Deployers must, within 30 days after a covered ADMT materially influences a consequential decision resulting in an adverse outcome, provide the affected consumer with: (1) a plain-language description of the consequential decision and the role the covered ADMT played; (2) instructions and a simple-to-follow process to request additional information about the covered ADMT and inputs, including the ADMT name, version number (if applicable), developer, and the types, categories, and sources of personal data used (to the extent the deployer received the necessary information from the developer); and (3) an explanation of consumer rights under § 6-1-1705 and how to exercise them. Trade secrets and information protected by federal law need not be disclosed, but the deployer must notify the consumer if information is withheld. Creditors complying with ECOA and FCRA notice requirements satisfy this obligation for the same decision if the federal notice also meets the requirements of this section. FERPA-subject deployers may use existing FERPA processes.

HIPAA-covered entities that use a covered ADMT to determine a patient's eligibility for financial assistance (including discounted care) must provide patients with: (1) a plain-language description of the consequential decision and the role of the covered ADMT; (2) the types of information relied upon in the eligibility determination (except trade secrets and legally protected information); (3) information on how to request correction of materially inaccurate personal data consistent with HIPAA and § 25.5-3-502; and (4) information on how to request meaningful human review or reconsideration, where applicable. Compliance may be through advance general disclosure or a notice within 30 calendar days after an adverse outcome. Additionally, all HIPAA-covered entities must provide patients with a general notice of use of advanced technologies, including covered ADMT, which may be incorporated with existing patient-rights notices.

Deployers must, before making a consequential decision, (1) notify the consumer that a high-risk AI system will be used, (2) disclose the system's purpose, the nature of the decision, deployer contact information, a plain-language system description, and instructions for accessing the deployer's public transparency statement, and (3) inform the consumer of applicable opt-out rights under Colorado's privacy law. Notices must be delivered directly, in plain language, in all languages the deployer uses in ordinary business, and in a format accessible to consumers with disabilities.

Deployers must, following an adverse consequential decision, provide the consumer with (1) a statement disclosing the principal reasons for the decision, including the degree of AI contribution, data types used, and data sources, (2) an opportunity to correct incorrect personal data, and (3) an opportunity to appeal with human review where technically feasible.

Deployers must, before making a consequential decision about a consumer using a high-risk AI system, provide the consumer with: (1) notice that a high-risk AI system has been deployed to make or substantially factor in the decision; (2) a statement disclosing the system's purpose, the nature of the consequential decision, deployer contact information, a plain-language description of the system, and instructions for accessing the deployer's public transparency statement; and (3) information about the consumer's right to opt out of profiling for decisions with legal or similarly significant effects under C.R.S. § 6-1-1306(1)(a)(I)(C) if applicable. All notices and statements must be provided directly to the consumer, in plain language, in all languages the deployer uses in ordinary business communications, and in a format accessible to consumers with disabilities. If direct delivery is not possible, the deployer must make the information available in a manner reasonably calculated to reach the consumer.

Deployers must, when a consequential decision made using a high-risk AI system is adverse to the consumer, provide the consumer with: (1) a statement of the principal reasons for the decision, including the degree and manner of the AI system's contribution, the type of data processed, and the source(s) of that data; (2) an opportunity to correct any incorrect personal data used in making the decision; and (3) an opportunity to appeal the adverse decision, which must allow for human review if technically feasible, unless an appeal would not be in the consumer's best interest (e.g., where delay might endanger the consumer's life or safety).

Deployers must, before making an employment-related decision using automated employment-related decision technology as a substantial factor, provide the affected employee or applicant a written notice disclosing: (1) deployment of the technology, (2) its purpose and nature of the decision, (3) the technology's trade name, (4) categories of personal data analyzed and how they are assessed, (5) data sources, and (6) deployer contact information.

Deployers must transmit consequential decisions to consumers without undue delay. For adverse decisions based on personal data beyond what the consumer directly provided, deployers must (1) disclose the principal reasons for the decision, including the degree of AI contribution, data types processed, and data sources; (2) provide an opportunity to correct inaccuracies in personal data under the VCDPA; and (3) provide an opportunity to appeal, with human review where technically reasonable and practicable, unless delay would risk the consumer's life or safety.

Deployers must, before finalizing a consequential decision made or facilitated by a covered ADS, provide the subject with a plain-language written disclosure identifying that an ADS will be used, the system's name, version, and developer, whether the use is within a developer-approved scope, the personal characteristics assessed, data sources, key disproportionately-affecting parameters, output structure and how outputs inform the decision, whether a human will review the outputs or decision, the subject's opt-out and appeal rights, and contact information for the deployer and any managing or interpreting entity. A medical emergency exception applies.

Deployers must, within five days after finalizing a consequential decision, provide the subject with a plain-language written disclosure containing the personal characteristics used, data sources, key disproportionately-affecting parameters, output structure and how outputs were used, the role of the ADS and whether human judgment was involved, contact information, and the subject's correction and appeal rights. Disclosures must be transmitted directly, provided in English and any regularly used language, made accessible to people with disabilities, and clearly presented. A medical emergency exception applies.

Deployers must notify any natural person when a high-risk automated decision system is used to make a decision about them and disclose: (1) the purpose of the system and the specific decision it was used to make; (2) how the system was used to make the decision; (3) the type of data used; (4) contact information for the deployer; and (5) a link to the deployer's public website statement about its high-risk automated decision systems.

Employers must provide workers with a written postuse notice at the time the worker is informed of any ADS-assisted disciplinary, termination, or deactivation decision. The notice must be a separate, stand-alone, plain-language communication in the worker's routine language, delivered via email, hyperlink, or other simple method. The notice must state: (1) that the employer used an ADS to assist in the decision; (2) that a human reviewer conducted an independent investigation and compiled corroborating evidence; (3) contact information for a human the worker may reach for more information about the decision and the worker's data-access rights; and (4) that the employer is prohibited from retaliating against the worker for exercising rights under the bill.

When a worker exercises a data-access request, employers must provide a written, plain-language document accessible away from the workplace containing: (1) the specific decision for which the ADS was used; (2) the specific worker input data the ADS used and the specific output it produced; (3) any additional corroborating or supporting information used beyond the ADS output; (4) the name of the vendor or entity that created the ADS and the product name of the ADS; and (5) a copy of any completed impact assessments regarding the ADS.

Business entities that use information obtained through a biometric surveillance system to deny a consumer access to the business's premises or to remove a consumer from the premises must provide the consumer with a detailed explanation of the business entity's actions and the criteria used in making the determination.

Deployers must, for adverse consequential decisions, provide the consumer with (1) a statement disclosing principal reasons for the decision including the AI system's contribution, data types processed, and data sources; (2) an opportunity to correct incorrect personal data used in the decision; and (3) an opportunity to appeal the decision with human review where technically feasible.

Healthcare insurers must provide an explanation, understandable at all literacy levels, of the rationale used by any AI-based algorithm or system when recommending denial, delay, or modification of healthcare services under a health benefit plan.

Employers must provide written notice to affected workers and their exclusive bargaining representatives before using any workplace AI tool for employment-related decisions or workplace surveillance, including (1) at least 90 days before first deploying a new tool, (2) by February 1, 2027 for tools already in use, and (3) upon hire for new workers. The notice must be a standalone, plain-language communication containing the tool's purpose and justification, affected employment decisions, worker data collected and its storage, a description of the tool's inputs, analysis, and outputs, data access and transfer practices, surveillance scope, tool vendor and model name, quotas and adverse-action consequences, job displacement impacts, manager/worker training, and results of any CCPA risk assessments.

Employers must, before deploying a high-risk AI system to make or substantially factor into a consequential employee decision, (1) notify the employee that a high-risk AI system will be used, (2) disclose the system's purpose and the nature of the decision, (3) identify what employee data will be collected, (4) share the most recent impact assessment results, (5) inform the employee of the right to opt out and request an alternative decision-making process, (6) explain how to request reevaluation of any consequential decision, and (7) provide a plain-language description of the system. All disclosures must be delivered directly to the employee, in plain language, in the employer's business languages, and in accessible formats.

Employers must, when a consequential decision made by or substantially based on a high-risk AI system is adverse to an employee, (1) disclose the principal reasons for the decision including the AI system's degree of contribution, the data types processed, and data sources, (2) allow the employee to examine and correct the personal data processed, and (3) provide an opportunity to appeal inaccurate-data-based decisions with human review.

Deployers must, when an automated employment-related decision process makes or substantially factors into an adverse employment-related decision, provide the affected applicant or employee with: (1) a high-level statement disclosing the principal reasons for the adverse decision, including the degree and manner of the process's contribution, the type of data processed, and the source of that data; (2) an opportunity to examine and correct the data used and to appeal the decision with human review if it was based on incorrect data; and (3) upon request, a copy of the most recent bias audit. The high-level statement must be provided directly to the individual, in plain language, in all languages the deployer ordinarily uses in the state, and in a format accessible to individuals with disabilities.

Deployers must transmit to the consumer within one business day after an automated consequential decision a notice including: (1) a specific explanation of the principal factors and variables that led to the decision, including the degree and manner of AI contribution, the data sources processed, and a plain-language explanation of how the consumer's personal data informed those factors; (2) information about the consumer's right to correct data and how to submit corrections and supplementary information; (3) what actions the consumer might have taken to secure a different decision and may take in the future; (4) information on opportunities to correct incorrect personal data processed in the decision; and (5) information on opportunities to appeal an adverse decision, which appeal must allow for human review if technically feasible.

Deployers must, within 30 days after using an algorithmic decision system to make or influence a covered decision, provide the affected individual with a plain-language disclosure listing (1) the types, categories, and sources of personal characteristics analyzed, predicted, input, inferred, or collected, (2) the top 20 personal characteristics that most substantially influenced the output, and (3) information on how to exercise access and correction rights.

Health carriers must include in each denial notice the specific reasons for the denial, referencing the enrollee-provider contract, the specialty of the reviewing provider, the applicable medical or clinical policy sections, and the specific reasoning of the reviewing provider.

Health care providers must, before using an AI system to make or substantially factor into a consequential decision, provide the patient or authorized representative with a written notice that: (1) informs them that AI will be used to make or substantially factor into the consequential decision; (2) discloses the purpose of the AI system and the nature of the consequential decision; (3) describes the AI system in plain language; and (4) allows the patient to opt out of processing of individually identifiable health information or other personal data for purposes of profiling in furtherance of decisions that have legal or similarly significant effects. The notice must be provided directly to the patient or authorized representative, or if that is not possible, in a manner reasonably calculated to ensure receipt.

Health care providers that used an AI system to make or substantially factor into a consequential decision must provide the patient or authorized representative with: (1) a written statement describing the consequential decision and its principal reasons, including the degree and manner of the AI system's contribution, the types of data the AI processed, and the sources of that data; (2) an opportunity to correct any incorrect health information or personal data the AI system processed in making the decision; and (3) an opportunity to appeal the consequential decision, including human review of all information relating to the decision to the extent technically feasible. The appeal right does not apply when providing an opportunity for appeal is not in the patient's best interest, including when any delay might pose a risk to the patient's life or safety.

Deployers must provide consumers, in plain language and at or before the time of an adverse action, (1) notice that a high-risk AI system was used in the consequential decision, (2) a description of the type of information used and the primary factors contributing to the decision, and (3) information on how to request correction, submit additional information, seek reconsideration, and obtain human review. Trade secrets need not be disclosed, but a meaningful explanation must be provided.

Employers must provide written advance notice to each employee (or authorized representative) who will foreseeably be directly affected by an automated decision system used for employment-related decisions other than hiring. The notice must be provided: (1) at least 30 days before an automated decision system is first deployed; (2) no later than January 1, 2027, for systems already in use at the effective date; and (3) within 30 days of hiring a new employee. The notice must contain: (a) the type of employment-related decisions affected; (b) a general description of the categories of employee-input data, data sources, and collection methods; (c) any key parameters known to disproportionately affect the system's output; (d) the vendor or entity that created the system; (e) if applicable, a description of each quota including quantified tasks, potential adverse actions for failure to meet the quota, and whether the quota is subject to change; (f) the employee's right to access and correct data; and (g) a statement that retaliation is prohibited. The notice must be in plain language, stand-alone, in the employee's routine language, and delivered via a simple method such as email, electronic link, or other written format.

Employers that primarily relied on an automated decision system to make a discipline, termination, or deactivation decision must provide the affected employee with a written notice at the time the employer informs the employee of the decision. The notice must contain: (a) a contact person for more information; (b) a statement that the employer used an automated decision system to assist in the decision; (c) a statement that the employee has the right to request a copy of the data used by the system; and (d) a statement that retaliation for exercising chapter rights is prohibited. The notice must be in plain language, stand-alone, in the employee's routine language, and delivered via a simple method.

Health care entities must ensure registered professional nurses have access to the data inputs and key factors that produced any AI recommendation used in direct patient care.

Health care entities must ensure registered professional nurses have access to the data inputs and key factors that produced any AI recommendation used in direct patient care.

Employers must, within seven days after making an employment-related decision using automated decision system output, provide the covered individual with full, accessible, and meaningful documentation in plain language and at no cost, including: (i) a description of the automated decision system used; (ii) a plain-language description and explanation of the input data and a machine-readable copy of that data; (iii) a description and explanation of how the output was used in making the decision; and (iv) the reasoning for using the output in the decision.

Employers that use or intend to use automated decision system output in employment-related decisions must disclose to each covered individual: (1) the fact of use or intended use; (2) a description of the system, including input data types and collection circumstances, characteristics measured, job-relevance of those characteristics, measurement methodology, and plain-language interpretation guidance; (3) the identity of the entity operating the system; (4) how the output is or will be used in the decision; and (5) how the individual may dispute or appeal the decision. Existing employees hired on or before July 1, 2026 must receive disclosures by August 1, 2026. Candidates and future hires must receive disclosures before hiring. Employers must provide updated disclosures within 30 days of any significant change or new information.

Employers must provide written notice to each worker (or authorized representative) who will foreseeably be directly affected by an ADS used for employment-related decisions (excluding hiring). Notice must be provided at least 30 days before first ADS deployment, at the time the Part takes effect if the ADS is already in use, or within 30 days of a new worker's hiring date. The notice must be a separate, standalone, plain-language communication in the worker's routine language, delivered via an accessible method. The notice must include: (1) the types of employment-related decisions affected, (2) categories, sources, and collection methods for worker input data, (3) any key parameters known to disproportionately affect ADS output, (4) the individuals, vendors, or entities that created the ADS, (5) if applicable, each quota set or measured by the ADS with quantified metrics, potential adverse actions for failure to meet quotas, and whether quotas are subject to change, (6) the worker's right to access and correct data used by the ADS, (7) that retaliation is prohibited, and (8) the worker's right to appeal any ADS-assisted decision and the appeal process.

Employers that primarily rely on an ADS to make a discipline, termination, or deactivation decision must provide the affected worker with written notice at the time the decision is made. The notice must be a separate, standalone, plain-language communication in the worker's routine language, and must include: (1) the human individual to contact for more information and to request a copy of the worker's data relied on in the decision, (2) that the employer used an ADS in the decision, (3) that the worker has a right to request a copy of the data used by the ADS, (4) that retaliation is prohibited, and (5) the worker's right to appeal the decision under R.S. 23:975.

Covered insurers must, within 21 days of a consumer's request, provide a written, consumer-specific explanation of any adverse action involving an ADS, including the top contributing factors ranked by relative contribution, data sources used, the right to correct data, and the right to file a complaint. Trade-secret protection does not relieve this obligation.

Health insurance issuers must allow covered persons, upon request, to review and obtain copies of all documents relevant to any AI or automated decision system used in the utilization review or determination process.

Law enforcement agencies and district attorneys must (1) notify all individuals charged with a crime who were identified using a facial recognition search that they were subject to such a search and (2) make readily available to defendants and their attorneys all records pertaining to facial recognition searches performed during the investigation, including match results, algorithm details, accuracy rates, audit testing, operator identities, training records, and the selection methodology.

Law enforcement agencies and district attorneys must (1) notify all individuals charged with a crime that a facial recognition search was used in their identification, and (2) make readily available to defendants and their attorneys all records pertaining to facial recognition searches conducted during the investigation — including search results, alternative matches, the algorithm used, system accuracy rates, audit testing records, officer identity and training, and the match-selection process.

Employers must disclose to affected employees no less than 30 days before a monitoring-based employment decision goes into effect: (1) that the decision was based on electronically-monitored data, (2) the specific monitoring tools used and how they work, (3) the specific data and judgments used, and (4) any non-monitoring information used in the decision.

Employers must notify employees and candidates at least ten business days before using an automated employment decision tool, disclosing: (1) that the tool will be used, (2) the qualifications and data attributes assessed and outputs produced, (3) data sources and retention policy, (4) the most recent impact assessment results, (5) how to request an alternative non-automated selection process, and (6) how to request reevaluation and the right to file a civil complaint. Notice must be in plain language, included in job postings, posted on the employer's website in all employee-facing languages, provided directly to candidates, and accessible to individuals with disabilities.

Deployers must (1) notify consumers when an AI system materially influences a consequential decision, (2) provide consumers with the purpose of the system and an explanation of how the system influenced the decision, and (3) provide a process to appeal or correct adverse decisions.

Deployers must, before a consequential decision is made, notify the consumer that a high-risk AI system has been deployed to make or be a substantial factor in making the decision. Deployers must also provide a statement disclosing: (1) the purpose of the system and the nature of the consequential decision; (2) the deployer's contact information; (3) a plain-language description of the system; and (4) instructions on how to access the deployer's public website summary. If applicable, deployers must inform the consumer of the right to opt out of personal data processing for profiling in furtherance of decisions with legal or similarly significant effects. Notices must be provided directly to the consumer, in plain language, in all languages in which the deployer ordinarily communicates with consumers, and in a format accessible to consumers with disabilities. If direct delivery is not possible, the deployer must make the information available in a manner reasonably calculated to reach the consumer.

Deployers must, when a consequential decision is adverse to the consumer, provide: (1) a statement disclosing the principal reasons for the decision, including the degree and manner of the AI system's contribution, the type of data processed, and the sources of that data; (2) an opportunity to correct any incorrect personal data the system processed in making the decision; and (3) an opportunity to appeal the adverse decision, which must allow for human review if technically feasible, unless the appeal would not be in the consumer's best interest (e.g., where delay poses a risk to the consumer's life or safety).

Law enforcement agencies and district attorneys must (1) notify all individuals charged with a crime that they were identified using a facial recognition search and (2) make readily available to defendants and their attorneys all records pertaining to facial recognition searches conducted during the investigation, including search results, alternative matches, the algorithm and accuracy rate, audit testing, searcher identity, training records, and the match-selection process.

When an employer makes a hiring, promotion, termination, disciplinary, or compensation decision based in whole or part on electronic monitoring data, the employer must disclose to affected employees no less than thirty days before the decision takes effect: (1) that the decision was based in whole or part on electronic monitoring data; (2) the specific monitoring tools used, how they gather and analyze data, and the time increments of data collection; (3) the specific data and judgments used in the decision-making process; and (4) any non-monitoring information used in the decision.

Employers must notify employees and candidates at least ten business days before using an automated employment decision tool to assess or evaluate them. The notice must include: (1) that an automated tool will be used; (2) the qualifications and characteristics the tool assesses, the data or attributes used, and the types of outputs produced; (3) what data is collected, its source, and the data retention policy; (4) results of the most recent impact assessment including any disparate impact findings and employer response; (5) how to request an alternative selection process or accommodation not involving the automated tool; and (6) how to request reevaluation of the tool's decision and the right to file a civil complaint. The notice must be written in plain language, included in job postings, posted on the employer's website in all employee-communication languages, provided directly to each candidate in their language, accessible to persons with disabilities, and otherwise presented to ensure clear and effective communication.

Consumer reporting agencies must be able to provide a plain-language explanation of each algorithmic evaluation, meeting at minimum an 8.0 on the Flesch–Kincaid readability scale.

Employers must provide a written pre-use notice to every worker (or their authorized representative) and any representing union before deploying an automated decision system for employment-related decisions. The notice must be provided: (1) at least 30 days before introducing a new ADS; (2) no later than September 1, 2026 for existing ADS; (3) prominently to job applicants or new workers before collecting personal information for ADS processing; (4) at least 30 days before any significant change; and (5) to unions on a timeline allowing meaningful bargaining. The notice must be a standalone plain-language communication in the worker's routine language and must include: the nature, purpose, and scope of the ADS; the specific data categories and sources; the system logic and key parameters; the identity of the ADS creator and operators; the job qualifications assessed and evaluation outputs; results of any impact assessments; a list of all ADS the employer currently uses; and a description of worker rights. A copy of every notice must be submitted to the commissioner of labor and industry within ten days.

Employers must provide a post-decision written notice to every worker affected by an ADS-informed employment decision. The notice must be provided: (1) at the time the worker is informed of the decision, or no later than 15 business days after the decision, whichever is earlier; or (2) for discipline or termination, at least 30 days before it takes effect. The notice must acknowledge that an ADS was used, describe worker rights, include a form or link to appeal or request detailed information, and state that retaliation is prohibited. For repeated same-use ADS within a quarter, a full notice is required for the first use each quarter and a summary notice at quarter-end covering the number and dates of uses and worker rights.

Employers must respond to a worker's access request within 14 calendar days and provide: (1) a plain-language explanation of the specific decision; (2) the specific worker data used by the ADS and all worker-specific outputs; (3) how the ADS output was used, including the rationale, the roles of ADS output and human involvement, corroborating information, the ADS logic and assumptions as applied to the worker, the key parameters and how they applied, and the range of possible outputs with aggregate statistics for comparison; (4) the name of the ADS creator and the product name; and (5) a copy of any completed impact assessments. Service providers, contractors, and vendors must provide full assistance to the employer in fulfilling access requests, including providing worker input/output data and relevant ADS information in their possession.

Employers must provide affected workers with written post-decision notice when monitoring data was used in an employment-related decision — at the time of the decision or within 15 business days, or at least 30 days before discipline or termination takes effect. The notice must acknowledge monitoring-data use, describe worker rights, provide an appeal form link, and state the anti-retaliation prohibition.

Employers must respond to worker access requests within 14 calendar days with a plain-language explanation of the decision, identification of the specific monitoring tool and its data-collection methodology, a machine-readable copy of the worker's monitored data, any additional decision inputs (including automated decision system inferences and aggregate benchmark data), and the names of monitoring vendors. Vendors must provide full assistance to employers in fulfilling access requests.

Employers must provide workers with written post-decision notice when monitoring data was used in an employment-related decision — within 15 business days of the decision, or at least 30 days before discipline or termination takes effect. The notice must acknowledge use of monitoring data, describe worker rights, include an appeal form, and state the anti-retaliation prohibition.

Employers must, within 14 calendar days of a worker's access request, provide a plain-language explanation of the decision, identification of the monitoring tool and how it operates, a machine-readable copy of the worker's data, any additional information used in the decision (including automated inferences and benchmark data), and the names of monitoring vendors. Vendors must fully assist in responding.

Employers must provide affected workers, their authorized representatives, and any representing union with a written, plain-language pre-use notice at least 30 days before introducing or significantly modifying an automated decision system, disclosing the system's purpose, data categories, logic, key parameters, creator and operator identity, job qualifications assessed, impact assessment results, a current list of all automated decision systems in use, and a description of worker rights.

Employers must provide each affected worker with a written post-decision notice — at the time of the decision or within 15 business days (30 days before discipline takes effect) — acknowledging use of an automated decision system, describing worker rights, providing an appeal form, and stating the anti-retaliation protection. For repeat use of the same system, a full notice for the first quarterly use plus a quarterly summary is required.

Employers must, within 14 calendar days of a worker's access request, provide the specific data used, all outputs produced, the rationale for the decision (including the roles of the system output and human involvement), the system logic as applied to the worker, key parameters, the range of possible outputs with aggregate statistics, the system creator's name, and any completed impact assessments. Vendors must provide full assistance to the employer in responding.

Employers must not discipline or terminate an employee for failure to meet a performance standard without first providing written notice that includes a plain-language explanation of reasons, the effective date, and all records relied upon to substantiate the action.

Employers must notify each covered individual within 30 days of use that an automated employment decision tool was used, disclose the job qualifications or characteristics assessed, the data sources, the employer's data retention policy, the tool name and vendor, and — if the outcome was adverse — provide a written statement of specific reasons and sufficient disclosures to enable the individual to contest the employment decision.

Employers must, before requesting a video interview analyzed by AI, (1) notify the applicant that AI may be used to analyze the video and assess fitness, (2) explain how the AI works and what characteristics it evaluates, and (3) obtain written consent (which may be electronic) before proceeding with AI evaluation.

Employers and public entities must provide at least 10 days' advance written notice before any adverse AI-assisted employment or public-benefit decision takes effect, explaining the reasons, providing access to all data, and informing the individual of appeal rights. Upon request within 30 days, the employer must (1) allow the individual to review and copy all data and receive a complete explanation of how the AEDS or ABSDS produced its outputs including factor weighting, (2) allow the individual to appeal on grounds of data inaccuracy, bias, or legal violations, and (3) designate a qualified human reviewer with authority and discretion to modify or overturn the decision. For applicants, notice must be provided no later than the time of the decision.

Employers must, before requesting an AI-analyzed video interview, (1) notify the applicant that AI may be used to analyze the video and assess fitness, (2) explain how the AI works and what characteristics it evaluates, and (3) obtain written consent to be evaluated by AI. Employers may not use AI to evaluate an applicant who has not consented.

Business entities that use biometric surveillance information to deny a consumer access to premises or to remove a consumer from premises must provide the consumer with a detailed explanation of the entity's actions and the criteria used in making the determination.

Employers and public entities must give at least 10 days' advance written notice of an adverse decision made using an EMT, AEDS, or ABSDS (or notice at decision time for application rejections), explaining the reasons, providing access to all relevant data and a full explanation of how the system was used, and stating access, contest, and relief rights.

Deployers must, after an adverse consequential decision, provide the consumer with (1) a statement explaining the principal reasons for the decision and the specific data about the consumer that most influenced it, (2) the degree of AI contribution and level of human oversight, (3) the source and type of data processed, and (4) an opportunity to correct any incorrect personal data used.

Food delivery platforms must provide delivery workers, upon request, with a written explanation of any suspension, deactivation, or significant limitation of access to work imposed through an algorithmic management system.

Employers must provide each worker (or authorized representative) foreseeably affected by an ADS with a written, plain-language, standalone pre-use notice at least 30 days before first deploying the ADS (or by January 1, 2027 for systems already in use), and within 30 days of hiring a new worker. The notice must describe: (1) the types of employment-related decisions affected, (2) categories and sources of worker input data, (3) parameters disproportionately affecting output, (4) ADS vendor contact information, (5) applicable quotas and adverse consequences, (6) data access and correction rights, and (7) the employer's anti-retaliation obligation.

Employers that primarily relied on ADS output for a discipline, termination, or deactivation decision must provide the affected worker with a written, plain-language, standalone notice at the time the decision is communicated. The notice must identify a human contact, state that an ADS was used, disclose the worker's right to request a copy of their data, and state the employer's anti-retaliation obligation.

Employers and employment agencies that use an automated employment decision tool to screen job applicants must notify each candidate of: (1) that an automated employment decision tool will be used in connection with the assessment or evaluation of the candidate; (2) the job qualifications and characteristics the tool will use in assessing the candidate; and (3) the type of data collected for the tool, the source of that data, and the employer's or employment agency's data retention policy.

Landlords must notify an applicant of the reason for denial if the applicant's housing application is denied through use of the automated housing decision making tool.

New York residents must have the right to understand how and why an outcome impacting them was determined by an automated system, even when the system is not the sole determinant of the outcome. Automated systems must provide explanations that are technically valid, meaningful to the individual, and proportionate to the level of risk based on context.

Employers must notify employees and candidates, before or at the time of an employment decision, that an AEDT is being used, what qualifications and data it assesses, what outputs it produces, the data sources and retention policy, and (for 100+ employee employers) the most recent impact assessment results. Notice must be in clear and plain language, included in every relevant job posting, and posted on the employer's website in English and the ten most commonly spoken non-English languages in the state.

Landlords must notify each housing applicant at least 24 hours before using an automated decision tool that (1) the tool will be used, (2) the characteristics the tool will evaluate, (3) the type and source of data collected and the landlord's retention policy, and (4) the reason for any denial. The notice must allow the applicant to request an alternative selection process or accommodation.

Banks must notify each loan applicant at least 24 hours before using an automated decision tool that (1) the tool will be used, (2) the characteristics it will evaluate, (3) the type and source of data collected and the bank's retention policy, and (4) the reason for any denial. The notice must allow the applicant to opt out of or consent to the use and retention of their personal information.

Before deploying a high-risk AI decision system to make or substantially factor into a consequential decision concerning a consumer, the deployer must: (1) notify the consumer that the system is being used; (2) provide a statement disclosing the system's purpose and the nature of the consequential decision; (3) provide deployer contact information; (4) provide a plain-language description of the system; and (5) provide instructions for accessing the deployer's public website statement on deployed systems. All notices must be provided directly to the consumer, in plain language, in all languages the deployer ordinarily uses for consumer communications, and in a format accessible to consumers with disabilities.

When a high-risk AI decision system has been used to make or substantially factor into an adverse consequential decision concerning a consumer, the deployer must provide the consumer: (1) a statement disclosing the principal reasons for the adverse decision, including the degree and manner in which the AI system contributed, the type of data processed, and the source of that data; (2) an opportunity to correct any incorrect personal data the system processed; and (3) an opportunity to appeal the adverse decision, which must include human review if technically feasible, unless human review would not be in the consumer's best interest (e.g., where delay poses a risk to life or safety).

When a deployer withholds information from a consumer under the trade secret or legal protection exemption, the deployer must send notice to the consumer disclosing: (1) that information is being withheld; and (2) the basis for the decision to withhold.

Covered entities must notify each loan applicant at least 24 hours before using an automated lending decision-making tool that (1) an automated tool will be used in their assessment, (2) the criteria the tool will apply, (3) the types and sources of data collected and the entity's data retention policy, and (4) within 24 hours after any denial, to the extent practicable, the reason for the denial.

Employers must notify applicants that an automated system will be used in the hiring process, describe in plain language the type of data the system analyzes, and describe the role of the human reviewer in the final employment decision.

Employers must notify employees and candidates before or at the time of an employment decision that an AEDT will be used, including what qualifications and data the tool assesses, what data is collected and its source, the employer's data retention policy, and (for employers with 100+ employees) the most recent impact assessment results. Notices must be in plain language, included in job postings, and posted on the employer's website in English and the ten most commonly spoken non-English languages in the state.

Employers must disclose to affected employees at least 14 days before a monitoring-based employment decision takes effect: that the decision was based on electronically monitored data, the specific monitoring tools used, the specific data and judgments derived from that data, and any non-monitoring information used in the decision.

Employers must notify employees and candidates at least 10 business days before using an AEDT to assess or evaluate them, disclosing: that an AEDT will be used; the qualifications assessed, data inputs, and output types; what data is collected and its source and retention policy; the most recent impact assessment results including any disparate impact findings; how to request an alternative non-AEDT selection process or accommodation; and how to request reevaluation and the right to file a civil complaint. Notice must be in plain language, included in job postings, posted on the employer's website in all languages regularly used with employees, provided directly to each candidate in their language, and available in accessible formats.

Employers must provide written notice at least 14 calendar days before any employment decision based on monitoring data or AEDT output takes effect, disclosing performance standards, the employee's monitored data, aggregated peer data for the prior 90 days, AEDT outputs, the most recent impact assessment, and all non-monitoring information used. Employees may request reevaluation in writing (including text or email) by identifying the disputed data or output and providing supporting evidence. Employers must investigate and respond within seven calendar days, providing evidence of accuracy or correcting the data and reevaluating the decision without the flawed input.

Deployers must, when a high-risk AI decision system makes or substantially factors into an adverse consequential decision concerning a consumer, provide the consumer with: (1) a statement disclosing the principal reasons for the adverse decision, including the degree to which and manner in which the AI system contributed, the type of data processed, and the source of that data; (2) an opportunity to correct any incorrect personal data processed in making the decision; and (3) an opportunity to appeal the adverse decision, which must allow for human review if technically feasible, unless providing such opportunity would not be in the consumer's best interest (e.g., delay posing life or safety risk).

Deployers must notify each individual subject to a consequential employment decision, at or before the time of the decision, that an AEDT is in use, and must provide the tool's purpose, a plain-language description of how it is the controlling factor, and deployer contact information.

Landlords must notify each applicant (1) that an automated housing decision making tool will be used, (2) the characteristics the tool will evaluate, (3) the type and source of data collected and the landlord's data retention policy, and (4) if the application is denied, the reason for denial.

Covered entities must, to the extent practicable, notify a loan applicant of the reason for denial within 24 hours after a loan application is denied through use of an automated lending decision-making tool.

Food delivery platforms must provide delivery workers with a written explanation upon request of any suspension, deactivation, or significant limitation of access to work imposed through an algorithmic management system.

Employers must, within 30 days of making or effectuating a hiring, promotion, termination, disciplinary, or compensation decision based in whole or in part on data gathered through electronic monitoring, disclose to affected employees and their authorized representative: (1) that the decision was based in whole or in part on electronically monitored data, (2) the specific monitoring tools used, how they work to gather and analyze data, and the time increments in which data is gathered, (3) the specific data and judgments based on that data used in the decision-making process, and (4) any information used in the decision-making process gathered from sources other than electronic monitoring.

Deployers must, when a consequential decision is adverse to a consumer, (1) explain the principal reasons including the degree and manner of AI contribution, data types, and data sources, (2) allow the consumer to examine and correct personal data used, and (3) provide an opportunity to appeal based on inaccurate personal data with human review where technically feasible. All notices must be provided directly to the consumer, in plain language, in all languages the deployer ordinarily uses, and in formats accessible to consumers with disabilities.

Deployers must, when a high-risk AI system has made or been a substantial factor in making an adverse consequential decision concerning a consumer, provide the consumer with: (1) a statement disclosing the principal reasons for the decision, including the degree to which and manner in which the AI system contributed, the type of data processed, and the source(s) of that data; (2) an opportunity to correct any incorrect personal data that the AI system processed in making the decision; and (3) an opportunity to appeal the adverse decision, which appeal must, if technically feasible, allow for human review — unless providing the appeal opportunity is not in the consumer's best interest (e.g., where delay might pose a risk to the consumer's life or safety).

Persons using AI in conducting business or providing goods or services to Texas residents must make available to any individual affected by an AI-made decision an explanation of how and why the AI reached that decision.

Covered entities must evaluate and document consumer rights with respect to covered algorithms, including (1) whether consumers receive clear notice that an algorithm will be used, (2) whether consumers have an opt-out mechanism, (3) the transparency and explainability of the algorithm, (4) any mechanisms for consumers to contest, correct, or appeal a decision, and (5) the extent to which third-party decision recipients access algorithm results.

Employers must, within 7 days of making an employment-related decision using ADS output, provide the covered individual with free, plain-language documentation describing the ADS used, the input data (including a machine-readable copy), how the output was used, and the reasoning for relying on it.

Employers must disclose to covered individuals, before making an employment-related decision (or within 30 days for existing employees pre-enactment, or before accepting an application for post-enactment candidates): that ADS output is or will be used; the system's description, data types collected, characteristics measured, how they relate to job functions, and how to interpret outputs; the ADS operator's identity; how the output will be used; and the dispute/appeal process. Updated disclosures must be provided within 30 days of material changes.

Landlords must, upon request, provide tenants or prospective tenants with a plain-language summary of the general factors considered by the algorithmic pricing device in determining rent. Landlords need not disclose proprietary formulas, source code, weighting of inputs, or other trade secrets.

Landlords must provide tenants and prospective tenants with a plain-language summary of the general factors considered by the algorithmic pricing device in determining rent. Proprietary formulas, source code, weighting of inputs, and trade secrets need not be disclosed.

Employers must provide employees with written notice in plain, clear, and concise language before using an automated decision system to make an employment-related decision. The notice must include at minimum: (1) a plain language explanation of the ADS's nature, purpose, and scope, including specific employment decisions potentially affected; (2) the logic and key parameters affecting output; (3) the specific categories and sources of employee input data, including any data from electronic monitoring; (4) performance metrics the employer will use with the ADS; (5) the types of outputs the ADS will produce; (6) the developer(s) of the ADS; (7) the operator(s), monitor(s), and interpreter(s) of ADS results; (8) how to access the most recent impact assessment; (9) a description of the employee's rights to access and correct data under subsection (j); and (10) a statement that employees are protected from retaliation.

Deployers must provide the consumer with a single post-decision notice containing a plain-language explanation of the consequential decision that identifies the principal reasons for the decision, including: (1) the identity of the developer if different from the deployer; (2) a description of the system's output (score, recommendation, etc.); (3) the degree and manner to which the automated decision system contributed to the decision; (4) the types and sources of data processed; (5) a plain-language explanation of how the consumer's personal data informed the decision; and (6) what actions the consumer might have taken or might take in the future to secure a different decision.

Employers must include in the written notice (1) a statement that the employer uses electronic monitoring, (2) a general list of the types of monitoring technology used for the primary purpose of monitoring job performance, and (3) a statement whether the employer has a verification process that includes meaningful human review to confirm monitoring data.

Deployers must transmit consequential decisions to consumers without undue delay. When a consequential decision is adverse to the consumer and based on personal information beyond what the consumer directly provided, the deployer must provide a statement disclosing the principal reasons for the decision, including: (1) the degree to which and manner in which the high-risk AI system contributed to the decision; (2) the type of data processed by the system in making the decision; and (3) the sources of such data.

Deployers must transmit to the consumer any consequential decision made by a high-risk AI system without undue delay. If the decision is adverse to the consumer and based on personal data beyond what the consumer provided directly, the deployer must provide a statement disclosing the principal reason or reasons for the decision, including: (1) the degree to which and manner in which the AI system contributed to the decision; (2) the type of data processed in making the decision; and (3) the sources of such data.

Deployers must, following an adverse consequential decision, provide the consumer with (1) a statement disclosing the principal reasons for the decision, including the degree of AI contribution, data types used, and data sources, (2) an opportunity to correct incorrect personal data, and (3) an opportunity to appeal with human review where technically feasible.

Deployers must, when a consequential decision made using a high-risk AI system is adverse to the consumer, provide the consumer with: (1) a statement of the principal reasons for the decision, including the degree and manner of the AI system's contribution, the type of data processed, and the source(s) of that data; (2) an opportunity to correct any incorrect personal data used in making the decision; and (3) an opportunity to appeal the adverse decision, which must allow for human review if technically feasible, unless an appeal would not be in the consumer's best interest (e.g., where delay might endanger the consumer's life or safety).

Controllers using automated profiling that produces a decision denying a consumer an employment opportunity must, on consumer request: (1) inform the consumer whether any of the personal data processed for the profiling was submitted by a third party; (2) allow the consumer to correct any incorrect third-party-submitted personal data used in the profiling; and (3) re-evaluate the profiling decision based on the corrected personal data.

Deployers must transmit consequential decisions to consumers without undue delay. For adverse decisions based on personal data beyond what the consumer directly provided, deployers must (1) disclose the principal reasons for the decision, including the degree of AI contribution, data types processed, and data sources; (2) provide an opportunity to correct inaccuracies in personal data under the VCDPA; and (3) provide an opportunity to appeal, with human review where technically reasonable and practicable, unless delay would risk the consumer's life or safety.

Deployers must, within five days after finalizing a consequential decision, provide the subject with a plain-language written disclosure containing the personal characteristics used, data sources, key disproportionately-affecting parameters, output structure and how outputs were used, the role of the ADS and whether human judgment was involved, contact information, and the subject's correction and appeal rights. Disclosures must be transmitted directly, provided in English and any regularly used language, made accessible to people with disabilities, and clearly presented. A medical emergency exception applies.

When a worker exercises a data-access request, employers must provide a written, plain-language document accessible away from the workplace containing: (1) the specific decision for which the ADS was used; (2) the specific worker input data the ADS used and the specific output it produced; (3) any additional corroborating or supporting information used beyond the ADS output; (4) the name of the vendor or entity that created the ADS and the product name of the ADS; and (5) a copy of any completed impact assessments regarding the ADS.

Deployers must, for adverse consequential decisions, provide the consumer with (1) a statement disclosing principal reasons for the decision including the AI system's contribution, data types processed, and data sources; (2) an opportunity to correct incorrect personal data used in the decision; and (3) an opportunity to appeal the decision with human review where technically feasible.

Employers must, when a consequential decision made by or substantially based on a high-risk AI system is adverse to an employee, (1) disclose the principal reasons for the decision including the AI system's degree of contribution, the data types processed, and data sources, (2) allow the employee to examine and correct the personal data processed, and (3) provide an opportunity to appeal inaccurate-data-based decisions with human review.

Deployers must, when an automated employment-related decision process makes or substantially factors into an adverse employment-related decision, provide the affected applicant or employee with: (1) a high-level statement disclosing the principal reasons for the adverse decision, including the degree and manner of the process's contribution, the type of data processed, and the source of that data; (2) an opportunity to examine and correct the data used and to appeal the decision with human review if it was based on incorrect data; and (3) upon request, a copy of the most recent bias audit. The high-level statement must be provided directly to the individual, in plain language, in all languages the deployer ordinarily uses in the state, and in a format accessible to individuals with disabilities.

Deployers must transmit to the consumer within one business day after an automated consequential decision a notice including: (1) a specific explanation of the principal factors and variables that led to the decision, including the degree and manner of AI contribution, the data sources processed, and a plain-language explanation of how the consumer's personal data informed those factors; (2) information about the consumer's right to correct data and how to submit corrections and supplementary information; (3) what actions the consumer might have taken to secure a different decision and may take in the future; (4) information on opportunities to correct incorrect personal data processed in the decision; and (5) information on opportunities to appeal an adverse decision, which appeal must allow for human review if technically feasible.

Deployers must, within 30 days after using an algorithmic decision system to make or influence a covered decision, provide the affected individual with a plain-language disclosure listing (1) the types, categories, and sources of personal characteristics analyzed, predicted, input, inferred, or collected, (2) the top 20 personal characteristics that most substantially influenced the output, and (3) information on how to exercise access and correction rights.

Health care providers that used an AI system to make or substantially factor into a consequential decision must provide the patient or authorized representative with: (1) a written statement describing the consequential decision and its principal reasons, including the degree and manner of the AI system's contribution, the types of data the AI processed, and the sources of that data; (2) an opportunity to correct any incorrect health information or personal data the AI system processed in making the decision; and (3) an opportunity to appeal the consequential decision, including human review of all information relating to the decision to the extent technically feasible. The appeal right does not apply when providing an opportunity for appeal is not in the patient's best interest, including when any delay might pose a risk to the patient's life or safety.

Deployers must implement a reasonable process by which consumers may (1) request correction of inaccurate personal information used in a consequential decision, (2) submit additional information for reconsideration, and (3) obtain human review of an adverse action by a reviewer with authority to overturn the decision and subject-matter-relevant training. Narrow exceptions apply when human review would conflict with law or compromise security, but the deployer must document the basis and offer an alternative dispute channel.

Deployers must, upon consumer request and to the extent reasonably necessary for dispute resolution, provide the consumer with access to relevant records including a copy or summary of the information used by the high-risk AI system and the output relied upon as a substantial factor. Trade secrets and proprietary source code need not be disclosed.

Health care entities must ensure registered professional nurses have access to the data inputs and key factors that produced any AI recommendation used in direct patient care.

Health care entities must ensure registered professional nurses have access to the data inputs and key factors that produced any AI recommendation used in direct patient care.

Employers must, within seven days after making an employment-related decision using automated decision system output, provide the covered individual with full, accessible, and meaningful documentation in plain language and at no cost, including: (i) a description of the automated decision system used; (ii) a plain-language description and explanation of the input data and a machine-readable copy of that data; (iii) a description and explanation of how the output was used in making the decision; and (iv) the reasoning for using the output in the decision.

Covered insurers must, within 21 days of a consumer's request, provide a written, consumer-specific explanation of any adverse action involving an ADS, including the top contributing factors ranked by relative contribution, data sources used, the right to correct data, and the right to file a complaint. Trade-secret protection does not relieve this obligation.

Health insurance issuers must allow covered persons, upon request, to review and obtain copies of all documents relevant to any AI or automated decision system used in the utilization review or determination process.

Employers must disclose to affected employees no less than 30 days before a monitoring-based employment decision goes into effect: (1) that the decision was based on electronically-monitored data, (2) the specific monitoring tools used and how they work, (3) the specific data and judgments used, and (4) any non-monitoring information used in the decision.

Employers must notify employees and candidates at least ten business days before using an automated employment decision tool, disclosing: (1) that the tool will be used, (2) the qualifications and data attributes assessed and outputs produced, (3) data sources and retention policy, (4) the most recent impact assessment results, (5) how to request an alternative non-automated selection process, and (6) how to request reevaluation and the right to file a civil complaint. Notice must be in plain language, included in job postings, posted on the employer's website in all employee-facing languages, provided directly to candidates, and accessible to individuals with disabilities.

Deployers must, when a consequential decision is adverse to the consumer, provide: (1) a statement disclosing the principal reasons for the decision, including the degree and manner of the AI system's contribution, the type of data processed, and the sources of that data; (2) an opportunity to correct any incorrect personal data the system processed in making the decision; and (3) an opportunity to appeal the adverse decision, which must allow for human review if technically feasible, unless the appeal would not be in the consumer's best interest (e.g., where delay poses a risk to the consumer's life or safety).

When an employer makes a hiring, promotion, termination, disciplinary, or compensation decision based in whole or part on electronic monitoring data, the employer must disclose to affected employees no less than thirty days before the decision takes effect: (1) that the decision was based in whole or part on electronic monitoring data; (2) the specific monitoring tools used, how they gather and analyze data, and the time increments of data collection; (3) the specific data and judgments used in the decision-making process; and (4) any non-monitoring information used in the decision.

Employers must notify employees and candidates at least ten business days before using an automated employment decision tool to assess or evaluate them. The notice must include: (1) that an automated tool will be used; (2) the qualifications and characteristics the tool assesses, the data or attributes used, and the types of outputs produced; (3) what data is collected, its source, and the data retention policy; (4) results of the most recent impact assessment including any disparate impact findings and employer response; (5) how to request an alternative selection process or accommodation not involving the automated tool; and (6) how to request reevaluation of the tool's decision and the right to file a civil complaint. The notice must be written in plain language, included in job postings, posted on the employer's website in all employee-communication languages, provided directly to each candidate in their language, accessible to persons with disabilities, and otherwise presented to ensure clear and effective communication.

Employers must respond to a worker's access request within 14 calendar days and provide: (1) a plain-language explanation of the specific decision; (2) the specific worker data used by the ADS and all worker-specific outputs; (3) how the ADS output was used, including the rationale, the roles of ADS output and human involvement, corroborating information, the ADS logic and assumptions as applied to the worker, the key parameters and how they applied, and the range of possible outputs with aggregate statistics for comparison; (4) the name of the ADS creator and the product name; and (5) a copy of any completed impact assessments. Service providers, contractors, and vendors must provide full assistance to the employer in fulfilling access requests, including providing worker input/output data and relevant ADS information in their possession.

Employers must respond to worker access requests within 14 calendar days with a plain-language explanation of the decision, identification of the specific monitoring tool and its data-collection methodology, a machine-readable copy of the worker's monitored data, any additional decision inputs (including automated decision system inferences and aggregate benchmark data), and the names of monitoring vendors. Vendors must provide full assistance to employers in fulfilling access requests.

Employers must, within 14 calendar days of a worker's access request, provide a plain-language explanation of the decision, identification of the monitoring tool and how it operates, a machine-readable copy of the worker's data, any additional information used in the decision (including automated inferences and benchmark data), and the names of monitoring vendors. Vendors must fully assist in responding.

Employers must, within 14 calendar days of a worker's access request, provide the specific data used, all outputs produced, the rationale for the decision (including the roles of the system output and human involvement), the system logic as applied to the worker, key parameters, the range of possible outputs with aggregate statistics, the system creator's name, and any completed impact assessments. Vendors must provide full assistance to the employer in responding.

Employers must notify each covered individual within 30 days of use that an automated employment decision tool was used, disclose the job qualifications or characteristics assessed, the data sources, the employer's data retention policy, the tool name and vendor, and — if the outcome was adverse — provide a written statement of specific reasons and sufficient disclosures to enable the individual to contest the employment decision.

Employers and public entities must provide at least 10 days' advance written notice before any adverse AI-assisted employment or public-benefit decision takes effect, explaining the reasons, providing access to all data, and informing the individual of appeal rights. Upon request within 30 days, the employer must (1) allow the individual to review and copy all data and receive a complete explanation of how the AEDS or ABSDS produced its outputs including factor weighting, (2) allow the individual to appeal on grounds of data inaccuracy, bias, or legal violations, and (3) designate a qualified human reviewer with authority and discretion to modify or overturn the decision. For applicants, notice must be provided no later than the time of the decision.

Employers and public entities must give at least 10 days' advance written notice of an adverse decision made using an EMT, AEDS, or ABSDS (or notice at decision time for application rejections), explaining the reasons, providing access to all relevant data and a full explanation of how the system was used, and stating access, contest, and relief rights.

On request within 30 days, employers and public entities must let the individual review and copy the decision data, personnel files, impact-assessment and oversight records, and factor-weighting explanation; permit an appeal to correct inaccurate or biased data and contest the decision; and designate a qualified, empowered human reviewer with authority to modify or overturn it who issues the final internal determination.

Deployers must, after an adverse consequential decision, provide the consumer with (1) a statement explaining the principal reasons for the decision and the specific data about the consumer that most influenced it, (2) the degree of AI contribution and level of human oversight, (3) the source and type of data processed, and (4) an opportunity to correct any incorrect personal data used.

Landlords must notify each housing applicant, at least 24 hours before the automated housing decision making tool is used, that (1) an automated tool will be used in connection with the assessment or evaluation of the applicant, (2) the characteristics the tool will use in the assessment, and (3) the type of data collected, the source of that data, and the landlord's data retention policy.

Banks must provide loan applicants denied based on incorrect personal information a 30-day period to correct the information and appeal the denial.

When a high-risk AI decision system has been used to make or substantially factor into an adverse consequential decision concerning a consumer, the deployer must provide the consumer: (1) a statement disclosing the principal reasons for the adverse decision, including the degree and manner in which the AI system contributed, the type of data processed, and the source of that data; (2) an opportunity to correct any incorrect personal data the system processed; and (3) an opportunity to appeal the adverse decision, which must include human review if technically feasible, unless human review would not be in the consumer's best interest (e.g., where delay poses a risk to life or safety).

Employers must notify employees and candidates at least 10 business days before using an AEDT to assess or evaluate them, disclosing: that an AEDT will be used; the qualifications assessed, data inputs, and output types; what data is collected and its source and retention policy; the most recent impact assessment results including any disparate impact findings; how to request an alternative non-AEDT selection process or accommodation; and how to request reevaluation and the right to file a civil complaint. Notice must be in plain language, included in job postings, posted on the employer's website in all languages regularly used with employees, provided directly to each candidate in their language, and available in accessible formats.

Employers must provide written notice at least 14 calendar days before any employment decision based on monitoring data or AEDT output takes effect, disclosing performance standards, the employee's monitored data, aggregated peer data for the prior 90 days, AEDT outputs, the most recent impact assessment, and all non-monitoring information used. Employees may request reevaluation in writing (including text or email) by identifying the disputed data or output and providing supporting evidence. Employers must investigate and respond within seven calendar days, providing evidence of accuracy or correcting the data and reevaluating the decision without the flawed input.

Deployers must, when a high-risk AI decision system makes or substantially factors into an adverse consequential decision concerning a consumer, provide the consumer with: (1) a statement disclosing the principal reasons for the adverse decision, including the degree to which and manner in which the AI system contributed, the type of data processed, and the source of that data; (2) an opportunity to correct any incorrect personal data processed in making the decision; and (3) an opportunity to appeal the adverse decision, which must allow for human review if technically feasible, unless providing such opportunity would not be in the consumer's best interest (e.g., delay posing life or safety risk).

Landlords must notify each applicant (1) that an automated housing decision making tool will be used, (2) the characteristics the tool will evaluate, (3) the type and source of data collected and the landlord's data retention policy, and (4) if the application is denied, the reason for denial.

Covered entities must provide loan applicants denied based on incorrect personal information a 30-day window to correct the information and appeal the denial.

Employers must, within 30 days of making or effectuating a hiring, promotion, termination, disciplinary, or compensation decision based in whole or in part on data gathered through electronic monitoring, disclose to affected employees and their authorized representative: (1) that the decision was based in whole or in part on electronically monitored data, (2) the specific monitoring tools used, how they work to gather and analyze data, and the time increments in which data is gathered, (3) the specific data and judgments based on that data used in the decision-making process, and (4) any information used in the decision-making process gathered from sources other than electronic monitoring.

Deployers must, when a consequential decision is adverse to a consumer, (1) explain the principal reasons including the degree and manner of AI contribution, data types, and data sources, (2) allow the consumer to examine and correct personal data used, and (3) provide an opportunity to appeal based on inaccurate personal data with human review where technically feasible. All notices must be provided directly to the consumer, in plain language, in all languages the deployer ordinarily uses, and in formats accessible to consumers with disabilities.

Deployers must, when a high-risk AI system has made or been a substantial factor in making an adverse consequential decision concerning a consumer, provide the consumer with: (1) a statement disclosing the principal reasons for the decision, including the degree to which and manner in which the AI system contributed, the type of data processed, and the source(s) of that data; (2) an opportunity to correct any incorrect personal data that the AI system processed in making the decision; and (3) an opportunity to appeal the adverse decision, which appeal must, if technically feasible, allow for human review — unless providing the appeal opportunity is not in the consumer's best interest (e.g., where delay might pose a risk to the consumer's life or safety).

Employers must, within 7 days of making an employment-related decision using ADS output, provide the covered individual with free, plain-language documentation describing the ADS used, the input data (including a machine-readable copy), how the output was used, and the reasoning for relying on it.

Deployers must provide the consumer with a single post-decision notice containing a plain-language explanation of the consequential decision that identifies the principal reasons for the decision, including: (1) the identity of the developer if different from the deployer; (2) a description of the system's output (score, recommendation, etc.); (3) the degree and manner to which the automated decision system contributed to the decision; (4) the types and sources of data processed; (5) a plain-language explanation of how the consumer's personal data informed the decision; and (6) what actions the consumer might have taken or might take in the future to secure a different decision.

Deployers must transmit consequential decisions to consumers without undue delay. When a consequential decision is adverse to the consumer and based on personal information beyond what the consumer directly provided, the deployer must provide a statement disclosing the principal reasons for the decision, including: (1) the degree to which and manner in which the high-risk AI system contributed to the decision; (2) the type of data processed by the system in making the decision; and (3) the sources of such data.

State agencies or ADS vendors must provide notice to individuals likely to be affected by ADS decisions or outcomes, including information about how to appeal or opt out of those decisions.

Deployers must provide consumers with clear and conspicuous notice, prior to using a covered ADMT to materially influence a consequential decision, that the deployer uses or will use a covered ADMT in a consequential decision affecting the consumer, along with instructions on how to obtain additional information. A deployer satisfies this requirement by maintaining a prominent public notice reasonably accessible at points of consumer interaction, including through a link or posting reasonably proximate to the interaction or transaction.

Deployers must, before making a consequential decision, (1) notify the consumer that a high-risk AI system will be used, (2) disclose the system's purpose, the nature of the decision, deployer contact information, a plain-language system description, and instructions for accessing the deployer's public transparency statement, and (3) inform the consumer of applicable opt-out rights under Colorado's privacy law. Notices must be delivered directly, in plain language, in all languages the deployer uses in ordinary business, and in a format accessible to consumers with disabilities.

Deployers must, before making a consequential decision about a consumer using a high-risk AI system, provide the consumer with: (1) notice that a high-risk AI system has been deployed to make or substantially factor in the decision; (2) a statement disclosing the system's purpose, the nature of the consequential decision, deployer contact information, a plain-language description of the system, and instructions for accessing the deployer's public transparency statement; and (3) information about the consumer's right to opt out of profiling for decisions with legal or similarly significant effects under C.R.S. § 6-1-1306(1)(a)(I)(C) if applicable. All notices and statements must be provided directly to the consumer, in plain language, in all languages the deployer uses in ordinary business communications, and in a format accessible to consumers with disabilities. If direct delivery is not possible, the deployer must make the information available in a manner reasonably calculated to reach the consumer.

Deployers must, before making an employment-related decision using automated employment-related decision technology as a substantial factor, provide the affected employee or applicant a written notice disclosing: (1) deployment of the technology, (2) its purpose and nature of the decision, (3) the technology's trade name, (4) categories of personal data analyzed and how they are assessed, (5) data sources, and (6) deployer contact information.

Deployers must, before finalizing a consequential decision made or facilitated by a covered ADS, provide the subject with a plain-language written disclosure identifying that an ADS will be used, the system's name, version, and developer, whether the use is within a developer-approved scope, the personal characteristics assessed, data sources, key disproportionately-affecting parameters, output structure and how outputs inform the decision, whether a human will review the outputs or decision, the subject's opt-out and appeal rights, and contact information for the deployer and any managing or interpreting entity. A medical emergency exception applies.

Deployers must notify any natural person when a high-risk automated decision system is used to make a decision about them and disclose: (1) the purpose of the system and the specific decision it was used to make; (2) how the system was used to make the decision; (3) the type of data used; (4) contact information for the deployer; and (5) a link to the deployer's public website statement about its high-risk automated decision systems.

Employers must provide workers with a written postuse notice at the time the worker is informed of any ADS-assisted disciplinary, termination, or deactivation decision. The notice must be a separate, stand-alone, plain-language communication in the worker's routine language, delivered via email, hyperlink, or other simple method. The notice must state: (1) that the employer used an ADS to assist in the decision; (2) that a human reviewer conducted an independent investigation and compiled corroborating evidence; (3) contact information for a human the worker may reach for more information about the decision and the worker's data-access rights; and (4) that the employer is prohibited from retaliating against the worker for exercising rights under the bill.

Deployers must inform end users at least five business days before using a high-risk AI system to make a consequential decision, in clear, conspicuous, and consumer-friendly terms available in each language in which the company offers its services. Deployers must allow sufficient time and opportunity for the end user to opt out of the automated decision process and have the decision made by a human representative instead. End users may not be punished for opting out, and the deployer must render a decision within 45 days. When the decision confers a benefit on the end user, the deployer must offer the option to waive the five-day advance notice. An urgent-necessity exception applies when compliance would cause imminent detriment to the end user's welfare, but the right to request human review may never be waived. End users are entitled to no more than one opt-out per consequential decision in a six-month period.

Deployers must notify consumers no later than the time a high-risk AI system is used to make a consequential decision, disclosing the system's purpose, nature, the nature of the consequential decision, deployer contact information, and a plain-language description of the system.

Employers must provide written notice to affected workers and their exclusive bargaining representatives before using any workplace AI tool for employment-related decisions or workplace surveillance, including (1) at least 90 days before first deploying a new tool, (2) by February 1, 2027 for tools already in use, and (3) upon hire for new workers. The notice must be a standalone, plain-language communication containing the tool's purpose and justification, affected employment decisions, worker data collected and its storage, a description of the tool's inputs, analysis, and outputs, data access and transfer practices, surveillance scope, tool vendor and model name, quotas and adverse-action consequences, job displacement impacts, manager/worker training, and results of any CCPA risk assessments.

Employers must require workers to sign confirming they received and understand the workplace AI tool notice, and must not use the tool until affected workers have returned their signed notices.

Employers must give prior written notice in plain language and in the employee's primary language to all affected employees before engaging in electronic monitoring, disclosing the types of monitoring, the intended use of collected information, data storage practices and retention periods, and a statement of employees' rights. Employers must also post a conspicuous workplace notice of monitoring types. An exception applies when the employer has reasonable grounds to believe employees are engaged in misconduct.

Employers must, before deploying a high-risk AI system to make or substantially factor into a consequential employee decision, (1) notify the employee that a high-risk AI system will be used, (2) disclose the system's purpose and the nature of the decision, (3) identify what employee data will be collected, (4) share the most recent impact assessment results, (5) inform the employee of the right to opt out and request an alternative decision-making process, (6) explain how to request reevaluation of any consequential decision, and (7) provide a plain-language description of the system. All disclosures must be delivered directly to the employee, in plain language, in the employer's business languages, and in accessible formats.

Deployers must, before an automated employment-related decision process makes or substantially factors into an employment-related decision, provide written notice to the affected applicant or employee disclosing: (1) that the deployer has deployed the process, (2) the process's purpose and the nature of the decision, (3) opt-out rights under § 42-518, (4) deployer contact information, (5) availability of human review, (6) how to request reevaluation of the decision, (7) a link to the most recent bias audit summary, and (8) how to request additional documentation about the process.

Employers must provide advance written notice to any individual disclosing that an automated employment-related decision process will be used to make, assist in, or be used in the course of making employment decisions affecting that individual. The notice must at minimum disclose the trade name of the process and the types and sources of personal information the process will process or analyze.

Persons using AI or automated decision tools in determinations about the sale, rental, or financing of dwellings, or in brokerage services, must disclose to affected individuals that such tools were used.

Deployers must notify the consumer, no later than the time the automated decision system is deployed to make or assist in making a consequential decision, that an automated decision system is being used. Deployers must also provide the consumer with: (1) a statement disclosing the system's purpose and the nature of the consequential decision; (2) contact information for the deployer; (3) a plain-language description of the system, including the personal characteristics or attributes measured, the method of measurement, relevance to the decision, any human components, how automated components inform the decision, and a direct link to a public website page containing a plain-language logic description, key parameters, outputs, data types and sources, and the most recent impact assessment results; and (4) instructions on how to access the deployer's public website statement required by § 10-16-5.

Deployers must provide all notices and explanations required by this section directly to the consumer, in plain language, in all languages in which the deployer ordinarily communicates with consumers, and in a format accessible to consumers with disabilities. If direct delivery is not possible, the deployer must make the information available in a manner reasonably calculated to ensure the consumer receives it. Deployers must not use an automated decision system to make or assist in making a consequential decision if they cannot satisfy these notice requirements.

Deployers must, before using an algorithmic decision system to make, inform, or influence a decision with a material legal or similarly significant effect in a covered domain, provide the affected individual with a plain-language notice identifying the developer, system trade name and version, the nature and stage of the decision, and deployer contact information.

Health care providers must, before using an AI system to make or substantially factor into a consequential decision, provide the patient or authorized representative with a written notice that: (1) informs them that AI will be used to make or substantially factor into the consequential decision; (2) discloses the purpose of the AI system and the nature of the consequential decision; (3) describes the AI system in plain language; and (4) allows the patient to opt out of processing of individually identifiable health information or other personal data for purposes of profiling in furtherance of decisions that have legal or similarly significant effects. The notice must be provided directly to the patient or authorized representative, or if that is not possible, in a manner reasonably calculated to ensure receipt.

Deployers must provide consumers, in plain language and at or before the time of an adverse action, (1) notice that a high-risk AI system was used in the consequential decision, (2) a description of the type of information used and the primary factors contributing to the decision, and (3) information on how to request correction, submit additional information, seek reconsideration, and obtain human review. Trade secrets need not be disclosed, but a meaningful explanation must be provided.

Employers must provide written advance notice to each employee (or authorized representative) who will foreseeably be directly affected by an automated decision system used for employment-related decisions other than hiring. The notice must be provided: (1) at least 30 days before an automated decision system is first deployed; (2) no later than January 1, 2027, for systems already in use at the effective date; and (3) within 30 days of hiring a new employee. The notice must contain: (a) the type of employment-related decisions affected; (b) a general description of the categories of employee-input data, data sources, and collection methods; (c) any key parameters known to disproportionately affect the system's output; (d) the vendor or entity that created the system; (e) if applicable, a description of each quota including quantified tasks, potential adverse actions for failure to meet the quota, and whether the quota is subject to change; (f) the employee's right to access and correct data; and (g) a statement that retaliation is prohibited. The notice must be in plain language, stand-alone, in the employee's routine language, and delivered via a simple method such as email, electronic link, or other written format.

Employers must notify applicants upon receiving their application that the employer utilizes an automated decision system when making hiring decisions. The notification may be provided using an automatic reply mechanism or on a job posting.

Fully autonomous (L3) AAASPs must, before delivering services, obtain affirmative patient acknowledgment of the prescribed disclosure that the provider is an AI system without routine human clinical oversight and that the patient may seek alternative human care at any time.

Employers must, when using an automated decision-making system for any function covered by Section 10(a): (1) provide notice to each affected employee no later than the time a decision is issued that the decision was made using an automated decision-making system; (2) provide an appeals process for employees directly impacted by decisions made by the system; and (3) offer each affected employee the opportunity for an independent alternative review of the decision by an individual working for or on behalf of the employer, separate from the automated system.

Employers must provide the disclosures required by Section 11 of this chapter before using automated decision system output in any employment-related decision. This is a prerequisite to lawful use of the output.

Employers that use or intend to use automated decision system output in employment-related decisions must disclose to each covered individual: (1) the fact of use or intended use; (2) a description of the system, including input data types and collection circumstances, characteristics measured, job-relevance of those characteristics, measurement methodology, and plain-language interpretation guidance; (3) the identity of the entity operating the system; (4) how the output is or will be used in the decision; and (5) how the individual may dispute or appeal the decision. Existing employees hired on or before July 1, 2026 must receive disclosures by August 1, 2026. Candidates and future hires must receive disclosures before hiring. Employers must provide updated disclosures within 30 days of any significant change or new information.

Employers must provide written notice to each worker (or authorized representative) who will foreseeably be directly affected by an ADS used for employment-related decisions (excluding hiring). Notice must be provided at least 30 days before first ADS deployment, at the time the Part takes effect if the ADS is already in use, or within 30 days of a new worker's hiring date. The notice must be a separate, standalone, plain-language communication in the worker's routine language, delivered via an accessible method. The notice must include: (1) the types of employment-related decisions affected, (2) categories, sources, and collection methods for worker input data, (3) any key parameters known to disproportionately affect ADS output, (4) the individuals, vendors, or entities that created the ADS, (5) if applicable, each quota set or measured by the ADS with quantified metrics, potential adverse actions for failure to meet quotas, and whether quotas are subject to change, (6) the worker's right to access and correct data used by the ADS, (7) that retaliation is prohibited, and (8) the worker's right to appeal any ADS-assisted decision and the appeal process.

Employers who use an ADS to make hiring decisions must notify each job applicant upon receiving the applicant's application that the employer utilizes an ADS for hiring decisions. Notification may be made using an automatic reply mechanism or on the job posting.

Covered insurers must disclose to consumers at the time of application, renewal, or any adverse action whether an ADS was used in the insurance decision, using prescribed or substantially similar clear and conspicuous language that includes notice of the right to request an explanation.

Law enforcement agencies and district attorneys must (1) notify all individuals charged with a crime who were identified using a facial recognition search that they were subject to such a search and (2) make readily available to defendants and their attorneys all records pertaining to facial recognition searches performed during the investigation, including match results, algorithm details, accuracy rates, audit testing, operator identities, training records, and the selection methodology.

Law enforcement agencies and district attorneys must (1) notify all individuals charged with a crime that a facial recognition search was used in their identification, and (2) make readily available to defendants and their attorneys all records pertaining to facial recognition searches conducted during the investigation — including search results, alternative matches, the algorithm used, system accuracy rates, audit testing records, officer identity and training, and the match-selection process.

Employers must disclose to affected employees no less than 30 days before a monitoring-based employment decision goes into effect: (1) that the decision was based on electronically-monitored data, (2) the specific monitoring tools used and how they work, (3) the specific data and judgments used, and (4) any non-monitoring information used in the decision.

Employers must notify employees and candidates at least ten business days before using an automated employment decision tool, disclosing: (1) that the tool will be used, (2) the qualifications and data attributes assessed and outputs produced, (3) data sources and retention policy, (4) the most recent impact assessment results, (5) how to request an alternative non-automated selection process, and (6) how to request reevaluation and the right to file a civil complaint. Notice must be in plain language, included in job postings, posted on the employer's website in all employee-facing languages, provided directly to candidates, and accessible to individuals with disabilities.

Deployers must (1) notify consumers when an AI system materially influences a consequential decision, (2) provide consumers with the purpose of the system and an explanation of how the system influenced the decision, and (3) provide a process to appeal or correct adverse decisions.

Deployers must, before a consequential decision is made, notify the consumer that a high-risk AI system has been deployed to make or be a substantial factor in making the decision. Deployers must also provide a statement disclosing: (1) the purpose of the system and the nature of the consequential decision; (2) the deployer's contact information; (3) a plain-language description of the system; and (4) instructions on how to access the deployer's public website summary. If applicable, deployers must inform the consumer of the right to opt out of personal data processing for profiling in furtherance of decisions with legal or similarly significant effects. Notices must be provided directly to the consumer, in plain language, in all languages in which the deployer ordinarily communicates with consumers, and in a format accessible to consumers with disabilities. If direct delivery is not possible, the deployer must make the information available in a manner reasonably calculated to reach the consumer.

Law enforcement agencies and district attorneys must (1) notify all individuals charged with a crime that they were identified using a facial recognition search and (2) make readily available to defendants and their attorneys all records pertaining to facial recognition searches conducted during the investigation, including search results, alternative matches, the algorithm and accuracy rate, audit testing, searcher identity, training records, and the match-selection process.

When an employer makes a hiring, promotion, termination, disciplinary, or compensation decision based in whole or part on electronic monitoring data, the employer must disclose to affected employees no less than thirty days before the decision takes effect: (1) that the decision was based in whole or part on electronic monitoring data; (2) the specific monitoring tools used, how they gather and analyze data, and the time increments of data collection; (3) the specific data and judgments used in the decision-making process; and (4) any non-monitoring information used in the decision.

Employers must notify employees and candidates at least ten business days before using an automated employment decision tool to assess or evaluate them. The notice must include: (1) that an automated tool will be used; (2) the qualifications and characteristics the tool assesses, the data or attributes used, and the types of outputs produced; (3) what data is collected, its source, and the data retention policy; (4) results of the most recent impact assessment including any disparate impact findings and employer response; (5) how to request an alternative selection process or accommodation not involving the automated tool; and (6) how to request reevaluation of the tool's decision and the right to file a civil complaint. The notice must be written in plain language, included in job postings, posted on the employer's website in all employee-communication languages, provided directly to each candidate in their language, accessible to persons with disabilities, and otherwise presented to ensure clear and effective communication.

Employers using a monitoring or automated decisions tool must display a conspicuous workplace poster giving notice of that use.

Employers must provide a written pre-use notice to every worker (or their authorized representative) and any representing union before deploying an automated decision system for employment-related decisions. The notice must be provided: (1) at least 30 days before introducing a new ADS; (2) no later than September 1, 2026 for existing ADS; (3) prominently to job applicants or new workers before collecting personal information for ADS processing; (4) at least 30 days before any significant change; and (5) to unions on a timeline allowing meaningful bargaining. The notice must be a standalone plain-language communication in the worker's routine language and must include: the nature, purpose, and scope of the ADS; the specific data categories and sources; the system logic and key parameters; the identity of the ADS creator and operators; the job qualifications assessed and evaluation outputs; results of any impact assessments; a list of all ADS the employer currently uses; and a description of worker rights. A copy of every notice must be submitted to the commissioner of labor and industry within ten days.

Employers must provide a post-decision written notice to every worker affected by an ADS-informed employment decision. The notice must be provided: (1) at the time the worker is informed of the decision, or no later than 15 business days after the decision, whichever is earlier; or (2) for discipline or termination, at least 30 days before it takes effect. The notice must acknowledge that an ADS was used, describe worker rights, include a form or link to appeal or request detailed information, and state that retaliation is prohibited. For repeated same-use ADS within a quarter, a full notice is required for the first use each quarter and a summary notice at quarter-end covering the number and dates of uses and worker rights.

Employers must provide detailed written pre-use notice to workers, authorized representatives, and unions at least 30 days before introducing or significantly changing any electronic monitoring tool, and must submit a copy to the Commissioner of Labor and Industry within ten days. The notice must include a description of data collected, the monitoring purpose and necessity justification, storage practices, vendor names, whether data feeds into automated decision systems, and a description of worker rights.

Employers must provide affected workers with written post-decision notice when monitoring data was used in an employment-related decision — at the time of the decision or within 15 business days, or at least 30 days before discipline or termination takes effect. The notice must acknowledge monitoring-data use, describe worker rights, provide an appeal form link, and state the anti-retaliation prohibition.

Employers must provide notice to employees and applicants for employment that the employer is using artificial intelligence in recruitment, hiring, promotion, renewal of employment, selection for training or apprenticeship, discharge, discipline, tenure, or the terms, privileges, or conditions of employment.

Employers must provide workers, their authorized representatives, and any applicable union with a detailed written pre-use notice at least 30 days before deploying or significantly changing an electronic monitoring tool, containing twelve enumerated categories of information including the data collected, the purpose and necessity justification, whether data feeds automated decisions, and worker rights. A copy must be filed with the Commissioner of Labor and Industry within ten days.

Employers must provide workers with written post-decision notice when monitoring data was used in an employment-related decision — within 15 business days of the decision, or at least 30 days before discipline or termination takes effect. The notice must acknowledge use of monitoring data, describe worker rights, include an appeal form, and state the anti-retaliation prohibition.

Employers must provide affected workers, their authorized representatives, and any representing union with a written, plain-language pre-use notice at least 30 days before introducing or significantly modifying an automated decision system, disclosing the system's purpose, data categories, logic, key parameters, creator and operator identity, job qualifications assessed, impact assessment results, a current list of all automated decision systems in use, and a description of worker rights.

Employers must provide each affected worker with a written post-decision notice — at the time of the decision or within 15 business days (30 days before discipline takes effect) — acknowledging use of an automated decision system, describing worker rights, providing an appeal form, and stating the anti-retaliation protection. For repeat use of the same system, a full notice for the first quarterly use plus a quarterly summary is required.

Employers must provide each employee at hiring (and all current employees by October 1, 2026) a written description of every work performance standard to which the employee is subject, including any potential adverse employment action for failure to meet the standard.

Employers must (1) notify employees of any change to a work performance standard as soon as possible and before the new standard takes effect, (2) provide a written description of the new standard within two business days, and (3) deliver all written descriptions in person through a human manager during work hours.

Employers must notify an employee of termination for failure to meet a work performance standard at least fourteen days before the termination becomes effective. At least thirty days must elapse between a first warning and termination, and the employer may not rely on warnings issued more than one year prior.

Employers must notify each covered individual at least 10 business days before use that an automated employment decision tool subject to a bias audit will be used in connection with the individual's application or employment assessment. For candidates, notice must be provided on the employment section of the employer's website, in a job posting, or via mail or email. For current employees, notice must be provided in a written policy, a job posting, or via mail or email.

Employers must, before requesting a video interview analyzed by AI, (1) notify the applicant that AI may be used to analyze the video and assess fitness, (2) explain how the AI works and what characteristics it evaluates, and (3) obtain written consent (which may be electronic) before proceeding with AI evaluation.

Employers and public entities must provide employees and their recognized bargaining representative with written notice as required by section 6, and must respond to concerns raised by the employee representative regarding AEDS, ABSDS, or EMT compliance, before implementing any such system.

Employers and public entities must provide written notice to all affected employees, service beneficiaries, and recognized bargaining representatives at least 60 days before implementing any AEDS, ABSDS, or EMT. Notice must include: the type of system and decisions affected; impact assessment summaries with registry directions; descriptions of data collected and outputs used; employee and beneficiary rights; productivity quotas or performance standards (employees only); and the employer's obligation to respond to union concerns. Notice must also be given at least 60 days before any significant changes. New hires must receive notice within 30 days with written acknowledgment.

Employers and public entities must not take any adverse employment action based in whole or in part on a productivity quota or performance standard that was not previously disclosed to the affected employee.

All notices to employees and service beneficiaries and impact assessment summaries must be written in clear plain language, translated into any language spoken by at least 5% of the workforce, provided in hard copy and electronic form, posted conspicuously in the workplace, and include a statement that retaliation is prohibited.

Employers and employment agencies must notify candidates for employment and employees being considered for promotion at least 10 business days before using an AEDT, including instructions for requesting an alternative selection process or reasonable accommodation. Notice may be provided via the employment website, job posting, written policy, or direct communication.

Employers must, before requesting an AI-analyzed video interview, (1) notify the applicant that AI may be used to analyze the video and assess fitness, (2) explain how the AI works and what characteristics it evaluates, and (3) obtain written consent to be evaluated by AI. Employers may not use AI to evaluate an applicant who has not consented.

Employers and public entities must give affected workers, service beneficiaries, and any bargaining representative at least 60 days' written notice before implementing or materially changing an EMT, AEDS, or ABSDS, disclosing the system, affected decisions, impact-assessment summary and registry access, collected data and outputs, contest rights, and any performance standards or quotas.

Employers and public entities must provide all required notices and impact-assessment summaries in clear plain language, translated for any language spoken by at least five percent of the workforce, in hard copy and electronic form, posted conspicuously, and disclosing the anti-retaliation protection.

Employers and public entities must give at least 10 days' advance written notice of an adverse decision made using an EMT, AEDS, or ABSDS (or notice at decision time for application rejections), explaining the reasons, providing access to all relevant data and a full explanation of how the system was used, and stating access, contest, and relief rights.

Covered entities must provide clear notice to an individual when an automated decision system is used in a housing or credit decision affecting that individual.

Deployers must notify consumers before an AI system is used to make or contribute to a consequential decision, including the developer name, trade name, version number or other identifying information about the AI system, and the deployer's contact information.

Food delivery platforms must provide delivery workers with clear, written, plain-language notice of (1) the factors the algorithmic management system considers in assigning deliveries and evaluating performance, (2) any metrics that may affect work access or compensation, and (3) the circumstances under which a worker may be suspended, deactivated, or penalized.

Employers must provide each worker (or authorized representative) foreseeably affected by an ADS with a written, plain-language, standalone pre-use notice at least 30 days before first deploying the ADS (or by January 1, 2027 for systems already in use), and within 30 days of hiring a new worker. The notice must describe: (1) the types of employment-related decisions affected, (2) categories and sources of worker input data, (3) parameters disproportionately affecting output, (4) ADS vendor contact information, (5) applicable quotas and adverse consequences, (6) data access and correction rights, and (7) the employer's anti-retaliation obligation.

Employers must notify job applicants upon receiving an application that the employer uses an ADS in making hiring decisions for the position being applied to. Notification may be made via automatic reply or job posting.

Employers and employment agencies that use an automated employment decision tool to screen job applicants must notify each candidate of: (1) that an automated employment decision tool will be used in connection with the assessment or evaluation of the candidate; (2) the job qualifications and characteristics the tool will use in assessing the candidate; and (3) the type of data collected for the tool, the source of that data, and the employer's or employment agency's data retention policy.

Employers and employment agencies must provide the required notice at least ten business days before using the automated employment decision tool, and must allow the candidate to request an alternative selection process or accommodation.

Landlords must notify each housing applicant, at least 24 hours before the automated housing decision making tool is used, that (1) an automated tool will be used in connection with the assessment or evaluation of the applicant, (2) the characteristics the tool will use in the assessment, and (3) the type of data collected, the source of that data, and the landlord's data retention policy.

Employers must notify employees and candidates, before or at the time of an employment decision, that an AEDT is being used, what qualifications and data it assesses, what outputs it produces, the data sources and retention policy, and (for 100+ employee employers) the most recent impact assessment results. Notice must be in clear and plain language, included in every relevant job posting, and posted on the employer's website in English and the ten most commonly spoken non-English languages in the state.

Landlords must notify each housing applicant at least 24 hours before using an automated decision tool that (1) the tool will be used, (2) the characteristics the tool will evaluate, (3) the type and source of data collected and the landlord's retention policy, and (4) the reason for any denial. The notice must allow the applicant to request an alternative selection process or accommodation.

Banks must notify each loan applicant at least 24 hours before using an automated decision tool that (1) the tool will be used, (2) the characteristics it will evaluate, (3) the type and source of data collected and the bank's retention policy, and (4) the reason for any denial. The notice must allow the applicant to opt out of or consent to the use and retention of their personal information.

Before deploying a high-risk AI decision system to make or substantially factor into a consequential decision concerning a consumer, the deployer must: (1) notify the consumer that the system is being used; (2) provide a statement disclosing the system's purpose and the nature of the consequential decision; (3) provide deployer contact information; (4) provide a plain-language description of the system; and (5) provide instructions for accessing the deployer's public website statement on deployed systems. All notices must be provided directly to the consumer, in plain language, in all languages the deployer ordinarily uses for consumer communications, and in a format accessible to consumers with disabilities.

Covered entities must notify each loan applicant at least 24 hours before using an automated lending decision-making tool that (1) an automated tool will be used in their assessment, (2) the criteria the tool will apply, (3) the types and sources of data collected and the entity's data retention policy, and (4) within 24 hours after any denial, to the extent practicable, the reason for the denial.

Covered deployers must inform the covered subject (and any covered agent) at the immediate onset of an engagement, in clear consumer-friendly terms and in every service language, that a high-risk AI system will be used to make or assist in a consequential decision; this notice is waived only where urgent benefit decisions would otherwise harm the subject.

Employers must notify applicants that an automated system will be used in the hiring process, describe in plain language the type of data the system analyzes, and describe the role of the human reviewer in the final employment decision.

Deployers must provide a short-form notice (≤500 words) regarding each covered algorithm they develop, offer, license, or use. The notice must be concise, clear, conspicuous, plain-language, not misleading, accessible to individuals with disabilities, contextually appropriate, free, and must include an overview of each applicable individual right and disclosure — drawing attention to practices that may be unexpected or that involve a consequential action. For individuals with whom the deployer has a relationship, the deployer must deliver an electronic version of the short-form notice directly upon the individual's first interaction with the covered algorithm. For individuals without a relationship, the deployer must post the notice on its website.

Employers must notify employees and candidates before or at the time of an employment decision that an AEDT will be used, including what qualifications and data the tool assesses, what data is collected and its source, the employer's data retention policy, and (for employers with 100+ employees) the most recent impact assessment results. Notices must be in plain language, included in job postings, and posted on the employer's website in English and the ten most commonly spoken non-English languages in the state.

Employers must provide prior written notice to all employees and candidates subject to electronic monitoring, covering monitoring purpose, data collected, dates/times/frequency, AEDT integration, productivity standards use, storage/retention, and least-invasiveness justification. Notice must be multilingual, accessibility-compliant, in clear and plain language, provided at hiring and annually, posted conspicuously, and must constitute actual (not conditional) notice. For random or periodic monitoring, employers must inform affected employees of the specific events being monitored at the time monitoring takes place.

Employers must notify employees and candidates at least 10 business days before using an AEDT to assess or evaluate them, disclosing: that an AEDT will be used; the qualifications assessed, data inputs, and output types; what data is collected and its source and retention policy; the most recent impact assessment results including any disparate impact findings; how to request an alternative non-AEDT selection process or accommodation; and how to request reevaluation and the right to file a civil complaint. Notice must be in plain language, included in job postings, posted on the employer's website in all languages regularly used with employees, provided directly to each candidate in their language, and available in accessible formats.

Deployers must, before deploying a high-risk AI decision system to make or substantially factor into a consequential decision about a consumer, notify the consumer that the system has been deployed and provide: (1) a statement disclosing the system's purpose and the nature of the consequential decision; (2) the deployer's contact information; (3) a plain-language description of the system; and (4) instructions for accessing the deployer's public website statement under subdivision 6. All notices and statements must be provided directly to the consumer, in plain language, in all languages used in the deployer's ordinary course of business, and in a format accessible to consumers with disabilities.

Deployers must notify each individual subject to a consequential employment decision, at or before the time of the decision, that an AEDT is in use, and must provide the tool's purpose, a plain-language description of how it is the controlling factor, and deployer contact information.

Landlords must notify each applicant (1) that an automated housing decision making tool will be used, (2) the characteristics the tool will evaluate, (3) the type and source of data collected and the landlord's data retention policy, and (4) if the application is denied, the reason for denial.

Landlords must deliver the required notice at least 24 hours before using the automated housing decision making tool and must allow the applicant to request an alternative selection process or accommodation.

Covered entities must notify each loan applicant at least 24 hours before using an automated lending decision-making tool, disclosing (1) that the tool will be used, (2) the criteria the tool will apply, and (3) the type and source of data collected and the entity's data retention policy.

Employers must provide notice to employees that the employer is using artificial intelligence for recruitment, hiring, promotion, renewal of employment, selection for training or apprenticeship, discharge, discipline, tenure, or the terms, privileges, or conditions of employment. The specific circumstances requiring notice, the time period for providing notice, and the means of notice will be established by Division of Human Rights rulemaking.

Food delivery platforms must provide delivery workers with clear, written, plain-language notice of (1) the factors the algorithmic management system considers in assigning deliveries and evaluating performance, (2) the metrics that may affect the worker's access to work opportunities or compensation, and (3) the circumstances under which a worker may be suspended, deactivated, or penalized.

Business entities must disclose in a clear and conspicuous manner that the consumer has a right to request human review whenever AI is used in a consumer interaction involving a high-impact decision.

Deployers must, before deploying a high-risk AI system to make or substantially factor in a consequential decision about a consumer, (1)notify the consumer of the AI system's use, (2) disclose the system's purpose and the nature of the decision, (3) provide the right to opt out of automated decision-making based on personal data, (4) provide deployer contact information, (5) provide a plain-language system description, and (6) provide instructions to access the deployer's public website statement.

Deployers must, before a high-risk AI system makes or is a substantial factor in making a consequential decision concerning a consumer: (1) notify the consumer that a high-risk AI system will be used; (2) provide a statement disclosing the system's purpose, the nature of the consequential decision, the deployer's contact information, a plain-language description of the system, and instructions on how to access the statement; and (3) inform the consumer of any applicable right to opt out of automated profiling for decisions producing legal or similarly significant effects. All notices must be provided directly to the consumer, in plain language, in all languages used in the deployer's ordinary course of business, and in a format accessible to consumers with disabilities. If direct notice is not feasible, the deployer must make the information available in a manner reasonably calculated to reach the consumer.

Covered entities must evaluate and document consumer rights with respect to covered algorithms, including (1) whether consumers receive clear notice that an algorithm will be used, (2) whether consumers have an opt-out mechanism, (3) the transparency and explainability of the algorithm, (4) any mechanisms for consumers to contest, correct, or appeal a decision, and (5) the extent to which third-party decision recipients access algorithm results.

Employers must disclose to covered individuals, before making an employment-related decision (or within 30 days for existing employees pre-enactment, or before accepting an application for post-enactment candidates): that ADS output is or will be used; the system's description, data types collected, characteristics measured, how they relate to job functions, and how to interpret outputs; the ADS operator's identity; how the output will be used; and the dispute/appeal process. Updated disclosures must be provided within 30 days of material changes.

Covered entities must evaluate the extent to which they provide consumers with (1) clear notice of automated decision system use, (2) a mechanism for opting out, (3) transparency and explainability regarding contributing factors, (4) the ability to contest, correct, or appeal decisions, and (5) documentation of complaints and remediation outcomes. Covered entities must also document the categories of third-party decision recipients receiving decision results.

Landlords who use an algorithmic pricing device to set advertised rent, renewal rent, or rent offered to a prospective tenant must disclose such use in writing to the tenant or prospective tenant before lease execution (or before occupancy for oral rental agreements), including a statement that an algorithmic pricing device was used and the name of the software, platform, or service used.

Employers must provide employees with written notice in plain, clear, and concise language before using an automated decision system to make an employment-related decision. The notice must include at minimum: (1) a plain language explanation of the ADS's nature, purpose, and scope, including specific employment decisions potentially affected; (2) the logic and key parameters affecting output; (3) the specific categories and sources of employee input data, including any data from electronic monitoring; (4) performance metrics the employer will use with the ADS; (5) the types of outputs the ADS will produce; (6) the developer(s) of the ADS; (7) the operator(s), monitor(s), and interpreter(s) of ADS results; (8) how to access the most recent impact assessment; (9) a description of the employee's rights to access and correct data under subsection (j); and (10) a statement that employees are protected from retaliation.

Deployers must inform the consumer prior to the use of an automated decision system for a consequential decision, in clear, conspicuous, and consumer-friendly terms available in each language in which the company offers its end services. The notice must include: (1) a description of the personal characteristics or attributes the system will measure or assess; (2) the method of measurement or assessment; (3) how those attributes are relevant to the consequential decision; (4) any human components of the system; (5) how automated components inform the decision; and (6) a direct link to a publicly accessible page on the deployer's website with plain-language descriptions of the system's outputs, the types and sources of data collected and processed, and the results of the most recent impact assessment.

Employers must notify employees and their exclusive bargaining representatives in writing at least 30 days before implementing electronic monitoring for performance evaluation purposes.

Employers already using electronic monitoring for performance evaluations as of the effective date must provide written notice to affected employees and their exclusive bargaining representatives within 30 days of the effective date.

Employers must provide written notice to new hires at the time the job offer is made stating that the employer uses or intends to use electronic monitoring to assist in performance evaluations.

Employers must include in the written notice (1) a statement that the employer uses electronic monitoring, (2) a general list of the types of monitoring technology used for the primary purpose of monitoring job performance, and (3) a statement whether the employer has a verification process that includes meaningful human review to confirm monitoring data.

Deployers must notify the consumer before any consequential decision is made using a high-risk AI system that the deployer has deployed such a system to make or substantially factor in the decision. The deployer must also provide a statement disclosing: (1) the purpose of the system and the nature of the consequential decisions; (2) the deployer's contact information; and (3) a plain-language description of the system.

Deployers must notify consumers before a consequential decision is made that a high-risk AI system has been deployed to make or substantially factor into the decision. Deployers must also provide a statement disclosing: (1) the purpose of the system and the nature of the consequential decisions it makes; (2) the deployer's contact information; and (3) a plain-language description of the system.

State agencies or ADS vendors must provide notice to individuals likely to be affected by ADS decisions or outcomes, including information about how to appeal or opt out of those decisions.

Deployers must, upon request from a consumer who experienced an adverse outcome from a consequential decision materially influenced by a covered ADMT, provide an opportunity for meaningful human review and reconsideration of the consequential decision, to the extent commercially reasonable. Meaningful human review requires a reviewer designated by the deployer who has authority to approve, modify, or override the decision; considers relevant primary evidence; is trained to conduct the review; does not default to the system output; and has access to sufficient information to understand the output's intended use, material limitations, categories of inputs, and principal factors used to generate the output. FERPA-subject deployers may comply through existing student record amendment and appeal processes.

HIPAA-covered entities that use a covered ADMT to determine a patient's eligibility for financial assistance (including discounted care) must provide patients with: (1) a plain-language description of the consequential decision and the role of the covered ADMT; (2) the types of information relied upon in the eligibility determination (except trade secrets and legally protected information); (3) information on how to request correction of materially inaccurate personal data consistent with HIPAA and § 25.5-3-502; and (4) information on how to request meaningful human review or reconsideration, where applicable. Compliance may be through advance general disclosure or a notice within 30 calendar days after an adverse outcome. Additionally, all HIPAA-covered entities must provide patients with a general notice of use of advanced technologies, including covered ADMT, which may be incorporated with existing patient-rights notices.

Deployers must, following an adverse consequential decision, provide the consumer with (1) a statement disclosing the principal reasons for the decision, including the degree of AI contribution, data types used, and data sources, (2) an opportunity to correct incorrect personal data, and (3) an opportunity to appeal with human review where technically feasible.

Deployers must, when a consequential decision made using a high-risk AI system is adverse to the consumer, provide the consumer with: (1) a statement of the principal reasons for the decision, including the degree and manner of the AI system's contribution, the type of data processed, and the source(s) of that data; (2) an opportunity to correct any incorrect personal data used in making the decision; and (3) an opportunity to appeal the adverse decision, which must allow for human review if technically feasible, unless an appeal would not be in the consumer's best interest (e.g., where delay might endanger the consumer's life or safety).

Deployers must transmit consequential decisions to consumers without undue delay. For adverse decisions based on personal data beyond what the consumer directly provided, deployers must (1) disclose the principal reasons for the decision, including the degree of AI contribution, data types processed, and data sources; (2) provide an opportunity to correct inaccuracies in personal data under the VCDPA; and (3) provide an opportunity to appeal, with human review where technically reasonable and practicable, unless delay would risk the consumer's life or safety.

Health carriers must allow enrollees to bypass the carrier's internal grievance process and proceed directly to independent review by a certified independent review organization for retrospective denials of prior-authorized services under RCW 48.43.525.

Health insurance issuers must provide physicians with a clear and accessible process for appealing downcoded claims, including written or electronic instructions, contact information for the managing physician, a submission window of no less than 180 days, and adjudication timelines consistent with state utilization review law. Physicians must be permitted to appeal in batches of similar claims without restriction.

Deployers must provide subjects with the opportunity within 30 business days after a consequential decision to (1) correct inaccurate personal information used by the ADS, with deployer response within 30 business days, rectification within 30 days if the correction would change the outcome, and explanation if it would not, and (2) appeal the decision outcome, with deployer review within 30 business days, rectification within 30 days if the original decision was incorrect, and explanation of denial basis if the decision is upheld. If a correction request is denied, the deployer must explain the basis and offer deletion of the subject's personal information.

Operators must provide consumers with human customer service support and communications during business hours of 8 a.m. to 6 p.m. daily. During those hours, operators must connect any person interacting with a customer service chatbot or automated customer support system to a customer service agent within five minutes after a request for human customer service is made.

Operators of telephonic customer service platforms must ensure that: (1) after a customer call is answered, the customer is not placed on hold for more than 5 minutes at any point and cumulative hold times for a call do not exceed 10 minutes total; and (2) if a call is answered by a customer service chatbot, the operator provides human assistance within five minutes after the call is made.

Operators of online customer service platforms must provide customers with the option to request customer service assistance from a human being and, upon that request, must provide human assistance within five minutes.

Deployers must provide, as technically feasible, any natural person subject to a decision made by a high-risk automated decision system with an opportunity to appeal that decision for review by a natural person.

Deployers must inform end users at least five business days before using a high-risk AI system to make a consequential decision, in clear, conspicuous, and consumer-friendly terms available in each language in which the company offers its services. Deployers must allow sufficient time and opportunity for the end user to opt out of the automated decision process and have the decision made by a human representative instead. End users may not be punished for opting out, and the deployer must render a decision within 45 days. When the decision confers a benefit on the end user, the deployer must offer the option to waive the five-day advance notice. An urgent-necessity exception applies when compliance would cause imminent detriment to the end user's welfare, but the right to request human review may never be waived. End users are entitled to no more than one opt-out per consequential decision in a six-month period.

Deployers must inform end users within five days after a high-risk AI system has been used to make a consequential decision. Deployers must provide and explain an appeal process that allows the end user to (1) formally contest the decision, (2) provide supporting information, and (3) obtain meaningful human review. The deployer must respond to appeals within 45 days, extendable once by 45 additional days with notice and reasons. End users are entitled to no more than one appeal per consequential decision in a six-month period.

Deployers must, for adverse consequential decisions, provide the consumer with (1) a statement disclosing principal reasons for the decision including the AI system's contribution, data types processed, and data sources; (2) an opportunity to correct incorrect personal data used in the decision; and (3) an opportunity to appeal the decision with human review where technically feasible.

Employers must, when a consequential decision made by or substantially based on a high-risk AI system is adverse to an employee, (1) disclose the principal reasons for the decision including the AI system's degree of contribution, the data types processed, and data sources, (2) allow the employee to examine and correct the personal data processed, and (3) provide an opportunity to appeal inaccurate-data-based decisions with human review.

Deployers must, when an automated employment-related decision process makes or substantially factors into an adverse employment-related decision, provide the affected applicant or employee with: (1) a high-level statement disclosing the principal reasons for the adverse decision, including the degree and manner of the process's contribution, the type of data processed, and the source of that data; (2) an opportunity to examine and correct the data used and to appeal the decision with human review if it was based on incorrect data; and (3) upon request, a copy of the most recent bias audit. The high-level statement must be provided directly to the individual, in plain language, in all languages the deployer ordinarily uses in the state, and in a format accessible to individuals with disabilities.

Deployers must implement human review over every automated employment-related decision process used to make or substantially factor into employment-related decisions. A qualified human reviewer — with authority to make or change decisions and understanding of the process's biases and limitations — must review the AI output and, when appropriate, modify or veto it prior to any adverse decision. Deployers must establish procedures to pause, correct, or reverse erroneous or harmful outputs, and must maintain logs of all human review reports and interventions. No automated employment-related decision process may be used for a final or determinative employment-related decision without human review.

Deployers must transmit to the consumer within one business day after an automated consequential decision a notice including: (1) a specific explanation of the principal factors and variables that led to the decision, including the degree and manner of AI contribution, the data sources processed, and a plain-language explanation of how the consumer's personal data informed those factors; (2) information about the consumer's right to correct data and how to submit corrections and supplementary information; (3) what actions the consumer might have taken to secure a different decision and may take in the future; (4) information on opportunities to correct incorrect personal data processed in the decision; and (5) information on opportunities to appeal an adverse decision, which appeal must allow for human review if technically feasible.

Health carriers must provide enrollees with a universal external review request form and a clear, step-by-step guide explaining the enrollee's rights and procedures to request an internal appeal or external review upon any adverse determination.

Health care providers that used an AI system to make or substantially factor into a consequential decision must provide the patient or authorized representative with: (1) a written statement describing the consequential decision and its principal reasons, including the degree and manner of the AI system's contribution, the types of data the AI processed, and the sources of that data; (2) an opportunity to correct any incorrect health information or personal data the AI system processed in making the decision; and (3) an opportunity to appeal the consequential decision, including human review of all information relating to the decision to the extent technically feasible. The appeal right does not apply when providing an opportunity for appeal is not in the patient's best interest, including when any delay might pose a risk to the patient's life or safety.

Deployers must implement a reasonable process by which consumers may (1) request correction of inaccurate personal information used in a consequential decision, (2) submit additional information for reconsideration, and (3) obtain human review of an adverse action by a reviewer with authority to overturn the decision and subject-matter-relevant training. Narrow exceptions apply when human review would conflict with law or compromise security, but the deployer must document the basis and offer an alternative dispute channel.

Fully autonomous (L3) AAASPs must, before delivering services, obtain affirmative patient acknowledgment of the prescribed disclosure that the provider is an AI system without routine human clinical oversight and that the patient may seek alternative human care at any time.

Employers must, when using an automated decision-making system for any function covered by Section 10(a): (1) provide notice to each affected employee no later than the time a decision is issued that the decision was made using an automated decision-making system; (2) provide an appeals process for employees directly impacted by decisions made by the system; and (3) offer each affected employee the opportunity for an independent alternative review of the decision by an individual working for or on behalf of the employer, separate from the automated system.

Schools must honor a student's or parent's right to: (1) opt out of school-issued personal electronic devices, electronic textbooks, electronic required reading, or electronic or online assignments; (2) request a human teacher review any automated scored grade or scored grade generated by artificial intelligence; and (3) opt out of predictive analytics systems without academic penalty. When any of these rights is exercised, the school must provide the student with a comparable analog version of what the educational technology provides, including physical paper assignments, physical textbook copies, or physical copies of required reading.

Employers must allow covered individuals, after receiving post-decision documentation, to: (i) dispute the automated decision system output in a manner that is accessible, equitable, and does not impose an unreasonable burden, to a human with appropriate and relevant experience; and (ii) appeal the employment-related decision to a human with appropriate and relevant experience who is not the same human who performed the corroboration under clause (E).

Employers that primarily rely on an ADS to make a discipline, termination, or deactivation decision must provide the affected worker with written notice at the time the decision is made. The notice must be a separate, standalone, plain-language communication in the worker's routine language, and must include: (1) the human individual to contact for more information and to request a copy of the worker's data relied on in the decision, (2) that the employer used an ADS in the decision, (3) that the worker has a right to request a copy of the data used by the ADS, (4) that retaliation is prohibited, and (5) the worker's right to appeal the decision under R.S. 23:975.

Employers or vendors that use an ADS to make an employment-related decision must provide the affected worker with a right to appeal that decision, request human review, submit additional information, and correct data errors. The employer or vendor must provide a form or hyperlink to an electronic appeal form within 30 days of the worker's notification. The form must include options to request ADS input/output data, corroborating evidence from the human reviewer, a field for the worker's reason and supporting evidence, and a designation for an authorized representative. The employer or vendor must respond to the appeal within 14 business days by designating a human reviewer who can objectively evaluate all evidence, has sufficient authority, discretion, and resources to evaluate and overturn the decision, and was not involved in the original decision. The response must be a clear written document describing the appeal result and reasons. If the reviewer overturns the decision, the employer or vendor must rectify it within 21 business days.

Covered insurers must, upon consumer request within 30 days of an adverse action, assign a qualified human underwriter or claims professional to independently review the decision, complete the review within 30 days, and provide a written explanation. The reviewer must have full authority to modify or reverse the adverse action based on the consumer's specific facts.

Health insurance issuers must allow any insured to appeal a coverage determination that the insured has learned was made with a recommendation from AI or an automated decision system.

Employers must notify employees and candidates at least ten business days before using an automated employment decision tool, disclosing: (1) that the tool will be used, (2) the qualifications and data attributes assessed and outputs produced, (3) data sources and retention policy, (4) the most recent impact assessment results, (5) how to request an alternative non-automated selection process, and (6) how to request reevaluation and the right to file a civil complaint. Notice must be in plain language, included in job postings, posted on the employer's website in all employee-facing languages, provided directly to candidates, and accessible to individuals with disabilities.

Deployers must, when a consequential decision is adverse to the consumer, provide: (1) a statement disclosing the principal reasons for the decision, including the degree and manner of the AI system's contribution, the type of data processed, and the sources of that data; (2) an opportunity to correct any incorrect personal data the system processed in making the decision; and (3) an opportunity to appeal the adverse decision, which must allow for human review if technically feasible, unless the appeal would not be in the consumer's best interest (e.g., where delay poses a risk to the consumer's life or safety).

Employers must not rely primarily on automated decision tool output when making hiring, promotion, termination, disciplinary, or compensation decisions. To satisfy this requirement: (1) employers must establish meaningful human oversight, considering the tool's complexity, the reviewer's experience and training, preparation time, and feasibility of expert consultation; (2) a human decision-maker must actually review each automated output and exercise independent judgment; (3) the human must consider non-automated information such as supervisory evaluations, personnel files, work products, or peer reviews; and (4) the employer must consider non-automated information in each such decision. Employers must not require employee or candidate consent to automated tool use as a condition of being considered for an employment decision, and must not discipline or disadvantage anyone for requesting accommodation.

Consumer reporting agencies must require all automated evaluations to be subject to human review within 24 hours before a decision is final, and must provide an expedited review process with human review within 48 hours after a consumer submits a review request.

Carriers must ensure that their internal grievance process provides for human review of any adverse decision made using artificial intelligence, an algorithm, or other software tools when a member files a grievance challenging that decision. The human review must include an assessment of whether the AI tool complied with § 15–10B–05.1, which requires individualized clinical data inputs, prohibits sole reliance on group datasets, and imposes non-discrimination and oversight requirements.

Employers must provide each worker affected by an ADS-informed employment decision with a form or link to appeal the decision. The appeal form must include options to request ADS input/output data and human reviewer corroborating evidence, space for the worker's reasons and supporting evidence, and information on designating an authorized representative. Workers must file appeals within 30 days of post-use notification. Employers must respond within five business days by assigning a human reviewer who: objectively evaluates all evidence, has authority and training to evaluate the decision (including ADS limitations and worker rights), has authority to overturn the decision, and was not involved in the original decision. The reviewer must produce a written document explaining the appeal result and reasoning, provided to both the employer and worker. If the decision is overturned, the employer must rectify it within five business days.

Employers must provide workers with a form to appeal any employment-related decision based on electronic monitoring data. The employer must respond within five business days by designating an independent human reviewer — not involved in the original decision, with authority to overturn it — who must produce a written decision with reasoning. If overturned, the employer must rectify the decision within five business days.

Employers must provide workers with a structured appeal form when monitoring data was used in an employment-related decision, respond within five business days by designating an independent, qualified human reviewer with authority to overturn the decision, produce a written decision with reasons, and rectify any overturned decision within five business days.

Employers must provide workers with a form to appeal any employment-related decision made using an automated decision system. Within five business days of receiving an appeal, the employer must designate an independent human reviewer — not involved in the original decision, with authority to overturn it — who must objectively evaluate all evidence, produce a written decision explaining the result and reasons, and if the decision is overturned, the employer must rectify it within five business days.

Employers must, within thirty minutes of an employee's request, assign a human manager authorized to make discipline-related decisions to speak with the employee in person during work hours.

Employers and public entities must provide at least 10 days' advance written notice before any adverse AI-assisted employment or public-benefit decision takes effect, explaining the reasons, providing access to all data, and informing the individual of appeal rights. Upon request within 30 days, the employer must (1) allow the individual to review and copy all data and receive a complete explanation of how the AEDS or ABSDS produced its outputs including factor weighting, (2) allow the individual to appeal on grounds of data inaccuracy, bias, or legal violations, and (3) designate a qualified human reviewer with authority and discretion to modify or overturn the decision. For applicants, notice must be provided no later than the time of the decision.

On request within 30 days, employers and public entities must let the individual review and copy the decision data, personnel files, impact-assessment and oversight records, and factor-weighting explanation; permit an appeal to correct inaccurate or biased data and contest the decision; and designate a qualified, empowered human reviewer with authority to modify or overturn it who issues the final internal determination.

Covered entities must provide individuals adversely affected by an automated decision system with the right to request meaningful human review of the decision.

Deployers must provide consumers an opportunity to appeal any adverse consequential decision, and the appeal must be reviewed by a human being.

Employers that primarily relied on ADS output for a discipline, termination, or deactivation decision must provide the affected worker with a written, plain-language, standalone notice at the time the decision is communicated. The notice must identify a human contact, state that an ADS was used, disclose the worker's right to request a copy of their data, and state the employer's anti-retaliation obligation.

Utilities must, upon a residential customer's request for billing review, (1) suspend all adverse actions including late fees, collections, and service termination, (2) conduct a review including qualified human personnel review and error correction, and (3) provide a written determination to the customer within ten business days.

Landlords must allow housing applicants to request an alternative selection process or accommodation as an alternative to evaluation by the automated housing decision making tool. This right must be communicated in the required notice provided at least 24 hours before use of the tool.

Persons developing and deploying automated systems must provide New York residents with the right to opt out of automated systems in favor of a human alternative, where appropriate. Appropriateness is determined based on reasonable expectations in a given context, with a focus on ensuring broad accessibility and protecting the public from particularly harmful impacts.

Persons developing and deploying automated systems must provide New York residents with access to a timely human consideration and remedy through a fallback and escalation process if an automated system fails, produces an error, or if the resident wishes to appeal or contest the system's impacts. The fallback process must be accessible, equitable, effective, maintained, accompanied by appropriate operator training, and must not impose an unreasonable burden on the public.

Landlords must notify each housing applicant at least 24 hours before using an automated decision tool that (1) the tool will be used, (2) the characteristics the tool will evaluate, (3) the type and source of data collected and the landlord's retention policy, and (4) the reason for any denial. The notice must allow the applicant to request an alternative selection process or accommodation.

When a high-risk AI decision system has been used to make or substantially factor into an adverse consequential decision concerning a consumer, the deployer must provide the consumer: (1) a statement disclosing the principal reasons for the adverse decision, including the degree and manner in which the AI system contributed, the type of data processed, and the source of that data; (2) an opportunity to correct any incorrect personal data the system processed; and (3) an opportunity to appeal the adverse decision, which must include human review if technically feasible, unless human review would not be in the consumer's best interest (e.g., where delay poses a risk to life or safety).

Covered deployers must, within ten days of a consequential decision, notify the subject that a high-risk AI system was used and provide an appeal process allowing the subject to (1) contest the decision, (2) submit supporting information, and (3) obtain meaningful human review, responding within forty-five days (extendable once).

Employers must provide any applicant who receives an adverse employment decision made using an automated system with a human-conducted review of that decision upon the applicant's request.

Deployers must, once Division regulations are promulgated (within two years of the effective date), provide individuals a means to opt out of the use of a covered algorithm for a consequential action and to elect to have the consequential action undertaken by a human without the use of a covered algorithm. The opt-out and human-alternative mechanism must be clear and conspicuous, in plain language, easy to execute, and at no cost to the individual, as specified by Division regulations.

Deployers must, once Division regulations are promulgated (within two years of the effective date), provide individuals a mechanism to appeal to a human any consequential action resulting from the deployer's use of a covered algorithm. The appeal mechanism must be clear and conspicuous, in plain language, easy to execute, at no cost, proportionate to the consequential action, reasonably accessible to individuals with disabilities, timely, usable, effective, and non-discriminatory. Where appropriate, the mechanism must allow individuals to identify and correct personal data used by the algorithm. Human reviewers must meet Division-specified training requirements.

Employers must notify employees and candidates at least 10 business days before using an AEDT to assess or evaluate them, disclosing: that an AEDT will be used; the qualifications assessed, data inputs, and output types; what data is collected and its source and retention policy; the most recent impact assessment results including any disparate impact findings; how to request an alternative non-AEDT selection process or accommodation; and how to request reevaluation and the right to file a civil complaint. Notice must be in plain language, included in job postings, posted on the employer's website in all languages regularly used with employees, provided directly to each candidate in their language, and available in accessible formats.

Employers must not require employees or candidates to consent to AEDT use as a condition of being considered for an employment decision, and must not discipline or disadvantage any employee or candidate who requests an alternative accommodation.

Deployers must, when a high-risk AI decision system makes or substantially factors into an adverse consequential decision concerning a consumer, provide the consumer with: (1) a statement disclosing the principal reasons for the adverse decision, including the degree to which and manner in which the AI system contributed, the type of data processed, and the source of that data; (2) an opportunity to correct any incorrect personal data processed in making the decision; and (3) an opportunity to appeal the adverse decision, which must allow for human review if technically feasible, unless providing such opportunity would not be in the consumer's best interest (e.g., delay posing life or safety risk).

Landlords must deliver the required notice at least 24 hours before using the automated housing decision making tool and must allow the applicant to request an alternative selection process or accommodation.

Business entities must provide the consumer with timely access to a human representative upon request, if a human representative is reasonably available.

Business entities must provide consumers with the right to request that a human representing the business entity review any consumer interaction involving a high-impact decision. The business entity must commence the human review within 14 days of the request and complete the review with a decision delivered to the consumer within 28 days of the request.

Digital platforms must honor requests from a deceased user's estate representative (or designated personally authorized representative) to revoke consent, terminate the AI simulation, and delete AI-generated content created after death, and may not override a valid estate directive.

Board rules must guarantee each person receiving services the option to communicate directly with a human licensee rather than solely through AI, and must define the process for exercising that option.

Deployers must, when a consequential decision is adverse to a consumer, (1) explain the principal reasons including the degree and manner of AI contribution, data types, and data sources, (2) allow the consumer to examine and correct personal data used, and (3) provide an opportunity to appeal based on inaccurate personal data with human review where technically feasible. All notices must be provided directly to the consumer, in plain language, in all languages the deployer ordinarily uses, and in formats accessible to consumers with disabilities.

When a student fails to perform satisfactorily on an assessment scored by machine grading, the agency must, upon written parental request, rescore the constructed-response portion using a traditional human scoring method at no cost to the parent.

Covered entities must evaluate and document consumer rights with respect to covered algorithms, including (1) whether consumers receive clear notice that an algorithm will be used, (2) whether consumers have an opt-out mechanism, (3) the transparency and explainability of the algorithm, (4) any mechanisms for consumers to contest, correct, or appeal a decision, and (5) the extent to which third-party decision recipients access algorithm results.

Deployers must, once FTC regulations are promulgated (within 2 years of enactment), provide individuals a means to opt out of covered algorithm use for a consequential action and elect to have the action undertaken by a human without algorithm involvement.

Employers must enable covered individuals to (1) dispute the ADS output to a human with appropriate and relevant experience via an accessible, equitable, and non-burdensome process, and (2) appeal the employment-related decision to a different human with appropriate and relevant experience than the one who corroborated the ADS output.

Covered entities must evaluate the extent to which they provide consumers with (1) clear notice of automated decision system use, (2) a mechanism for opting out, (3) transparency and explainability regarding contributing factors, (4) the ability to contest, correct, or appeal decisions, and (5) documentation of complaints and remediation outcomes. Covered entities must also document the categories of third-party decision recipients receiving decision results.

Deployers must, pursuant to FTC regulations to be promulgated within two years of enactment, provide individuals a means to opt out of algorithmic consequential actions and elect a human alternative at no cost.

Deployers must, pursuant to FTC regulations to be promulgated within two years of enactment, provide individuals a mechanism to appeal algorithmic consequential actions to a human reviewer. The mechanism must be accessible, proportionate, and include data correction capabilities and trained reviewers.

Landlords must, upon request by a tenant or prospective tenant, provide a human review of any rent determination or renewal increase generated or recommended by an algorithmic pricing device.

Landlords must provide tenants and prospective tenants, upon request, with a human review of any rent determination or renewal increase generated or recommended by an algorithmic pricing device.

Deployers must provide and explain a process for consumers to appeal a consequential decision. The appeal process must allow the consumer to formally contest the decision, provide supporting information, and obtain meaningful human review. The deployer must designate a human reviewer who is trained and qualified, free of conflicts of interest, was not involved in the initial decision, is protected from retaliation for exercising their review functions, and is allocated sufficient resources. The human reviewer must consider the consumer's information and may consider other relevant sources. The deployer must respond within 45 days, extendable once by an additional 45 days with notice and explanation of the delay.

Deployers must, upon request from a consumer who experienced an adverse outcome from a consequential decision materially influenced by a covered ADMT, provide an opportunity for meaningful human review and reconsideration of the consequential decision, to the extent commercially reasonable. Meaningful human review requires a reviewer designated by the deployer who has authority to approve, modify, or override the decision; considers relevant primary evidence; is trained to conduct the review; does not default to the system output; and has access to sufficient information to understand the output's intended use, material limitations, categories of inputs, and principal factors used to generate the output. FERPA-subject deployers may comply through existing student record amendment and appeal processes.

Deployers must, following an adverse consequential decision, provide the consumer with (1) a statement disclosing the principal reasons for the decision, including the degree of AI contribution, data types used, and data sources, (2) an opportunity to correct incorrect personal data, and (3) an opportunity to appeal with human review where technically feasible.

Deployers must, when a consequential decision made using a high-risk AI system is adverse to the consumer, provide the consumer with: (1) a statement of the principal reasons for the decision, including the degree and manner of the AI system's contribution, the type of data processed, and the source(s) of that data; (2) an opportunity to correct any incorrect personal data used in making the decision; and (3) an opportunity to appeal the adverse decision, which must allow for human review if technically feasible, unless an appeal would not be in the consumer's best interest (e.g., where delay might endanger the consumer's life or safety).

Controllers using automated profiling that produces a decision denying a consumer an employment opportunity must, on consumer request: (1) inform the consumer whether any of the personal data processed for the profiling was submitted by a third party; (2) allow the consumer to correct any incorrect third-party-submitted personal data used in the profiling; and (3) re-evaluate the profiling decision based on the corrected personal data.

Deployers must transmit consequential decisions to consumers without undue delay. For adverse decisions based on personal data beyond what the consumer directly provided, deployers must (1) disclose the principal reasons for the decision, including the degree of AI contribution, data types processed, and data sources; (2) provide an opportunity to correct inaccuracies in personal data under the VCDPA; and (3) provide an opportunity to appeal, with human review where technically reasonable and practicable, unless delay would risk the consumer's life or safety.

Health carriers must allow enrollees to bypass the carrier's internal grievance process and proceed directly to independent review by a certified independent review organization for retrospective denials of prior-authorized services under RCW 48.43.525.

Health insurance issuers must provide physicians with a clear and accessible process for appealing downcoded claims, including written or electronic instructions, contact information for the managing physician, a submission window of no less than 180 days, and adjudication timelines consistent with state utilization review law. Physicians must be permitted to appeal in batches of similar claims without restriction.

Deployers must provide subjects with the opportunity within 30 business days after a consequential decision to (1) correct inaccurate personal information used by the ADS, with deployer response within 30 business days, rectification within 30 days if the correction would change the outcome, and explanation if it would not, and (2) appeal the decision outcome, with deployer review within 30 business days, rectification within 30 days if the original decision was incorrect, and explanation of denial basis if the decision is upheld. If a correction request is denied, the deployer must explain the basis and offer deletion of the subject's personal information.

Deployers must inform end users within five days after a high-risk AI system has been used to make a consequential decision. Deployers must provide and explain an appeal process that allows the end user to (1) formally contest the decision, (2) provide supporting information, and (3) obtain meaningful human review. The deployer must respond to appeals within 45 days, extendable once by 45 additional days with notice and reasons. End users are entitled to no more than one appeal per consequential decision in a six-month period.

Deployers must, for adverse consequential decisions, provide the consumer with (1) a statement disclosing principal reasons for the decision including the AI system's contribution, data types processed, and data sources; (2) an opportunity to correct incorrect personal data used in the decision; and (3) an opportunity to appeal the decision with human review where technically feasible.

Healthcare insurers must provide enrollees a process for contesting outcomes produced by automated decision-making systems.

Employers must, when a consequential decision made by or substantially based on a high-risk AI system is adverse to an employee, (1) disclose the principal reasons for the decision including the AI system's degree of contribution, the data types processed, and data sources, (2) allow the employee to examine and correct the personal data processed, and (3) provide an opportunity to appeal inaccurate-data-based decisions with human review.

Deployers must, when an automated employment-related decision process makes or substantially factors into an adverse employment-related decision, provide the affected applicant or employee with: (1) a high-level statement disclosing the principal reasons for the adverse decision, including the degree and manner of the process's contribution, the type of data processed, and the source of that data; (2) an opportunity to examine and correct the data used and to appeal the decision with human review if it was based on incorrect data; and (3) upon request, a copy of the most recent bias audit. The high-level statement must be provided directly to the individual, in plain language, in all languages the deployer ordinarily uses in the state, and in a format accessible to individuals with disabilities.

Deployers must transmit to the consumer within one business day after an automated consequential decision a notice including: (1) a specific explanation of the principal factors and variables that led to the decision, including the degree and manner of AI contribution, the data sources processed, and a plain-language explanation of how the consumer's personal data informed those factors; (2) information about the consumer's right to correct data and how to submit corrections and supplementary information; (3) what actions the consumer might have taken to secure a different decision and may take in the future; (4) information on opportunities to correct incorrect personal data processed in the decision; and (5) information on opportunities to appeal an adverse decision, which appeal must allow for human review if technically feasible.

Health carriers must provide enrollees with a universal external review request form and a clear, step-by-step guide explaining the enrollee's rights and procedures to request an internal appeal or external review upon any adverse determination.

Health care providers that used an AI system to make or substantially factor into a consequential decision must provide the patient or authorized representative with: (1) a written statement describing the consequential decision and its principal reasons, including the degree and manner of the AI system's contribution, the types of data the AI processed, and the sources of that data; (2) an opportunity to correct any incorrect health information or personal data the AI system processed in making the decision; and (3) an opportunity to appeal the consequential decision, including human review of all information relating to the decision to the extent technically feasible. The appeal right does not apply when providing an opportunity for appeal is not in the patient's best interest, including when any delay might pose a risk to the patient's life or safety.

Deployers must provide a written response to consumer correction, reconsideration, or human review requests within a reasonable period, including the outcome, an explanation if the adverse action is upheld, and any additional steps available through internal appeal or external rights.

Employers must, when using an automated decision-making system for any function covered by Section 10(a): (1) provide notice to each affected employee no later than the time a decision is issued that the decision was made using an automated decision-making system; (2) provide an appeals process for employees directly impacted by decisions made by the system; and (3) offer each affected employee the opportunity for an independent alternative review of the decision by an individual working for or on behalf of the employer, separate from the automated system.

Employers must allow covered individuals, after receiving post-decision documentation, to: (i) dispute the automated decision system output in a manner that is accessible, equitable, and does not impose an unreasonable burden, to a human with appropriate and relevant experience; and (ii) appeal the employment-related decision to a human with appropriate and relevant experience who is not the same human who performed the corroboration under clause (E).

Employers or vendors that use an ADS to make an employment-related decision must provide the affected worker with a right to appeal that decision, request human review, submit additional information, and correct data errors. The employer or vendor must provide a form or hyperlink to an electronic appeal form within 30 days of the worker's notification. The form must include options to request ADS input/output data, corroborating evidence from the human reviewer, a field for the worker's reason and supporting evidence, and a designation for an authorized representative. The employer or vendor must respond to the appeal within 14 business days by designating a human reviewer who can objectively evaluate all evidence, has sufficient authority, discretion, and resources to evaluate and overturn the decision, and was not involved in the original decision. The response must be a clear written document describing the appeal result and reasons. If the reviewer overturns the decision, the employer or vendor must rectify it within 21 business days.

Covered insurers must, upon consumer request within 30 days of an adverse action, assign a qualified human underwriter or claims professional to independently review the decision, complete the review within 30 days, and provide a written explanation. The reviewer must have full authority to modify or reverse the adverse action based on the consumer's specific facts.

Health insurance issuers must allow any insured to appeal a coverage determination that the insured has learned was made with a recommendation from AI or an automated decision system.

Controllers must establish a conspicuously available appeal process for consumers whose data rights requests are denied, respond in writing within 60 days with a substantive explanation, and provide a mechanism to contact the attorney general if the appeal is denied.

Employers must notify employees and candidates at least ten business days before using an automated employment decision tool, disclosing: (1) that the tool will be used, (2) the qualifications and data attributes assessed and outputs produced, (3) data sources and retention policy, (4) the most recent impact assessment results, (5) how to request an alternative non-automated selection process, and (6) how to request reevaluation and the right to file a civil complaint. Notice must be in plain language, included in job postings, posted on the employer's website in all employee-facing languages, provided directly to candidates, and accessible to individuals with disabilities.

Deployers must (1) notify consumers when an AI system materially influences a consequential decision, (2) provide consumers with the purpose of the system and an explanation of how the system influenced the decision, and (3) provide a process to appeal or correct adverse decisions.

Deployers must, when a consequential decision is adverse to the consumer, provide: (1) a statement disclosing the principal reasons for the decision, including the degree and manner of the AI system's contribution, the type of data processed, and the sources of that data; (2) an opportunity to correct any incorrect personal data the system processed in making the decision; and (3) an opportunity to appeal the adverse decision, which must allow for human review if technically feasible, unless the appeal would not be in the consumer's best interest (e.g., where delay poses a risk to the consumer's life or safety).

Carriers must ensure that their internal grievance process provides for human review of any adverse decision made using artificial intelligence, an algorithm, or other software tools when a member files a grievance challenging that decision. The human review must include an assessment of whether the AI tool complied with § 15–10B–05.1, which requires individualized clinical data inputs, prohibits sole reliance on group datasets, and imposes non-discrimination and oversight requirements.

Employers must provide each worker affected by an ADS-informed employment decision with a form or link to appeal the decision. The appeal form must include options to request ADS input/output data and human reviewer corroborating evidence, space for the worker's reasons and supporting evidence, and information on designating an authorized representative. Workers must file appeals within 30 days of post-use notification. Employers must respond within five business days by assigning a human reviewer who: objectively evaluates all evidence, has authority and training to evaluate the decision (including ADS limitations and worker rights), has authority to overturn the decision, and was not involved in the original decision. The reviewer must produce a written document explaining the appeal result and reasoning, provided to both the employer and worker. If the decision is overturned, the employer must rectify it within five business days.

Employers must provide workers with a form to appeal any employment-related decision based on electronic monitoring data. The employer must respond within five business days by designating an independent human reviewer — not involved in the original decision, with authority to overturn it — who must produce a written decision with reasoning. If overturned, the employer must rectify the decision within five business days.

Employers must provide workers with a structured appeal form when monitoring data was used in an employment-related decision, respond within five business days by designating an independent, qualified human reviewer with authority to overturn the decision, produce a written decision with reasons, and rectify any overturned decision within five business days.

Employers must provide workers with a form to appeal any employment-related decision made using an automated decision system. Within five business days of receiving an appeal, the employer must designate an independent human reviewer — not involved in the original decision, with authority to overturn it — who must objectively evaluate all evidence, produce a written decision explaining the result and reasons, and if the decision is overturned, the employer must rectify it within five business days.

Employers must notify each covered individual within 30 days of use that an automated employment decision tool was used, disclose the job qualifications or characteristics assessed, the data sources, the employer's data retention policy, the tool name and vendor, and — if the outcome was adverse — provide a written statement of specific reasons and sufficient disclosures to enable the individual to contest the employment decision.

If a recognized bargaining representative raises compliance concerns within 30 days of receiving notice, the employer or public entity must halt implementation and provide a written response addressing the concerns — including any agreed modifications or a compliance explanation — before proceeding. If the representative is not satisfied, they may pursue administrative, civil, or grievance remedies.

Employers and public entities must provide at least 10 days' advance written notice before any adverse AI-assisted employment or public-benefit decision takes effect, explaining the reasons, providing access to all data, and informing the individual of appeal rights. Upon request within 30 days, the employer must (1) allow the individual to review and copy all data and receive a complete explanation of how the AEDS or ABSDS produced its outputs including factor weighting, (2) allow the individual to appeal on grounds of data inaccuracy, bias, or legal violations, and (3) designate a qualified human reviewer with authority and discretion to modify or overturn the decision. For applicants, notice must be provided no later than the time of the decision.

Employers and public entities must not implement a system after a bargaining representative raises specific compliance concerns within 30 days until they provide a written response adopting any needed modification or explaining why none is necessary.

On request within 30 days, employers and public entities must let the individual review and copy the decision data, personnel files, impact-assessment and oversight records, and factor-weighting explanation; permit an appeal to correct inaccurate or biased data and contest the decision; and designate a qualified, empowered human reviewer with authority to modify or overturn it who issues the final internal determination.

Deployers must provide consumers an opportunity to appeal any adverse consequential decision, and the appeal must be reviewed by a human being.

Utilities must, upon a residential customer's request for billing review, (1) suspend all adverse actions including late fees, collections, and service termination, (2) conduct a review including qualified human personnel review and error correction, and (3) provide a written determination to the customer within ten business days.

Persons developing and deploying automated systems must provide New York residents with access to a timely human consideration and remedy through a fallback and escalation process if an automated system fails, produces an error, or if the resident wishes to appeal or contest the system's impacts. The fallback process must be accessible, equitable, effective, maintained, accompanied by appropriate operator training, and must not impose an unreasonable burden on the public.

Banks must provide loan applicants denied based on incorrect personal information a 30-day period to correct the information and appeal the denial.

When a high-risk AI decision system has been used to make or substantially factor into an adverse consequential decision concerning a consumer, the deployer must provide the consumer: (1) a statement disclosing the principal reasons for the adverse decision, including the degree and manner in which the AI system contributed, the type of data processed, and the source of that data; (2) an opportunity to correct any incorrect personal data the system processed; and (3) an opportunity to appeal the adverse decision, which must include human review if technically feasible, unless human review would not be in the consumer's best interest (e.g., where delay poses a risk to life or safety).

Covered entities must allow applicants whose loan applications were denied based on incorrect personal information to correct the information and appeal the denial within 30 days of receiving the denial notice.

Covered deployers must, within ten days of a consequential decision, notify the subject that a high-risk AI system was used and provide an appeal process allowing the subject to (1) contest the decision, (2) submit supporting information, and (3) obtain meaningful human review, responding within forty-five days (extendable once).

Deployers must, once Division regulations are promulgated (within two years of the effective date), provide individuals a mechanism to appeal to a human any consequential action resulting from the deployer's use of a covered algorithm. The appeal mechanism must be clear and conspicuous, in plain language, easy to execute, at no cost, proportionate to the consequential action, reasonably accessible to individuals with disabilities, timely, usable, effective, and non-discriminatory. Where appropriate, the mechanism must allow individuals to identify and correct personal data used by the algorithm. Human reviewers must meet Division-specified training requirements.

Employers must provide written notice at least 14 calendar days before any employment decision based on monitoring data or AEDT output takes effect, disclosing performance standards, the employee's monitored data, aggregated peer data for the prior 90 days, AEDT outputs, the most recent impact assessment, and all non-monitoring information used. Employees may request reevaluation in writing (including text or email) by identifying the disputed data or output and providing supporting evidence. Employers must investigate and respond within seven calendar days, providing evidence of accuracy or correcting the data and reevaluating the decision without the flawed input.

Deployers must, when a high-risk AI decision system makes or substantially factors into an adverse consequential decision concerning a consumer, provide the consumer with: (1) a statement disclosing the principal reasons for the adverse decision, including the degree to which and manner in which the AI system contributed, the type of data processed, and the source of that data; (2) an opportunity to correct any incorrect personal data processed in making the decision; and (3) an opportunity to appeal the adverse decision, which must allow for human review if technically feasible, unless providing such opportunity would not be in the consumer's best interest (e.g., delay posing life or safety risk).

Covered entities must provide loan applicants denied based on incorrect personal information a 30-day window to correct the information and appeal the denial.

Deployers must, when a consequential decision is adverse to a consumer, (1) explain the principal reasons including the degree and manner of AI contribution, data types, and data sources, (2) allow the consumer to examine and correct personal data used, and (3) provide an opportunity to appeal based on inaccurate personal data with human review where technically feasible. All notices must be provided directly to the consumer, in plain language, in all languages the deployer ordinarily uses, and in formats accessible to consumers with disabilities.

Deployers must, when a high-risk AI system has made or been a substantial factor in making an adverse consequential decision concerning a consumer, provide the consumer with: (1) a statement disclosing the principal reasons for the decision, including the degree to which and manner in which the AI system contributed, the type of data processed, and the source(s) of that data; (2) an opportunity to correct any incorrect personal data that the AI system processed in making the decision; and (3) an opportunity to appeal the adverse decision, which appeal must, if technically feasible, allow for human review — unless providing the appeal opportunity is not in the consumer's best interest (e.g., where delay might pose a risk to the consumer's life or safety).

Covered entities must evaluate and document consumer rights with respect to covered algorithms, including (1) whether consumers receive clear notice that an algorithm will be used, (2) whether consumers have an opt-out mechanism, (3) the transparency and explainability of the algorithm, (4) any mechanisms for consumers to contest, correct, or appeal a decision, and (5) the extent to which third-party decision recipients access algorithm results.

Deployers must, once FTC regulations are promulgated (within 2 years of enactment), provide individuals a mechanism to appeal to a human any consequential action resulting from the deployer's use of a covered algorithm, including the ability to identify and correct personal data used by the algorithm.

Employers must enable covered individuals to (1) dispute the ADS output to a human with appropriate and relevant experience via an accessible, equitable, and non-burdensome process, and (2) appeal the employment-related decision to a different human with appropriate and relevant experience than the one who corroborated the ADS output.

Covered entities must evaluate the extent to which they provide consumers with (1) clear notice of automated decision system use, (2) a mechanism for opting out, (3) transparency and explainability regarding contributing factors, (4) the ability to contest, correct, or appeal decisions, and (5) documentation of complaints and remediation outcomes. Covered entities must also document the categories of third-party decision recipients receiving decision results.

Deployers must, pursuant to FTC regulations to be promulgated within two years of enactment, provide individuals a mechanism to appeal algorithmic consequential actions to a human reviewer. The mechanism must be accessible, proportionate, and include data correction capabilities and trained reviewers.

Deployers must provide and explain a process for consumers to appeal a consequential decision. The appeal process must allow the consumer to formally contest the decision, provide supporting information, and obtain meaningful human review. The deployer must designate a human reviewer who is trained and qualified, free of conflicts of interest, was not involved in the initial decision, is protected from retaliation for exercising their review functions, and is allocated sufficient resources. The human reviewer must consider the consumer's information and may consider other relevant sources. The deployer must respond within 45 days, extendable once by an additional 45 days with notice and explanation of the delay.

Law enforcement agencies must ensure FRT results never serve as the sole basis for probable cause or positive identification — independently obtained corroborating evidence is always required.

Law enforcement agencies must ensure that every FRT result is independently verified by a trained individual before the result is used for any purpose in a criminal investigation.

Judicial officers and other authorized decision-makers must make all criminal justice decisions — including pre-trial detention or release, prosecution, adjudication, sentencing, probation, parole, correctional supervision, and rehabilitation — with human decision-maker involvement. No such decision may be made solely by an artificial intelligence-based tool, and any AI-generated recommendation or prediction must remain subject to challenge or objection permitted by law.

Health insurance issuers must ensure that all downcoding appeals are reviewed by a physician who is (1) licensed to practice medicine in all its branches, (2) of the same or similar specialty as the treating physician, (3) experienced in the relevant health care services, (4) independent from the original downcoding decision, and (5) performs a documented review of all clinical information and medical records supporting the billed service.

Employers must not rely solely on an ADS when making a disciplinary, termination, or deactivation decision. When an employer uses ADS output to assist in such a decision, the employer must direct a human reviewer to conduct an independent investigation and compile corroborating or supporting information — which may include supervisory evaluations, personnel files, work product, peer reviews, and witness interviews. If the employer cannot corroborate the ADS output, or the human reviewer concludes the output is inaccurate, incomplete, or misleading, the employer must not use the ADS output to discipline, terminate, or deactivate the worker.

News media content created in whole or in material part by generative AI must be reviewed by a human worker who has authority to approve, deny, or modify any decision recommended or made by the AI system before that content may be published.

The commission's standards must establish requirements for human review and approval for the deployment and use of AI models by electrical and gas corporations, including specifying where human review must be placed in the deployment workflow.

The commission's standards must require human review and approval for any AI model that (1) makes or directly implements operational decisions affecting utility infrastructure without a mandatory human approval step, (2) generates auto-implemented recommendations without case-by-case human review, or (3) performs acts that could foreseeably result in physical harm, service interruption, or public safety impact. Reviewing staff must have relevant expertise, sufficient information and time, unimpeded authority to reject or modify the AI output, and freedom from workflow pressure that renders rejection impractical.

Employers must designate at least one internal reviewer with AI operational expertise, familiarity with the most recent impact assessment, understanding of the system's data processing, authority to change or influence AI outputs, and adequate time and resources to evaluate outputs. The internal reviewer must verify the accuracy of employee data inputs and consider the AI system's outputs.

Deployers must implement human review over every automated employment-related decision process used to make or substantially factor into employment-related decisions. A qualified human reviewer — with authority to make or change decisions and understanding of the process's biases and limitations — must review the AI output and, when appropriate, modify or veto it prior to any adverse decision. Deployers must establish procedures to pause, correct, or reverse erroneous or harmful outputs, and must maintain logs of all human review reports and interventions. No automated employment-related decision process may be used for a final or determinative employment-related decision without human review.

Persons using AI or automated decision tools in determinations about the sale, rental, or financing of dwellings, or in brokerage services, must ensure an individual responsible for the determination participates in or reviews each determination.

Health care providers that use AI to make or substantially factor into consequential decisions must maintain AI oversight personnel. The oversight personnel must be a natural person with the qualifications, experience, and expertise necessary to evaluate AI outputs in health care (including predictions, scoring, recommendations, decisions, and conclusions). The oversight personnel may be a third-party contractor. The oversight personnel must (1) monitor the health care provider's AI systems, and (2) before any AI output is used to make or substantially factor into a consequential decision, review and evaluate the output and either validate or override it.

Deployers must implement a reasonable process by which consumers may (1) request correction of inaccurate personal information used in a consequential decision, (2) submit additional information for reconsideration, and (3) obtain human review of an adverse action by a reviewer with authority to overturn the decision and subject-matter-relevant training. Narrow exceptions apply when human review would conflict with law or compromise security, but the deployer must document the basis and offer an alternative dispute channel.

Employers must not rely solely on an automated decision system when making a discipline, termination, or deactivation decision.

When an employer relies primarily on output from an automated decision system to make a discipline, termination, or deactivation decision, the employer must use a human reviewer to review the automated decision system output and compile and review other relevant information, which may include supervisory or managerial evaluations, personnel files, employee work product, peer reviews, and witness interviews (including relevant online customer reviews).

Health care entities must prohibit staffing, triage, admission, discharge, or transfer decisions that rely solely on AI. Human clinical review by a registered professional nurse is required for all such decisions.

Employers must ensure meaningful and continuing human review whenever an automated decision-making system is used — directly or indirectly — to perform any function related to public assistance administration, any function that will adversely impact employee rights, civil liberties, safety, or welfare, or any function affecting employees' statutory or constitutional rights. The human reviewer must understand the system's risks and limitations, be trained on the system, have authority to intervene or override outputs suspected of being invalid, inaccurate, or discriminatory (and must reject outputs that cannot be independently corroborated), and have adequate time and resources for review. This prohibition also extends to procurement, purchase, or acquisition of any service or system relying on an automated decision-making system for these functions.

Health care entities must prohibit staffing, triage, admission, discharge, or transfer decisions that rely solely on AI, and must require human clinical review by a registered professional nurse for all such decisions.

Employers must not rely exclusively on an automated decision system in making any employment-related decision with respect to a covered individual. Every such decision must involve human judgment beyond the automated system's output.

Employers must independently corroborate every automated decision system output through meaningful oversight by a human with appropriate and relevant experience before using it in an employment-related decision. The human must have the authority and ability to override the automated output.

Employers must not rely solely on an ADS when making a discipline, termination, or deactivation decision. A human must be involved in the decision.

Employers or vendors utilizing ADS output to assist in employment-related decisions must: (1) ensure the accuracy of the ADS output; (2) assign a designated internal reviewer to conduct a separate investigation and compile corroborating information (e.g., supervisory evaluations, personnel files, employee work products, peer reviews); and (3) ensure the reviewer has sufficient authority, discretion, resources, and time to corroborate output, sufficient expertise in similar systems and the ADS in question to interpret outputs and impact assessments, and sufficient education, training, or experience to make a well-informed decision. The reviewer must be protected from retaliation. Employers must not rely on ADS output to make an employment-related decision if the output cannot be corroborated or the human reviewer has concluded the output is inaccurate, incomplete, or misleading.

Covered insurers must not generate a final claims payment determination using an ADS without human review and approval by a licensed claims professional who has authority to override the algorithmic determination, access to the specific factors driving it, and who documents the basis for each approval, modification, or override.

Health insurance issuers must be prepared to demonstrate, for any adverse determination in which AI or an automated decision system materially contributed, that the determination was independently reached through documented clinical judgment without reliance upon algorithmic output. Any such adverse determination is presumed invalid unless this showing is made.

When an adverse determination is appealed on the basis of AI or automated decision system use, the insurer must not use any AI or automated decision system in any subsequent review of that claim.

Employers must not rely primarily on electronically-monitored data when making hiring, promotion, disciplinary, termination, or compensation decisions. Employers must establish meaningful human oversight, designate a human decision-maker who actually reviews the monitoring data for accuracy, reviews pending correction requests, exercises independent judgment, and considers non-monitoring information such as supervisory evaluations, personnel files, work products, or peer reviews.

Employers must not rely primarily on automated decision tool output for hiring, promotion, termination, disciplinary, or compensation decisions. Employers must establish meaningful human oversight with a qualified internal reviewer who actually reviews tool outputs, exercises independent judgment, and considers non-ADS information such as supervisory evaluations, personnel files, work products, or peer reviews.

Employers must not rely primarily on employee data collected through electronic monitoring when making hiring, promotion, disciplinary (including termination), or compensation decisions. To satisfy this requirement, employers must: (1) establish meaningful human oversight of such decisions — including designating at least one internal reviewer with sufficient expertise, familiarity with the most recent impact assessment, and understanding of tool outputs to identify biases, errors, discrepancies, or inaccuracies; (2) ensure a human decision-maker actually reviews the monitoring data, verifies its accuracy and currency, reviews any pending correction requests, and exercises independent judgment; and (3) require the human decision-maker to consider information beyond monitoring data, such as supervisory evaluations, personnel files, employee work products, or peer reviews.

Employers must not rely primarily on automated decision tool output when making hiring, promotion, termination, disciplinary, or compensation decisions. To satisfy this requirement: (1) employers must establish meaningful human oversight, considering the tool's complexity, the reviewer's experience and training, preparation time, and feasibility of expert consultation; (2) a human decision-maker must actually review each automated output and exercise independent judgment; (3) the human must consider non-automated information such as supervisory evaluations, personnel files, work products, or peer reviews; and (4) the employer must consider non-automated information in each such decision. Employers must not require employee or candidate consent to automated tool use as a condition of being considered for an employment decision, and must not discipline or disadvantage anyone for requesting accommodation.

Consumer reporting agencies must require all automated evaluations to be subject to human review within 24 hours before a decision is final, and must provide an expedited review process with human review within 48 hours after a consumer submits a review request.

Consumer reporting agencies must subject at least 10% of all algorithmic evaluations to random human review to prevent false positives.

Employers must never rely solely on an automated decision system when making an employment-related decision. When relying in part on an ADS, the employer must: (1) ensure the accuracy of the ADS output; and (2) assign a designated internal reviewer to investigate and compile corroborating information. The reviewer must have sufficient authority, discretion, resources, and time to corroborate ADS output; expertise in similar systems sufficient to interpret outputs and impact assessment results; training on ADS limitations, biases, and worker rights; and protection from retaliation. If the employer cannot corroborate the ADS output or the reviewer concludes it is inaccurate, incomplete, or misleading, the employer must not rely on the ADS for the employment-related decision.

Employers must not take any adverse action against a worker based on data from a continuous time-tracking tool, except in cases of egregious misconduct.

Employers must not rely solely on an electronic monitoring tool for employment-related decisions. When relying in part on monitoring data, employers must (1) ensure data accuracy and (2) designate a qualified internal human reviewer — with authority, expertise, training on monitoring-tool limitations and worker rights, and retaliation protection — to corroborate the monitoring data before the decision is made. If the data cannot be corroborated or is found inaccurate, incomplete, or misleading, the employer must not rely on it.

Employers must not rely solely on electronic monitoring tool data when making employment-related decisions and must use a qualified designated internal reviewer — with sufficient authority, expertise, training on monitoring tool biases and worker rights, and retaliation protection — to corroborate the data before acting. If the data cannot be corroborated or is found inaccurate, incomplete, or misleading, the employer must not rely on it.

Employers must not rely solely on an automated decision system for any employment-related decision. When relying in part on such a system, employers must (1) ensure the accuracy of the output and (2) designate a qualified internal reviewer with sufficient authority, expertise, and training to corroborate the output using independent evidence. If the reviewer cannot corroborate the output or finds it inaccurate, incomplete, or misleading, the employer must not rely on the system for that decision.

Employers must not take adverse employment action against an employee for failure to meet a work performance standard that violates the prohibited-standard restrictions, was not properly disclosed, is based solely on peer-ranking, is based on continuous time-increment tracking, or is based primarily on work speed data collected through automated electronic monitoring.

Employers must not take adverse employment action against an employee based solely on data collected via continuous incremental time-tracking tools such as keystroke logging, idle-time trackers, or mouse-movement monitors.

Employers and public entities must provide at least 10 days' advance written notice before any adverse AI-assisted employment or public-benefit decision takes effect, explaining the reasons, providing access to all data, and informing the individual of appeal rights. Upon request within 30 days, the employer must (1) allow the individual to review and copy all data and receive a complete explanation of how the AEDS or ABSDS produced its outputs including factor weighting, (2) allow the individual to appeal on grounds of data inaccuracy, bias, or legal violations, and (3) designate a qualified human reviewer with authority and discretion to modify or overturn the decision. For applicants, notice must be provided no later than the time of the decision.

Employers and public entities must not base any employment or public-benefit decision exclusively or determinatively on AEDS, ABSDS, or EMT outputs. They must establish meaningful human oversight including: (1) designated internal reviewers trained in the AI system's operation who can identify errors, biases, and inaccuracies; (2) reviewer authority to dispute, revise, or reject AI outputs; (3) a requirement that human decision-makers exercise independent judgment and consider non-AI information (supervisory evaluations, personnel files, peer reviews) for consequential decisions; and (4) adequate time, resources, and direct communication availability for reviewers.

On request within 30 days, employers and public entities must let the individual review and copy the decision data, personnel files, impact-assessment and oversight records, and factor-weighting explanation; permit an appeal to correct inaccurate or biased data and contest the decision; and designate a qualified, empowered human reviewer with authority to modify or overturn it who issues the final internal determination.

Employers and public entities must not base any employment or public-benefit decision solely or determinatively on EMT/surveillance data, AEDS/ABSDS outputs, or third-party/data-broker information; such data must be corroborated by designated internal reviewers and remain subject to challenge by the affected individual.

Employers and public entities must establish meaningful human oversight for all such decisions, designating trained internal reviewers with authority to dispute, revise, or reject outputs found inaccurate, discriminatory, or invalid, requiring a human decision-maker to exercise independent judgment and consider information beyond the system outputs, and giving reviewers adequate time, resources, and availability to communicate directly with affected individuals.

Employers must not rely solely on ADS output for discipline, termination, or deactivation decisions. When ADS output is the primary basis for such decisions, a human reviewer must review the ADS output and compile and review other relevant information (including supervisory evaluations, personnel files, work product, peer reviews, and witness interviews). Customer ratings may not be used as the only or primary ADS input for any employment-related decision.

Utilities must not issue any residential bill flagged as containing a billing anomaly as a final charge until qualified personnel have reviewed the anomaly and corrected any identified error.

Utilities must not make fully automated adverse billing determinations. All final determinations regarding disputed or anomalous bills must be subject to human review.

Persons developing and deploying automated systems intended for use in sensitive domains — including criminal justice, employment, education, and health — must additionally (1) tailor the system to its purpose, (2) provide meaningful access for oversight, (3) include training for residents interacting with the system, and (4) incorporate human consideration for adverse or high-risk decisions.

Employers must not solely rely on AEDT output when making hiring, promotion, termination, disciplinary, or compensation decisions. Employers must establish meaningful human oversight that requires consideration of non-AEDT information — including supervisory or managerial evaluations, personnel files, employee work products, or peer reviews.

Covered deployers must conduct meaningful human review — by a trained individual with authority to approve, deny, or modify the outcome — of each consequential decision made with a high-risk AI system.

Any news media content created in whole or in material part by generative AI must be reviewed by a human worker before publication. The human reviewer must have authority to approve, deny, or modify any decision recommended or made by the automated system.

Employers must ensure that a qualified human reviewer with authority to modify or overturn the automated system's output conducts a deliberate evaluation of that output before making any final or adverse employment decision based on automated resume screening or applicant evaluation.

Employers must not deny employment to any applicant solely on the basis of an automated system's action, and must ensure that all automated recommendations, scores, rankings, and filters are subject to human evaluation and override authority.

Employers must not solely rely on AEDT output when making hiring, promotion, termination, disciplinary, or compensation decisions. Employers must establish meaningful human oversight requiring consideration of information beyond AEDT outputs, including supervisory evaluations, personnel files, employee work products, or peer reviews.

Employers must not rely primarily on electronically monitored data when making hiring, promotion, termination, disciplinary, or compensation decisions. Employers must establish meaningful human oversight, designate a qualified internal reviewer who actually reviews monitored data, verifies accuracy, reviews pending correction requests, and exercises independent judgment, and must ensure the decision-maker considers information beyond electronic monitoring outputs.

Employers must not rely primarily on AEDT output when making hiring, promotion, termination, disciplinary, or compensation decisions. Employers must establish meaningful human oversight, ensure a human decision-maker actually reviews AEDT output and exercises independent judgment, and require the decision-maker to consider information beyond AEDT outputs such as supervisory evaluations, personnel files, employee work products, or peer reviews.

Deployers must ensure that the qualified end-user retains authority to amend or overrule AI device outputs based on their professional judgment. Deployers and all other entities are prohibited from pressuring qualified end-users to ignore or alter their professional judgment regarding AI device outputs.

Employers must not rely primarily on employee data collected through electronic monitoring when making hiring, promotion, disciplinary (including termination), or compensation decisions. Employers must establish meaningful human oversight of such decisions, including: (1) designating at least one internal reviewer with sufficient ADS expertise, familiarity with the most recent impact assessment, and understanding of system outputs to identify biases, errors, and inaccuracies; (2) granting the reviewer authority to dispute, rerun, or recommend rejection of outputs suspected to be invalid, inaccurate, or discriminatory; and (3) ensuring the reviewer has sufficient time and resources. A human decision-maker must review the electronically monitored information, verify accuracy, review pending data correction requests, and exercise independent judgment. The human decision-maker must also consider non-monitoring information — including supervisory evaluations, personnel files, employee work products, and peer reviews — in making each decision.

School entities must ensure that AI does not replace a licensed teacher in providing core academic instruction or assigning final grades.

School entities must ensure that any instructional content generated by AI is reviewed and approved by a licensed teacher before being provided to students.

Employers must not rely exclusively on an automated decision system in making any employment-related decision with respect to a covered individual.

Employers must independently corroborate each automated decision system output through meaningful oversight by a human with appropriate and relevant experience before using the output in an employment-related decision.

Covered entities must adopt and adhere to a policy that (1) ensures AI/CDSS outputs are not substituted for the independent judgment of health care professionals acting within their scope of practice, (2) allows professionals to override AI/CDSS outputs in a timely manner when clinically appropriate or required by law, (3) provides a feedback channel for professionals to report incorrect or biased outputs, and (4) prohibits sharing override data identifying individual professionals or identifiable groups, except for patient-care communications or legal proceedings.

The Department of Defense must not employ lethal force through autonomous weapon systems without appropriate levels of human judgment and supervision, and must ensure all other autonomous weapon system uses conform to DoD Directive 3000.09.

All criminal justice decisions — including pre-trial detention or release, prosecution, adjudication, sentencing, probation, parole, correctional supervision, and rehabilitation — must be made by the judicial officer or other authorized person. No such decision may be made without human involvement. Any AI-generated recommendation or prediction must be subject to challenge or objection permitted by law.

Employers must not solely rely on automated decision system outputs when making employment-related decisions. An employer may use an ADS in employment-related decisions only if all three conditions are met: (1) the ADS outputs are corroborated by human oversight of the employee, including supervisory or managerial observations, work documentation, personnel records, and consultations with coworkers; (2) the employer has conducted an impact assessment of the ADS under subsection (g); and (3) the employer has provided the required notice under subsection (f)(4).

Deployers must provide and explain a process for consumers to appeal a consequential decision. The appeal process must allow the consumer to formally contest the decision, provide supporting information, and obtain meaningful human review. The deployer must designate a human reviewer who is trained and qualified, free of conflicts of interest, was not involved in the initial decision, is protected from retaliation for exercising their review functions, and is allocated sufficient resources. The human reviewer must consider the consumer's information and may consider other relevant sources. The deployer must respond within 45 days, extendable once by an additional 45 days with notice and explanation of the delay.

Employers must not solely rely on automated decision system outputs when making employment-related decisions. An employer may use an automated decision system for employment-related decisions only if the outputs are corroborated by human oversight (including supervisory observations, personnel records, and coworker consultations), the employer has conducted an impact assessment, and the employer has complied with notice requirements.