The Department of Administration must adopt regulations governing the development, procurement, implementation, use, and ongoing assessment of state agency AI systems for consequential decisions, including provisions ensuring pre-implementation impact assessments, non-discrimination safeguards, and ongoing system assessment.

The Department of Administration must adopt regulations governing the development, procurement, implementation, use, and ongoing assessment of state agency generative AI systems for consequential decisions, including pre-implementation impact assessment requirements, anti-discrimination safeguards, ongoing assessment, and foreign adversary country designations.

Deployers and developers must establish, document, implement, and maintain a governance program with reasonable safeguards to manage algorithmic discrimination risks, proportionate to the tool's use and the entity's role and resources. The program must (1) designate at least one employee responsible for compliance oversight with authority to raise compliance concerns, (2) identify and implement anti-discrimination safeguards, (3) conduct annual comprehensive compliance reviews, (4) retain impact assessment results for five years after completion, and (5) adjust safeguards in light of material changes in technology, risk, or operations.

Deployers and developers must establish, document, implement, and maintain a governance program with reasonable administrative and technical safeguards to manage algorithmic discrimination risks. The program must (1) designate at least one compliance employee with authority to raise compliance concerns and trigger prompt internal investigation, (2) identify and implement discrimination safeguards, (3) provide for required impact assessments, (4) conduct an annual comprehensive compliance review, (5) retain impact assessment results for two years, and (6) adjust safeguards in response to material changes in technology, risk, standards, or business operations.

Covered deployers must develop, implement, and maintain a comprehensive written information security program containing administrative, technical, and physical safeguards appropriate to the deployer's size, scope, and type of business; available resources; volume of data stored; and the security and confidentiality needs of the personal information stored. The program must incorporate safeguards consistent with protections for personal information under all applicable state and federal laws and regulations.

Covered deployers must identify and assess reasonably foreseeable internal and external risks to the security, confidentiality, and integrity of records containing personal information, and establish a process for evaluating and improving the effectiveness of current safeguards, including: (1) ongoing employee and contractor education and training on proper use of security procedures and the importance of personal information security; (2) mandating employee compliance with program policies and procedures; (3) providing a means for detecting and preventing security system failures; (4) security policies for storage, access, and transportation of personal information records outside business premises; (5) disciplinary measures for program violations; (6) measures preventing terminated employees from accessing personal information records; (7) reasonable restrictions on physical access to personal information records including locked storage; and (8) regular monitoring to ensure the program prevents unauthorized access or use, with information safeguard upgrades as necessary.

Covered deployers must maintain policies for the supervision of third-party service providers that include: (1) taking reasonable steps to select and retain service providers capable of maintaining appropriate security measures for personal information consistent with applicable law, and (2) requiring service providers by contract to implement and maintain appropriate security measures for personal information.

Covered deployers must, to the extent feasible, implement technical computer system security measures including: (1) secure user authentication protocols with login credential controls, reasonably secure password or unique identifier methods, password security controls, restriction to active users and accounts, and account lockout after multiple failed access attempts; (2) secure access controls restricting personal information access to employees and contractors who need it and assigning unique identification and passwords; (3) encryption of personal information transmitted across public networks, wirelessly, or stored on laptops and portable devices; (4) reasonable monitoring for unauthorized use of or access to personal information; (5) reasonably current firewall protection and operating system security patches for internet-connected systems; and (6) reasonably current system security agent software with malware protection, patches, and virus definitions set to receive regular updates.

Deployers must implement and maintain an iterative risk management policy and program that specifies the principles, processes, and personnel used to identify, document, and mitigate known or reasonably foreseeable risks of algorithmic discrimination, and must regularly and systematically review and update the program over the AI system's life cycle.

Deployers must implement and maintain a risk management policy and program specifying the principles, processes, and personnel used to identify, document, and mitigate algorithmic discrimination risks, with regular and systematic review and updates over the system's life cycle.

Deployers must implement and maintain an iterative risk management policy and program specifying the principles, processes, and personnel used to identify, document, and mitigate known or reasonably foreseeable risks of algorithmic discrimination, reviewed and updated regularly over the system's lifecycle. This obligation applies only to high-risk AI systems that are the principal basis of consequential decisions.

Deployers must implement and maintain a risk management policy and program covering the principles, processes, and personnel used to identify, document, and mitigate algorithmic discrimination risks. The program must be iterative and regularly reviewed and updated over the system's life cycle. Effective June 30, 2026.

Deployers must implement and maintain an iterative risk management policy and program covering principles, processes, and personnel for identifying, documenting, and mitigating algorithmic discrimination risks, calibrated to NIST AI RMF, ISO/IEC 42001, or an equivalent framework and to the deployer's size, system scope, and data sensitivity.

Developers of general-purpose AI models must create, maintain, and annually revise technical documentation covering training and testing processes, intended tasks, integration contexts, acceptable-use policies, release dates, distribution methods, input/output modalities, and detailed training data descriptions (type, provenance, curation methods, selection criteria, bias detection methods). Developers must also establish and maintain a copyright compliance policy.

Law enforcement agencies must formally adopt facial recognition software in writing and establish standard operating procedures before conducting any facial recognition searches.

Law enforcement agencies must ensure each facial recognition specialist has completed agency-approved training, assign each specialist a unique username and password, and restrict access to authorized persons only.

Law enforcement agencies must establish policies providing for suspension or revocation of facial recognition software access for users who fail to comply with this Code section or other applicable law.

The Chief Information Officer must develop and implement statewide technology standards, including standards and guidelines for the State's use of generative AI.

Businesses with 10 or more employees that use AI systems must comply with the five AI governance principles — safety, transparency, accountability, fairness, and contestability — as implemented through rules adopted by the Department of Innovation and Technology. The Department must adopt rules to ensure businesses: (1) ensure AI systems operate without causing harm to individuals; (2) provide clear and understandable explanations of how AI systems work and make decisions; (3) identify and hold individuals or companies responsible for AI system performance and outcomes; (4) prevent and mitigate bias to ensure equitable treatment for all individuals; and (5) allow individuals to challenge and seek redress for decisions made by AI systems.

Deployers must establish, document, implement, and maintain a governance program with reasonable administrative and technical safeguards to map, measure, manage, and govern the risks of algorithmic discrimination. The program must include discrimination safeguards, impact assessment procedures, an annual compliance review, two-year retention of impact assessment results, and ongoing adjustment of safeguards in light of material changes.

Deployers must establish, document, implement, and maintain a governance program with reasonable administrative and technical safeguards to map, measure, manage, and govern reasonably foreseeable algorithmic discrimination risks associated with each automated decision tool. Safeguards must be proportionate to the tool's use, the deployer's role and size, the nature of the deployer's activities, and the technical feasibility and cost of available tools. The program must: (1) identify and implement safeguards for foreseeable discrimination risks; (2) support performance of impact assessments required by Section 10; (3) conduct an annual comprehensive compliance review; (4) retain impact assessment results for at least two years after completion; and (5) adapt safeguards in response to material changes in technology, risk, technical standards, or business operations. This obligation does not apply to deployers with fewer than 25 employees unless the tool impacted more than 999 people in the prior calendar year.

The Office of the Attorney General, the Comptroller, and the State Treasurer must each establish policies and procedures functionally compatible with the Department's AI policies for the development, procurement, deployment, use, and ongoing assessment of high-risk AI systems by June 1, 2025.

The Department of Information Technology must adopt, by December 1, 2024, policies and procedures governing the development, procurement, deployment, use, and ongoing assessment of high-risk AI by State agencies, including inventory criteria, adequate guardrails, notification and opt-out guidance for impacted individuals, and procurement guidance ensuring data privacy and legal compliance.

The Governor's AI Subcabinet must develop AI strategy and monitoring processes, oversee AI inventories and impact assessments, ensure compliance with State AI policies, develop a comprehensive action plan, and build foundational AI infrastructure across State government.

Deployers must implement a risk management policy governing deployment of each high-risk AI system that (1) identifies, documents, and mitigates algorithmic discrimination risks, (2) specifies principles, processes, and personnel, (3) spans the entire deployment period, and (4) is regularly and systematically reviewed and updated, drawing on the NIST AI RMF, ISO/IEC 42001, or an equivalent framework.

Consumer reporting agencies must implement a data governance framework that (1) certifies data sources for accuracy and relevance with at least monthly updates, (2) tracks data lineage and establishes quality control measures, and (3) meets minimum dataset size requirements — at least 1,000 data points per category for simple algorithms, 5,000 for more complex algorithms, and 10,000 for highly complex models or small-effect detection.

Consumer reporting agencies must maintain a contingency plan for system failures or data breaches that could compromise algorithmic integrity.

Law enforcement agencies using facial recognition technology must adopt and maintain a use and data management policy and post a copy of the policy on the agency's public website.

Law enforcement agencies that use facial recognition technology must adopt and maintain a use and data management policy and post the policy on the agency's public website.

State or local government agencies must adopt and provide a written use and privacy policy before using facial verification, covering the specific purpose, data retention period, and consent requirements. Third-party vendors must provide a copy of their written policies to the contracting agency.

Third-party vendors must provide contracting government agencies with a written privacy policy that is easy to read and understandable to an average consumer, includes the date of last update, and must notify the agency of privacy policy changes within a reasonable period.

Third-party vendors must develop a written information security policy with administrative, technical, and physical controls to protect the confidentiality, integrity, and availability of facial biometric data. Data must be stored within the United States. Vendors must protect data using at least the industry standard of care and at least as protectively as they protect other personal information, and may not release data to government agencies without a valid warrant or court order.

State or local government agencies that use facial recognition technology without a third-party vendor must develop the same written privacy and retention policies required of third-party vendors and must adhere to the same retention, destruction, and privacy provisions.

Government agencies operating facial recognition services without a third-party vendor must establish a policy that ensures best-quality results by following the developer's guidance and that outlines a training protocol for all operators and data processors, covering the service's capabilities and limitations, output-interpretation procedures, and the meaningful human review requirement for decisions with legal effects.

Deployers must implement a risk management policy and program to govern their deployment of each high-risk AI system. A single policy may cover multiple high-risk systems. Systems conforming to the NIST AI Risk Management Framework or ISO/IEC 42001 as of January 1, 2025, are presumed to satisfy this requirement.

Deployers must implement a risk management policy and program that specifies principles, processes, and personnel for identifying, documenting, and mitigating algorithmic discrimination risks, must be iterative and regularly updated over the system lifecycle, and must meet standards established by DOJ rule.

Insurers must adopt practices designed to ensure that their use of AI systems does not result in unfair or deceptive trade practices in violation of NRS 686A.010–686A.310.

Insurers must develop, implement, and maintain a written plan for responsible AI use that includes a plan for acquiring, using, or relying upon third-party AI systems, covering contractual cooperation with regulatory inquiries and audit rights to confirm third-party compliance.

Operators must establish an independent ethics and risk management board of at least five members — none of whom may be a member, officer, or director of the operator — to assess the ethical implications and operational outcomes of all use cases of each licensed high-risk AI system.

Deployers and developers must establish, document, implement, and maintain a governance program with reasonable administrative and technical safeguards to manage foreseeable discrimination risks, scaled to the entity's role, size, and resources. The program must at minimum (1) identify and implement discrimination safeguards, (2) conduct annual comprehensive compliance reviews, (3) retain impact assessment results for two years, and (4) adjust safeguards in response to material changes in technology or business operations.

Deployers must classify each AI system into one of the four risk categories (unacceptable, high, limited, or minimal) before deployment.

Companies that include Oklahoma citizens' personally identifiable information in an AI model must implement reasonable security measures for data privacy within their industry and conduct regular risk assessments addressing design, operational, and discrimination harm.

Deployers and developers must establish, document, implement, and maintain a governance program with reasonable administrative and technical safeguards to map, measure, manage, and govern the reasonably foreseeable risks of algorithmic discrimination associated with their automated decision tools, proportionate to the tool's use, the entity's role, size, complexity, resources, and technical feasibility.

Deployers must implement and maintain a risk management program establishing policies, processes, and personnel for identifying, mitigating, and documenting risks from CAIDS deployment, calibrated to the deployer's size, system scope, data sensitivity, and implementation cost.

Developers must implement and maintain a risk management program establishing policies, processes, training procedures, and personnel for identifying, mitigating, and documenting risks from CAIDS development, calibrated to the developer's size, system scope, training data sensitivity, and implementation cost.

Deployers must implement and maintain a risk management program establishing policies, processes, and personnel to identify, mitigate, and document risks arising from deployment of a CAIDS, scaled to the deployer's size, the system's nature and scope, data sensitivity, and implementation cost.

Developers must implement and maintain a risk management program establishing policies, processes, training procedures, and personnel to identify, mitigate, and document risks arising from development of a CAIDS, scaled to the developer's size, the system's nature and scope, training data sensitivity, and implementation cost.

Developers and deployers must, prior to deployment, assess potential algorithmic discrimination risks and implement a risk management policy that identifies, documents, and mitigates discrimination risks and Subchapter B prohibited uses, calibrated to the NIST AI RMF GenAI Profile, the entity's size and complexity, the system's scope and intended use, and the sensitivity of personal data processed.

Agencies responsible for maintaining and operating arrest photo databases must establish procedures to ensure compliance with database purging requirements.

Each covered agency must establish and publicly post on its website within 90 days of enactment a policy governing its use of facial recognition systems to ensure officer compliance with the Act.

Covered entities must meaningfully consult with internal stakeholders (employees, ethics teams, responsible technology teams) and independent external stakeholders (impacted community representatives, civil society advocates, technology experts) when performing impact assessments, including through participatory design, independent auditing, or soliciting feedback.

Covered entities must support and perform ongoing training and education for all relevant employees, contractors, and agents regarding documented material negative impacts from similar automated decision systems and improved methods of performing impact assessments.

Covered entities must disclose their efforts to align the foundation model with the NIST AI Risk Management Framework or a similar Federal Government-approved consensus technical standard, as specified in FTC regulations.

The Director of OMB must issue guidance requiring all federal agencies to incorporate the NIST AI Risk Management Framework and NIST-issued guidelines into their AI risk management efforts, within 180 days of NIST issuing guidelines under subsection (b)(2).

NIST must, within one year of enactment, issue guidance for agencies to incorporate the AI Risk Management Framework, including standards for AI development, procurement, and use; cybersecurity strategies; supplier attestation standards; training recommendations; minimum profile requirements; and small business profiles.

The Director of OMB must provide a template for agency use on the OMB guidance that includes recommended procedures for implementation of the AI Risk Management Framework.

Each agency head must conform all policies, principles, practices, procedures, and guidelines governing the design, development, implementation, deployment, use, or evaluation of AI systems to the NIST AI Risk Management Framework and OMB guidance.

The OMB Director must develop, issue, and periodically update government-wide policies, standards, and guidance governing the use of federal AI systems, including procurement policies, data protection, anti-discrimination best practices, training data identification, periodic system evaluations, and AI governance charter requirements, consistent with NIST standards.

Each agency head must comply with the subchapter and OMB guidance, integrate AI management processes with agency strategic and budgetary planning, and ensure senior officials — including the CIO, Chief Data Officer, and senior privacy official — implement AI risk-reduction policies and periodically validate management controls.

Each agency head must conduct regular training programs on federal AI system management and compliance for relevant agency officials, including those supporting CIO, Chief Data Officer, Evaluation Officer, and privacy official functions.

The OMB Director must issue implementing guidance within one year of enactment, in consultation with NIST, GSA, and OSTP, and must review and update the guidance biennially for the first ten years and periodically thereafter.

Each agency head must ensure responsible AI research, development, acquisition, application, governance, and use consistent with democratic values including privacy, civil rights, civil liberties, information security, nondiscrimination, transparency, and reliability.

Each agency head must hire or designate a Chief Artificial Intelligence Officer at the senior executive level (above GS-15) responsible for AI policy development, governmentwide compliance, risk management planning (including risk-level classification), rights-protective design and deployment, and participation in budget and acquisition decision processes.

The OMB Director must issue guidance within 120 days directing each CFO Act agency to establish an internal AI Governance Board — chaired by the CAIO and including designated senior officials (deputy head, CIO, chief acquisition officer, chief data officer, senior privacy official, civil rights official, and others) — to coordinate and govern the agency's AI issues.

Each agency head must establish an AI strategy for trustworthy AI adoption that includes (1) defined roles and responsibilities, (2) values and ethics principles, (3) trust and safety standards, (4) risk identification and mitigation processes, (5) algorithmic discrimination safeguards, (6) current and anticipated AI use domains, (7) workforce development steps, (8) conditions for public-facing AI use, (9) internal coordination processes, (10) interagency governance, (11) data governance, (12) procurement safeguards for rights and safety, and (13) specific implementation actions and desired outcomes.

The Director of OMB must, when updating AI guidance under the AI in Government Act of 2020, consider the NSCAI's recommended practices, Executive Order 13960 principles, input from the Privacy and Civil Liberties Oversight Board, relevant interagency councils, and external privacy and civil rights experts.

Critical-impact AI organizations must perform a documented TEVV-based risk management assessment no later than 30 days before making a critical-impact AI system publicly available, and biennially thereafter. The assessment must cover (1) organizational AI risk management policies and processes, (2) the system's structure, context, and capabilities, (3) quantitative and qualitative risk measurement methods and metrics, and (4) risk resource allocation and monitoring. Assessment reports must be submitted to the Secretary of Commerce within 90 days of completion in a format the Secretary determines.

Persons deploying AI models in securities contexts must establish, maintain, and enforce written policies and procedures reasonably designed to prevent violations of federal securities laws by those models, or face strict liability for all acts, practices, and conduct of the model as if the person had committed them directly.

Suppliers seeking the affirmative defense to unlicensed-practice liability must create, maintain, and implement a written policy that states the chatbot's intended purpose and limitations, and describes procedures for (1) involving licensed mental health therapists in development and review, (2) ensuring consistency with clinical best practices, (3) conducting pre-deployment and ongoing testing to ensure output poses no greater risk than therapy with a licensed therapist, (4) identifying foreseeable adverse outcomes, (5) providing a user harm-reporting mechanism, (6) implementing risk-assessment and response protocols, (7) responding in real time to acute risk of physical harm, (8) ensuring regular objective reviews of safety, accuracy, and efficacy, (9) providing safe-use instructions, (10) ensuring users understand they are interacting with AI, (11) ensuring users understand purpose, capabilities, and limitations, (12) prioritizing user safety over engagement metrics or profit, (13) implementing anti-discrimination measures, and (14) ensuring HIPAA-equivalent security and privacy compliance. Suppliers must also maintain documentation describing foundation models, training data, HIPAA compliance, data practices, and ongoing accuracy/safety efforts, and must comply with the filed policy at the time of any alleged violation.

Law enforcement agencies must adopt a written policy governing employee use of generative AI that specifies which technologies and tasks are permitted, emphasizes the importance of reviewing AI-generated content, and warns that violations may result in administrative discipline.

Law enforcement agencies must adopt and maintain a written policy governing employee use of generative AI and AI technology, covering authorized tools and settings, permissible uses, the importance of human review, and disciplinary consequences for violations.

The Department of Criminal Justice Services must establish a comprehensive framework — including formal policies and procedures — governing law-enforcement use of generative AI and machine learning systems in preparing legal instruments and public records, generating or acquiring evidence for legal proceedings or interrogations, and processing surveillance information.

All criminal justice agencies in Virginia must adopt a policy for the use of generative AI and machine learning systems consistent with the model policy published by DCJS by July 1, 2025.

Deployers must design and implement a risk management policy and program — at least as stringent as the NIST AI RMF or another nationally or internationally recognized framework — specifying the principles, processes, and personnel used to identify, mitigate, and document algorithmic discrimination risks. The program must be reasonable considering the deployer's size, system scope, data sensitivity, and implementation cost.

Deployers must design, implement, and maintain a risk management policy and program for each high-risk AI system that is at least as stringent as the NIST AI RMF or another nationally or internationally recognized AI risk management framework, and is reasonable considering the deployer's size, the system's scope and data sensitivity, and the cost of implementation.

Deployers must not deploy an inherently dangerous AI system or a system creating foreseeable risks under § 2495e unless they have designed, implemented, and maintained a risk management policy and program that specifies principles, processes, and personnel for identifying, mitigating, and documenting foreseeable deployment risks. The program must be at least as stringent as the NIST AI RMF and reasonable given the deployer's size, the system's scope, and the data it processes.

Public agencies already using an automated decision system at the effective date must comply with all provisions and procedures in this chapter by January 1, 2023, or immediately cease use of the system until compliance is achieved.

The Office of Privacy and Data Protection must develop guidelines for state agency use of artificial intelligence to ensure ethical, transparent, accountable, and responsible implementation and protection of personally identifiable information.

The Department of Administration must adopt regulations governing the development, procurement, implementation, use, and ongoing assessment of state agency AI systems for consequential decisions, including provisions ensuring pre-implementation impact assessments, non-discrimination safeguards, and ongoing system assessment.

The Department of Administration must adopt regulations governing the development, procurement, implementation, use, and ongoing assessment of state agency generative AI systems for consequential decisions, including pre-implementation impact assessment requirements, anti-discrimination safeguards, ongoing assessment, and foreign adversary country designations.

Deployers and developers must establish, document, implement, and maintain a governance program with reasonable safeguards to manage algorithmic discrimination risks, proportionate to the tool's use and the entity's role and resources. The program must (1) designate at least one employee responsible for compliance oversight with authority to raise compliance concerns, (2) identify and implement anti-discrimination safeguards, (3) conduct annual comprehensive compliance reviews, (4) retain impact assessment results for five years after completion, and (5) adjust safeguards in light of material changes in technology, risk, or operations.

Deployers and developers must establish, document, implement, and maintain a governance program with reasonable administrative and technical safeguards to manage algorithmic discrimination risks. The program must (1) designate at least one compliance employee with authority to raise compliance concerns and trigger prompt internal investigation, (2) identify and implement discrimination safeguards, (3) provide for required impact assessments, (4) conduct an annual comprehensive compliance review, (5) retain impact assessment results for two years, and (6) adjust safeguards in response to material changes in technology, risk, standards, or business operations.

Covered deployers must identify and assess reasonably foreseeable internal and external risks to the security, confidentiality, and integrity of records containing personal information, and establish a process for evaluating and improving the effectiveness of current safeguards, including: (1) ongoing employee and contractor education and training on proper use of security procedures and the importance of personal information security; (2) mandating employee compliance with program policies and procedures; (3) providing a means for detecting and preventing security system failures; (4) security policies for storage, access, and transportation of personal information records outside business premises; (5) disciplinary measures for program violations; (6) measures preventing terminated employees from accessing personal information records; (7) reasonable restrictions on physical access to personal information records including locked storage; and (8) regular monitoring to ensure the program prevents unauthorized access or use, with information safeguard upgrades as necessary.

Covered deployers must conduct regular reviews of the scope of the program's security measures at least annually and whenever there is a material change in business practices that may reasonably affect the security or integrity of records containing personal information.

Deployers must implement and maintain an iterative risk management policy and program that specifies the principles, processes, and personnel used to identify, document, and mitigate known or reasonably foreseeable risks of algorithmic discrimination, and must regularly and systematically review and update the program over the AI system's life cycle.

Deployers must implement and maintain a risk management policy and program specifying the principles, processes, and personnel used to identify, document, and mitigate algorithmic discrimination risks, with regular and systematic review and updates over the system's life cycle.

Deployers must implement and maintain an iterative risk management policy and program specifying the principles, processes, and personnel used to identify, document, and mitigate known or reasonably foreseeable risks of algorithmic discrimination, reviewed and updated regularly over the system's lifecycle. This obligation applies only to high-risk AI systems that are the principal basis of consequential decisions.

Deployers must implement and maintain a risk management policy and program covering the principles, processes, and personnel used to identify, document, and mitigate algorithmic discrimination risks. The program must be iterative and regularly reviewed and updated over the system's life cycle. Effective June 30, 2026.

Deployers must implement and maintain an iterative risk management policy and program covering principles, processes, and personnel for identifying, documenting, and mitigating algorithmic discrimination risks, calibrated to NIST AI RMF, ISO/IEC 42001, or an equivalent framework and to the deployer's size, system scope, and data sensitivity.

Law enforcement agencies must (1) conduct quarterly random-sample audits of authorized facial recognition users to verify proper documentation is being maintained, (2) conduct at least annual random-sample audits to verify procedural compliance and that the authorized-user list is current, and (3) document and retain all audit records for at least two calendar years.

Deployers must establish, document, implement, and maintain a governance program with reasonable administrative and technical safeguards to map, measure, manage, and govern the risks of algorithmic discrimination. The program must include discrimination safeguards, impact assessment procedures, an annual compliance review, two-year retention of impact assessment results, and ongoing adjustment of safeguards in light of material changes.

Deployers must establish, document, implement, and maintain a governance program with reasonable administrative and technical safeguards to map, measure, manage, and govern reasonably foreseeable algorithmic discrimination risks associated with each automated decision tool. Safeguards must be proportionate to the tool's use, the deployer's role and size, the nature of the deployer's activities, and the technical feasibility and cost of available tools. The program must: (1) identify and implement safeguards for foreseeable discrimination risks; (2) support performance of impact assessments required by Section 10; (3) conduct an annual comprehensive compliance review; (4) retain impact assessment results for at least two years after completion; and (5) adapt safeguards in response to material changes in technology, risk, technical standards, or business operations. This obligation does not apply to deployers with fewer than 25 employees unless the tool impacted more than 999 people in the prior calendar year.

The Governor's AI Subcabinet must develop AI strategy and monitoring processes, oversee AI inventories and impact assessments, ensure compliance with State AI policies, develop a comprehensive action plan, and build foundational AI infrastructure across State government.

Deployers must implement a risk management policy governing deployment of each high-risk AI system that (1) identifies, documents, and mitigates algorithmic discrimination risks, (2) specifies principles, processes, and personnel, (3) spans the entire deployment period, and (4) is regularly and systematically reviewed and updated, drawing on the NIST AI RMF, ISO/IEC 42001, or an equivalent framework.

Law enforcement agencies must complete an annual compliance audit beginning October 1, 2023, retain all audit materials for at least three years, and disclose audit results upon request to the Attorney General, Public Defender, State's Attorney, U.S. Attorney, or their designees.

Third-party vendors must provide contracting government agencies with a written privacy policy that is easy to read and understandable to an average consumer, includes the date of last update, and must notify the agency of privacy policy changes within a reasonable period.

Deployers must implement a risk management policy and program that specifies principles, processes, and personnel for identifying, documenting, and mitigating algorithmic discrimination risks, must be iterative and regularly updated over the system lifecycle, and must meet standards established by DOJ rule.

Deployers and developers must establish, document, implement, and maintain a governance program with reasonable administrative and technical safeguards to manage foreseeable discrimination risks, scaled to the entity's role, size, and resources. The program must at minimum (1) identify and implement discrimination safeguards, (2) conduct annual comprehensive compliance reviews, (3) retain impact assessment results for two years, and (4) adjust safeguards in response to material changes in technology or business operations.

The governance program must (1) identify and implement algorithmic-discrimination safeguards, (2) integrate impact-assessment obligations, (3) conduct an annual comprehensive compliance review, (4) retain impact-assessment results for two years after completion, and (5) make reasonable adjustments to safeguards in response to material changes in technology, risk, technical standards, or business operations.

Each agency head must conform all policies, principles, practices, procedures, and guidelines governing the design, development, implementation, deployment, use, or evaluation of AI systems to the NIST AI Risk Management Framework and OMB guidance.

The OMB Director must develop, issue, and periodically update government-wide policies, standards, and guidance governing the use of federal AI systems, including procurement policies, data protection, anti-discrimination best practices, training data identification, periodic system evaluations, and AI governance charter requirements, consistent with NIST standards.

Each agency head must comply with the subchapter and OMB guidance, integrate AI management processes with agency strategic and budgetary planning, and ensure senior officials — including the CIO, Chief Data Officer, and senior privacy official — implement AI risk-reduction policies and periodically validate management controls.

The OMB Director must issue implementing guidance within one year of enactment, in consultation with NIST, GSA, and OSTP, and must review and update the guidance biennially for the first ten years and periodically thereafter.

The Director of OMB must, when updating AI guidance under the AI in Government Act of 2020, consider the NSCAI's recommended practices, Executive Order 13960 principles, input from the Privacy and Civil Liberties Oversight Board, relevant interagency councils, and external privacy and civil rights experts.

Critical-impact AI organizations must perform a documented TEVV-based risk management assessment no later than 30 days before making a critical-impact AI system publicly available, and biennially thereafter. The assessment must cover (1) organizational AI risk management policies and processes, (2) the system's structure, context, and capabilities, (3) quantitative and qualitative risk measurement methods and metrics, and (4) risk resource allocation and monitoring. Assessment reports must be submitted to the Secretary of Commerce within 90 days of completion in a format the Secretary determines.

Law enforcement agencies must adopt and maintain a written policy governing employee use of generative AI and AI technology, covering authorized tools and settings, permissible uses, the importance of human review, and disciplinary consequences for violations.

Attorneys must execute and retain for seven years an affidavit certifying, for each document filed or intended to be filed in a California state or federal court, whether generative AI was used in drafting the document and, if so, that all AI-generated text, citations, and legal analysis has been reviewed for accuracy and approved by a human.

Deployers and developers must establish, document, implement, and maintain a governance program with reasonable safeguards to manage algorithmic discrimination risks, proportionate to the tool's use and the entity's role and resources. The program must (1) designate at least one employee responsible for compliance oversight with authority to raise compliance concerns, (2) identify and implement anti-discrimination safeguards, (3) conduct annual comprehensive compliance reviews, (4) retain impact assessment results for five years after completion, and (5) adjust safeguards in light of material changes in technology, risk, or operations.

Generative AI system providers, generative AI system distributors, and large online platforms must, beginning January 1, 2026, and annually thereafter, produce a Risk Assessment and Mitigation Report assessing synthetic content risks and harms — including AI-generated CSAM, NCII, election and public health disinformation, and plagiarism. The report must be audited by qualified independent auditors using state-of-the-art techniques and applicable national and international AI auditing standards.

Deployers and developers must establish, document, implement, and maintain a governance program with reasonable administrative and technical safeguards to manage algorithmic discrimination risks. The program must (1) designate at least one compliance employee with authority to raise compliance concerns and trigger prompt internal investigation, (2) identify and implement discrimination safeguards, (3) provide for required impact assessments, (4) conduct an annual comprehensive compliance review, (5) retain impact assessment results for two years, and (6) adjust safeguards in response to material changes in technology, risk, standards, or business operations.

Covered deployers must document responsive actions taken in connection with any security breach incident, including a mandatory post-incident review of each event and any changes made to business practices for the protection of personal information in response.

Employers must maintain an updated list of all automated decision systems currently in use.

Developers of general-purpose AI models must create, maintain, and annually revise technical documentation covering training and testing processes, intended tasks, integration contexts, acceptable-use policies, release dates, distribution methods, input/output modalities, and detailed training data descriptions (type, provenance, curation methods, selection criteria, bias detection methods). Developers must also establish and maintain a copyright compliance policy.

Workers' compensation carriers must maintain detailed records of every qualified-human-professional review of an AI-assisted adverse claim decision, including (1) the reviewer's name, title, business address, and unique identifier; (2) the date and time of the decision; and (3) documentation of the basis for the reduction or denial, including any information provided by the algorithm, AI system, or machine learning system.

Insurers must maintain detailed records of every qualified-human-professional review of an AI-assisted adverse claim decision, including (1) the reviewer's name, title, business address, and unique identifier; (2) the date and time of the decision; and (3) documentation of the basis for the reduction or denial, including any information provided by the algorithm, AI system, or machine learning system.

Health maintenance organizations must maintain detailed records of every qualified-human-professional review of an AI-assisted adverse claim decision, including (1) the reviewer's name, title, business address, and unique identifier; (2) the date and time of the decision; and (3) documentation of the basis for the reduction or denial, including any information provided by the algorithm, AI system, or machine learning system.

Insurers must maintain detailed records of all actions taken by qualified human professionals when adjusting, denying, or reviewing claim decisions, including: (1) the name and title of each qualified human professional who made or reviewed a claim decision; (2) the date and time of each claim decision and review; and (3) documentation of the basis for any denial, including any information provided by an algorithm, AI system, or machine learning system.

Insurers that use an algorithm, AI system, or machine learning system as part of their claims-handling process must detail in their claims-handling manual (1) the manner in which such systems are to be used and (2) the manner in which the insurer complies with this section.

Facial recognition specialists must (1) use the software only for official law enforcement business, (2) log in with assigned credentials, (3) record the case number and law enforcement reason for each search in the incident report, (4) use only lawfully collected probe images, (5) use only agency-approved software, and (6) ensure every search request and its results are documented in the incident report.

Law enforcement agencies seeking to use another agency's facial recognition software must submit a written request from a supervisory-level official, obtain supervisory-level approval from the providing agency, and execute a signed interagency agreement or MOU containing eight enumerated acknowledgments covering legal compliance, use limitations, anti-surveillance commitments, corroboration requirements, confidentiality, and lawful probe-image sourcing.

Law enforcement agencies must (1) conduct quarterly random-sample audits of authorized facial recognition users to verify proper documentation is being maintained, (2) conduct at least annual random-sample audits to verify procedural compliance and that the authorized-user list is current, and (3) document and retain all audit records for at least two calendar years.

Deployers must establish, document, implement, and maintain a governance program with reasonable administrative and technical safeguards to map, measure, manage, and govern the risks of algorithmic discrimination. The program must include discrimination safeguards, impact assessment procedures, an annual compliance review, two-year retention of impact assessment results, and ongoing adjustment of safeguards in light of material changes.

Deployers must establish, document, implement, and maintain a governance program with reasonable administrative and technical safeguards to map, measure, manage, and govern reasonably foreseeable algorithmic discrimination risks associated with each automated decision tool. Safeguards must be proportionate to the tool's use, the deployer's role and size, the nature of the deployer's activities, and the technical feasibility and cost of available tools. The program must: (1) identify and implement safeguards for foreseeable discrimination risks; (2) support performance of impact assessments required by Section 10; (3) conduct an annual comprehensive compliance review; (4) retain impact assessment results for at least two years after completion; and (5) adapt safeguards in response to material changes in technology, risk, technical standards, or business operations. This obligation does not apply to deployers with fewer than 25 employees unless the tool impacted more than 999 people in the prior calendar year.

The Department of State Police must document in writing every facial recognition search performed and every search request made to the FBI.

Law enforcement agencies must immediately document the factual basis for any emergency facial recognition search, ensure the search is narrowly tailored, and within 48 hours of obtaining results file a signed, sworn statement from a supervisory official with the superior court setting forth the grounds for the emergency search.

The department of state police must document in writing every facial recognition search request made to the FBI under this section.

Law enforcement agencies conducting emergency facial recognition searches must (1) immediately document the factual basis for the emergency, (2) ensure the search is narrowly tailored to the emergency, and (3) file a signed, sworn statement by a supervisory official with the superior court within 48 hours of receiving search results.

The Department of State Police must document in writing every facial recognition search performed and every search request made to the FBI under this section.

Law enforcement agencies conducting emergency facial recognition searches must (1) immediately document the factual basis for the emergency belief, (2) ensure the search is narrowly tailored, and (3) within 48 hours of obtaining results, file a signed, sworn statement with the superior court setting forth the grounds for the search.

Each unit of State government must conduct an annual data inventory by December 1 each year, identifying data necessary for operations or required by law, in the form prescribed by the Chief Data Officer, including flagging data used in artificial intelligence.

Law enforcement agencies must complete an annual compliance audit by October 1 each year, retain all audit materials for at least 3 years, and disclose audit results upon request to the Attorney General, Public Defender, State's Attorneys, U.S. Attorneys, or their designees.

Law enforcement agencies must complete an annual compliance audit beginning October 1, 2023, retain all audit materials for at least three years, and disclose audit results upon request to the Attorney General, Public Defender, State's Attorney, U.S. Attorney, or their designees.

Manufacturers and importers of licensed chatbots must establish and maintain records, and make reports to the Director, as the Director may by regulation reasonably require to assure the safety and effectiveness of the chatbot.

Covered platforms must store all chatbot conversations that do not include sensitive personal information for at least 60 days.

Licensees must implement industry-standard encryption for data in transit and at rest, maintain detailed access logs, and conduct regular security audits no less than once every six months.

Manufacturers and importers of licensed chatbots must establish and maintain records and submit reports to the Director as required by regulation to assure the safety and effectiveness of such devices.

Covered platforms must store all chatbot conversations that do not include sensitive personal information for at least 60 days.

Large frontier developers and large chatbot providers that redact published plan documents for trade secrets, cybersecurity, public safety, national security, or legal compliance must describe the character and justification of each redaction in the published version to the extent permitted by the concerns justifying the redaction, and must retain the unredacted information for five years.

Insurers must develop, implement, and maintain a written plan for responsible AI use that includes a plan for acquiring, using, or relying upon third-party AI systems, covering contractual cooperation with regulatory inquiries and audit rights to confirm third-party compliance.

Large developers must, before deploying a frontier model, record (as and when reasonably possible) and retain for as long as the frontier model is deployed plus five years information on the specific tests and test results used in any assessment of the frontier model, in sufficient detail for third parties to replicate the testing procedure.

Licensees must ensure their system automatically generates a log every time it operates, conforming to standards set by the secretary, and must preserve all logs for ten years from the date of generation.

Operators must maintain all books, records, source code, and logs as the secretary requires, including at minimum all system-generated logs and a backup of every version of the system, stored safely as prescribed.

Employers and vendors must retain all documentation pertaining to the design, development, use, and data of automated employment decision tools, including data sources, technical specifications, individuals involved in development, historical use data, and a version history sufficient to attest to the tool's specifications at the time of any employment decision. Documentation must be stored in a legible and accessible format for auditors.

Employers must establish, maintain, and preserve for three years contemporaneous, true, and accurate records of all data collected via electronic monitoring tools to ensure compliance with employee and commissioner data requests. Employers must destroy monitoring data no later than 37 months after collection unless the employee provides written, informed consent to continued retention.

Employers and vendors must retain all documentation pertaining to the design, development, use, and data of each AEDT — including training data sources, technical specifications, developer identities, historical use data, and a historical record of tool versions — sufficient to reconstruct the tool's state at the time of any disputed employment decision. Documentation must be stored per commissioner-specified requirements and be legible and accessible to auditors conducting impact assessments.

When frontier developers redact published documents for trade secrets, cybersecurity, public safety, or national security, they must describe the character and justification of each redaction in the published version and must retain unredacted originals for five years.

Deployers and developers must establish, document, implement, and maintain a governance program with reasonable administrative and technical safeguards to manage foreseeable discrimination risks, scaled to the entity's role, size, and resources. The program must at minimum (1) identify and implement discrimination safeguards, (2) conduct annual comprehensive compliance reviews, (3) retain impact assessment results for two years, and (4) adjust safeguards in response to material changes in technology or business operations.

Employers and vendors must retain all documentation pertaining to the design, development, use, and data of an automated employment decision tool necessary to conduct a bias audit, including data sources, technical specifications, developer identities, historical use data, and a version history sufficient to reconstruct the tool as it existed at the time of any disputed employment decision. Documentation must be legible and accessible to auditors.

Deployers must maintain (1) updated inventories of deployed AI systems, (2) documentation on system design, intended use, and training data, and (3) records of audits, risk assessments, and oversight activities.

The governance program must (1) identify and implement algorithmic-discrimination safeguards, (2) integrate impact-assessment obligations, (3) conduct an annual comprehensive compliance review, (4) retain impact-assessment results for two years after completion, and (5) make reasonable adjustments to safeguards in response to material changes in technology, risk, technical standards, or business operations.

Developers must provide deployers with the technical capability to access documentation reasonably necessary for the deployer's impact assessment, including the CAIDS's capabilities, known limitations, and intended-use guidelines. Trade secrets and confidential information are not required to be disclosed.

Developers must provide deployers with the technical capability to access information reasonably necessary to perform impact assessments, including documentation of the CAIDS's capabilities, known limitations, and guidelines for intended use. Trade secrets and confidential information need not be disclosed.

Persons providing AI mental health services must maintain service records in the same manner required by the professional licensing statute applicable to a licensed mental health professional providing the same service.

Online platforms must retain for five years (extendable to eight by the FTC) a de-identified record describing each algorithmic process's data inputs, weighting methodology, development methodology (including training data and bias testing), and — for non-small-business platforms using algorithms in housing, education, employment, insurance, credit, or public accommodations — a disparate-impact assessment. Records must be produced to the FTC on request.

Online platforms must retain for five years (extendable to eight by FTC determination) a de-identified record for each algorithmic process describing the personal information categories used, the weighting/ranking method, the development data and training data, testing methodology for accuracy, fairness, bias, and discrimination, and — for non-small-business platforms using algorithmic processes in housing, education, employment, insurance, credit, or public accommodations — an assessment of whether the process produces disparate outcomes across protected characteristics.

Covered entities must maintain documentation of all impact assessments, including all information described in the assessment requirements, for three years beyond the duration of deployment of the automated decision system or augmented critical decision process.

Covered entities must document in the impact assessment: (1) the baseline decision process being replaced and its known harms, (2) the intended benefits and purpose of the new augmented critical decision process, (3) all stakeholder consultations including contacts, dates, agreements, and recommendations adopted or rejected, (4) the development and deployment timeline, (5) resource needs identified, and (6) any assessment requirements that were infeasible and the rationale.

Law enforcement agencies whose officers use facial recognition must log all uses of facial recognition to the extent necessary to comply with the Act's reporting and audit requirements.

Covered entities must maintain documentation of all impact assessments, including the information described in Sec. 4(a), for three years beyond the duration of deployment of each automated decision system or augmented critical decision process.

Covered entities must, as part of the impact assessment for a new augmented critical decision process, evaluate and document the previously existing decision-making process (including baseline description, known harms, intended benefits, and intended purpose), and document all stakeholder consultations including contacts, dates, and terms of engagement.

Covered entities must document the development and deployment lifecycle (milestones, responsible teams), identify needed improvements in performance, fairness, transparency, privacy, safety, and cost, and document any impact assessment requirements that were infeasible to complete with rationale.

Each agency head must oversee the creation of AI governance charters for all covered federal AI systems, ensure they are regularly updated, publish them on the agency's public webpage, submit them to the Federal Register within 30 days of establishment or termination, and submit them to GSA for inclusion in the Federal AI System Inventory.

Each agency head must establish and maintain an accurate AI governance charter for every federal AI system that is high-risk or that uses, is trained on, or produces individual records, documenting at minimum: system purpose and responsible officials, development and funding details, training data and testing information, ongoing oversight cadence, system usage including AI-assisted determinations, output data descriptions, and Privacy Act system-of-records information. Charters must be updated within 30 days of any significant system change.

Online platforms must retain for 5 years (extendable to 8 by FTC determination) a de-identified record of each algorithmic process describing: data categories used, ranking methodology, development method including training data and ongoing training, testing methodology for accuracy, fairness, bias, and discrimination, and — for non-small-business platforms using algorithms in housing, education, employment, insurance, credit, or public accommodations — an assessment of whether the process produces disparate outcomes across protected characteristics.

Each agency head must establish an AI strategy for trustworthy AI adoption that includes (1) defined roles and responsibilities, (2) values and ethics principles, (3) trust and safety standards, (4) risk identification and mitigation processes, (5) algorithmic discrimination safeguards, (6) current and anticipated AI use domains, (7) workforce development steps, (8) conditions for public-facing AI use, (9) internal coordination processes, (10) interagency governance, (11) data governance, (12) procurement safeguards for rights and safety, and (13) specific implementation actions and desired outcomes.

Online platforms must retain for five years (extendable to eight) a de-identified record describing each algorithmic process, including personal information categories used, weighting methods, development data, training data, and testing for accuracy, fairness, bias, and discrimination. Non-small-business platforms using algorithms related to housing, education, employment, insurance, credit, or public accommodations must include a disparate-impact assessment across protected characteristics. Records must be produced to the FTC upon request.

Covered entities must maintain documentation of each impact assessment, including all information described in Sec. 4(a), for 3 years beyond the duration of deployment of the automated decision system or augmented critical decision process.

Covered entities must, as part of the impact assessment, evaluate any previously existing decision-making process being replaced, document stakeholder consultations (including points of contact, dates, legal agreements, materials reviewed, and recommendations adopted or rejected with rationale), and document the baseline, known harms, intended benefits, and purpose of the new system.

Covered entities must maintain ongoing documentation of the development and deployment process (including milestone dates and responsible teams), identify needed capabilities and tools for improvement across performance, fairness, transparency, privacy, safety, efficiency, and cost, and document any impact assessment requirements that were infeasible to complete along with corresponding rationale.

Critical-impact AI organizations must perform a documented TEVV-based risk management assessment no later than 30 days before making a critical-impact AI system publicly available, and biennially thereafter. The assessment must cover (1) organizational AI risk management policies and processes, (2) the system's structure, context, and capabilities, (3) quantitative and qualitative risk measurement methods and metrics, and (4) risk resource allocation and monitoring. Assessment reports must be submitted to the Secretary of Commerce within 90 days of completion in a format the Secretary determines.

Covered entities must maintain documentation of all impact assessments, including the information described in Section 4(a), for three years beyond the duration of the system's deployment.

Covered entities must, as part of their impact assessment, create and maintain contemporaneous documentation covering: (1) evaluation of previously existing decision processes, (2) stakeholder consultation records, (3) development and deployment milestones, (4) identified resource and capability needs, and (5) any requirements that could not be met with corresponding rationale.

Developers must enter into written contracts with deployers that specify data processing procedures, deployment instructions, data types, processing duration, rights and obligations including material-change notification, and must prohibit cross-party data combination. Contracts may not relieve either party of Act liability or prohibit reporting to enforcement agencies. Developers must retain each deployer contract for 10 years.

When a frontier developer redacts published compliance documents, it must describe the character and justification of each redaction in the published version and retain the unredacted information for five years.

Suppliers seeking the affirmative defense to unlicensed-practice liability must create, maintain, and implement a written policy that states the chatbot's intended purpose and limitations, and describes procedures for (1) involving licensed mental health therapists in development and review, (2) ensuring consistency with clinical best practices, (3) conducting pre-deployment and ongoing testing to ensure output poses no greater risk than therapy with a licensed therapist, (4) identifying foreseeable adverse outcomes, (5) providing a user harm-reporting mechanism, (6) implementing risk-assessment and response protocols, (7) responding in real time to acute risk of physical harm, (8) ensuring regular objective reviews of safety, accuracy, and efficacy, (9) providing safe-use instructions, (10) ensuring users understand they are interacting with AI, (11) ensuring users understand purpose, capabilities, and limitations, (12) prioritizing user safety over engagement metrics or profit, (13) implementing anti-discrimination measures, and (14) ensuring HIPAA-equivalent security and privacy compliance. Suppliers must also maintain documentation describing foundation models, training data, HIPAA compliance, data practices, and ongoing accuracy/safety efforts, and must comply with the filed policy at the time of any alleged violation.

Learning Laboratory participants must retain records as required by Office rule or the participation agreement.

Each algorithmic accountability report must include clear and understandable statements covering: system name, vendor, and version; general capabilities and weapons potential; data inputs, generation, collection, and processing methods; bias testing status; purpose and proposed use; compliance plans for Section 4 requirements; constitutional-rights impact; civil rights and disparate impact analysis with mitigation plan; statutory decision criteria; and a comprehensive use and data management policy covering deployment protocols, access rules, data security, personnel training, community engagement, and fiscal impact.

Each algorithmic accountability report must include 15 categories of clear and understandable statements covering: system name, vendor, and version; general capabilities (including weapon use); purpose and proposed use; data inputs and outputs; bias and inaccuracy examination results; known errors; appeal processes; community engagement; algorithm availability; compliance plans; legal-rights impacts; protected-class differential treatment; statutorily mandated criteria; data management policies and protocols; and fiscal impact.

Deployers and developers must establish, document, implement, and maintain a governance program with reasonable safeguards to manage algorithmic discrimination risks, proportionate to the tool's use and the entity's role and resources. The program must (1) designate at least one employee responsible for compliance oversight with authority to raise compliance concerns, (2) identify and implement anti-discrimination safeguards, (3) conduct annual comprehensive compliance reviews, (4) retain impact assessment results for five years after completion, and (5) adjust safeguards in light of material changes in technology, risk, or operations.

Deployers and developers must establish, document, implement, and maintain a governance program with reasonable administrative and technical safeguards to manage algorithmic discrimination risks. The program must (1) designate at least one compliance employee with authority to raise compliance concerns and trigger prompt internal investigation, (2) identify and implement discrimination safeguards, (3) provide for required impact assessments, (4) conduct an annual comprehensive compliance review, (5) retain impact assessment results for two years, and (6) adjust safeguards in response to material changes in technology, risk, standards, or business operations.

Workers' compensation carriers must maintain detailed records of every qualified-human-professional review of an AI-assisted adverse claim decision, including (1) the reviewer's name, title, business address, and unique identifier; (2) the date and time of the decision; and (3) documentation of the basis for the reduction or denial, including any information provided by the algorithm, AI system, or machine learning system.

Insurers must maintain detailed records of every qualified-human-professional review of an AI-assisted adverse claim decision, including (1) the reviewer's name, title, business address, and unique identifier; (2) the date and time of the decision; and (3) documentation of the basis for the reduction or denial, including any information provided by the algorithm, AI system, or machine learning system.

Health maintenance organizations must maintain detailed records of every qualified-human-professional review of an AI-assisted adverse claim decision, including (1) the reviewer's name, title, business address, and unique identifier; (2) the date and time of the decision; and (3) documentation of the basis for the reduction or denial, including any information provided by the algorithm, AI system, or machine learning system.

Insurers must maintain detailed records of all actions taken by qualified human professionals when adjusting, denying, or reviewing claim decisions, including: (1) the name and title of each qualified human professional who made or reviewed a claim decision; (2) the date and time of each claim decision and review; and (3) documentation of the basis for any denial, including any information provided by an algorithm, AI system, or machine learning system.

Facial recognition specialists must (1) use the software only for official law enforcement business, (2) log in with assigned credentials, (3) record the case number and law enforcement reason for each search in the incident report, (4) use only lawfully collected probe images, (5) use only agency-approved software, and (6) ensure every search request and its results are documented in the incident report.

Law enforcement agencies must (1) conduct quarterly random-sample audits of authorized facial recognition users to verify proper documentation is being maintained, (2) conduct at least annual random-sample audits to verify procedural compliance and that the authorized-user list is current, and (3) document and retain all audit records for at least two calendar years.

Deployers must establish, document, implement, and maintain a governance program with reasonable administrative and technical safeguards to map, measure, manage, and govern the risks of algorithmic discrimination. The program must include discrimination safeguards, impact assessment procedures, an annual compliance review, two-year retention of impact assessment results, and ongoing adjustment of safeguards in light of material changes.

Law enforcement agencies conducting emergency facial recognition searches must (1) immediately document the factual basis for the emergency, (2) ensure the search is narrowly tailored to the emergency, and (3) file a signed, sworn statement by a supervisory official with the superior court within 48 hours of receiving search results.

Law enforcement agencies conducting emergency facial recognition searches must (1) immediately document the factual basis for the emergency belief, (2) ensure the search is narrowly tailored, and (3) within 48 hours of obtaining results, file a signed, sworn statement with the superior court setting forth the grounds for the search.

Each unit of State government must conduct an annual data inventory by December 1 each year, identifying data necessary for operations or required by law, in the form prescribed by the Chief Data Officer, including flagging data used in artificial intelligence.

Law enforcement agencies must complete an annual compliance audit by October 1 each year, retain all audit materials for at least 3 years, and disclose audit results upon request to the Attorney General, Public Defender, State's Attorneys, U.S. Attorneys, or their designees.

Law enforcement agencies must complete an annual compliance audit beginning October 1, 2023, retain all audit materials for at least three years, and disclose audit results upon request to the Attorney General, Public Defender, State's Attorney, U.S. Attorney, or their designees.

Manufacturers and importers of licensed chatbots must establish and maintain records, and make reports to the Director, as the Director may by regulation reasonably require to assure the safety and effectiveness of the chatbot.

Manufacturers and importers of licensed chatbots must establish and maintain records and submit reports to the Director as required by regulation to assure the safety and effectiveness of such devices.

Licensees must ensure their system automatically generates a log every time it operates, conforming to standards set by the secretary, and must preserve all logs for ten years from the date of generation.

Operators must maintain all books, records, source code, and logs as the secretary requires, including at minimum all system-generated logs and a backup of every version of the system, stored safely as prescribed.

Employers and vendors must retain all documentation pertaining to the design, development, use, and data of automated employment decision tools, including data sources, technical specifications, individuals involved in development, historical use data, and a version history sufficient to attest to the tool's specifications at the time of any employment decision. Documentation must be stored in a legible and accessible format for auditors.

Employers must establish, maintain, and preserve for three years contemporaneous, true, and accurate records of all data collected via electronic monitoring tools to ensure compliance with employee and commissioner data requests. Employers must destroy monitoring data no later than 37 months after collection unless the employee provides written, informed consent to continued retention.

Employers and vendors must retain all documentation pertaining to the design, development, use, and data of each AEDT — including training data sources, technical specifications, developer identities, historical use data, and a historical record of tool versions — sufficient to reconstruct the tool's state at the time of any disputed employment decision. Documentation must be stored per commissioner-specified requirements and be legible and accessible to auditors conducting impact assessments.

Employers and vendors must retain all documentation pertaining to the design, development, use, and data of an automated employment decision tool necessary to conduct a bias audit, including data sources, technical specifications, developer identities, historical use data, and a version history sufficient to reconstruct the tool as it existed at the time of any disputed employment decision. Documentation must be legible and accessible to auditors.

Deployers must maintain (1) updated inventories of deployed AI systems, (2) documentation on system design, intended use, and training data, and (3) records of audits, risk assessments, and oversight activities.

The governance program must (1) identify and implement algorithmic-discrimination safeguards, (2) integrate impact-assessment obligations, (3) conduct an annual comprehensive compliance review, (4) retain impact-assessment results for two years after completion, and (5) make reasonable adjustments to safeguards in response to material changes in technology, risk, technical standards, or business operations.

Online platforms must retain for five years (extendable to eight by the FTC) a de-identified record describing each algorithmic process's data inputs, weighting methodology, development methodology (including training data and bias testing), and — for non-small-business platforms using algorithms in housing, education, employment, insurance, credit, or public accommodations — a disparate-impact assessment. Records must be produced to the FTC on request.

Online platforms must retain for five years (extendable to eight by FTC determination) a de-identified record for each algorithmic process describing the personal information categories used, the weighting/ranking method, the development data and training data, testing methodology for accuracy, fairness, bias, and discrimination, and — for non-small-business platforms using algorithmic processes in housing, education, employment, insurance, credit, or public accommodations — an assessment of whether the process produces disparate outcomes across protected characteristics.

Covered entities must maintain documentation of all impact assessments, including all information described in the assessment requirements, for three years beyond the duration of deployment of the automated decision system or augmented critical decision process.

Law enforcement agencies whose officers use facial recognition must log all uses of facial recognition to the extent necessary to comply with the Act's reporting and audit requirements.

Federal law enforcement agencies using facial recognition must annually submit use data to the GAO for compliance audit. If violations are found, the agency must cease using facial recognition until all violations are corrected and must notify the public of the suspension.

State and local law enforcement agencies using facial recognition must annually submit use data to an independent state agency for compliance audit. If violations are found, the agency must cease using facial recognition until all violations are corrected and must notify the public of the suspension. Audit data must be disaggregated by race, ethnicity, gender, and age when feasible.

Covered entities must maintain documentation of all impact assessments, including the information described in Sec. 4(a), for three years beyond the duration of deployment of each automated decision system or augmented critical decision process.

Each agency head must oversee the creation of AI governance charters for all covered federal AI systems, ensure they are regularly updated, publish them on the agency's public webpage, submit them to the Federal Register within 30 days of establishment or termination, and submit them to GSA for inclusion in the Federal AI System Inventory.

Each agency head must establish and maintain an accurate AI governance charter for every federal AI system that is high-risk or that uses, is trained on, or produces individual records, documenting at minimum: system purpose and responsible officials, development and funding details, training data and testing information, ongoing oversight cadence, system usage including AI-assisted determinations, output data descriptions, and Privacy Act system-of-records information. Charters must be updated within 30 days of any significant system change.

Online platforms must retain for five years (extendable to eight) a de-identified record describing each algorithmic process, including personal information categories used, weighting methods, development data, training data, and testing for accuracy, fairness, bias, and discrimination. Non-small-business platforms using algorithms related to housing, education, employment, insurance, credit, or public accommodations must include a disparate-impact assessment across protected characteristics. Records must be produced to the FTC upon request.

Covered entities must maintain documentation of each impact assessment, including all information described in Sec. 4(a), for 3 years beyond the duration of deployment of the automated decision system or augmented critical decision process.

Critical-impact AI organizations must perform a documented TEVV-based risk management assessment no later than 30 days before making a critical-impact AI system publicly available, and biennially thereafter. The assessment must cover (1) organizational AI risk management policies and processes, (2) the system's structure, context, and capabilities, (3) quantitative and qualitative risk measurement methods and metrics, and (4) risk resource allocation and monitoring. Assessment reports must be submitted to the Secretary of Commerce within 90 days of completion in a format the Secretary determines.

Covered entities must maintain documentation of all impact assessments, including the information described in Section 4(a), for three years beyond the duration of the system's deployment.

Developers must, upon reasonable deployer request, make available compliance information including pre-deployment evaluation reports and annual reviews, and must either cooperate with deployer-conducted assessments or arrange for an independent auditor assessment of the developer's practices and provide that report to the deployer.

Learning Laboratory participants must retain records as required by Office rule or the participation agreement.

Generative AI system providers, generative AI system distributors, and large online platforms must, beginning January 1, 2026, and annually thereafter, produce a Risk Assessment and Mitigation Report assessing synthetic content risks and harms — including AI-generated CSAM, NCII, election and public health disinformation, and plagiarism. The report must be audited by qualified independent auditors using state-of-the-art techniques and applicable national and international AI auditing standards.

Operators must obtain an independent, third-party audit assessing the operator's compliance with this Act at least once every two years. Operators must make publicly available on their website a high-level summary of the audit's findings, excluding confidential or proprietary information.

Health care providers that use AI to determine or influence health care decisions must undergo an annual third-party audit, by July 1 beginning in 2026, evaluating whether AI-driven decisions align with medical care standards, meet ethical standards, or excessively delay care. Providers must submit proof of audit completion to the Department upon request.

Carriers that use AI to determine or influence health care decisions must undergo an annual third-party audit, by July 1 beginning in 2026, evaluating whether AI-driven decisions align with medical care standards, meet ethical standards, or excessively delay care. Carriers must submit proof of audit completion to the Commissioner upon request.

Law enforcement agencies must complete an annual compliance audit by October 1 each year, retain all audit materials for at least 3 years, and disclose audit results upon request to the Attorney General, Public Defender, State's Attorneys, U.S. Attorneys, or their designees.

Law enforcement agencies must complete an annual compliance audit beginning October 1, 2023, retain all audit materials for at least three years, and disclose audit results upon request to the Attorney General, Public Defender, State's Attorney, U.S. Attorney, or their designees.

The criminal intelligence information section must adopt an audit process to ensure facial recognition technology is used only for legitimate law enforcement purposes, including auditing uses and requests by law enforcement agencies.

Licensees must conduct regular inspections and perform an annual third-party audit of their chatbot operations. Results of all inspections and audits must be made available to the Department.

Licensees must conduct regular inspections and perform an annual third-party audit, and make all inspection and audit results available to the Department.

Large developers must annually retain an independent third party to perform a compliance audit of the requirements of this section, beginning on the effective date of the article or 90 days after the developer first qualifies as a large developer, whichever is later. The auditor must be granted access to unredacted materials and must produce a report that includes: (1) a detailed assessment of the developer's compliance steps, (2) identified instances of noncompliance and improvement recommendations, (3) a detailed assessment of internal controls including designation and empowerment of senior compliance personnel, and (4) the lead auditor's certifying signature. The developer must retain an unredacted copy of the report for the deployment period plus five years, conspicuously publish a redacted copy, transmit the redacted report to the Division of Homeland Security and Emergency Services, and grant the Division or the Attorney General access to the full report (with redactions only as required by federal law) upon request.

Operators must establish an independent ethics and risk management board of at least five members — none of whom may be a member, officer, or director of the operator — to assess the ethical implications and operational outcomes of all use cases of each licensed high-risk AI system.

Deployers must subject high-risk AI systems to annual independent audits to ensure compliance with legal and ethical standards.

Federal law enforcement agencies using facial recognition must annually submit use data to the GAO for compliance audit. If violations are found, the agency must cease using facial recognition until all violations are corrected and must notify the public of the suspension.

State and local law enforcement agencies using facial recognition must annually submit use data to an independent state agency for compliance audit. If violations are found, the agency must cease using facial recognition until all violations are corrected and must notify the public of the suspension. Audit data must be disaggregated by race, ethnicity, gender, and age when feasible.

Each agency's Inspector General must perform an independent biennial evaluation of the agency's AI governance compliance — including the completeness and timeliness of AI governance charters — and submit a report to the agency head, OMB Director, and appropriate congressional committees.

The Comptroller General must periodically evaluate and report to Congress on the effectiveness of agency AI governance, implementation of the subchapter, and whether requirements reflect technology advancements, including legislative recommendations.

Covered platforms subject to the transparency report requirement must cooperate with the independent third-party auditor by providing all relevant information, material, and system access, and must not misrepresent any relevant fact.

Suppliers must, beginning May 1, 2027, facilitate independent evaluation of safety protocols by either (1) commissioning an independent assessment from a qualified third party applying standards at least as rigorous as the NIST AI RMF, with no prior consulting relationship or financial interest, or (2) providing reasonable accommodations for independent research evaluations.

Each algorithmic accountability review office must conduct selective audits of filed reports during the transitional period (effective date through January 1, 2024), and beginning January 1, 2024 must conduct annual audits covering compliance with approved reports, known or suspected policy violations, systematic bias or disproportionate-impact issues, and recommendations for legislative revision. The state CIO must establish audit-scope guidelines by January 1, 2022. Annual audits must be published on the review office's website by March 1 each year.

Deployers and developers must establish, document, implement, and maintain a governance program with reasonable safeguards to manage algorithmic discrimination risks, proportionate to the tool's use and the entity's role and resources. The program must (1) designate at least one employee responsible for compliance oversight with authority to raise compliance concerns, (2) identify and implement anti-discrimination safeguards, (3) conduct annual comprehensive compliance reviews, (4) retain impact assessment results for five years after completion, and (5) adjust safeguards in light of material changes in technology, risk, or operations.

Deployers and developers must establish, document, implement, and maintain a governance program with reasonable administrative and technical safeguards to manage algorithmic discrimination risks. The program must (1) designate at least one compliance employee with authority to raise compliance concerns and trigger prompt internal investigation, (2) identify and implement discrimination safeguards, (3) provide for required impact assessments, (4) conduct an annual comprehensive compliance review, (5) retain impact assessment results for two years, and (6) adjust safeguards in response to material changes in technology, risk, standards, or business operations.

Covered deployers must designate one or more employees to maintain the comprehensive information security program.

Each state agency, department, and branch of government must appoint senior-level personnel responsible for maintaining and updating the high-risk AI use inventory.

Deployers must designate at least one employee to oversee and maintain the governance program and compliance with the Act. That employee must have authority to raise compliance concerns in good faith, and the employer must promptly and completely assess any compliance issue the designated employee raises.

Deployers must designate at least one employee to oversee and maintain the governance program and ensure compliance with the Act. The designated employee must have authority to assert a good faith belief that the design, production, or use of an automated decision tool does not comply with the Act. The employer must promptly and completely assess any compliance issue raised by the designated employee.

Consumer reporting agencies must designate staff to be responsible for compliance with the algorithmic system requirements of this section.

Law enforcement agencies that use or contract for facial recognition technology must designate an employee responsible for overseeing and administering FRT use in compliance with the subtitle and applicable local laws, regulations, and policies.

Law enforcement agencies that use or contract for facial recognition technology must designate an employee responsible for overseeing and administering the use of the technology in compliance with the subtitle and applicable local laws, regulations, and policies.

Operators must establish an independent ethics and risk management board of at least five members — none of whom may be a member, officer, or director of the operator — to assess the ethical implications and operational outcomes of all use cases of each licensed high-risk AI system.

Deployers and developers must designate one or more employees responsible for overseeing and maintaining the governance program and compliance with this article. Designated employees may assert good-faith compliance concerns, and the employer must conduct a prompt and complete assessment of any compliance issue so raised.

Deployers must establish governance groups to oversee the classification, deployment, and monitoring of high-risk AI systems.

Deployers and developers must designate at least one employee responsible for overseeing the governance program and chapter compliance, with authority to raise good-faith compliance concerns; the employer must promptly and completely assess any issue raised by the designated employee.

Each covered agency must establish and maintain an office of civil rights that employs experts and technologists focused on bias, discrimination, and other harms resulting from covered algorithms.

Online platforms must certify under oath — signed by the CEO, CPO, COO, CISO, or equivalent senior officer attesting to personal knowledge — the accuracy and completeness of each required disclosure within 30 days of the disclosure and annually thereafter, plus upon any material change.

Each covered agency must establish and publicly post on its website within 90 days of enactment a policy governing its use of facial recognition systems to ensure officer compliance with the Act.

Each agency head must delegate primary AI compliance authority and accountability to the agency Chief Information Officer (or comparable official).

Online platforms must certify under oath — through a senior executive (CEO, CPO, COO, CISO, or equivalent) — the accuracy and completeness of all algorithmic process, content moderation, and advertisement library disclosures within 30 days of making each disclosure, annually thereafter, and upon any material change.

The OMB Director must establish a Chief Artificial Intelligence Officers Council within 90 days of enactment, comprising CAIOs from CFO Act agencies and other designated members, to coordinate interagency AI practices, share best practices, and manage AI-related risks across the federal government.

Each agency head must hire or designate a Chief Artificial Intelligence Officer at the senior executive level (above GS-15) responsible for AI policy development, governmentwide compliance, risk management planning (including risk-level classification), rights-protective design and deployment, and participation in budget and acquisition decision processes.

The OMB Director must issue guidance within 120 days directing each CFO Act agency to establish an internal AI Governance Board — chaired by the CAIO and including designated senior officials (deputy head, CIO, chief acquisition officer, chief data officer, senior privacy official, civil rights official, and others) — to coordinate and govern the agency's AI issues.

The Director of OMB must establish the Artificial Intelligence Hygiene Working Group within 45 days of enactment and appoint its members from appropriate interagency councils.

Covered agencies must establish and maintain an office of civil rights that employs experts and technologists focused on bias, discrimination, and other harms resulting from covered algorithms.

Employers must train all individuals or entities that operate or use an automated decision system on the system's input data, appeals process, potential biases, limitations, potential adverse effects on workers, potential errors, and examples of inappropriate uses.

Employers must train any individual or entity that operates or uses an automated decision system's output on the system's inputs, appeals process, potential biases, limitations, potential adverse effects, potential errors, and examples of inappropriate uses.

State agencies must train all staff who use the automated decision system for employment decisions to comply with applicable federal and state law and to ensure the system does not result in algorithmic discrimination.

Local government entities must train staff who use the automated decision system for employment decisions to comply with applicable federal and state law and to ensure the system does not result in algorithmic discrimination.