The Department of Technology must conduct a comprehensive inventory of all high-risk automated decision systems that have been proposed for use, development, or procurement by, or are being used, developed, or procured by, any state agency, on or before September 1, 2024.

The Department of Technology must include in the comprehensive inventory a description of each system's decision-making capabilities and intended benefits, alternatives considered, efficacy research results, categories of data and personal information used, and risk mitigation measures in place (including accuracy metrics, cybersecurity and privacy controls, risk assessments, and contestation processes).

The Department of Administrative Services must conduct an annual inventory of all AI systems in use by state agencies — including system name, vendor, capabilities, decision-making role, and impact assessment status — and publish the inventory on the state's open data portal.

The Judicial Department must conduct an annual inventory of its AI systems — including system name, vendor, capabilities, decision-making role, and impact assessment status — and publish the inventory on the department's website.

The Department of Administrative Services must annually inventory all AI systems in use by state agencies — including system name, vendor, capabilities, decision-making role, impact assessment status, PII access, and known risks — and publish the inventory on the state's open data portal.

The Indiana Department of Education must establish and annually update a publicly titled inventory of at least twenty AI platforms, classifying each as supported or discouraged for school use, and must create a submission process allowing teachers and school administrators to nominate AI platforms for inclusion.

Law enforcement agencies contracting for a non-government FRT system must disclose on their public website the name of the system and the names and descriptions of the databases searched.

Each unit of State government must conduct a regular inventory of systems employing high-risk AI — including system name, vendor, capabilities, purpose, pre-deployment impact assessment status, decision-making role, and most recent impact assessment summary — and submit it to the Department in the prescribed format, beginning December 1, 2025.

The Department must publish an aggregated statewide AI inventory on its website, withholding only information whose publication would compromise system security or integrity, and must provide withheld information to the Governor, General Assembly members, and law enforcement upon request.

The Secretary of Information Technology must conduct inventories and ongoing assessments of AI systems used by units of State government as required under § 3.5–803.

The Sunset Advisory Commission must, as part of its review criteria for each state agency, assess the agency's use of AI systems in its operations, its oversight of AI use by persons under its jurisdiction, and any related impact on the agency's ability to achieve its mission, goals, and objectives.

State agencies must provide to the Department of Information Resources an evaluation of the agency's use or considered use of artificial intelligence systems, as part of the department's information technology infrastructure data collection.

State agencies must include an inventory of their artificial intelligence systems as part of their periodic information resources reviews submitted to the Department of Information Resources.

The Government Operations Agency must, by January 1, 2027, establish on its website (1) a mechanism for AI auditors to enroll, (2) enrollment fees not exceeding reasonable administrative costs, and (3) a mechanism for natural persons to report misconduct by enrolled AI auditors.

The Government Operations Agency must, beginning January 1, 2027, (1) publish all enrolled AI auditor information in a publicly accessible format on its website, (2) retain misconduct reports for as long as the auditor remains enrolled plus 10 years, and (3) share misconduct reports with other state agencies as necessary for enforcement purposes.

Public bodies must annually report on initial and ongoing high-risk AI system assessments and provide an inventory of all such systems to the General Assembly (legislative branch), the Executive Secretary of the Supreme Court (judicial branch), or the CIO (executive branch and others).

The Chief Data Officer and agency data officers must, by January 1, 2026, review state agency data inventories to identify and publish data useful for AI and machine learning, develop data quality and anti-discrimination governance policies for such data, apply necessary privacy protections, and establish publication procedures through the state open data repository.

The state board of education must create and maintain a statewide master list of all software used by students in Missouri public schools as a public transparency tool. Software may only be listed after the contracting entity has executed the statewide digital privacy agreement and obtained academic-effectiveness verification, and these requirements must be met before student use.

Contracting entities must execute the statewide digital privacy agreement, obtain academic-effectiveness verification, and submit all documentation to the state board of education for listing for each software product adopted. Local educational agencies must also maintain their local software inventory. The state board must publish and update the statewide master list on an ongoing basis and conduct compliance audits.

State agencies must publish on their website a list of all automated employment decision-making tools they use, including a description of each tool, the date use began, and a summary of purpose and use, initially by December 30 following the effective date and annually thereafter.

The Office of Information Technology Services must maintain and annually publish on the New York State Open Data website a statewide inventory of all state agency artificial intelligence systems, including the purpose and uses of each system. State agencies must submit required inventory data to the office at least 60 days before each annual publication date.

The Commissioner of Labor must maintain a database of AI/automation-related WARN reports and must prepare and publish quarterly summaries analyzing the number, sector, and location of workforce reductions identified as resulting from AI or automation. Reports must be made publicly available on the Department of Labor's website and shared with the Department of Economic Development for use in workforce innovation planning and retraining programs.

The State Department of Education must create and maintain a publicly accessible Data Transparency Portal that (1) lists all data elements collected, (2) identifies which elements are mandatory versus optional, (3) publishes copies of all active vendor contracts and data-sharing agreements, (4) reports all data breaches or unauthorized disclosures within thirty days, and (5) posts annual privacy and security compliance audits.

School entities must maintain publicly accessible information identifying all approved AI tools and their intended uses.

The Federal Acquisition Security Council must develop a list of all artificial intelligence produced or developed by a foreign adversary within 60 days of enactment.

The Federal Acquisition Security Council must update the foreign adversary AI list at least every 180 days.

Law-enforcement agencies must conduct an annual inventory of all covered AI systems used by the agency and make the inventory publicly available by November 1 of each year, including each system's name and vendor, capabilities and limitations, data inputs and outputs, and authorized and unauthorized uses.

State agencies must publish and maintain on their website a list of all automated employment decision-making tools they use, including a description of each tool, the date the agency began using it, a summary of its purpose and use, and any other relevant information.

State agencies must not implement any AI system unless the agency has first performed an impact assessment under OPM's policies to ensure the system will not result in unlawful discrimination or disparate impact, and must not implement the system if the agency head determines it will cause such discrimination.

The Judicial Department must not implement any AI system unless it has first performed an impact assessment ensuring the system will not cause unlawful discrimination or disparate impact, and must not implement the system if the Chief Court Administrator determines it will cause such harm. The department must also perform ongoing assessments of deployed AI systems.

State agencies must not use AI in public-assistance delivery or rights-impacting functions unless compliant with OPM/DAS policies, must comply with OPM/DAS policies for AI procurement, and must complete and publicly post an AI impact assessment at least 60 days before deploying any procured AI technology.

Each unit of State government must conduct an impact assessment of high-risk AI systems — by December 31, 2026 for systems procured on or after February 1, 2026, and by July 1, 2027 for systems procured before that date.

Units of State government that employ high-risk AI must conduct regular impact assessments at a cadence determined by the Governor's AI Subcabinet.

Public bodies must complete an impact assessment under § 2.2-5519 before implementing any high-risk AI system, perform ongoing post-implementation assessments, and cease using any system determined to be non-compliant.

State agencies authorized to procure a high-risk AI system must contract with an impartial third party for an impact assessment (per Sec. 3(b) requirements), submit the assessment to the Commissioner of Administrative Services, and post it on the agency's website at least 60 days before deployment. Personally identifiable information may be redacted.

State agencies authorized to procure AI technology must contract with an independent auditor for a bias audit under Section 8. The completed bias audit must be submitted to the Commissioner of Administrative Services and posted on the agency's website at least 60 days before deployment. The agency may redact personally identifiable information.

State agencies must conduct an impact assessment before deploying any automated decision system and at least every two years thereafter, and before any material change. The assessment must describe the system's objective, evaluate its ability to achieve objectives, summarize underlying algorithms and training data, test for accuracy, bias, discrimination across protected classes, cybersecurity and privacy risks, public health and safety risks, foreseeable misuse, sensitive data handling, and individual notification mechanisms.

State agencies must conduct an impact assessment before using any automated decision system, with reassessments at least every two years and before any material change. The assessment must include: (1) description of objectives; (2) evaluation of ability to achieve objectives; (3) description of underlying algorithms, computational modes, AI tools, design, and training data; (4) testing for accuracy, fairness, bias, and discrimination across protected characteristics with mitigation plans; (5) cybersecurity and privacy risk assessment with safeguards; (6) public health and safety risk assessment; (7) foreseeable misuse assessment with safeguards; (8) assessment of sensitive/personal data requirements, use, storage, and user controls; and (9) notification mechanisms for impacted individuals.

Boards of education and boards of trustees that use surveillance systems with AI capabilities must adopt a policy that (1) describes the surveillance system, (2) identifies the types of information collected, (3) explains how the information will be used, (4) addresses data access in compliance with student-records law, and (5) requires posting of signage in prominent locations indicating AI-equipped surveillance is in use. Video surveillance policies must also comply with P.L.2017, c.119.

The Department of Administrative Services must conduct an annual inventory of all AI systems in use by state agencies — including system name, vendor, capabilities, decision-making role, and impact assessment status — and publish the inventory on the state's open data portal.

The Judicial Department must conduct an annual inventory of its AI systems — including system name, vendor, capabilities, decision-making role, and impact assessment status — and publish the inventory on the department's website.

The Department of Administrative Services must annually inventory all AI systems in use by state agencies — including system name, vendor, capabilities, decision-making role, impact assessment status, PII access, and known risks — and publish the inventory on the state's open data portal.

State agencies must not use AI in public-assistance delivery or rights-impacting functions unless compliant with OPM/DAS policies, must comply with OPM/DAS policies for AI procurement, and must complete and publicly post an AI impact assessment at least 60 days before deploying any procured AI technology.

The Department must publish an aggregated statewide AI inventory on its website, withholding only information whose publication would compromise system security or integrity, and must provide withheld information to the Governor, General Assembly members, and law enforcement upon request.

The Government Operations Agency must, beginning January 1, 2027, (1) publish all enrolled AI auditor information in a publicly accessible format on its website, (2) retain misconduct reports for as long as the auditor remains enrolled plus 10 years, and (3) share misconduct reports with other state agencies as necessary for enforcement purposes.

State agencies authorized to procure a high-risk AI system must contract with an impartial third party for an impact assessment (per Sec. 3(b) requirements), submit the assessment to the Commissioner of Administrative Services, and post it on the agency's website at least 60 days before deployment. Personally identifiable information may be redacted.

State agencies authorized to procure AI technology must contract with an independent auditor for a bias audit under Section 8. The completed bias audit must be submitted to the Commissioner of Administrative Services and posted on the agency's website at least 60 days before deployment. The agency may redact personally identifiable information.

State agencies must submit impact assessments to the governor, president of the senate, and speaker of the house at least 60 days before system implementation and publish approved assessments on the agency's website. Agencies may redact information that would substantially harm public health or safety, infringe privacy rights, or significantly impact IT security, provided an explanatory statement of the redaction determination is published alongside the redacted assessment.

The Executive Office of Public Safety and Security must publish annually by March 31 on its website disaggregated statistics on all law enforcement facial recognition searches from the prior calendar year, including totals by agency, warrant-based searches by offense, emergency searches, and the race and gender of search subjects.

The Executive Office of Public Safety and Security must publish annually by March 31 on its website disaggregated statistics on all non-law-enforcement public agency facial recognition searches from the prior calendar year, including the race and gender of search subjects for each agency.

State agencies must submit each impact assessment to the governor, president of the senate, and speaker of the house at least 60 days before implementing the assessed automated decision-making system. Approved and utilized systems' impact assessments must be published on the relevant agency's website. An agency may redact information if disclosure would substantially harm public health/safety, infringe privacy rights, or significantly impact information technology protection, provided the agency publishes an explanatory statement describing its determination process alongside the redacted assessment.

Contracting entities must execute the statewide digital privacy agreement, obtain academic-effectiveness verification, and submit all documentation to the state board of education for listing for each software product adopted. Local educational agencies must also maintain their local software inventory. The state board must publish and update the statewide master list on an ongoing basis and conduct compliance audits.

Boards of education and boards of trustees must distribute the adopted AI surveillance policy to the parents and guardians of students within the district or school.

The Office of Information Technology Services must maintain and annually publish on the New York State Open Data website a statewide inventory of all state agency artificial intelligence systems, including the purpose and uses of each system. State agencies must submit required inventory data to the office at least 60 days before each annual publication date.

The Commissioner of Labor must maintain a database of AI/automation-related WARN reports and must prepare and publish quarterly summaries analyzing the number, sector, and location of workforce reductions identified as resulting from AI or automation. Reports must be made publicly available on the Department of Labor's website and shared with the Department of Economic Development for use in workforce innovation planning and retraining programs.

All state and local law enforcement agencies must conspicuously post the ALPR minimum standards policy on their website (or in their main office if no website exists) and make the policy available to the public upon request.

The State Department of Education must create and maintain a publicly accessible Data Transparency Portal that (1) lists all data elements collected, (2) identifies which elements are mandatory versus optional, (3) publishes copies of all active vendor contracts and data-sharing agreements, (4) reports all data breaches or unauthorized disclosures within thirty days, and (5) posts annual privacy and security compliance audits.

The Office of Public Insurance Counsel must include in its annual consumer report cards information identifying and objectively comparing the use of AI-based algorithms by health benefit plan issuers and utilization review agents, with collaboration from the Texas Department of Insurance and the Health and Human Services Commission.

The Director of OMB must publish the foreign adversary AI list on a publicly available website within 180 days of enactment.

The Department of Technology must develop and adopt regulations creating an ADS procurement standard that includes (1) a detailed risk assessment procedure covering governance, purpose, misuse potential, data legality and provenance, robustness, and explainability; (2) risk control methods; (3) adverse incident monitoring procedures; (4) prohibited use case identification; (5) a detailed equity assessment; (6) a human oversight assessment; and (7) data minimization standards prohibiting vendors from using agency data for proprietary training. The Department must consider specified AI risk management publications, collaborate with stakeholders, consult with the CPPA, and solicit public comment.

The Department of Technology must, beginning January 1, 2026, and annually thereafter, review and update both the ADS procurement standard and its implementing regulations.

State agencies must not procure an ADS, enter into a contract for an ADS, or contract for any service utilizing an ADS until the Department of Technology has adopted the ADS procurement standard regulations.

State agencies must include in every ADS contract clauses that (1) provide a completed risk assessment analyzing governance, purpose, misuse potential, data legality and provenance, robustness, and explainability; (2) require adherence to appropriate procurement standards; (3) provide adverse incident monitoring procedures; (4) require agency authorization before deployment of ADS upgrades and enhancements; and (5) provide a termination right for significant vendor breaches.

State contracting agencies must include a provision in every contract entered on or after October 1, 2023 requiring the contracting business to comply with the Connecticut Data Privacy Act (Conn. Gen. Stat. §§ 42-515 to 42-525).

State agencies must not use AI in public-assistance delivery or rights-impacting functions unless compliant with OPM/DAS policies, must comply with OPM/DAS policies for AI procurement, and must complete and publicly post an AI impact assessment at least 60 days before deploying any procured AI technology.

The Indiana Department of Education must establish guidelines for creating school AI policies and publish a model school AI policy, covering disclosure requirements for students, proper and improper use examples, privacy policies, and recommendations on restricting AI platform use.

Beginning July 1, 2025, units of State government may not deploy any new AI system unless it complies with the policies and procedures adopted by the Department under § 3.5–804.

Units of State government seeking to test new technology (including AI) through a proof-of-concept pilot must obtain approval from the Secretary of Information Technology, enter into a memorandum of understanding with DoIT, and comply with competitive solicitation requirements. The Department of General Services must adopt policies and procedures for competitive proof of concept procurements.

The state chief information officer must establish by rule provenance standards for digital content on public-facing state agency webpages used for transactions or services, requiring provenance records identifying the software or tool used, creation date, content identifier, and prior content identifiers.

State agencies must not award a contract for a high-risk automated decision system to any person who has violated the Unruh Civil Rights Act, the California Fair Employment and Housing Act, or the Automated Decision Systems chapter (Bus. & Prof. Code § 22756 et seq.).

Public bodies must not implement any high-risk AI system unless they have fulfilled all requirements of Chapter 55.6 and complied with the CIO's high-risk AI policies and procedures.

Public bodies must include a CIO-developed high-risk AI system compliance clause in all procurement contracts for high-risk AI systems for which negotiation or renegotiation begins on or after July 1, 2026.

State agencies must not procure, purchase, or acquire any high-risk AI system utilizing automated decision systems except where specifically authorized by law.

State agencies and entities acting on their behalf must not use AI technology in any function related to public assistance delivery or materially impacting individuals' rights, civil liberties, safety, or welfare unless specifically authorized by law. State agencies must not procure, purchase, or acquire AI technology unless specifically authorized by law.

The state and its political subdivisions must not enter into, modify, renew, or extend an AI technology contract unless the contracting entity provides a sworn affidavit attesting it is not owned by, controlled by, or organized under the laws of a foreign country of concern.

The Department of State Police may perform facial recognition searches only for four authorized purposes: executing a felony warrant, responding to an emergency involving imminent danger of death or serious physical injury, identifying a deceased person, or acting on behalf of another agency that has obtained a warrant or documented an emergency or deceased-identification basis.

The Department of State Police must centralize all facial recognition search functions within a single facial recognition operations group and must use only facial recognition technology from the RMV, the FBI, or technology approved by the Executive Office of Technology Services and Security following a public hearing.

The Department of State Police must limit facial recognition searches to the five enumerated purposes: Registrar identity verification, warrant-based felony identification, emergencies involving imminent danger of death or serious physical injury, deceased-person identification, and searches on behalf of other agencies that have obtained a warrant or documented emergency grounds.

The Department of State Police must designate a single facial recognition operations group to receive, evaluate, and perform all facial recognition search requests, and must use only facial recognition technology currently used by the Registrar or FBI — or technology approved by the Executive Office of Technology Services and Security following a public hearing.

No executive office, department, division, agency, or commission of the commonwealth may procure, purchase, or acquire any service or system utilizing automated decision systems unless the use is specifically authorized by law.

No executive office, department, division, agency, or commission of the commonwealth may procure, purchase, or acquire any service or system utilizing or relying on automated decision systems unless the use of such system is specifically authorized by law.

The Office of Information Technology must establish minimum requirements for AI safety tests applicable to all AI technology sold, developed, deployed, used, or offered for sale in New Jersey. The requirements must include at minimum: (1) an analysis of potential cybersecurity threats and vulnerabilities; (2) an analysis of the AI technology's data sources and potential sources of bias, inaccurate information, or violations of state or federal criminal, copyright, patent, or trade secret laws; and (3) descriptions of possible remedies or defensive measures to address identified threats, biases, inaccuracies, or potential legal violations.

The Office of Information Technology must establish minimum requirements for AI safety tests — including cybersecurity threat analysis, data source and bias analysis, and remediation descriptions — and must review each annual safety test report submitted by AI companies.

State units must purchase algorithmic decision system products or services only if they adhere to responsible AI standards, including (1) harm avoidance (minimizing risks of physical or mental injury, unjustified information disclosure, and unwarranted damage to property, reputation, or environment), (2) transparency (full disclosure of system capabilities, limitations, and potential problems), (3) fairness (eliminating discrimination, embedding equality and justice as system goals, and providing feedback avenues to redress harms), and (4) comprehensive impact and risk evaluation.

State governmental entities must not enter into, extend, or renew AI contracts unless the vendor provides a sworn affidavit attesting it is not owned by, controlled by, or organized under the laws of a foreign adversary.

NIST must develop standards, guidelines, and minimum requirements for federal agency use, risk management, and procurement of AI systems (excluding national security systems), including standards for authenticating, tracking provenance, and labeling agency-generated synthetic content, and standards for testing, evaluation, verification, and validation of AI acquisitions.

Each executive agency head must, within 90 days of enactment, review all AI provided by a covered foreign adversary entity on the Section 2(a) list and consider it for exclusion and removal from agency procurement and use.

Each executive agency head must use at minimum the supply chain risk management authorities in 41 U.S.C. § 4713 to consider exclusion and removal of listed foreign adversary AI.

The Department of Criminal Justice Services must establish and publicly post on its website a model policy governing the use of covered AI systems by state and local law-enforcement agencies and sheriff's departments, covering authorized uses, a default prohibition on unauthorized uses, data practices, anti-discrimination protections, criminal-investigation disclosure requirements, and disciplinary consequences for violations.