Developers must provide each deployer with documentation covering the automated decision tool's intended uses, known limitations (including foreseeable algorithmic discrimination risks), the type of training data used, the tool's pre-sale validity and explainability evaluation, and the deployer's responsibilities under the chapter. Trade secrets need not be disclosed.

Developers must provide each deployer with a statement of the automated decision tool's intended uses and documentation of its known limitations (including foreseeable algorithmic discrimination risks), the types of training data used, and the tool's pre-sale validity and explainability evaluations. Trade secrets need not be disclosed.

Developers must make documentation available to deployers or other developers describing the high-risk AI system's capabilities, limitations, and intended uses.

Developers must provide deployers with impact-assessment-enabling documentation — including model cards, dataset cards, or other impact assessments — to the extent feasible.

Developers must make available to each deployer or other developer a general statement describing intended uses and known harmful uses of the high-risk AI system, along with documentation describing data governance measures, intended inputs, and outputs.

Developers must make available to deployers, to the extent feasible, the documentation and information (such as model cards, dataset cards, or impact assessments) necessary for deployers to complete an impact assessment under § 6-1-1703(3).

Developers must make available to deployers, to the extent feasible, model cards, dataset cards, or other impact assessment documentation necessary for the deployer to complete its own impact assessment, effective June 30, 2026.

Developers must make available to each deployer documentation covering foreseeable uses, training data summaries, discrimination risks, performance evaluation methods, data governance measures, intended outputs, mitigation measures, and monitoring guidance for each high-risk AI system, including materials necessary for the deployer to complete an impact assessment.

Businesses with 10 or more employees that use AI systems in Illinois must publish on their official website a public report explaining compliance with the five AI governance principles. The report must: (1) be updated annually and whenever significant changes are made to the AI system, including modifications to algorithms, substantial alterations to data inputs, or shifts in operational contexts; (2) include information on the system's design, major design-process decisions (such as testing metrics), training data, risk mitigation strategies, and any impact assessments conducted; and (3) be written in plain language accessible to the general public while also providing a more detailed explanation for specialized audiences.

Developers offering a high-risk AI system for sale must (1) provide purchasers with standardized disclosure documentation covering system purpose, intended uses, known risks of algorithmic discrimination, limitations, training data summary, data governance measures, bias mitigation steps, best practices, and monitoring information, and (2) provide deployers with information necessary to complete an impact assessment.

Developers must make available to deployers or other developers of each high-risk AI system: (1) a general statement describing uses and known harmful or inappropriate uses; (2) documentation disclosing a high-level summary of training data types, each known limitation including reasonably foreseeable algorithmic discrimination risks, the system's purpose, intended benefits and uses, and information necessary for deployer compliance; (3) documentation describing pre-deployment performance and discrimination evaluation methodology, data governance measures covering training datasets including suitability of data sources and bias mitigation, intended outputs, measures taken to mitigate known discrimination risks, and guidance on how the system should be used, not be used, and be monitored by a human in consequential-decision contexts; and (4) documentation reasonably necessary to assist the deployer in understanding each output and monitoring performance for algorithmic discrimination risk. Trade secrets and legally protected or security-sensitive information may be withheld.

Developers that make a high-risk AI system available to deployers or other developers must, to the extent feasible, provide the documentation and information necessary for the deployer or a third party contracted by the deployer to complete an impact assessment, including any model card or other impact assessment. A developer that also serves as deployer for the same system need not generate this documentation unless the system is provided to an unaffiliated deployer.

Developers must provide recipients (deployers) with a general summary of foreseeable and harmful uses and detailed documentation covering purpose, training data summary, known limitations and discrimination risks, bias evaluation methodology, data governance measures, intended outputs, mitigation steps, monitoring guidance, and all information necessary for deployer compliance.

Persons developing automated systems must, whenever possible, perform independent evaluations confirming system safety and effectiveness — including steps taken to mitigate potential harms — and make the results publicly available.

Designers, developers, and deployers must provide accessible, plain-language documentation describing overall system functioning, the role of automation, the responsible individual or organization, and clear explanations of outcomes. Documentation must be kept current and residents must be notified of significant changes to use cases or key functionalities.

Frontier developers must publish a transparency report on their website before or concurrently with deploying a new or substantially modified frontier model, covering the developer's website, a user-communication mechanism, the model's release date, supported languages, output modalities, intended uses, and any generally applicable use restrictions. Publication within a system card or model card satisfies this requirement.

Developers must provide deployers with a statement of intended use and documentation covering (1) known limitations including foreseeable discrimination risks, (2) the type of data used to program or train the tool, and (3) how the tool was evaluated for validity and explainability before sale or licensing. Trade secrets and confidential business information need not be disclosed.

Persons developing automated systems must perform independent evaluation and reporting confirming system safety and effectiveness — including steps taken to mitigate potential harms — and must make results public whenever possible.

Whenever possible, persons developing automated systems must provide residents with access to reporting that confirms respect for their data decisions and assesses the potential impact of surveillance technologies on their rights, opportunities, or access.

Designers, developers, and deployers must provide accessible plain-language documentation covering overall system functioning, the role of automation, notice of system use, identification of the responsible individual or organization, and clear explanations of outcomes. Notice must be kept current and residents must be notified of significant changes to use cases or key functionalities.

Persons developing automated systems must make public, whenever possible, summary reporting that includes plain-language information about the automated systems and assessments of the clarity and quality of notice and explanations provided.

Persons developing automated systems must make publicly available, whenever possible, summary reporting on human governance processes including descriptions of fallback mechanisms and assessments of their timeliness, accessibility, outcomes, and effectiveness.

Developers must provide deployers with a statement of intended uses and documentation covering the tool's known limitations and algorithmic discrimination risks, the types of data used to program or train the tool, and how the tool was evaluated for validity and explainability before sale or licensing.

Developers must provide deployers with a statement of the automated decision tool's intended uses and documentation covering known limitations (including foreseeable algorithmic discrimination risks), training data types, and pre-sale validity and explainability evaluations. Trade secrets need not be disclosed.

Developers must provide deployers with a written High-Risk Report before delivering a high-risk AI system, covering intended uses, known discrimination risks, NIST AI RMF-aligned performance metrics, training data summary, data governance measures, and recommended risk management principles.

Developers must update and provide the High-Risk Report information to deployers within 30 days of any intentional and substantial modification to the system.

Developers must provide deployers with all documentation and information necessary for the deployer to complete an impact assessment.

The Health and Human Services Commission must publish on its website the testing results for each AI technology application submitted for approval.

Covered persons must publicly disclose on their website or another electronically accessible location: (1) the name of each AI model used, (2) a brief description of each model's functions and purposes, (3) the name of each third party that has provided input on an implemented AI model, (4) a description of each third party's specific input, and (5) any model changes resulting from such third-party input. Individual end users providing personal-capacity feedback based on their own user experience are not considered third parties for these purposes.

Online platforms must disclose to users, in conspicuous, accessible, and plain language (in each language in which the platform provides services), for each type of algorithmic process: (1) the categories of personal information collected or created, (2) how that information is collected, (3) how it is used in the algorithmic process, and (4) the method by which the process prioritizes, ranks, or weighs different categories of personal information.

Online platforms must disclose to users, in conspicuous, accessible, and plain language (in every language the platform serves), the categories of personal information each algorithmic process collects, how it is collected, how it is used, and how the algorithm prioritizes or ranks categories of personal information to withhold, amplify, recommend, or promote content.

Covered entities must publish specified foundation model transparency information on their website and on the FTC's central registry, in machine-readable format, as defined by FTC regulations.

Covered entities must disclose the intended purposes, foreseen limitations or risks, version history, release date, and computational power used to train and operate each foundation model, as specified in FTC regulations.

Covered entities must disclose benchmark performance results — whether from self-evaluation or audit — including what precautions the model takes when responding to high-risk domains such as healthcare, biological or chemical synthesis, cybersecurity, elections, policing, financial lending, education, employment, public services, and vulnerable populations including children.

Online platforms must disclose to users, in conspicuous, accessible, and plain language available in all supported languages, the categories of personal information collected for each algorithmic process, the collection method, how the information is used, and the method by which the algorithm prioritizes or ranks data to recommend or withhold content.

Online platforms must disclose to users in conspicuous, accessible, and plain language a complete description of content moderation practices, including automated and human-labor-based practices, available in all supported languages.

Developers and deployers must publish a comprehensive public disclosure covering their identity and contact information, links to evaluation and assessment summaries, categories of personal data collected or processed and processing purposes, third-party data transfers, a description of individual rights, general compliance practices, a mandated statutory disclaimer, and the effective date. Disclosures must be in plain language, available in all covered languages, and accessible to individuals with disabilities. Material changes require prior notification to affected individuals and a 10-year public version log.

Developers of base artificial intelligence models must clearly and conspicuously disclose the following information in the model's terms of service, in a manner appropriate for the medium and easily accessible to users: (1) the name of the model, (2) the developer of the model, (3) the location where the developer is incorporated, (4) the release date of the most recent version, (5) the date the model's training data was most recently updated, (6) supported languages, and (7) a link to the model's terms of service. Compliance with this disclosure obligation does not serve as a defense to liability for harm caused to a plaintiff.

Developers must not provide a high-risk AI system to a deployer unless the developer makes available (1) a statement of intended uses and (2) documentation disclosing known limitations, algorithmic discrimination risks, performance evaluation summaries, mitigation measures, and instructions for human oversight of the system's consequential decisions. Trade secrets and proprietary information are exempt from disclosure.

Developers must provide deployers, before offering a high-risk AI system, with documentation covering intended uses, known limitations, foreseeable discrimination risks, data types collected and used for training, data governance measures, bias mitigation steps, system outputs, and how individuals can use or monitor the system for consequential decisions.

Developers must provide deployers with a statement of intended uses and documentation covering (1) the tool's known limitations and foreseeable algorithmic discrimination risks, (2) the types of data used to program or train the tool, and (3) how the tool was evaluated for validity and explainability before sale or licensing.

Large chatbot providers must, before or concurrently with integrating a new foundation model or a substantially modified version of an existing foundation model into a covered chatbot, conspicuously publish on their website summaries of: (1) child safety risk assessments conducted pursuant to their plan; (2) the results of those assessments; (3) the extent of third-party evaluator involvement; and (4) other steps taken to fulfill child safety risk requirements under the plan.

Large frontier developers must, before or concurrently with deploying a new frontier model or a substantially modified version of an existing frontier model, conspicuously publish on their website summaries of: (1) catastrophic risk assessments conducted pursuant to their plan; (2) the results of those assessments; (3) the extent of third-party evaluator involvement; and (4) other steps taken to fulfill catastrophic risk requirements under the plan. Publication as part of a system card or model card satisfies this obligation.

Large developers must, before deploying a frontier model, conspicuously publish a copy of the safety and security protocol with appropriate redactions and transmit a copy of the redacted protocol to the Division of Homeland Security and Emergency Services. The large developer must also grant the Division of Homeland Security and Emergency Services or the Attorney General access to the protocol with redactions only to the extent required by federal law, upon request.

Large frontier developers must include in the transparency report summaries of catastrophic risk assessments, assessment results, the extent of third-party evaluator involvement, and other steps taken to fulfill the frontier AI framework with respect to the frontier model.

Large frontier developers must publish on their website, before deploying a new or substantially modified frontier model, summaries of catastrophic risk assessments, assessment results, the extent of third-party evaluator involvement, and other steps taken to fulfill the public safety plan.

Deployers and developers must publish a clear, readily accessible public policy summarizing the types of automated decision tools they use or make available and how they manage the foreseeable risks of algorithmic discrimination arising from those tools.

Deployers and developers must publish a clear, publicly accessible AI policy summarizing the types of automated decision tools they use or offer and how they manage reasonably foreseeable risks of algorithmic discrimination.

Developers must publish on their website or in a public use case inventory a clear and readily available statement summarizing their high-risk AI systems, including intended uses and known risks.

Deployers must publish on their website a clear and readily available statement summarizing their deployment of high-risk AI systems, including the types of systems deployed and their purposes.

Developers must publish on their website or in a public use-case inventory a statement summarizing the types of high-risk AI systems they make available and their intended uses.

Deployers must publish on their website a clear summary of the high-risk AI systems they deploy, including intended uses and risk information.

Social media platforms must prominently and clearly provide on their website or mobile application: (1) terms of service, policies, and community standards; (2) user privacy policies; (3) the purpose of each algorithmic recommendation system in use; (4) inputs used by each algorithmic recommendation system, including how each input is measured, uses minor personal data, influences recommendations, and is weighed relative to other inputs; and (5) for every feature using minor user personal data, descriptions of the feature's purpose, the personal data collected and used, how the data is used, any transfers to processors or third parties (with identity and purpose), and how long the data is retained.

Developers must publish and maintain on their website or in a public use case inventory a statement summarizing the types of high-risk AI systems they offer and how they manage known or reasonably foreseeable risks of algorithmic discrimination.

Deployers must publish and maintain on their website a clear and readily available statement summarizing the types of high-risk AI systems they deploy and how they manage associated risks.

Developers must publish a clear and readily available statement on their website or in a public use case inventory summarizing specified information about their high-risk AI systems, effective June 30, 2026.

Deployers must publish a clear and readily available statement on their website summarizing specified information about their high-risk AI systems, effective June 30, 2026.

Developers must publish and maintain on their website or in a public use-case inventory a statement summarizing the types of high-risk AI systems they offer and how they manage algorithmic discrimination risks, updated within 90 days of any intentional and substantial modification.

Integrators must publish and maintain on their website or in a public use-case inventory a statement summarizing the types of high-risk AI systems they have integrated and how they manage algorithmic discrimination risks, updated within 90 days of any intentional and substantial modification.

Deployers must publish and periodically update on their website a statement summarizing the types of high-risk AI systems they deploy, how they manage algorithmic discrimination risks, and the nature, source, and extent of data collected and used.

Deployers must publicly publish and maintain a clear, readily accessible policy summarizing (1) the types of automated decision tools currently in use or made available to others and (2) how the deployer manages the reasonably foreseeable risks of algorithmic discrimination from those tools.

Developers must publicly post a clear, readily accessible policy summarizing (1) the types of automated decision tools they currently make available to others and (2) how they manage foreseeable algorithmic discrimination risks arising from use of those tools.

Deployers must make publicly available, in a readily accessible manner, a clear policy summarizing: (1) the types of automated decision tools currently in use or made available to others by the deployer; and (2) how the deployer manages the reasonably foreseeable risks of algorithmic discrimination arising from those tools.

The executive office of public safety and security must publish annually on its website, by March 31, aggregated data on law enforcement facial recognition searches for the prior calendar year — disaggregated by requesting agency, search basis (warrant vs. emergency), alleged offense, and race and gender of search subjects.

The executive office of public safety and security must publish annually on its website, by March 31, the total number of facial recognition searches performed by or at the request of non-law-enforcement public agencies, disaggregated by agency, including the race and gender of search subjects.

Health care providers that use AI to determine or influence health care decisions must annually post on their website, by July 1, documentation detailing key data about AI-driven decisions from the preceding year — including human review thresholds, overturn rates, misdiagnosis rates, miscalculated dosage rates, instances of care plans disregarding preexisting conditions or contraindicated medications or patient care preferences, and any additional data the Department requires. This data must be archived and remain publicly available.

Carriers that use AI to determine or influence health care decisions must annually post on their website, by July 1 beginning in 2026, documentation detailing key data about AI-driven decisions from the preceding year — including human review thresholds, overturn rates, denial rates, criteria used for approvals or denials, and any additional data required by the Commissioner. This data must be archived and remain publicly available.

The Department must publish the AI policies and procedures on its website within 45 days of adoption.

Developers must publish on their website or in a public use-case inventory a summary of each high-risk AI system offered for sale and the measures taken to manage algorithmic discrimination risks, and must update the publication within 90 days of any material system change.

Deployers must publish and periodically update a clear, prominently displayed statement on their website summarizing deployed high-risk AI systems, discrimination risk management practices, and the nature, source, and extent of personal information collected or used.

Consumer reporting agencies must maintain a public registry of all algorithms used, including each algorithm's purpose, data sources, and general methodology.

Operators must publish a privacy policy accessible on the platform's website that discloses how user data will be used, stated in a succinct and easy-to-understand statement of less than 250 words.

Developers must publish and maintain a public use case inventory that is clear and readily available, summarizing: (1) the types of high-risk AI systems developed and currently made available; (2) the types of high-risk AI systems intentionally and substantially modified and currently made available; and (3) how the developer manages known risks of algorithmic discrimination from those systems. The inventory must be updated as necessary for accuracy and no later than 90 days after any intentional and substantial modification.

Deployers must publish and maintain a clear and readily available public statement disclosing: (1) the types of high-risk AI systems currently deployed; (2) how the deployer manages known risks of algorithmic discrimination from those systems; and (3) a description of the nature, source, and extent of information collected and used by the deployer. The statement must be updated at least annually.

Covered businesses must prominently and clearly disclose on their website or mobile application their privacy policies, terms of service, and community standards; the purpose of each algorithmic recommendation system; the inputs used by each such system and how each input is measured, uses minors' data, influences recommendations, and is weighted; and for every feature using minors' personal data, the purpose, data collected and used, how data is used, any third-party transfers, and data retention periods.

Developers must post on their website a public-use case inventory summarizing the types of high-risk AI systems they offer, how they manage algorithmic discrimination risks, and must update it within 90 days of any intentional and substantial modification.

Deployers must publish on their website and make readily available to consumers (1) a summary of deployed high-risk AI systems and how algorithmic discrimination risks are managed, and (2) a detailed explanation of the information collected and used. The disclosure must be updated at least annually and upon deployment of a new high-risk AI system.

Designers, developers, and deployers must, whenever possible, provide New York residents with access to reporting that confirms respect for their data decisions and assesses the potential impact of surveillance technologies on their rights, opportunities, or access.

Designers, developers, and deployers must, whenever possible, make public summary reporting that includes plain-language information about automated systems and assessments of the clarity and quality of notice and explanations provided.

Persons developing or deploying automated systems must, whenever possible, make publicly available summary reporting describing human governance processes and assessing their timeliness, accessibility, outcomes, and effectiveness.

Licensees must conspicuously post their license in their office and, if they have a public internet presence, on their website or mobile application.

Deployers and developers must make publicly available, in a readily accessible manner, a plain-language policy summarizing (1) the type of automated employment decision tools currently in use or offered to others, and (2) how the entity manages foreseeable discrimination risks arising from those tools.

Developers must publicly publish a readily accessible policy summarizing the types of automated decision tools they make available and how they manage algorithmic discrimination risks for those tools.

Deployers and developers must publicly publish a clear, readily accessible policy summarizing the types of automated decision tools they use or make available and how they manage the foreseeable risks of algorithmic discrimination from those tools.

Online platforms must disclose to users in conspicuous, accessible, and plain language — in each language the platform serves — a complete description of the platform's content moderation practices, including both automated and human-labor moderation.

Online platforms must disclose to users a complete, conspicuous, accessible, and plain-language description of their content moderation practices, including automated and human-labor-based methods, in every language the platform serves.

The Director of the Administrative Office of the United States Courts must release to the public, post online, and transmit to Congress each June a full report on the use of facial recognition in conjunction with reference photo databases.

The OMB Director must provide guidance and a template for agency AI governance plans, requiring publication on a centralized public agency webpage using a uniform URL format (agencyname.gov/AI).

Each agency must publish its AI governance charters on the agency's public webpage and on the Federal AI System Inventory before the associated federal AI system is used, subject to narrow waivers for classified national security information or Director-approved exemptions.

Covered platforms with 10M+ monthly U.S. active users that predominantly host user-generated content must publish at least annually a public transparency report, based on an independent third-party audit, covering (1) minor-user metrics, (2) foreseeable risks of harm to minors, (3) descriptions of engagement-driving design features and personal data collection, (4) safeguard efficacy evaluations, (5) harm-content prevalence data, and (6) prevention and mitigation measures taken and planned.

Online platforms must disclose to users a complete description of their content moderation practices — including automated and human moderation methods — in conspicuous, accessible, plain, non-misleading language in every language the platform supports.

Developers and deployers must publish a comprehensive public disclosure covering their identity and contact information, links to evaluation and assessment summaries, categories of personal data collected or processed and processing purposes, third-party data transfers, a description of individual rights, general compliance practices, a mandated statutory disclaimer, and the effective date. Disclosures must be in plain language, available in all covered languages, and accessible to individuals with disabilities. Material changes require prior notification to affected individuals and a 10-year public version log.

The Secretary of Defense must make the unclassified portion of each annual AI submission publicly available.

Large frontier developers must publish on their website, before deploying a new or substantially modified foundation model as part of a covered chatbot, summaries of child safety risk assessments, assessment results, the extent of third-party evaluator involvement, and other steps taken to fulfill the child protection plan.

Suppliers must publish on their website, not less than quarterly, clear and conspicuous disclosures covering: (1) safety protocols and their efficacy, (2) detection protocols and their efficacy, (3) findings of independent assessments, (4) user engagement estimates with methodology, and (5) the number and type of user-reported safety-critical situations. Disclosures may not include personal data of any Utah user.

The Department of Criminal Justice Services must establish and publish a model policy for the use of generative AI and machine learning systems to serve as a guideline for criminal justice agencies statewide.

Developers must post a clear and conspicuous statement on their public-facing website summarizing the types of high-risk AI systems they have developed or substantially modified that are currently deployed, and how the developer manages foreseeable algorithmic discrimination risks for each.

Deployers must post a clear and conspicuous statement on their public-facing website summarizing the types of high-risk AI systems currently deployed and how the deployer manages foreseeable algorithmic discrimination risks for each.

Developers must publicly publish a clear, readily accessible policy summarizing the types of automated decision tools they make available and how they manage foreseeable algorithmic discrimination risks from those tools.

Covered businesses must prominently and clearly publish on their website or mobile application (1) terms of service, privacy policies, and community standards; (2) the purpose, inputs, measurement methodology, minor-data usage, recommendation influence, and relative weighting for each algorithmic recommendation system; and (3) for each service feature using covered minors' personal data, the feature's purpose, data collected and used, how data is used, third-party data sharing details, and retention periods.

Covered businesses must prominently publish on their website or mobile application: (1) terms of service, privacy policies, and community standards; (2) the purpose and detailed input-level information for each algorithmic recommendation system, including how each input uses minors' personal data and influences recommendations; and (3) for each feature using minors' personal data, the feature's purpose, data collected, data used, how data is used, third-party sharing details, and retention periods.