Regulon — VT-HB-340 · VT HB 340 (Automated Decision Systems)

WHAT THIS BILL REGULATES · 5 REQUIREMENT TYPES

How Is This Bill Enforced

Enforcement Authority

Attorney General enforcement. Violations constitute unfair and deceptive acts in commerce under the Vermont Consumer Protection Act (9 V.S.A. § 2453). The Attorney General may conduct civil investigations, enter into assurances of discontinuance, and bring civil actions. A consumer harmed by a violation is eligible to all remedies provided under the Vermont Consumer Protection Act.

Private Right of Action

Penalties

Violations are treated as unfair and deceptive acts under the Vermont Consumer Protection Act (9 V.S.A. § 2453). A consumer harmed by a violation is eligible to all remedies provided under the Vermont Consumer Protection Act, which includes injunctive relief, actual damages, and reasonable attorney's fees and costs. The Attorney General may also seek civil penalties, assurances of discontinuance, and other enforcement remedies available under Chapter 63, subchapter 1 of Title 9.

Verbatim statutory text on the left; plain-language analysis and a per-section checklist on the right. Numbered markers cross-link to the matching checklist row.

Statutory Text

Analysis & Obligations

9 V.S.A. § 4193a

Definitions

(1)–(13) As used in this subchapter: (1)(A) "Algorithmic discrimination" means any condition in which the use of an automated decision system results in a differential treatment or impact that disfavors an individual on the basis of the individual's actual or perceived age, color, disability, ethnicity, genetic information, immigration or citizenship status, limited proficiency in the English language, national origin, race, religion, reproductive health, sex, sexual orientation, gender identity, veteran status, or other classification protected under the laws of this State or federal law. (B) "Algorithmic discrimination" does not include: (i) a developer's or deployer's testing of the developer's or deployer's own automated decision system to identify, mitigate, and prevent discrimination; (ii) expanding an applicant, customer, or participant pool to increase diversity or redress historical discrimination; or (iii) an act or omission by or on behalf of a private club or other establishment that is not in fact open to the public, as set forth in Title II of the federal Civil Rights Act of 1964, 42 U.S.C.§ 2000a(e), as amended. (2) "Auditor" refers to an independent entity, including an individual, a nonprofit, a firm, a corporation, a partnership, a cooperative, or an association, commissioned to perform an audit. (3)(A) "Automated decision system" means a computational process derived from machine learning, statistical modeling, data analytics, or artificial intelligence that issues an output, including a score, classification, or recommendation. (B) "Automated decision system" does not include any software used primarily for basic computerized processes, such as antimalware, antivirus, autocorrect functions, calculators, databases, data storage, electronic communications, firewall, internet domain registration, website loading, networking, spam and robocall filtering, spellcheck tools, spreadsheets, web caching, web hosting, or any tool that relates only to nonemployment internal management affairs such as ordering office supplies or processing payments, and that do not materially affect the rights, liberties, benefits, safety, or welfare of any individual within the State. (4) "Consequential decision" means a decision that has a material, legal, or similarly significant effect on the provision or denial to any consumer of, or the cost, terms, or availability of: (A) educational and vocational training, including: (i) assessment or grading, including detecting student cheating or plagiarism; (ii) accreditation; (iii) certification; (iv) admissions or enrollment; and (v) financial aid or scholarships; (B) employment or an employment opportunity, including: (i) pay or promotion; (ii) hiring or termination; and (iii) automated task allocation; (C) housing or lodging, including long-term or short-term rentals; (D) essential utilities, including electricity, heat, water, internet or telecommunications access, or transportation; (E) family planning, including adoption services or reproductive services, as well as assessments related to child protection services; (F) health care or health insurance, including mental health care, dental, or vision; (G) financial services, including a financial service provided by a mortgage company, mortgage broker, or creditor; (H) law enforcement activities, including the allocation of law enforcement personnel or assets, the enforcement of laws, maintaining public order, or managing public safety; (I) government services, including the determination, allocation, or denial of public benefits and services; and (J) a reasonable accommodation or other right granted under the civil rights laws of this State. (5) "Consumer" means an individual who is a resident of the State. (6) "Deployer" means a person doing business in this State that uses an automated decision system in a consequential decision in the State or provides an automated decision system for use in a consequential decision by the general public in the State. A developer shall also be considered a deployer if its actions satisfy this definition. (7) "Deployer-employer" means a deployer that is an employer. (8) "Developer" means a person doing business in this State that designs, codes, or produces an automated decision system for use in a consequential decision or creates a substantial change with respect to an automated decision system for use in a consequential decision, whether for its own use in the State or for use by a third party in the State. (9) "Developer-employer" means a developer that is an employer. (10) "Employee" means an individual who performs services for and under the control and direction of an employer for wages or other remuneration, including former employees, or natural persons employed as independent contractors to carry out work in furtherance of an employer's business enterprise who are not themselves employers. (11) "Employer" means any person, firm, partnership, institution, corporation, or association that employs one or more employees. (12) "Software stack" means the group of individual software components that work together to support the execution of an automated decision system. (13) "Substantial change" means any: (A) deliberate change to an automated decision system that would result in material inaccuracies in the reports created under section 4193f of this title; or (B) substantial change in the data that the automated decision system uses as input or training data.

Section 4193a establishes the definitions used throughout the subchapter. Key terms include automated decision system, consequential decision (covering ten enumerated domains from education to civil rights accommodations), algorithmic discrimination (with carve-outs for self-testing and diversity expansion), developer, deployer, and substantial change. The automated decision system definition is broad but excludes basic computing tools that do not materially affect individual rights.

9 V.S.A. § 4193b

Prohibition on algorithmic discrimination

DeployerDeveloper

1 It shall be unlawful discrimination for a developer or deployer to use, sell, or share an automated decision system for use in a consequential decision or a product featuring an automated decision system for use in a consequential decision that produces algorithmic discrimination.

Section 4193b establishes the core substantive prohibition: it is unlawful discrimination for a developer or deployer to use, sell, or share an automated decision system (or a product featuring one) for use in a consequential decision that produces algorithmic discrimination. This is a strict liability standard — no intent element is specified.

Compliance actions 1 item

Developers and deployers must not use, sell, or share an automated decision system for use in a consequential decision, or a product featuring such a system, that produces algorithmic discrimination — defined as differential treatment or impact disfavoring an individual based on age, color, disability, ethnicity, genetic information, immigration or citizenship status, limited English proficiency, national origin, race, religion, reproductive health, sex, sexual orientation, gender identity, veteran status, or other protected classification.

H-02

9 V.S.A. § 4193c

Deployer and developer obligations

DeployerDeveloper

(a)–(b) 2 Any deployer that employs an automated decision system for a consequential decision shall inform the consumer prior to the use of the system for a consequential decision in clear, conspicuous, and consumer-friendly terms, made available in each of the languages in which the company offers its end services, that automated decision systems will be used to make a consequential decision or to assist in making a consequential decision. (b) Any notice provided by a deployer to the consumer pursuant to subsection (a) of this section shall include: (1) a description of the personal characteristics or attributes that the system will measure or assess; (2) the method by which the system measures or assesses those attributes or characteristics; (3) how those attributes or characteristics are relevant to the consequential decisions for which the system should be used; (4) any human components of the system; (5) how any automated components of the system are used to inform the consequential decision; and (6) a direct link to a publicly accessible page on the deployer's website that contains a plain-language description of the: (A) system's outputs; (B) types and sources of data collected from natural persons and processed by the system when it is used to make, or assists in making, a consequential decision; and (C) results of the most recent impact assessment, or an active link to a web page where a consumer can review those results.

(c) 3 Any deployer that employs an automated decision system for a consequential decision shall provide the consumer with a single notice containing a plain-language explanation of the decision that identifies the principal reason or reasons for the consequential decision, including: (1) the identity of the developer of the automated decision system used in the consequential decision, if the deployer is not also the developer; (2) a description of what the output of the automated decision system is, such as a score, recommendation, or other similar description; (3) the degree and manner to which the automated decision system contributed to the decision; (4) the types and sources of data processed by the automated decision system in making the consequential decision; (5) a plain language explanation of how the consumer's personal data informed the consequential decision; and (6) what actions, if any, the consumer might have taken to secure a different decision and the actions that the consumer might take to secure a different decision in the future.

(d)(1)–(3) 4 A deployer shall provide and explain a process for a consumer to appeal a decision, which shall at minimum allow the consumer to: (A) formally contest the decision; (B) provide information to support their position; and (C) obtain meaningful human review of the decision. (2) For an appeal made pursuant to subdivision (1) of this subsection: (A) a deployer shall designate a human reviewer who: (i) is trained and qualified to understand the consequential decision being appealed, the consequences of the decision for the consumer, how to evaluate and how to serve impartially, including by avoiding prejudgment of the facts at issue, conflict of interest, and bias; (ii) does not have a conflict of interest for or against the deployer or the consumer; (iii) was not involved in the initial decision being appealed; (iv) shall enjoy protection from dismissal or its equivalent, disciplinary measures, or other adverse treatment for exercising their functions under this section; and (v) shall be allocated sufficient human resources by the deployer to conduct an effective appeal of the decision; and (B) the human reviewer shall consider the information provided by the consumer in their appeal and may consider other sources of information relevant to the consequential decision. (3) A deployer shall respond to a consumer's appeal not later than 45 after receipt of the appeal. That period may be extended once by an additional 45 days where reasonably necessary, taking into account the complexity and number of appeals. The deployer shall inform the consumer of any extension not later than 45 days after receipt of the appeal, together with the reasons for the delay.

(e) 5 The deployer or developer of an automated decision system is legally responsible for the quality and accuracy of all consequential decisions made, including any bias or algorithmic discrimination resulting from the operation of the automated decision system.

(f) 6 A developer shall not use, sell, or share an automated decision system for use in a consequential decision or a product featuring an automated decision system for use in a consequential decision that has not passed an independent audit, in accordance with section 4193e of this title. If an independent audit finds that an automated decision system for use in a consequential decision does produce algorithmic discrimination, the developer shall not use, sell, or share the system until the algorithmic discrimination has been proven to be rectified by a post-adjustment audit.

(g) Except as provided in subsection 4193e(a) of this title, the rights and obligations under this section may not be waived by any person, partnership, association, or corporation.

Section 4193c is the bill's core obligation section, imposing four distinct compliance duties on deployers: (1) pre-decision notice to consumers that an automated decision system will be used, with detailed content requirements; (2) post-decision explanation identifying the principal reasons for the decision; (3) a structured appeal process with meaningful human review by a qualified, conflict-free reviewer with anti-retaliation protections; and (4) legal responsibility for quality and accuracy of all consequential decisions. Additionally, developers face a pre-deployment independent audit gate — systems cannot be sold or shared without passing an independent audit, and systems found to produce algorithmic discrimination must be rectified and re-audited before distribution.

Compliance actions 5 items

Deployers must inform the consumer prior to the use of an automated decision system for a consequential decision, in clear, conspicuous, and consumer-friendly terms available in each language in which the company offers its end services. The notice must include: (1) a description of the personal characteristics or attributes the system will measure or assess; (2) the method of measurement or assessment; (3) how those attributes are relevant to the consequential decision; (4) any human components of the system; (5) how automated components inform the decision; and (6) a direct link to a publicly accessible page on the deployer's website with plain-language descriptions of the system's outputs, the types and sources of data collected and processed, and the results of the most recent impact assessment.

H-01.3

Deployers must provide the consumer with a single post-decision notice containing a plain-language explanation of the consequential decision that identifies the principal reasons for the decision, including: (1) the identity of the developer if different from the deployer; (2) a description of the system's output (score, recommendation, etc.); (3) the degree and manner to which the automated decision system contributed to the decision; (4) the types and sources of data processed; (5) a plain-language explanation of how the consumer's personal data informed the decision; and (6) what actions the consumer might have taken or might take in the future to secure a different decision.

H-01.1

Deployers must provide and explain a process for consumers to appeal a consequential decision. The appeal process must allow the consumer to formally contest the decision, provide supporting information, and obtain meaningful human review. The deployer must designate a human reviewer who is trained and qualified, free of conflicts of interest, was not involved in the initial decision, is protected from retaliation for exercising their review functions, and is allocated sufficient resources. The human reviewer must consider the consumer's information and may consider other relevant sources. The deployer must respond within 45 days, extendable once by an additional 45 days with notice and explanation of the delay.

H-01.4

Deployers and developers are legally responsible for the quality and accuracy of all consequential decisions made by an automated decision system, including any bias or algorithmic discrimination resulting from the system's operation.

—

Developers must not use, sell, or share an automated decision system for use in a consequential decision unless the system has passed an independent audit in accordance with § 4193e. If an independent audit finds the system produces algorithmic discrimination, the developer must not use, sell, or share the system until the discrimination has been rectified and confirmed by a post-adjustment audit.

H-02.6

9 V.S.A. § 4193d

Whistleblower protections

DeployerDeveloper

(a) 7 Developer-employers and deployer-employers of automated decision systems used in consequential decisions shall not: (1) prevent an employee from disclosing information to the Attorney General, including through terms and conditions of employment or seeking to enforce terms and conditions of employment, if the employee has reasonable cause to believe the information indicates a violation of this subchapter; or (2) retaliate against an employee for disclosing information to the Attorney General pursuant to subdivision (1) of this subsection.

(b) 8 Developer-employers and deployer-employers of automated decision systems used in consequential decisions shall provide a clear notice to all employees working on automated decision systems of their rights and responsibilities under this subchapter, including the right of employees of contractors and subcontractors to use the developer's internal process for making protected disclosures pursuant to subsection (c) of this section. A developer-employer or deployer-employer is presumed to be in compliance with the requirements of this subsection if the developer-employer or deployer-employer does either of the following: (1) at all times: (A) posts and displays within all workplaces maintained by the developer-employer or deployer-employer a notice to all employees of their rights and responsibilities under this subchapter; (B) ensures that all new employees receive equivalent notice; and (C) ensures that employees who work remotely periodically receive an equivalent notice; or (2) not less frequently than once every year, provides written notice to all employees of their rights and responsibilities under this subchapter and ensures that the notice is received and acknowledged by all of those employees.

(c) 9 Each developer-employer shall provide a reasonable internal process through which an employee may anonymously disclose information to the developer if the employee believes in good faith that the information indicates that the developer has violated any provision of this subchapter or any other law, or has made false or materially misleading statements related to its safety and security protocol, or failed to disclose known risks to employees, including, at a minimum, a monthly update to the person who made the disclosure regarding the status of the developer's investigation of the disclosure and the actions taken by the developer in response to the disclosure.

Section 4193d establishes whistleblower protections for employees of developer-employers and deployer-employers. The section prohibits employers from preventing employee disclosures to the Attorney General or retaliating against employees who make such disclosures. It requires clear notice to all employees of their rights, with a safe harbor for posting notices in workplaces and distributing annual written notices. Developer-employers must also provide an internal anonymous disclosure process with monthly status updates to the disclosing employee.

Compliance actions 3 items

Developer-employers and deployer-employers must not prevent employees from disclosing information to the Attorney General — including through terms and conditions of employment or enforcement of employment terms — if the employee has reasonable cause to believe the information indicates a violation of this subchapter. They must not retaliate against employees for making such disclosures.

G-03.3

Developer-employers and deployer-employers must provide clear notice to all employees working on automated decision systems of their rights and responsibilities under this subchapter, including the right of employees of contractors and subcontractors to use the developer's internal anonymous disclosure process. Compliance is presumed if the employer either (1) continuously posts workplace notices, ensures new employees receive notice, and periodically notifies remote workers, or (2) at least annually provides written notice to all employees and ensures receipt and acknowledgment.

G-03.4

Each developer-employer must provide a reasonable internal process through which an employee may anonymously disclose information if the employee believes in good faith that the information indicates a violation of this subchapter or any other law, that the developer has made false or materially misleading statements related to its safety and security protocol, or that the developer has failed to disclose known risks to employees. The process must include, at minimum, a monthly update to the disclosing employee on the status of the developer's investigation and the actions taken in response.

G-03.1

9 V.S.A. § 4193e

Audits

DeployerDeveloper

(a) 10 Prior to deployment of an automated decision system for use in a consequential decision, six months after deployment, and at least every 18 months thereafter for each calendar year an automated decision system is in use in consequential decisions after the first post-deployment audit, the developer and deployer shall be jointly responsible for ensuring that an independent audit is conducted in compliance with the provisions of this section to ensure that the product does not produce algorithmic discrimination and complies with the provisions of this subchapter. The developer and deployer shall enter into a contract specifying which party is responsible for the costs, oversight, and results of the audit. Absent an agreement of responsibility through contract, the developer and deployer shall be jointly and severally liable for any violations of this section. Regardless of final findings, the deployer or developer shall deliver all audits conducted under this section to the Attorney General.

(b) A deployer or developer may contract with more than one auditor to fulfill the requirements of this section.

(c) 10 The audit shall include the following: (1) an analysis of data management policies, including whether personal or sensitive data relating to a consumer is subject to data security protection standards that comply with the requirements of applicable State law; (2) an analysis of the system validity and reliability according to each specified use case listed in the entity's reporting document filed by the developer or deployer pursuant to section 4193f of this title; (3) a comparative analysis of the system's performance when used on consumers of different demographic groups and a determination of whether the system produces algorithmic discrimination in violation of this subchapter by each intended and foreseeable identified use as identified by the deployer and developer pursuant to section 4193f of this title; (4) an analysis of how the technology complies with existing relevant federal, State, and local labor, civil rights, consumer protection, privacy, and data privacy laws; and (5) an evaluation of the developer's or deployer's documented risk management policy and program as set forth in section 4193g of this title for conformity with subsection 4193g(a) of this title.

(d) The Attorney General may adopt further rules as necessary to ensure that audits under this section assess whether or not automated decision systems used in consequential decisions produce algorithmic discrimination and otherwise comply with the provisions of this subchapter.

(e) 10 The independent auditor shall have complete and unredacted copies of all reports previously filed by the deployer or developer pursuant to section 4193f of this title.

(f) 10 An audit conducted under this section shall be completed in its entirety without the assistance of an automated decision system.

(g) 10 An auditor shall be an independent entity, including an individual, nonprofit, firm, corporation, partnership, cooperative, or association. (2) For the purposes of this subchapter, no auditor may be commissioned by a developer or deployer of an automated decision system used in consequential decisions if the auditor: (A) has already been commissioned to provide any auditing or nonauditing service, including financial auditing, cybersecurity auditing, or consulting services of any type, to the commissioning company in the past 12 months; (B) is or was involved in using, developing, integrating, offering, licensing, or deploying the automated decision system; (C) has or had an employment relationship with a developer or deployer that uses, offers, or licenses the automated decision system; or (D) has or had a direct financial interest or a material indirect financial interest in a developer or deployer that uses, offers, or licenses the automated decision system. (3) Fees paid to auditors may not be contingent on the result of the audit and the commissioning company shall not provide any incentives or bonuses for a positive audit result.

(h) The Attorney General may adopt rules to ensure: (1) the independence of auditors under this section; (2) that teams conducting audits incorporate feedback from communities that may foreseeably be the subject of algorithmic discrimination with respect to the automated decision system being audited; and (3) that the requirements of an audit as set forth in subsection (c) of this section are updated to reflect responsible evaluation practices and include adequate information to enforce this subchapter.

Section 4193e establishes a mandatory independent audit regime. Developers and deployers are jointly responsible for ensuring an independent audit is conducted prior to deployment, six months after deployment, and at least every 18 months thereafter. The audit must cover data management policies, system validity and reliability by use case, comparative performance across demographic groups, legal compliance, and the risk management program. Auditors must meet strict independence requirements — no prior commercial relationship within 12 months, no involvement in the system, no employment or financial interest. Audits must be completed without the assistance of an automated decision system. All audits must be delivered to the Attorney General regardless of findings.

Compliance actions 1 item

Developers and deployers are jointly responsible for ensuring an independent audit is conducted prior to deployment, six months after deployment, and at least every 18 months thereafter. The audit must include: (1) analysis of data management policies and data security compliance; (2) analysis of system validity and reliability by use case; (3) comparative performance analysis across demographic groups with a determination of whether algorithmic discrimination is produced; (4) analysis of compliance with applicable labor, civil rights, consumer protection, privacy, and data privacy laws; and (5) evaluation of the risk management program. Auditors must be fully independent — no prior commercial, employment, or financial relationship with the developer or deployer within 12 months, fees must not be contingent on results, and no incentives for positive outcomes. Audits must be completed entirely without the assistance of an automated decision system. Auditors must receive complete and unredacted copies of all prior reports. All completed audits must be delivered to the Attorney General regardless of findings. Absent a contractual allocation of responsibility, the developer and deployer are jointly and severally liable.

H-02.6

9 V.S.A. § 4193f

Automated decision system reporting requirements

DeployerDeveloper

(a)–(b) 11 Every developer and deployer of an automated decision system used in a consequential decision shall comply with the reporting requirements of this section. Regardless of final findings, reports shall be filed with the Attorney General prior to deployment of an automated decision system used in a consequential decision and then annually, or after each substantial change to the system, whichever comes first. (b) Together with each report required to be filed under this section, developers and deployers shall file with the Attorney General a copy of the last completed independent audit required by this subchapter and a legal attestation that the automated decision system used in a consequential decision: (1) does not violate any provision of this subchapter; or (2) may violate or does violate one or more provisions of this article, that there is a plan of remediation to bring the automated decision system into compliance with this subchapter, and a summary of the plan of remediation.

(c) 12 Developers of automated decision systems shall file with the Attorney General a report containing the following: (1) a description of the system including: (A) a description of the system's software stack; (B) the purpose of the system and its expected benefits; and (C) the system's current and intended uses, including what consequential decisions it will support and what stakeholders will be impacted; (2) the intended outputs of the system and whether the outputs can be or are otherwise appropriate to be used for any purpose not previously articulated; (3) the methods for training of their models including: (A) any pre-processing steps taken to prepare datasets for the training of a model underlying an automated decision system; (B) descriptions of the datasets upon which models were trained and evaluated, how and why datasets were collected and the sources of those datasets, and how that training data will be used and maintained; (C) the quality and appropriateness of the data used in the automated decision system's design, development, testing, and operation; (D) whether the data contains sufficient breadth to address the range of real-world inputs the automated decision system might encounter and how any data gaps have been addressed; and (E) steps taken to ensure compliance with privacy, data privacy, data security, and copyright laws; (4) use and data management policies; (5) any other information necessary to allow the deployer to understand the outputs and monitor the system for compliance with this subchapter; (6) any other information necessary to allow the deployer to comply with the requirements of subsection (d) of this section; (7) a description of the system's capabilities and any developer-imposed limitations, including capabilities outside of its intended use, when the system should not be used, any safeguards or guardrails in place to protect against unintended, inappropriate, or disallowed uses, and testing of any safeguards or guardrails; (8) an internal risk assessment including documentation and results of testing conducted to identify all reasonably foreseeable risks related to algorithmic discrimination, validity and reliability, privacy and autonomy, and safety and security, as well as actions taken to address those risks, and subsequent testing to assess the efficacy of actions taken to address risks; and (9) whether the system should be monitored and, if so, how the system should be monitored.

(d) 13 Deployers of automated decision systems used in consequential decisions shall file with the Attorney General a report containing the following: (1) a description of the system, including: (A) a description of the system's software stack; (B) the purpose of the system and its expected benefits; and (C) the system's current and intended uses, including what consequential decisions it will support and what stakeholders will be impacted; (2) the intended outputs of the system and whether the outputs can be or are otherwise appropriate to be used for any purpose not previously articulated; (3) whether the deployer collects revenue or plans to collect revenue from use of the automated decision system in a consequential decision and, if so, how it monetizes or plans to monetize use of the system; (4) whether the system is designed to make consequential decisions itself or whether and how it supports consequential decisions; (5) a description of the system's capabilities and any deployer-imposed limitations, including capabilities outside of its intended use, when the system should not be used, any safeguards or guardrails in place to protect against unintended, inappropriate, or disallowed uses, and testing of any safeguards or guardrails; (6) an assessment of the relative benefits and costs to the consumer given the system's purpose, capabilities, and probable use cases; (7) an internal risk assessment including documentation and results of testing conducted to identify all reasonably foreseeable risks related to algorithmic discrimination, accuracy and reliability, privacy and autonomy, and safety and security, as well as actions taken to address those risks, and subsequent testing to assess the efficacy of actions taken to address risks; and (8) whether the system should be monitored and, if so, how the system should be monitored.

(e) The Attorney General shall: (1) adopt rules: (A) for a process whereby developers and deployers may request redaction of portions of reports required under this section to ensure that they are not required to disclose sensitive and protected information; and (B) to determine reasonably foreseeable risks related to algorithmic discrimination, validity and reliability, privacy and autonomy, and safety and security, pursuant to subsections (c) and (d) of this section; and (2) maintain an online database that is accessible to the general public with reports, redacted in accordance with this section, and audits required by this subchapter, which shall be updated biannually.

(f) For automated decision systems already in deployment for use in consequential decisions on or before July 1, 2025, developers and deployers shall not later than 18 months after July 1, 2025 complete and file the reports and complete the independent audit required by this subchapter.

Section 4193f imposes detailed reporting obligations on both developers and deployers. Reports must be filed with the Attorney General prior to deployment and then annually or after each substantial change, whichever comes first. Each report must be accompanied by the latest completed independent audit and a legal attestation of compliance or a remediation plan. Developer reports must cover system description, intended outputs, training methodology and data, use and data management policies, capabilities and limitations, internal risk assessment, and monitoring requirements. Deployer reports cover similar ground but add revenue and monetization disclosure. The Attorney General must maintain a public online database of redacted reports and audits, updated biannually. A transition provision gives systems already in deployment 18 months from July 1, 2025 to complete initial reports and audits.

Compliance actions 3 items

Developers and deployers must file reports with the Attorney General prior to deployment of an automated decision system used in a consequential decision and then annually, or after each substantial change to the system, whichever comes first. Each report must be accompanied by a copy of the last completed independent audit and a legal attestation that the system either (1) does not violate any provision of this subchapter, or (2) may violate or does violate one or more provisions, together with a remediation plan and summary.

R-02.1

Developers must file with the Attorney General a report containing: (1) system description including software stack, purpose, expected benefits, current and intended uses, impacted stakeholders; (2) intended outputs and whether they may be used beyond articulated purposes; (3) training methodology including pre-processing steps, dataset descriptions, data sources, collection rationale, data quality and appropriateness, breadth of training data, data gap remediation, and compliance with privacy, data security, and copyright laws; (4) use and data management policies; (5) information necessary for deployers to understand outputs and monitor compliance; (6) information necessary for deployer compliance with deployer reporting requirements; (7) system capabilities and developer-imposed limitations including out-of-scope uses, safeguards, guardrails, and testing thereof; (8) internal risk assessment with testing documentation and results covering algorithmic discrimination, validity and reliability, privacy and autonomy, and safety and security risks, plus actions taken and subsequent testing; and (9) monitoring requirements.

R-02.1

Deployers must file with the Attorney General a report containing: (1) system description including software stack, purpose, expected benefits, current and intended uses, impacted stakeholders; (2) intended outputs and whether they may be used beyond articulated purposes; (3) revenue and monetization disclosures; (4) whether the system makes consequential decisions autonomously or supports human decision-making; (5) system capabilities and deployer-imposed limitations including out-of-scope uses, safeguards, guardrails, and testing thereof; (6) cost-benefit assessment for consumers given system purpose, capabilities, and probable use cases; (7) internal risk assessment with testing documentation and results covering algorithmic discrimination, accuracy and reliability, privacy and autonomy, and safety and security risks, plus actions taken and subsequent testing; and (8) monitoring requirements.

R-02.1

9 V.S.A. § 4193g

Risk management policy and program

DeployerDeveloper

(a) 14 Each developer or deployer of automated decision systems used in consequential decisions shall plan, document, and implement a risk management policy and program to govern development or deployment, as applicable, of the automated decision system. The risk management policy and program shall specify and incorporate the principles, processes, and personnel that the deployer uses to identify, document, and mitigate known or reasonably foreseeable risks of algorithmic discrimination covered under section 4193b of this title. The risk management policy and program shall be an iterative process planned, implemented, and regularly and systematically reviewed and updated over the life cycle of an automated decision system, requiring regular, systematic review and updates, including updates to documentation. A risk management policy and program implemented and maintained pursuant to this subsection shall be reasonable considering the: (1) guidance and standards set forth in version 1.0 of the Artificial Intelligence Risk Management Framework published by the National Institute of Standards and Technology in the U.S. Department of Commerce, or the latest version of the Artificial Intelligence Risk Management Framework published by the National Institute of Standards and Technology if, in the Attorney General's discretion, the latest version of the Artificial Intelligence Risk Management Framework published by the National Institute of Standards and Technology in the U.S. Department of Commerce is at least as stringent as version 1.0; (2) size and complexity of the developer or deployer; (3) nature, scope, and intended uses of the automated decision system developed or deployed for use in consequential decisions; and (4) sensitivity and volume of data processed in connection with the automated decision system.

(b) A risk management policy and program implemented pursuant to subsection (a) of this section may cover multiple automated decision systems developed by the same developer or deployed by the same deployer for use in consequential decisions if sufficient.

(c) 14 The Attorney General may require a developer or a deployer to disclose the risk management policy and program implemented pursuant to subsection (a) of this section in a form and manner prescribed by the Attorney General. The Attorney General may evaluate the risk management policy and program to ensure compliance with this section.

Section 4193g requires each developer or deployer to plan, document, and implement a risk management policy and program governing the development or deployment of automated decision systems used in consequential decisions. The program must identify, document, and mitigate known or reasonably foreseeable risks of algorithmic discrimination. It must be iterative, regularly reviewed and updated over the system's lifecycle. Reasonableness is calibrated to the NIST AI RMF (version 1.0 or later if at least as stringent), the size and complexity of the entity, the nature and scope of the system, and the sensitivity and volume of data processed. A single program may cover multiple systems. The Attorney General may require disclosure of the program and evaluate it for compliance.

Compliance actions 1 item

Each developer or deployer must plan, document, and implement a risk management policy and program governing the development or deployment of automated decision systems used in consequential decisions. The program must specify and incorporate the principles, processes, and personnel used to identify, document, and mitigate known or reasonably foreseeable risks of algorithmic discrimination. The program must be iterative, regularly and systematically reviewed and updated over the system's lifecycle, with documentation updates. Reasonableness is assessed against: (1) the NIST AI RMF version 1.0 (or a later version if the Attorney General determines it is at least as stringent); (2) the size and complexity of the entity; (3) the nature, scope, and intended uses of the system; and (4) the sensitivity and volume of data processed. A single program may cover multiple systems. The Attorney General may require disclosure in a prescribed form and evaluate the program for compliance.

G-01.1

9 V.S.A. § 4193h

Enforcement and rulemaking

(a)–(b) 15 A person who violates this subchapter or rules adopted pursuant to this subchapter commits an unfair and deceptive act in commerce in violation of section 2453 of this title (Vermont Consumer Protection Act). A consumer harmed by a violation is eligible to all remedies provided under the Vermont Consumer Protection Act. (b) The Attorney General has the same authority to adopt rules to implement the provisions of this section and to conduct civil investigations, enter into assurances of discontinuance, bring civil actions, and take other enforcement actions as provided under chapter 63, subchapter 1 of this title.

Section 4193h establishes the enforcement framework. Violations are treated as unfair and deceptive acts in commerce under the Vermont Consumer Protection Act (9 V.S.A. § 2453). Consumers harmed by violations are entitled to all remedies under the Vermont Consumer Protection Act. The Attorney General has full enforcement authority including rulemaking, civil investigation, assurances of discontinuance, and civil actions under Chapter 63, subchapter 1 of Title 9.

Human Oversight Decision review · appeal pathways

6 items

H-02