Regulon — VA-HB-2046 · VA HB 2046 (Public Body High-Risk AI)

WHAT THIS BILL REGULATES · 5 REQUIREMENT TYPES

How Is This Bill Enforced

Enforcement Authority

No private right of action. Enforcement is through the Chief Information Officer of the Commonwealth, who develops and maintains policies and procedures governing public body use of high-risk AI systems. Public bodies must comply with CIO-issued policies and the chapter's requirements as a condition of implementation. No penalty provisions are specified in the bill.

Private Right of Action

No private right of action. Enforcement is exclusive to the designated authority.

Penalties

The bill does not specify monetary penalties, damages, or other remedies. Enforcement operates through CIO policy compliance requirements and the obligation on public bodies to cease using non-compliant systems.

Verbatim statutory text on the left; plain-language analysis and a per-section checklist on the right. Numbered markers cross-link to the matching checklist row.

Statutory Text

Analysis & Obligations

Va. Code § 2.2-2007(B)(10)

CIO powers: AI policies and procedures

Government

(B)(10) 1 10. Develop, publish, and maintain policies and procedures concerning the development, procurement, implementation, utilization, and ongoing assessment of systems that employ high-risk artificial intelligence systems, as defined in § 2.2-5517, and are in use by public bodies, consistent with the provisions of Chapter 55.6 (§ 2.2-5517 et seq.). Such policies and procedures shall, at a minimum, (i) govern the procurement, implementation, and ongoing assessment of any such system by a public body; (ii) address and provide resources regarding data security and privacy issues that may arise from the development and deployment of high-risk artificial intelligence systems by public bodies; (iii) be sufficient to ensure that no such system results in any algorithmic discrimination, as defined in § 2.2-5517; (iv) create guidelines for acceptable use policies for public bodies integrating high-risk artificial intelligence systems pursuant to § 2.2-5520; and (v) require a public body to assess the likely impact of any such system before implementing such system and perform ongoing assessments of such system to ensure that no such system results in any such algorithmic discrimination, as defined in § 2.2-5517. Such policies and procedures shall include a requirement that a high-risk artificial intelligence system compliance clause be included in procurement contracts for systems that use a high-risk artificial intelligence system for which negotiation or renegotiation is begun on or after July 1, 2026, requiring compliance with the provisions of Chapter 55.6 (§ 2.2-5517 et seq.) and any other applicable state law governing the development or deployment of high-risk artificial intelligence systems, as applicable.

This amendment to the existing CIO powers statute charges the Chief Information Officer of the Commonwealth with developing, publishing, and maintaining policies and procedures governing public body use of high-risk artificial intelligence systems. The policies must address procurement, implementation, ongoing assessment, data security and privacy, algorithmic discrimination prevention, acceptable use guidelines, and pre-implementation and ongoing impact assessments. Critically, the CIO must also require inclusion of a high-risk AI compliance clause in procurement contracts for which negotiation or renegotiation begins on or after July 1, 2026.

Compliance actions 1 item

The CIO must develop, publish, and maintain policies and procedures governing public body procurement, implementation, ongoing assessment, data security, privacy, acceptable use, and algorithmic discrimination prevention for high-risk AI systems, including requiring a high-risk AI compliance clause in procurement contracts negotiated or renegotiated on or after July 1, 2026.

G-01.1

Va. Code § 2.2-5517

Definitions

As used in this chapter, unless the context requires a different meaning:

Section 2.2-5517 establishes the defined terms for Chapter 55.6. Key terms include high-risk artificial intelligence system (an AI system specifically intended to autonomously make, or be a substantial factor in making, a consequential decision), deployer (a public body that deploys or uses such a system for consequential decisions), developer (a public body that develops or intentionally and substantially modifies such a system), and integrator (a public body that embeds an AI system into a software application for public use). The definition of high-risk AI system includes extensive carve-outs for narrow procedural tasks, preparatory assessments, and a rebuttable presumption excluding eighteen categories of common technologies.

Va. Code § 2.2-5518

Operating standards for public body developers

Developer

(A) 2 A. No developer of a high-risk artificial intelligence system shall offer, sell, lease, give, or otherwise provide to a deployer a high-risk artificial intelligence system unless the developer makes available to the deployer: 1. A statement disclosing the intended uses of such high-risk artificial intelligence system; 2. Documentation disclosing the following: a. The known or reasonably known limitations of such high-risk artificial intelligence system, including any and all known or reasonably foreseeable risks of algorithmic discrimination arising from the intended uses of such high-risk artificial intelligence system; b. The purpose of such high-risk artificial intelligence system and the intended benefits and uses of such high-risk artificial intelligence system; c. A summary describing how such high-risk artificial intelligence system was evaluated for performance and relevant information related to explainability before such high-risk artificial intelligence system was licensed, sold, given, or otherwise made available to a developer; d. The measures the developer has taken to mitigate reasonable foreseeable risks of algorithmic discrimination that the developer knows arises from deployment or use of such high-risk artificial intelligence system; and e. How an individual can use such high-risk artificial intelligence system to make, or monitor such high-risk artificial intelligence system when such high-risk artificial intelligence system is deployed or used to make, a consequential decision; 3. Documentation describing (i) how the high-risk artificial intelligence system was evaluated for performance and for mitigation of algorithmic discrimination before such system was made available to the deployer; (ii) the data governance measures used to cover the training data sets and the measures used to examine the suitability of data sources, possible biases of data sources, and appropriate mitigation; (iii) the intended outputs of the high-risk artificial intelligence system; (iv) the measures the developer has taken to mitigate known or reasonably foreseeable risks of algorithmic discrimination that may arise from the reasonably foreseeable deployment of the high-risk artificial intelligence system; and (v) how the high-risk artificial intelligence system should be used, not be used, and be monitored by an individual when such system is used to make, or is a substantial factor in making, a consequential decision; and 4. Any additional documentation that is reasonably necessary to assist the deployer in understanding the outputs and monitoring performance of the high-risk artificial intelligence system for risks of algorithmic discrimination.

(B) 3 B. Each developer that offers, sells, leases, gives, or otherwise makes available to a deployer a high-risk artificial intelligence system shall make available to the deployer information and documentation in the developer's possession, custody, or control that is reasonably required to complete an impact assessment as required in § 2.2-5519.

(C) C. A developer that also serves as a deployer for any high-risk artificial intelligence system shall not be required to generate the documentation required by this section unless such high-risk artificial intelligence system is provided to an unaffiliated entity acting as a deployer or as otherwise required by law.

(D) D. Nothing in this section shall be construed to require a developer to disclose any trade secret.

(E) E. High-risk artificial intelligence systems that are in conformity with the latest version of the Artificial Intelligence Risk Management Framework published by the National Institute of Standards and Technology, Standard ISO/IEC 42001 of the International Organization for Standardization, or another nationally or internationally recognized risk management framework for artificial intelligence systems, or parts thereof, shall be presumed to be in conformity with related requirements set out in this section and in associated regulations.

(F) 4 F. For any disclosure required pursuant to this section, each developer shall, no later than 90 days after the developer performs an intentional and substantial modification to any high-risk artificial intelligence system, update such disclosure as necessary to ensure that such disclosure remains accurate.

Section 2.2-5518 imposes documentation and disclosure obligations on public bodies acting as developers of high-risk AI systems. Before providing a high-risk AI system to a deployer, the developer must deliver comprehensive documentation covering intended uses, known limitations, algorithmic discrimination risks, performance evaluation summaries, data governance measures, mitigation steps, and human oversight instructions. The developer must also furnish any information reasonably required for the deployer to complete an impact assessment under § 2.2-5519.

A safe harbor presumes compliance for systems conforming to the NIST AI RMF, ISO/IEC 42001, or another nationally or internationally recognized AI risk management framework. Trade secrets are explicitly protected from mandatory disclosure. All documentation must be updated within 90 days of any intentional and substantial modification.

Compliance actions 3 items

Developers must provide deployers with documentation covering the high-risk AI system's intended uses, known limitations, algorithmic discrimination risks, performance evaluation summaries, data governance measures, bias mitigation steps, intended outputs, and human oversight instructions before making the system available.

G-02.1

Developers must make available to deployers all information and documentation in the developer's possession, custody, or control that is reasonably required for the deployer to complete an impact assessment under § 2.2-5519.

G-02.1

Developers must update all required disclosures within 90 days after performing an intentional and substantial modification to any high-risk AI system to ensure the disclosures remain accurate.

G-01.2

Va. Code § 2.2-5519

Operating standards for public body deployers

Government

(A) 5 A. No deployer shall deploy or use a high-risk artificial intelligence system to make a consequential decision unless the deployer has designed and implemented a risk management policy and program for such high-risk artificial intelligence system. The risk management policy shall specify the principles, processes, and personnel that the deployer shall use in maintaining the risk management program to identify, mitigate, and document any risk of algorithmic discrimination that is a reasonably foreseeable consequence of deploying or using such high-risk artificial intelligence system to make a consequential decision. Each risk management policy and program designed, implemented, and maintained pursuant to this subsection shall be (i) at least as stringent as the latest version of the Artificial Intelligence Risk Management Framework published by the National Institute of Standards and Technology, Standard ISO/IEC 42001 of the International Organization for Standardization, or another nationally or internationally recognized risk management framework for artificial intelligence systems and (ii) reasonable considering (a) the size and complexity of the deployer; (b) the nature and scope of the high-risk artificial intelligence systems deployed and used by the deployer, including the intended uses of such high-risk artificial intelligence systems; (c) the sensitivity and volume of data processed in connection with the high-risk artificial intelligence systems deployed and used by the deployer; and (d) the cost to the deployer to implement and maintain such risk management program.

(B) 6 B. Except as provided in this subsection, no deployer shall deploy or use a high-risk artificial intelligence system to make a consequential decision unless the deployer has completed an impact assessment for such high-risk artificial intelligence system. The deployer shall complete an impact assessment for a high-risk artificial intelligence system (i) before the deployer initially deploys such high-risk artificial intelligence system and (ii) not later than 90 days after each significant update to such high-risk artificial intelligence system is made available. Each impact assessment completed pursuant to this subsection shall include, at a minimum: 1. A statement by the deployer disclosing (i) the purpose, intended use cases and deployment context of, and benefits afforded by the high-risk artificial intelligence system and (ii) whether the deployment or use of the high-risk artificial intelligence system poses a reasonably foreseeable risk of algorithmic discrimination and, if so, (a) the nature of such algorithmic discrimination and (b) the steps that have been taken, to the extent feasible, to mitigate such risk; 2. For each post-deployment impact assessment completed pursuant to this subsection, whether the intended use cases of the high-risk artificial intelligence system as updated were consistent with, or varied from, the developer's intended uses of such high-risk artificial intelligence system; 3. A description of (i) the categories of data the high-risk artificial intelligence system processes as inputs and (ii) the outputs such high-risk artificial intelligence system produces; 4. If the deployer used data to customize the high-risk artificial intelligence system, an overview of the categories of data the deployer used to customize such high-risk artificial intelligence system; 5. A list of any metrics used to evaluate the performance and known limitations of the high-risk artificial intelligence system; 6. A description of any transparency measures taken concerning the high-risk artificial intelligence system, including any measures taken to disclose to a consumer that such high-risk artificial intelligence system is in use when such high-risk artificial intelligence system is in use; and 7. A description of any post-deployment monitoring performed and user safeguards provided concerning such high-risk artificial intelligence system, including any oversight process established by the deployer to address issues arising from deployment or use of such high-risk artificial intelligence system as such issues arise. A single impact assessment may address a comparable set of high-risk artificial intelligence systems deployed or used by a deployer. High-risk artificial intelligence systems that are in conformity with the latest version of the Artificial Intelligence Risk Management Framework published by the National Institute of Standards and Technology, Standard ISO/IEC 42001 of the International Organization for Standardization, or another nationally or internationally recognized risk management framework for artificial intelligence systems, or parts thereof, shall be presumed to be in conformity with related requirements set out in this section and in associated regulations. If a deployer completes an impact assessment for the purpose of complying with another applicable law or regulation, such impact assessment shall be deemed to satisfy the requirements established in this subsection if such impact assessment is reasonably similar in scope and effect to the impact assessment that would otherwise be completed pursuant to this subsection. A deployer that completes an impact assessment pursuant to this subsection shall maintain such impact assessment and all records concerning such impact assessment for five years.

(C) 7 C. Not later than the time that a deployer uses a high-risk artificial intelligence system to make a consequential decision concerning a consumer, the deployer shall notify the consumer that the deployer is using a high-risk artificial intelligence system to make such consequential decision concerning such consumer and provide to the consumer a statement disclosing (i) the purpose of such high-risk artificial intelligence system, (ii) the nature of such system, (iii) the nature of the consequential decision, (iv) the contact information for the deployer, and (v) a description in plain language of such system.

(C) second paragraph 8 If such consequential decision is adverse to such consumer, the deployer shall provide to the consumer (a) a statement disclosing the principal reason or reasons for the consequential decision, including (1) the degree to which and manner in which the high-risk artificial intelligence system contributed to the consequential decision, (2) the type of data that was processed by such system in making the consequential decision, and (3) the sources of such data; (b) an opportunity to correct any incorrect personal data that the high-risk artificial intelligence system processed in making, or as a substantial factor in making, the consequential decision; and (c) an opportunity to appeal such adverse consequential decision concerning the consumer arising from the deployment of such system. Any such appeal shall allow for human review, if technically feasible, unless providing the opportunity for appeal is not in the best interest of the consumer, including instances in which any delay might pose a risk to the life or safety of such consumer.

(D) 9 D. Each deployer shall make available, in a manner that is clear and readily available, a statement summarizing how such deployer manages any reasonably foreseeable risk of algorithmic discrimination that may arise from the use or deployment of the high-risk artificial intelligence system.

(E) 10 E. For any disclosure required pursuant to this section, each deployer shall, no later than 90 days after the developer performs an intentional and substantial modification to any high-risk artificial intelligence system, update such disclosure as necessary to ensure that such disclosure remains accurate.

Section 2.2-5519 establishes the core deployer obligations. Deploying public bodies must implement a risk management policy and program conforming at minimum to the NIST AI RMF, ISO/IEC 42001, or an equivalent recognized framework, tailored to the deployer's size, system complexity, data sensitivity, and cost. The deployer must complete an impact assessment before initial deployment and within 90 days of each significant update, covering purpose, discrimination risk, data categories, performance metrics, transparency measures, and post-deployment monitoring. Impact assessments must be retained for five years.

When a high-risk AI system is used for a consequential decision, the deployer must notify the consumer and disclose the system's purpose, nature, the nature of the decision, and deployer contact information. For adverse decisions, the deployer must explain principal reasons (including the AI's contribution and data sources), offer data correction, and provide an appeal opportunity with human review where technically feasible. Deployers must also publish a summary of how they manage algorithmic discrimination risk and update all disclosures within 90 days of any intentional and substantial modification.

Compliance actions 6 items

Deployers must design, implement, and maintain a risk management policy and program specifying principles, processes, and personnel for identifying, mitigating, and documenting algorithmic discrimination risks, at least as stringent as the NIST AI RMF, ISO/IEC 42001, or an equivalent recognized framework, and reasonable in light of the deployer's size, system complexity, data sensitivity, and cost.

G-01.1

Deployers must complete an impact assessment before initially deploying a high-risk AI system and within 90 days of each significant update, covering purpose, discrimination risks, data categories, customization data, performance metrics, transparency measures, and post-deployment monitoring. Impact assessments and all related records must be retained for five years. A single assessment may cover a comparable set of systems, and assessments completed under other applicable laws may satisfy this requirement if reasonably similar in scope.

H-02.3

Deployers must notify consumers no later than the time a high-risk AI system is used to make a consequential decision, disclosing the system's purpose, nature, the nature of the consequential decision, deployer contact information, and a plain-language description of the system.

H-01.3

Deployers must, for adverse consequential decisions, provide the consumer with (1) a statement disclosing principal reasons for the decision including the AI system's contribution, data types processed, and data sources; (2) an opportunity to correct incorrect personal data used in the decision; and (3) an opportunity to appeal the decision with human review where technically feasible.

H-01.1

Deployers must make publicly available, in a clear and readily accessible manner, a statement summarizing how the deployer manages reasonably foreseeable algorithmic discrimination risks arising from use or deployment of the high-risk AI system.

G-02.4

Deployers must update all required disclosures within 90 days after the developer performs an intentional and substantial modification to any high-risk AI system to ensure the disclosures remain accurate.

G-01.2

Va. Code § 2.2-5520

Operating standards for public body integrators

Government

first paragraph 11 Each integrator of a high-risk artificial intelligence system shall develop and adopt an acceptable use policy, which shall limit the use of the high-risk artificial intelligence system to mitigate known risks of algorithmic discrimination.

second paragraph 12 Each integrator of a high-risk artificial intelligence system shall provide to the deployer clear, conspicuous notice of (i) the name or other identifier of the high-risk artificial intelligence system integrated into a software application provided to the deployer; (ii) the name and contact information of the developer of the high-risk artificial intelligence system integrated into a software application provided to the deployer; (iii) whether the integrator has adjusted the model weights of the high-risk artificial intelligence system integrated into the software application by exposing it to additional data, a summary of the adjustment process, and how such process and the resulting system were evaluated for risk of algorithmic discrimination; (iv) a summary of any other non-substantial modifications made by the integrator; and (v) the integrator's acceptable use policy.

Section 2.2-5520 introduces a novel integrator role — public bodies that embed AI systems into software applications for public use — and imposes two obligations: adopting an acceptable use policy to limit system use and mitigate algorithmic discrimination risks, and providing deployers with clear notice of the integrated AI system's identity, developer contact information, any model weight adjustments and their discrimination risk evaluation, non-substantial modifications, and the integrator's acceptable use policy.

Compliance actions 2 items

Integrators must develop and adopt an acceptable use policy that limits the use of the high-risk AI system to mitigate known risks of algorithmic discrimination.

G-01.1

Integrators must provide deployers with clear, conspicuous notice identifying the integrated high-risk AI system, the developer's name and contact information, any model weight adjustments and their discrimination risk evaluation, a summary of non-substantial modifications, and the integrator's acceptable use policy.

G-02.1

Va. Code § 2.2-5521

Exemptions

(A) A. Nothing in this chapter shall be construed to restrict a developer's, integrator's, or deployer's ability to (i) comply with federal, state, or municipal ordinances or regulations; (ii) comply with a civil, criminal, or regulatory inquiry, investigation, subpoena, or summons by federal, state, local, or other governmental authorities; (iii) cooperate with law-enforcement agencies concerning conduct or activity that the developer, integrator, or deployer reasonably and in good faith believes may violate federal, state, or local law, ordinances, or regulations; (iv) investigate, establish, exercise, prepare for, or defend legal claims; (v) provide a product or service specifically requested by a consumer; (vi) perform under a contract to which a consumer is a party, including fulfilling the terms of a written warranty; (vii) take steps at the request of a consumer prior to entering into a contract; (viii) take immediate steps to protect an interest that is essential for the life or physical safety of the consumer or another individual; (ix) prevent, detect, protect against, or respond to security incidents, identity theft, fraud, harassment, or malicious or deceptive activities; (x) take actions to prevent, detect, protect against, report, or respond to the production, generation, incorporation, or synthesization of child sex abuse material, or any illegal activity, preserve the integrity or security of systems, or investigate, report, or prosecute those responsible for any such action; (xi) engage in public or peer-reviewed scientific or statistical research in the public interest that adheres to all other applicable ethics and privacy laws and is approved, monitored, and governed by an institutional review board that determines, or similar independent oversight entities that determine, (a) that the expected benefits of the research outweigh the risks associated with such research and (b) whether the developer, integrator, or deployer has implemented reasonable safeguards to mitigate the risks associated with such research; (xii) assist another developer, integrator, or deployer with any of the obligations imposed by this chapter; or (xiii) take any action that is in the public interest in the areas of public health, community health, or population health, but solely to the extent that such action is subject to suitable and specific measures to safeguard the public.

(B) B. The obligations imposed on developers, integrators, or deployers by this chapter shall not restrict a developer's, integrator's, or deployer's ability to (i) conduct internal research to develop, improve, or repair products, services, or technologies; (ii) effectuate a product recall; (iii) identify and repair technical errors that impair existing or intended functionality; or (iv) perform internal operations that are reasonably aligned with the expectations of the consumer or reasonably anticipated based on the consumer's existing relationship with the developer, integrator, or deployer.

(C) C. Nothing in this chapter shall be construed to impose any obligation on a developer, integrator, or deployer to disclose trade secrets.

(D) D. The obligations imposed on developers, integrators, or deployers by this chapter shall not apply where compliance by the developer, integrator, or deployer with such obligations would violate an evidentiary privilege under the laws of the Commonwealth.

(E) E. Nothing in this chapter shall be construed to impose any obligation on a developer, integrator, or deployer that adversely affects the legally protected rights or freedoms of any person, including the rights of any person to freedom of speech or freedom of the press guaranteed in the First Amendment to the Constitution of the United States or under the Virginia Human Rights Act (§ 2.2-3900 et seq.).

(F) F. If a developer, integrator, or deployer engages in any action authorized by an exemption set forth in this section, the developer, integrator, or deployer bears the burden of demonstrating that such action qualifies for such exemption.

Section 2.2-5521 enumerates broad exemptions from the chapter's obligations. Developers, integrators, and deployers may act to comply with law, cooperate with law enforcement, defend legal claims, provide requested products, protect safety, prevent fraud, combat CSAM, and conduct IRB-approved research. Internal operations — product improvement, recalls, and technical error repair — are also protected. Trade secrets and evidentiary privileges are shielded, and First Amendment rights are expressly preserved. The burden of demonstrating that an action qualifies for an exemption falls on the entity claiming it.

Va. Code § 2.2-5522

Additional requirements for public bodies

Government

(A) 13 A. A public body shall not implement any system that employs high-risk artificial intelligence systems unless it has fulfilled the requirements of this section and complied with the provisions of this chapter and the high-risk artificial intelligence policies and procedures developed by the Chief Information Officer of the Commonwealth pursuant to subdivision B 10 of § 2.2-2007.

(B) 14 B. A public body procuring any system that employs high-risk artificial intelligence systems shall in all future contracts for the procurement of such systems for which negotiation or renegotiation is begun on or after July 1, 2026, include a high-risk artificial intelligence system compliance clause, as developed by the Chief Information Officer of the Commonwealth pursuant to § 2.2-2007.

(C) 15 C. Prior to implementing any system that employs high-risk artificial intelligence systems, the public body shall comply with the impact assessment requirements of § 2.2-5519. A public body shall additionally perform ongoing assessments of such system after implementation. If the public body, or the head of the public body, determines, in its discretion, that such system does not comply with such requirements, the public body shall not implement such system or shall cease to use such system to the extent such system does not comply with such requirements.

(D) 16 D. All public bodies that implement high-risk artificial intelligence systems shall annually report on initial and ongoing system assessments and provide an inventory of such systems used. Public bodies in the legislative branch shall submit such report and inventory to the General Assembly. Public bodies in the judicial branch shall submit such report and inventory to the Executive Secretary of the Supreme Court of Virginia. Public bodies in the executive branch and any other public bodies not specified in this subsection shall submit such report and inventory to the Chief Information Officer of the Commonwealth. Such report and inventory shall be transmitted to the appropriate entity annually.

Section 2.2-5522 imposes four cumulative requirements on public bodies. First, no public body may implement a high-risk AI system without fulfilling the chapter's requirements and complying with CIO-issued policies. Second, procurement contracts for high-risk AI systems negotiated or renegotiated on or after July 1, 2026 must include a CIO-developed compliance clause. Third, public bodies must complete impact assessments before implementation and conduct ongoing assessments, with a duty to cease use of non-compliant systems. Fourth, all public bodies using high-risk AI must annually report assessments and maintain an inventory of such systems, submitted to the General Assembly (legislative branch), the Executive Secretary of the Supreme Court (judicial branch), or the CIO (executive branch and all others).

Compliance actions 4 items

Public bodies must not implement any high-risk AI system unless they have fulfilled all requirements of Chapter 55.6 and complied with the CIO's high-risk AI policies and procedures.

PS-01.4

Public bodies must include a CIO-developed high-risk AI system compliance clause in all procurement contracts for high-risk AI systems for which negotiation or renegotiation begins on or after July 1, 2026.

PS-01.4

Public bodies must complete an impact assessment under § 2.2-5519 before implementing any high-risk AI system, perform ongoing post-implementation assessments, and cease using any system determined to be non-compliant.

PS-01.2

Public bodies must annually report on initial and ongoing high-risk AI system assessments and provide an inventory of all such systems to the General Assembly (legislative branch), the Executive Secretary of the Supreme Court (judicial branch), or the CIO (executive branch and others).

PS-01.1

Enactment Clause 2

Work group on local government compliance

That the Chief Information Officer of the Commonwealth (CIO) shall convene a work group to examine the impact on and the ability of local governments to comply with the requirements of this act. The work group shall consist of a representative from the Virginia Association of Counties who is also a representative of a member county, a representative from the Virginia Municipal League who is also a representative of a member locality, a representative of the Virginia Association of Chiefs of Police, a representative from the Virginia Association of Commonwealth's Attorneys, the chief information officer of a school division, the chief information officer of a county, the chief information officer of a city, a representative from the Department of Human Resource Management, a representative of a regional technology council, a member of the Joint Commission on Technology and Science (JCOTS) who is a member of the House of Delegates, and a member of JCOTS who is a member of the Senate. The CIO shall submit a report of the work group's findings to JCOTS no later than December 1, 2025.

The second enactment clause directs the CIO to convene a work group to examine local government capacity to comply with the act. The work group includes representatives from the Virginia Association of Counties, the Virginia Municipal League, law enforcement, prosecutors, school division and local CIOs, the Department of Human Resource Management, a regional technology council, and members of the Joint Commission on Technology and Science. The work group must report findings to JCOTS by December 1, 2025.

Enactment Clause 3

Effective date

That the provisions of the first enactment of this act shall become effective on July 1, 2026.

The third enactment clause provides that the substantive provisions of the act become effective on July 1, 2026.

Public Sector Procurement restrictions · government use

4 items

PS-01.4

Public bodies must not implement any high-risk AI system unless they have fulfilled all requirements of Chapter 55.6 and complied with the CIO's high-risk AI policies and procedures.

PS-01.4

PS-01.2

PS-01.1

Human Oversight Decision review · appeal pathways

3 items

H-02.3

H-01.3

H-01.1

Governance Risk management · accountability programs

9 items

G-01.1

G-02.1

G-01.2

Developers must update all required disclosures within 90 days after performing an intentional and substantial modification to any high-risk AI system to ensure the disclosures remain accurate.

G-01.1

G-02.4

G-01.2

G-01.1

Integrators must develop and adopt an acceptable use policy that limits the use of the high-risk AI system to mitigate known risks of algorithmic discrimination.

G-02.1

Passage Likelihood

High

Status Engrossed

Chamber Passed origin

Committee No action

Majority party Yes

Bipartisan No

Prior session None

Legislative History

2025-01-07 Prefiled and ordered printed; Offered 01-13-2025 25102638D

2025-01-07 Referred to Committee on Communications, Technology and Innovation

2025-01-20 Fiscal Impact Statement from Department of Planning and Budget (HB2046)

2025-01-23 Assigned CT & I sub: Communications

2025-01-27 Subcommittee recommends reporting with substitute and referring to Appropriations (5-Y 4-N 1-A)

2025-01-27 Reported from Communications, Technology and Innovation with substitute and referred to Appropriations (12-Y 10-N)

2025-01-27 Committee substitute printed 25106183D-H1

2025-01-27 Assigned Approps sub: General Government and Capital Outlay

2025-01-28 Fiscal Impact Statement from Department of Planning and Budget (HB2046)

2025-01-31 Reported from Appropriations (12-Y 10-N)

2025-02-02 Read first time

2025-02-03 Read second time

2025-02-03 Communications, Technology and Innovation Substitute agreed to

2025-02-03 Engrossed by House - committee substitute

2025-02-04 Read third time and passed House (51-Y 47-N)

2025-02-05 Constitutional reading dispensed (on 1st reading)

2025-02-05 Referred to Committee on General Laws and Technology

2025-02-12 Reported from General Laws and Technology with substitute and rereferred to Finance and Appropriations (15-Y 0-N)

2025-02-12 Committee substitute printed 25107107D-S1

2025-02-14 Reported from Finance and Appropriations (14-Y 0-N)

2025-02-17 Fiscal Impact Statement from Department of Planning and Budget (HB2046)

2025-02-17 Rules suspended

2025-02-17 Constitutional reading dispensed (on 2nd reading) (39-Y 0-N)

2025-02-17 Passed by for the day

2025-02-18 Passed by for the day

2025-02-19 Passed by for the day

2025-02-20 Passed by for the day

2025-02-22 No further action taken

2025-02-22 Failed to pass

Sources

Full Text ↗

Entry Last Reviewed

2026-05-20

AI generated