fails to cure such violation not later than sixty (60) days after receipt of the notice of violation, the attorney general may bring an action pursuant to this chapter. (c) Except as provided in subsection (f) of this section, beginning on October 1, 2027, the attorney general may, in determining whether to grant a developer, integrator, deployer or other person the opportunity to cure a violation described in subsection (b) of this section, consider: (1) The number of violations; (2) The size and complexity of the developer, integrator, deployer or other person; (3) The nature and extent of the developer's, integrator's, deployer's or other person's business; (4) The substantial likelihood of injury to the public; (5) The safety of persons or property; and (6) Whether such violation was likely caused by human or technical error. (d) Nothing in this chapter shall be construed as providing the basis for a private right of action for violations of this chapter. (e) Except as provided in subsections (a) through (d), inclusive, of this section and subsection (f) of this section, a violation of the requirements established in this chapter shall constitute an unfair trade practice for purposes of § 6-13.1-5 and shall be enforced solely by the attorney general. (f)(1) In any action commenced by the attorney general for any violation of this chapter, it shall be an affirmative defense that the developer, integrator, deployer, or other person: (i) Discovered a violation of any provision of this chapter through red-teaming; (ii) Not later than sixty (60) days after discovering the violation as set forth in subsection (f)(1)(i) of this section: (A) Cures such violation; and (B) Provides to the attorney general, in a form and manner prescribed by the attorney general, notice that such violation has been cured and evidence that any harm caused by such violation has been mitigated; and (iii) Is otherwise in compliance with the latest version of: (A) The "Artificial Intelligence Risk Management Framework" published by the National Institute of Standards and Technology; (B) ISO or IEC 42001 of the International Organization for Standardization; (C) A nationally or internationally recognized risk management framework for artificial intelligence systems, other than the risk management frameworks specified in this subsection, that imposes requirements that are substantially equivalent to, and at least as stringent as, the requirements set forth in this chapter; or (D) Any risk management framework for artificial intelligence systems that is substantially equivalent to, and at least as stringent as, the risk management frameworks described in this subsection. (2) The developer, integrator, deployer or other person bears the burden of demonstrating to the attorney general that the requirements established in subsection (f)(1) of this section have been satisfied. (3) Nothing in this this chapter including, but not limited to, the enforcement authority granted to the attorney general under this section, shall be construed to preempt or otherwise affect any right, claim, remedy, presumption or defense available at law or in equity. Any rebuttable presumption or affirmative defense established under this chapter shall apply only to an enforcement action brought by the attorney general pursuant to this section and shall not apply to any right, claim, remedy, presumption, or defense available at law or in equity.

This section vests exclusive enforcement authority in the attorney general. During the first year (October 1, 2026 – September 30, 2027), the attorney general must issue a notice of violation and allow a 60-day cure period before bringing an action. After that period, the attorney general has discretion on whether to grant a cure opportunity, considering factors such as the number of violations, entity size and complexity, likelihood of public injury, and whether the violation was caused by human or technical error. The statute expressly bars any private right of action. Violations constitute unfair trade practices under § 6-13.1-5. An affirmative defense is available where the entity discovered the violation through red-teaming, cured it within 60 days, notified the attorney general, and is otherwise in compliance with NIST AI RMF, ISO/IEC 42001, or an equivalent framework. The section preserves all common-law and equitable claims and defenses and limits the rebuttable presumptions and affirmative defenses to attorney general enforcement actions.

Transparency AI identity disclosure · periodic reminders

1 item

T-02.1

Beginning Oct 1, 2026 Developers of AI systems that generate or manipulate synthetic digital content must ensure outputs are marked and detectable as synthetic before consumers first interact with or are exposed to them, in a consumer-detectable and accessibility-compliant manner, using technical solutions that are effective, interoperable, robust, and reliable consistent with recognized technical standards. Exemptions apply for text-only content, public-interest informational content, content unlikely to mislead a reasonable person, assistive editing, and compliance-detection tools.

Human Oversight Decision review · appeal pathways

8 items

H-02.1

Beginning Oct 1, 2026 Developers of high-risk AI systems must use reasonable care to protect consumers from known or reasonably foreseeable risks of algorithmic discrimination arising from the intended and contracted uses of the system.

H-02.1

Beginning Oct 1, 2026 Integrators must use reasonable care to protect consumers from known or reasonably foreseeable risks of algorithmic discrimination arising from the intended and contracted uses of integrated high-risk AI systems.

H-02.1

Beginning Oct 1, 2026 Deployers of high-risk AI systems must use reasonable care to protect consumers from known or reasonably foreseeable risks of algorithmic discrimination.

H-02.3

Beginning Oct 1, 2026 Deployers must complete an impact assessment of each high-risk AI system before deployment and at least annually thereafter (and within 90 days of any intentional and substantial modification), covering purpose, discrimination risk analysis, data categories, customization data, performance metrics, transparency measures, and post-deployment monitoring.

H-02.10

Beginning Oct 1, 2026 Deployers must retain the most recently completed impact assessment, all associated records, and all prior impact assessments for at least three years following the final deployment of the high-risk AI system.

H-02.8

Beginning Oct 1, 2026 Deployers must review the deployment of each high-risk AI system at least annually to ensure it is not causing algorithmic discrimination.

H-01.3

Beginning Oct 1, 2026 Deployers must, before deploying a high-risk AI system to make or substantially factor in a consequential decision about a consumer, (1)notify the consumer of the AI system's use, (2) disclose the system's purpose and the nature of the decision, (3) provide the right to opt out of automated decision-making based on personal data, (4) provide deployer contact information, (5) provide a plain-language system description, and (6) provide instructions to access the deployer's public website statement.

H-01.1

Beginning Oct 1, 2026 Deployers must, when a consequential decision is adverse to a consumer, (1) explain the principal reasons including the degree and manner of AI contribution, data types, and data sources, (2) allow the consumer to examine and correct personal data used, and (3) provide an opportunity to appeal based on inaccurate personal data with human review where technically feasible. All notices must be provided directly to the consumer, in plain language, in all languages the deployer ordinarily uses, and in formats accessible to consumers with disabilities.

Governance Risk management · accountability programs

9 items

G-02.1

Beginning Oct 1, 2026 Developers must provide each deployer or downstream developer with documentation covering foreseeable uses, known harmful uses, training data summaries, system limitations, algorithmic discrimination risks, performance evaluation methods, data governance measures, bias mitigation steps, intended outputs, and human monitoring instructions.

G-02.1

Beginning Oct 1, 2026 Developers must make available to deployers and downstream developers the documentation and information necessary for the deployer to complete an impact assessment, delivered through artifacts such as model cards, dataset cards, or other impact assessments.

G-02.4

Beginning Oct 1, 2026 Developers must publish on their website or in a public use case inventory a statement summarizing the types of high-risk AI systems they currently offer, and how they manage known or reasonably foreseeable risks of algorithmic discrimination, updated within 90 days of any intentional and substantial modification.

G-02.4

Beginning Oct 1, 2026 Integrators must publish on their website or in a public use case inventory a statement summarizing the types of high-risk AI systems they have integrated and how they manage algorithmic discrimination risks, updated within 90 days of any intentional and substantial modification.

G-01.1

Beginning Oct 1, 2026 Deployers must implement and maintain an iterative risk management policy and program covering principles, processes, and personnel for identifying, documenting, and mitigating algorithmic discrimination risks, conforming to NIST AI RMF, ISO/IEC 42001, or an equivalent framework, and regularly reviewed and updated over the system lifecycle.

G-02.4

Beginning Oct 1, 2026 Deployers must publish on their website a periodically updated statement summarizing the types of high-risk AI systems they deploy, how they manage algorithmic discrimination risks, and the nature, source, and extent of information collected and used.

G-01.1

Beginning Oct 1, 2026 Developers of general-purpose AI models must create and maintain technical documentation covering training and testing processes, intended tasks, integration targets, acceptable use policies, release date, distribution methods, input/output modalities, and a detailed training data description including data type and provenance, curation methodologies, selection methods, unsuitable data source identification, and bias detection methods. Documentation must be reviewed and revised at least annually.

G-02.1

Beginning Oct 1, 2026 Developers of general-purpose AI models must create, maintain, and make available to downstream integrators documentation enabling them to understand model capabilities and limitations, comply with chapter obligations, and integrate the model, including technical integration requirements, model information, and training data descriptions, reviewed at least annually.

G-01.1

Beginning Oct 1, 2026 Developers exempt from technical documentation requirements (open-source, internal-use, or internal-management models) must still establish and maintain an AI risk management framework that includes an internal governance function, a risk-context mapping function, a risk management function, and a risk measurement and tracking function.

Regulatory Reporting · disclosure · audit

5 items

R-01.3

Beginning Oct 1, 2026 Developers must disclose to the attorney general and all known deployers or other developers any known or reasonably foreseeable risks of algorithmic discrimination, within 90 days of discovering that the system has caused or is reasonably likely to have caused algorithmic discrimination to at least 1,000 consumers.

R-02.2

Beginning Oct 1, 2026 Developers must produce documentation to the attorney general upon request as part of an investigation, with trade secret and attorney-client privilege protections preserved.

R-01.3

Beginning Oct 1, 2026 Deployers must notify the attorney general within 90 days of discovering that a deployed high-risk AI system has caused algorithmic discrimination to at least 1,000 consumers.

R-02.2

Beginning Oct 1, 2026 Deployers must produce risk management policies, impact assessments, and related records to the attorney general within 90 days of a request as part of an investigation, with trade secret and attorney-client privilege protections preserved.

R-02.2

Beginning Oct 1, 2026 Developers of general-purpose AI models must produce technical documentation to the attorney general within 90 days of a request as part of an investigation, with trade secret and attorney-client privilege protections preserved.

—

Other

1 item

—

Beginning Oct 1, 2026 Integrators must enter into a binding contract with the developer before integrating a high-risk AI system into a product or service, clearly allocating developer and integrator duties including responsibility for documentation and impact assessment support obligations.

Passage Likelihood

Medium

Status Introduced

Chamber No passage

Committee No action

Majority party Yes

Bipartisan Yes

Prior session None

Legislative History

2025-03-07 Introduced, referred to Senate Artificial Intelligence & Emerging Technol

2025-04-04 Scheduled for hearing and/or consideration

2025-04-05 Committee postponed at request of sponsor (04/07/2025)

2025-04-17 Scheduled for hearing and/or consideration

2025-04-21 Meeting postponed (04/21/2025)

2025-05-09 Scheduled for hearing and/or consideration (05/12/2025)

2025-05-12 Committee recommended measure be held for further study

Sources

Full Text ↗

Entry Last Reviewed

2026-05-20

AI generated