The Department of Technology must submit a report of the comprehensive inventory of high-risk automated decision systems to the Assembly Committee on Privacy and Consumer Protection and the Senate Committee on Governmental Organization on or before January 1, 2025, and annually thereafter until the reporting requirement sunsets on January 1, 2029.

Large frontier developers must transmit to the Office of Emergency Services a summary of any assessment of catastrophic risk resulting from internal use of their frontier models every three months, or on another reasonable schedule specified by the developer and communicated in writing to the Office of Emergency Services, with written updates as appropriate.

The Department of Technology must update the Governor's report (per Executive Order N-12-23) as needed to respond to significant GenAI developments, consulting with academia, industry experts, and state employee representatives as appropriate.

Covered entities must provide written disclosures to the Division of Insurance, the Department of Human Services, or the Department of Health Care Policy and Financing, as applicable, identifying: (1) the utilization review functions for which the AI system will be used; (2) the points in the utilization review process when the AI system is used; (3) the human oversight process, including the qualifications of the reviewer and whether a human must approve an adverse determination; and (4) the process for maintaining audit information sufficient to demonstrate compliance with the utilization review requirements.

Employers that rely solely on AI analysis of video interviews to select applicants for in-person interviews must collect demographic data (race and ethnicity) on applicants who are and are not advanced to in-person interviews and applicants who are hired, and must report this data annually to the Department of Commerce and Economic Opportunity by December 31, covering the 12-month period ending November 30.

Law enforcement agencies must adopt a facial recognition technology use policy before deploying the technology and must file a full copy of the policy (or any revision) with the Justice and Public Safety Cabinet within 30 days of adoption or revision.

Law enforcement agencies must submit their annual FRT report to the Governor's Office of Crime Prevention, Youth, and Victim Services by May 1 each year. The Governor's Office must compile and transmit the reports, disaggregated by agency, to the Governor and General Assembly by October 1.

Each public senior higher education institution and Baltimore City Community College must (1) establish functionally compatible high-risk AI governance policies for research and academic AI by June 1, 2025, and (2) submit an annual report to the Department by September 1, 2025, and each year thereafter, on all high-risk AI procured and deployed for a research or academic purpose.

The AI Subcabinet must develop and submit to the Governor and General Assembly by December 1, 2024, a roadmap reviewing risks and opportunities of AI across twelve State service areas, including study plans, prioritization, stakeholders, and projected timelines.

The AI Subcabinet must submit a report to the Governor and General Assembly by December 1, 2025, on the sufficiency of the Subcabinet structure and the potential transition to a standalone department or independent unit.

Large frontier developers must transmit to the Office a summary of any assessment of catastrophic risk resulting from internal use of their frontier models every three months, or on another reasonable schedule agreed upon with the Office.

Each executive branch department must report its AI malicious-use prevention plan, findings, and recommendations to every member of the general assembly no later than January 1, 2025.

Health carriers writing at least 1% of total accident and health premiums in Washington must report annually to the OIC by October 1 the total number of prior authorization requests, approvals, and denials — including the percentage of denials aided by AI, the percentage of determinations exceeding statutory turnaround deadlines, and the number of nonelectronic requests — along with code-level data and trend data, broken out separately for carrier-direct and delegated health care benefit manager determinations.

MRO applicants must conduct an annual independence audit covering board composition, resource availability, funding sources, and civil society representation, and must report audit findings to the Attorney General.

Covered businesses must file an annual report with the Department of Labor by March 1 of each year covering the preceding calendar year. The report must include: (1) employment data estimating the number of employees displaced or whose hours were reduced due to AI, the number hired or whose hours increased due to AI, and the number of positions previously filled that the business decided not to fill due to AI; and (2) information on the nature of AI usage, including objectives of AI use, human oversight of AI, frequency and length of AI use, any use of AI in relation to sensitive personal data (including storage and access protections), and measures in place for oversight, risk reduction, or other protections related to AI use.

Every developer and deployer of a high-risk AI system must file with the attorney general a copy of the last completed independent audit together with each report required under this section.

Developers of high-risk AI systems must complete and file reports with the attorney general on the following schedule: (1) an initial report within six months after completion of development and initial offering to a deployer or initial deployment, (2) annually thereafter, and (3) within six months of any substantial change. Developer reports must include: a description of the system's intended uses and disallowed uses, an overview of how the system was developed, an overview of training data, and any other information necessary to allow deployers to understand the outputs, monitor compliance, and fulfill their duties under this article. For systems already deployed at the effective date, developers have 18 months to file the first report and associated audit.

Deployers of high-risk AI systems must complete and file reports with the attorney general on the following schedule: (1) an initial report within six months after initial deployment, (2) a second report within one year of the first, (3) biennially thereafter, and (4) within six months of any substantial change. Deployer reports must include: a description of actual, intended, or planned uses for consequential decisions and whether any developer-unintended uses are occurring; and an impact assessment covering algorithmic discrimination risk and mitigation steps, monetization plans (if applicable), and a cost-benefit evaluation for consumers and end users. A deployer that is also a developer may submit a single joint report containing all required information. For systems already deployed at the effective date, deployers have 18 months to file the first report and associated audit.

Insurers must disclose to OHIC and DBR how they use AI to manage healthcare claims and coverage, including the model types used, AI's role in decision-making, training datasets, performance metrics, governance and risk-management policies, and the decisions where AI made or substantially contributed.

Carriers must publicly disclose to the Bureau of Insurance their use of AI to manage insurance claims and coverage, including the underlying algorithms, data used, and resulting determinations.

Social media platforms with known minor Alaska-resident users must submit an annual report to the attorney general that includes: (1) a description of design features used by the platform that may affect minors; (2) a description of measures taken to mitigate harm to minors; (3) a summary of data collection and privacy practices relating to minors; and (4) a description of any internal assessments conducted regarding engagement or wellbeing of minors. The report may not be required to disclose proprietary algorithms or trade secrets.

Healthcare insurers must submit quality assurance testing results to the Insurance Commissioner at least semiannually and publish those results on a public website within 30 days of submission.

AI businesses must submit a transparency report to the Attorney General before using or selling a high-risk AI system, including the system's purposes and operation, results from internal risk assessment evaluations, and measures implemented to mitigate bias and harmful outcomes.

The commission must, by January 1, 2028, adopt standards requiring electrical and gas corporations to disclose the types of artificial intelligence models they use and how those models are used.

Electrical and gas corporations must file a compliance plan with the commission demonstrating compliance with the adopted AI standards. The commission may request records to verify compliance. Plans filed by electrical corporations must be reviewable by the Office of Energy Infrastructure Safety to ensure AI models used for wildfire mitigation are consistent with the corporation's wildfire mitigation plan.

Developers must provide the Attorney General with documentation regarding each automated decision system, in a form and manner prescribed by the Attorney General, including: (1) a general statement of reasonably foreseeable uses and known harmful or inappropriate uses; (2) documentation disclosing the system's purpose, intended benefits, high-level training data summaries, known limitations and discrimination risks, mitigation measures, pre-distribution performance evaluation methods, data governance measures covering training data suitability and bias, intended use/non-use/monitoring instructions, and all information necessary for deployers to comply with their own obligations; and (3) any additional documentation reasonably necessary for deployers to understand outputs and monitor discrimination risk.

Large frontier developers must transmit to the Attorney General a summary of any assessment of catastrophic risk resulting from internal use of their frontier models at least every 3 months.

Large frontier developers must transmit to the Attorney General a summary of catastrophic risk assessments from internal use of their frontier models every 3 months or on another reasonable schedule communicated in writing to the Attorney General.

State agencies must submit each impact assessment to the Governor and the General Assembly at least 30 days before implementing the automated decision-making system. All other public bodies must submit each assessment to the director, executive officers, or primary administrator of the relevant governing body at least 30 days before implementation. Employers may redact information from published or submitted assessments if disclosure would substantially harm public health or safety, infringe privacy, or impair IT/operational security, or if the assessment covers security-incident prevention technology — but must publish an explanatory statement describing the determination process for each redaction alongside the redacted assessment.

Academic medical centers conducting AI-assisted therapy research must (1) register each qualified research program with the Department within 30 days of IRB approval, (2) submit annual reports summarizing participant counts, serious adverse events, protocol modifications, and scientific findings, and (3) notify the Department within 10 business days of any IRB suspension or termination of a research protocol.

Auto insurers seeking any rate change must file a complete rate application with the Director of Insurance, bear the burden of proving the requested rate is justified and complies with the Section, and obtain prior approval before the change takes effect (deemed-approval after 60 days absent disapproval, hearing, or a Director-initiated review).

Large frontier developers must transmit to the Attorney General a summary of any assessment of catastrophic risk resulting from internal use of their frontier models at least every 3 months.

Large frontier developers must transmit to the Agency a summary of catastrophic risk assessments resulting from internal use of their frontier models every 3 months or on another reasonable schedule communicated in writing to the Agency.

Employers must, when reporting the reason for a mass layoff or closing under the Illinois WARN Act, disclose any artificial intelligence-related job impacts, including the number of employees laid off substantially due to AI replacement or automation of their job functions.

Large frontier developers must transmit to the attorney general a summary of any assessment of catastrophic risk resulting from internal use of their frontier models every three months or on another reasonable schedule communicated in writing to the department.

Carriers must annually submit to the Division of Insurance by December 31 a prescribed form detailing AI algorithms and data training sets used or planned for use in utilization review, together with an attestation that such algorithms and training data have minimized bias risk across protected characteristics and adhere to evidence-based clinical guidelines.

Large frontier developers must transmit to the Attorney General a summary of catastrophic risk assessments from internal use of their frontier models every three months, or on another reasonable schedule communicated in writing to the Attorney General.

Developers must annually submit to the attorney general a compliance statement signed by the CTO or more senior officer, containing (1) an assessment of critical harms the model may cause, (2) an assessment of residual risk despite safety protocol compliance, and (3) a description of the verification process. The initial statement must be submitted within 30 days of deployment or commercial release.

Employers must submit a copy of every pre-use notice to the Commissioner of Labor and Industry within ten days of providing the notice to workers.

Employers must, within thirty days after each quarter-end, disclose to the director of the department of labor and industrial relations all AI-related job impacts for the preceding quarter, including AI-driven layoffs, AI-driven hires, positions left unfilled due to AI replacement, individuals being retrained due to AI, and corresponding NAICS codes.

Employers must annually report the demographic data collected under subsection (d) to the Department of Labor and Workforce Development.

Large frontier developers must annually submit to the Attorney General a Risk Management Disclosure explaining the technical and organizational protocols they have implemented to reduce the risk of frontier models contributing to catastrophic harm.

Large frontier developers must structure their Risk Management Disclosure to map each of their actions to the suggested actions in the current NIST AI Risk Management Framework, stating for each whether it is relevant, whether adopted, how implemented or why not, the compliance criteria used, and who is responsible.

Large frontier developers must clearly identify which sections of their Risk Management Disclosure were written, edited, or otherwise contributed to by a generative AI system.

Artificial intelligence companies must annually submit a report to the Office of Information Technology containing: (1) a list of all AI technologies tested; (2) a description of each safety test conducted, including the test's adherence to OIT requirements; (3) a list of all third parties used to conduct safety tests, if any; and (4) the results of each safety test administered.

Employers must annually report the collected race and ethnicity demographic data to the Department of Labor and Workforce Development.

Employers must report the demographic data collected under subsection (d) annually to the New Jersey Department of Labor and Workforce Development.

Artificial intelligence companies must annually submit to the Office of Information Technology a report listing all AI technologies tested, describing each safety test conducted and its adherence to OIT requirements, identifying any third parties used for testing, and providing the results of each safety test.

Employers with 100 or more employees that deploy AI systems resulting in layoffs must file an AI Impact Disclosure with the Department of Labor and Workforce Development. The disclosure must contain, at minimum, the date the AI tool was deployed, the date of layoffs, and the number of workers displaced by the AI deployment.

AI infrastructure entities must conduct an environmental impact assessment at the time of initial deployment and annually thereafter, and file the assessment with the Department of Labor and Workforce Development. An additional environmental impact assessment must be conducted and filed with any capacity expansion.

Insurers must submit their AI-based algorithms and training data sets to the Superintendent, with a certification that they (1) minimize bias risk across protected characteristics and comply with antidiscrimination laws, (2) adhere to evidence-based clinical guidelines, (3) do not rely on non-compliant information, and (4) do not independently create or change clinical standards or coverage criteria.

Insurers must submit to the superintendent data on the amount of time each clinical peer reviewer spends examining an adverse determination before signing off, in such form and manner as the superintendent may require.

Operators must submit a copy of each user oath to the Attorney General within thirty days of the user making the oath, in the form and manner designated by the Attorney General.

Insurers, Article 43 corporations, and HMOs must submit the artificial intelligence-based algorithms and training datasets that are being used or will be used in the utilization review process to the Department of Financial Services for bias certification review.

Any person developing an autonomous weapons system (as defined in § 501(2)(i)) within New York must disclose in writing to the Secretary of State, prior to active development, the names and addresses of all persons involved, a description of the system, the system's functions and intended use cases, and measures that will be taken to mitigate risks. The Secretary may require cessation of development based on this disclosure.

License applicants must submit a written, sworn application containing: (a) the exact name and address of the applicant (and member/officer/incorporation details as applicable); (b) the name and business and residential address of each member of the ethics and risk management board, each principal, and each officer; and (c) a description of all known general use cases of the advanced AI system, including any purposes foreseen to be implemented by the applicant.

The ethics and risk management board of each operator must annually submit to the Secretary a comprehensive report for each licensed high-risk advanced AI system covering: (a) all possible use cases (intended and unintended, likely and unlikely); (b) a thorough risk assessment for each use case evaluating potential harm across privacy, security, fairness, economic implications, societal well-being, and safety; (c) a detailed evaluation of known user use cases with recommendations on whether certain applications should be constrained or banned; (d) a mitigation plan for each identified risk including preemptive measures, monitoring processes, and responsive actions, plus a user/stakeholder communication strategy; (e) a comprehensive review of all incidents or failures in the past year; (f) user education efforts and plans considering varying digital literacy levels; (g) disclosure of ethics board conflicts of interest and measures to manage them; and (h) an update on measures taken to ensure adherence to applicable AI laws, regulations, and ethical guidelines.

Licensees must obtain express written consent from the Secretary before implementing any source code modification or upgrade in an accessible version of the system. The licensee must submit a written description of the purpose, new or modified functions, reason for the change, and an assessment of new or heightened risks. The Secretary has 30 business days to approve or reject (extendable by 30 additional business days); if no response is received, the change is deemed approved. Source code rewrites are subject to the same requirements but are reviewed as new applications within 180 business days (extendable by 180 days). All modifications, upgrades, and rewrites must be conducted in a pre-production environment. Updates (minor enhancements, bug fixes, cosmetic changes, security patches) are exempt from this requirement.

Employers must provide to the Department of Labor, no less than annually, the summary of the most recent disparate impact analysis for each automated employment decision tool in use.

The Office of Information Technology Services must submit a copy of the AI inventory to the Governor, the Temporary President of the Senate, and the Speaker of the Assembly.

Employers must submit each impact assessment to the Department of Labor at least thirty days prior to the implementation of the artificial intelligence system that is the subject of the assessment.

Covered entities found by the Superintendent to have deployed automated lending decision-making tools producing discriminatory or biased outcomes must comply with any enhanced reporting requirements the Superintendent imposes, which may include additional annual reports, reports with additional information, or direct submission of all reports to the Department.

Covered developers and deployers must file each required report with the Department of Financial Services together with a copy of the last completed audit.

Covered developers must file reports with the Department of Financial Services within six months of completing development, annually thereafter, and within six months of any substantial change, describing intended and disallowed uses, how the system was developed, its training data, any audit, and information enabling deployer compliance.

Developers must submit documentation to the Attorney General affirming: (1) the identities and qualifications of professional domain experts involved in the AI technology, (2) the specific phases of development in which such experts contributed, and (3) any known risks, limitations, or ethical concerns disclosed during development. The Attorney General reviews submissions and issues certificates of compliance to compliant developers.

Developers and deployers must, within 30 days after completing a full pre-deployment evaluation, full impact assessment, or developer annual review: (1) submit the evaluation, assessment, or review to the Division of Consumer Protection; (2) publish a summary on their website in a manner easily accessible to individuals; and (3) submit the summary to the Division. Upon request, the evaluation, assessment, or review must be made available to the legislature. All evaluations, assessments, and reviews must be retained for at least 10 years. Trade secrets may be redacted from public disclosures; personal data must be redacted.

Insurers must submit to the Superintendent data on the amount of time each clinical peer reviewer spends examining an adverse determination before signing off, in the form and manner the Superintendent requires.

Employers must submit the completed AI impact assessment to the Department of Labor at least 30 days prior to implementation of the AI system that is the subject of the assessment.

Candidate committees must submit their synthetic media usage records to the State Board of Elections no later than one month after their election is certified. All other committees must submit such records no later than one month after election day.

Covered entities found by the superintendent to have deployed a tool producing discriminatory or biased outcomes must comply with any enhanced reporting requirements imposed by the superintendent, which may include additional annual reports, reports with additional information, or direct submission to the department.

Covered businesses must submit an annual report to the Department of Labor on or before March 1 of each year covering the preceding calendar year. The report must include: (1) employment data — estimates of employees displaced or whose hours were reduced due in full or in part to AI, employees hired or whose hours increased due in full or in part to AI, and positions previously filled that the business decided not to fill due in full or in part to AI; and (2) AI usage information — descriptions of the objectives of AI use, information regarding human oversight of AI, frequency and length of AI use, use of AI in relation to sensitive personal data including storage and access protections, and measures in place for oversight, risk reduction, or other protections related to AI use.

Employers filing a WARN notice must include a statement indicating whether the employment losses are the result, in whole or in part, of the introduction, expansion, or adoption of AI systems, automation technologies, or machine-based processes that have replaced or materially altered the duties of affected employees. The statement must also include, to the extent known at the time of notice: (1) the estimated percentage of positions affected due to such automation or AI integration, and (2) a brief description of the technology or process that contributed to the reduction.

Health plan issuers must file an annual report with the Superintendent of Insurance on or before March 1, covering: (1) each provider in the issuer's network; (2) the number of covered persons enrolled in health benefit plans in Ohio in the preceding calendar year; and (3) whether the issuer used, is using, or will use AI-based algorithms in utilization review processes, and if so: the algorithm criteria, data sets used to train the algorithm, the algorithm itself, outcomes of the software, and data on the amount of time a human reviewer spends examining each adverse determination before signing off. The report must be submitted in a form prescribed by the Superintendent, and an officer of the health plan issuer must verify its contents.

Licensed IVOs must provide written notice to the attorney general of any material changes to their verification plan, describing the proposed changes, the rationale, and how the changes will better ensure acceptable risk mitigation.

Health plan issuers must annually file a report with the Superintendent of Insurance on or before March 1. The report must cover: (1) each provider in the issuer's network; (2) the number of covered persons enrolled in health benefit plans in Ohio in the preceding calendar year; and (3) whether the issuer used, is using, or will use AI-based algorithms in utilization review, and if so: the algorithm criteria, data sets used to train the algorithm, the algorithm itself, outcomes of the software, and data on the time a human reviewer spends examining each adverse determination before signing off. The report must be submitted in a form prescribed by the superintendent, and an officer of the health plan issuer must verify its contents.

Facilities using AI-based algorithms for clinical decision making must annually file an AI compliance statement with the Department of Health, in the form and manner prescribed by the department. Each statement must: (1) summarize the function and scope of the AI algorithms, (2) provide a logic or decision tree, (3) describe each training data set including its source, (4) attest that the algorithms and training data comply with responsible-use requirements and provide supporting evidence, and (5) describe the facility's process for overseeing and validating algorithm performance and compliance.

Insurers using AI-based algorithms in utilization review must annually file an AI compliance statement with the Insurance Department, in the form and manner prescribed by the department. Each statement must: (1) summarize the function and scope of the AI algorithms, (2) provide a logic or decision tree, (3) describe each training data set including its source, (4) attest that the algorithms and training data comply with responsible-use requirements and provide supporting evidence, and (5) describe the insurer's process for overseeing and validating algorithm performance and compliance.

MA or CHIP managed care plans using AI-based algorithms in utilization review must annually file an AI compliance statement with the Department of Human Services. Each statement must: (1) summarize the function and scope of the AI algorithms, (2) provide a logic or decision tree, (3) describe each training data set including its source, (4) attest that the algorithms and training data comply with responsible-use requirements and provide supporting evidence, and (5) describe the plan's oversight and validation process.

Suppliers must file the written disclosure policy with the Bureau of Consumer Protection, in the form and manner prescribed by the bureau, along with: (1) the name and address of the supplier; (2) the name of the chatbot; and (3) an annual filing fee as prescribed by the bureau.

Facilities using AI-based algorithms for clinical decision making must annually file an AI compliance statement with the Department of Health. The statement must: (1) summarize the function and scope of the AI algorithms, (2) provide a logic or decision tree, (3) describe each training data set including its source, (4) attest that the algorithms and training data comply with responsible-use requirements and provide evidence of compliance, and (5) describe the facility's process for overseeing and validating AI performance and compliance.

Insurers using AI-based algorithms in utilization review must annually file an AI compliance statement with the Insurance Department. The statement must: (1) summarize the function and scope of the AI algorithms, (2) provide a logic or decision tree, (3) describe each training data set including its source, (4) attest compliance with responsible-use requirements and provide evidence, and (5) describe the insurer's process for overseeing and validating AI performance and compliance.

MA or CHIP managed care plans using AI-based algorithms in utilization review must annually file an AI compliance statement with the Department of Human Services. The statement must: (1) summarize the function and scope of the AI algorithms, (2) provide a logic or decision tree, (3) describe each training data set including its source, (4) attest compliance with responsible-use requirements and provide evidence, and (5) describe the plan's process for overseeing and validating AI performance and compliance.

Insurers must disclose to OHIC and DBR how they use artificial intelligence to manage healthcare claims and coverage, including: the types of AI models used, the role of AI in the decision-making process, training datasets, performance metrics, governance and risk management policies, and the specific decisions on claims and coverage where AI made or was a substantial factor in the decision.

Health carriers using AI, algorithms, or software tools for utilization review must compile an annual report detailing (1) how the AI tool was used in the utilization review process during the preceding fiscal year, and (2) the nature and degree of human review and oversight used to affirm or negate determinations. The report must be forwarded to the Executive Board of the Legislative Research Council on or before December 1 of each year.

Health benefit plan issuers must submit their AI-based algorithms and training datasets used or potentially used in utilization review to the Texas Department of Insurance in the form and manner prescribed by the commissioner.

The Secretaries of Treasury, Homeland Security, and Commerce must jointly submit to Congress, within 180 days of enactment and annually thereafter, a report describing interagency policies to defend against AI-enabled financial crimes, itemizing currently available resources, and identifying additional resource needs — addressing deepfakes, voice cloning, foreign election interference, synthetic identities, market-disrupting false signals, and overall digital fraud.

The Secretaries of Treasury, Homeland Security, and Commerce must jointly submit to Congress, within 90 days of each annual report, legislative recommendations and best practices to assist American businesses and government entities with risk mitigation and incident response to AI-enabled financial crimes.

Covered entities must submit to the FTC (1) an annual summary report for each deployed covered algorithm's ongoing impact assessment and (2) an initial summary report for any new covered algorithm prior to deployment.

Covered entities must include in their summary reports to the FTC: entity identification, a description of the critical decision the algorithm addresses, intended purpose, stakeholder consultation records, performance testing and differential performance evaluation results, publicly stated guardrails, data sourcing documentation, transparency and explainability measures, identified material negative impacts and remediation steps, infeasibility documentation, and any identified improvement resources — all in the format specified by the FTC.

Developers and deployers must submit full pre-deployment evaluations, impact assessments, and annual reviews to the FTC within 30 days of completion, make them available to Congress on request, publish summaries on their websites, and retain all records for at least 10 years. Trade secrets may be redacted; personal data must be redacted from public disclosures.

The Director of OMB must issue regulations or policies within 180 days of enactment to ensure federal-official compliance with the AI-content disclosure requirement and to establish specific formatting, placement, and wording guidelines for the disclaimer across various media formats.

Each covered agency's civil rights office must submit a biennial report to its congressional oversight committees — first due one year after enactment — detailing the state of covered-algorithm technology and risks, mitigation steps taken, stakeholder engagement actions, and legislative or administrative recommendations regarding algorithmic bias, discrimination, and related harms.

Covered entities must submit specified information related to each foundation model to the FTC and make certain information publicly available for each foundation model they provide.

Covered entities must submit to the FTC (1) an annual summary report for each ongoing deployed automated decision system or augmented critical decision process, and (2) an initial summary report for any new system or process prior to its deployment.

Covered entities must include in each summary report submitted to the FTC: entity identifying information, the specific critical decision being made, intended purpose, stakeholder consultation records, testing and evaluation documentation including differential performance results, publicly stated guardrails, data sourcing information, transparency and explainability measures, consumer contest/appeal mechanisms, identified material negative impacts and remediation steps, infeasible requirement documentation, and improvement resources, all in the format specified by the FTC.

Regulated entities supervised by more than one financial regulatory agency must notify each such agency of any AI Innovation Lab application within 5 business days of submission to the appropriate financial regulatory agency.

Developers and deployers must submit all full pre-deployment evaluations, full impact assessments, and developer annual reviews to the FTC within 30 days of completion, make them available to Congress on request, publish a summary on their website, and retain all records for at least 10 years. Trade secrets may be redacted; personal data must be redacted from public disclosures.

Each covered agency's office of civil rights must submit biennial reports to its congressional oversight committees detailing (1) the state of covered algorithm technology and associated bias risks, (2) agency mitigation steps, (3) stakeholder engagement actions, and (4) recommendations for legislative or administrative action to address algorithmic bias and discrimination.

The Secretary of Defense must notify Congress within five days of issuing an autonomous weapon system waiver for development, fielding, or substantial system modification, including the rationale, system description, operational parameters and safeguards, performance testing results, and anticipated waiver duration, in unclassified form with optional classified annex.

Developers and deployers must file reports with the Attorney General prior to deployment of an automated decision system used in a consequential decision and then annually, or after each substantial change to the system, whichever comes first. Each report must be accompanied by a copy of the last completed independent audit and a legal attestation that the system either (1) does not violate any provision of this subchapter, or (2) may violate or does violate one or more provisions, together with a remediation plan and summary.

Developers must file with the Attorney General a report containing: (1) system description including software stack, purpose, expected benefits, current and intended uses, impacted stakeholders; (2) intended outputs and whether they may be used beyond articulated purposes; (3) training methodology including pre-processing steps, dataset descriptions, data sources, collection rationale, data quality and appropriateness, breadth of training data, data gap remediation, and compliance with privacy, data security, and copyright laws; (4) use and data management policies; (5) information necessary for deployers to understand outputs and monitor compliance; (6) information necessary for deployer compliance with deployer reporting requirements; (7) system capabilities and developer-imposed limitations including out-of-scope uses, safeguards, guardrails, and testing thereof; (8) internal risk assessment with testing documentation and results covering algorithmic discrimination, validity and reliability, privacy and autonomy, and safety and security risks, plus actions taken and subsequent testing; and (9) monitoring requirements.

Deployers must file with the Attorney General a report containing: (1) system description including software stack, purpose, expected benefits, current and intended uses, impacted stakeholders; (2) intended outputs and whether they may be used beyond articulated purposes; (3) revenue and monetization disclosures; (4) whether the system makes consequential decisions autonomously or supports human decision-making; (5) system capabilities and deployer-imposed limitations including out-of-scope uses, safeguards, guardrails, and testing thereof; (6) cost-benefit assessment for consumers given system purpose, capabilities, and probable use cases; (7) internal risk assessment with testing documentation and results covering algorithmic discrimination, accuracy and reliability, privacy and autonomy, and safety and security risks, plus actions taken and subsequent testing; and (8) monitoring requirements.

Deployers must submit an AI System Safety and Impact Assessment to the Division of Artificial Intelligence prior to deploying any inherently dangerous AI system in Vermont and every two years thereafter. Deployers must also submit an updated assessment whenever a material and substantial change is made to the system's purpose or the type of data the system processes or uses for training.

Deployers must ensure each AI System Safety and Impact Assessment includes all 13 enumerated categories: (1) system purpose; (2) deployment context and intended use cases; (3) benefits of use; (4) foreseeable risks of unintended or unauthorized uses and mitigation steps; (5) whether the model is proprietary; (6) description of training data; (7) whether training data has been processed to remove personal information, copyrighted information, and do-not-train data; (8) transparency measures including identifying to individuals when the system is in use; (9) identification of third-party AI systems or datasets relied on; (10) whether the developer disclosed testing results, vulnerabilities, and safe-use parameters; (11) description of post-deployment input data; (12) post-deployment monitoring and user safeguards including the oversight process; and (13) how the model impacts consequential decisions or biometric data collection.

Providers must submit a description of the AI model to the Secretary of State as part of annual registration, including the model's capacity, training data, intended use, design process, and methodologies.

Developers must produce documentation to the Attorney General within 90 days of a request, covering the statements and documentation required under subsection (2). Materials are exempt from Colorado Open Records Act disclosure and may be designated as trade secret or proprietary.

Deployers must produce to the Attorney General within 90 days of a request the risk management policy, impact assessments, and associated records. Materials are exempt from Colorado Open Records Act disclosure and may be designated as trade secret or proprietary.

Developers must, upon request by the attorney general, disclose to the attorney general within 90 days the deployer documentation described in subsection (2). The AG may evaluate the documentation for compliance. The documentation is not subject to Colorado Open Records Act disclosure. Developers may designate materials as proprietary or trade secret, and disclosures of privileged or work-product-protected material do not constitute waiver.

Deployers must, upon request by the attorney general, disclose to the attorney general within 90 days the risk management policy, impact assessment, or retained records. The AG may evaluate these materials for compliance. Materials are not subject to Colorado Open Records Act disclosure. Deployers may designate materials as proprietary or trade secret, and disclosures of privileged or work-product-protected material do not constitute waiver.

Upon receipt of a civil investigative demand from the attorney general, developers and deployers must produce documentation including: a high-level description of the AI system's purpose, intended use, deployment context, and associated benefits; the type of data used for training; the categories of input data; the system's outputs; performance metrics; known limitations; post-deployment monitoring and user safeguards (including, for deployers, oversight and learning processes); and any other relevant documentation reasonably necessary for the investigation.

Utilization review agents must make their automated decision systems used for utilization review available for audit and inspection by the Commissioner of Insurance at any time.

Developers and deployers must comply with civil investigative demands from the Attorney General by producing requested information, statements, or documentation. Trade secrets may be redacted with an affirmative statement to the AG that the basis is trade secret protection. Attorney-client privileged materials are protected from waiver. All materials provided are exempt from FOIA disclosure.

Developers must disclose to the Attorney General any statement or documentation described in the chapter when relevant to an AG investigation. Deployers must disclose risk management policies, impact assessments, and records maintained under the chapter when relevant to an AG investigation.

Developers, deployers, and auditors must provide an unredacted copy of any performance evaluation or impact assessment to the Attorney General within 30 days of request. Disclosure does not waive attorney-client privilege, work-product protection, or trade secret protection. Documents are exempt from the California Public Records Act. Each day of continued ADS use without submission after an AG request constitutes an additional violation.

Persons using or distributing pricing algorithms must, within 30 days of a written request from the Attorney General, provide information related to their pricing algorithms.

A senior corporate officer (CEO, chief economist, CTO, or officer of similar authority) must certify the accuracy of any report submitted to the Attorney General regarding pricing algorithms.

State agencies must require developers of high-risk automated decision systems deployed by the state agency to provide a copy of the impact assessment to the state agency. The impact assessment provided to the state agency must be kept confidential.

Developers must provide to the Attorney General or Civil Rights Department, within 30 days of a request, a copy of any impact assessment performed under this chapter. Impact assessments provided under this subdivision must be kept confidential.

Health insurance issuers must comply with Department of Insurance requests for information and documentation relating to AI systems and predictive models, including documentation on AI systems governance, risk management, and use protocols; preacquisition and preutilization diligence, monitoring, and auditing of third-party AI systems and data; and implementation and compliance with the issuer's AI systems program. This includes responding to inquiries regarding any specific model, AI system, or application thereof during investigations or market conduct actions.

Developers and deployers must disclose their risk management policy and program to the attorney general in a form and manner prescribed by the attorney general upon the attorney general's request. The attorney general may evaluate the program for compliance.

Insurers must submit to OHIC and DBR, upon request, all information, documents, and software that permits enforcement of this chapter.

Insurers must produce to OHIC and DBR, on request, all information, documents, and software necessary to permit enforcement of the chapter.

Carriers must submit to the Bureau of Insurance, upon request, all information — including documents and software — necessary for enforcement of the AI disclosure requirements.

Healthcare insurers must submit to the Insurance Commissioner data on the amount of time a human reviewer spends examining each adverse determination before signing off on a denial, in the form and manner the Commissioner requires.

Electrical and gas corporations must file a compliance plan with the commission demonstrating compliance with the adopted AI standards. The commission may request records to verify compliance. Plans filed by electrical corporations must be reviewable by the Office of Energy Infrastructure Safety to ensure AI models used for wildfire mitigation are consistent with the corporation's wildfire mitigation plan.

Developers must produce any documentation or records required by this section to the Attorney General within seven days of a request, in a form and manner prescribed by the Attorney General. Records disclosed are exempt from Georgia's open-records requirements. Developers may designate materials as proprietary or trade secret, and disclosure does not waive attorney-client privilege or work-product protection.

Deployers (or contracted third parties) must produce any documentation or records required by this chapter to the Attorney General within seven days of a request, in a form and manner prescribed by the Attorney General. Records disclosed are exempt from Georgia's open-records requirements. Deployers may designate materials as proprietary or trade secret, and disclosure does not waive attorney-client privilege or work-product protection.

Developers must produce to the attorney general any statement or documentation required under the deployer-disclosure provisions when requested in connection with an investigation, subject to trade secret, proprietary information, and attorney-client privilege protections. Disclosure to the attorney general does not waive privilege or work-product protection.

Developers that redact published documents must retain unredacted versions for at least 5 years and make them available to the Attorney General upon request, and must describe the character and justification of each redaction in the published version.

Employers must file annual or special reports with the Indiana Department of Labor when required, on prescribed forms, answering specific questions about their use of automated decision systems for employment decisions. Employers must also maintain, keep, preserve, and make available to the department all records pertaining to compliance with this chapter.

Covered insurers must, upon request during a market conduct examination, provide the Commissioner with AI governance documentation, access to algorithmic systems and data, complete disparate impact audit reports, and demonstrations of system explainability. Insurers bear the cost of independent experts retained by the Commissioner.

Upon request of the Commissioner of Insurance, health insurance issuers must disclose the data sources, training parameters, and validation methods used to develop any AI or automated decision system used in coverage determinations.

Developers must, upon request by the attorney general, disclose the documentation described in Section 2(b) no later than 90 days after the request in the form and manner prescribed by the attorney general. Developers may designate materials as proprietary or trade secret. Disclosures are exempt from the Massachusetts Public Records Law and do not waive attorney-client privilege or work-product protection.

Deployers must, upon request by the attorney general, disclose the risk management policy, impact assessments, and associated records no later than 90 days after the request in the form and manner prescribed by the attorney general. Deployers may designate materials as proprietary or trade secret. Disclosures are exempt from the Massachusetts Public Records Law and do not waive attorney-client privilege or work-product protection.

Large developers must publish all compliance documents required by this act on a conspicuous page on their website. If redacting any document to protect trade secrets, public safety, national security, or to comply with applicable law, the large developer must: (1) retain the unredacted version for at least five years and provide the attorney general with the ability to inspect it on request, and (2) describe the character and justification of redactions in the published version. The same redaction and retention requirements apply to auditors publishing audit reports.

Contracting entities and vendors must provide the state board of education access to all records, documents, and data necessary for compliance audits and vendor reviews. Following each audit, the state board must issue a written compliance report identifying noncompliance findings, required corrective actions, and remediation timelines. The board may publish summary audit findings for public transparency.

The Office of Information Technology must review each annual safety test report submitted by an artificial intelligence company.

Operators must submit to periodic Secretary-initiated evaluations of their source code and system outcomes. Following the Secretary's binding recommendations, operators must consult with the Secretary on implementation feasibility, provide a detailed implementation plan with a timeline, and comply with that plan. Amendments to the plan require written notice to the Secretary describing the unexpected occurrence and proposed changes; the Secretary has 30 days to approve or reject amendments. If amendments are rejected, the operator must proceed with the original plan.

Licensees must cooperate with Secretary-initiated investigations and examinations by producing all relevant books, records, accounts, documents, source code, and logs, and by making persons available for examination under oath. Licensees must pay all expenses incurred in any examination, including proportionate shares of travel and subsistence costs, upon written notice of the assessment from the Secretary.

Developers must, to the extent feasible, make available to deployers and other developers the documentation and information necessary for the deployer (or a third party contracted by the deployer) to complete an impact assessment under this article. Documentation must be delivered through model cards, dataset cards, or other impact assessments. A developer that also serves as deployer for the same system is not required to generate this documentation unless the system is provided to an unaffiliated deployer.

Developers must, upon request by the attorney general as part of an investigation, disclose to the attorney general the general statement and documentation described in subdivision 2 of this section, in a form and manner prescribed by the attorney general. The developer may designate trade secret, security-sensitive, or FOIL-exempt information, and such information shall be exempt from public disclosure. Attorney-client privilege and work product protection are preserved and not waived by disclosure.

Deployers (or their contracted third parties) must, upon AG request as part of an investigation, disclose to the attorney general within 90 days the risk management policy, the impact assessment, and records maintained under § 1552. Deployers may designate trade secret, FOIL-exempt, or legally protected information, and such information shall be exempt from public disclosure. Attorney-client privilege and work product protection are preserved.

Developers of general-purpose AI models must, upon AG request as part of an investigation, disclose to the attorney general within 90 days any documentation maintained under § 1553, in a form and manner prescribed by the AG. Developers may designate trade secret, FOIL-exempt, or legally protected information, and such information shall be exempt from public disclosure. Attorney-client privilege and work product protection are preserved.

Covered entities must comply with investigations by the Superintendent, including producing all relevant books, records, accounts, and documents upon demand and making individuals available for examination under oath.

Developers must produce, within 30 days of service (or upon entry of a protective order for trade secrets), records sufficient to identify with certainty the text and data from a journalism provider's content used to train the developer's generative AI system, including URLs accessed, dates and times of collection, and provenance information, when served with a subpoena requested by a journalism provider.

Developers must, upon request by the attorney general as part of an investigation, disclose the general statement or documentation described in subdivision 2 of this section, in a form and manner prescribed by the attorney general. The developer may designate trade-secret, FOIL-exempt, or attorney-client privileged information, which shall be exempt from public disclosure. Disclosure to the AG does not waive privilege or work-product protection.

Deployers must, upon request by the attorney general as part of an investigation, disclose the risk management policy, impact assessment, or records maintained under this section no later than 90 days after the AG's request, in the form and manner prescribed by the AG. The deployer may designate trade-secret, FOIL-exempt, or privileged information, which shall be exempt from public disclosure. Disclosure to the AG does not waive attorney-client privilege or work-product protection.

Developers of general-purpose AI models must, upon request by the attorney general as part of an investigation, disclose any documentation maintained under this section no later than 90 days after the AG's request, in the form and manner prescribed by the AG. The developer may designate trade-secret, FOIL-exempt, or privileged information, which shall be exempt from public disclosure. Disclosure to the AG does not waive attorney-client privilege or work-product protection.

Deployers and developers must, upon request by the Attorney General, produce all impact assessments performed under this article within 45 days. Attorney-client privilege, work-product protection, and trade secret exemptions from FOIL are preserved.

Insurance carriers authorized to do business in New York must provide DFS access to their underwriting models — including any algorithm, formula, or structured methodology used to assess risk, determine premiums, or evaluate coverage eligibility — upon request of the Superintendent, through mutually agreed department staff.

Insurance carriers must, when underwriting models are not available, provide DFS access to granular claim data — including claim type, amount, date, geographic location, and resolution status — sufficient to allow the department to evaluate the carrier's underwriting practices and risk assessment methodologies.

Persons subject to an Attorney General investigative demand must produce information on the development or distribution of a pricing algorithm, including the identity of the person responsible for development or distribution and how the pricing algorithm works.

Facilities must produce additional information and evidence to the Department of Health upon request regarding their AI disclosure, responsible-use, and compliance-statement obligations.

Insurers must produce additional information and evidence to the Insurance Department upon request regarding their AI disclosure, responsible-use, and compliance-statement obligations.

MA or CHIP managed care plans must produce additional information and evidence to the Department of Human Services upon request regarding their AI disclosure, responsible-use, and compliance-statement obligations.

Facilities must produce additional information and evidence regarding their AI disclosures, responsible use, and compliance statements when requested by the Department of Health.

Insurers must produce additional information and evidence regarding their AI disclosures, responsible use, and compliance statements when requested by the Insurance Department.

MA or CHIP managed care plans must produce additional information and evidence regarding their AI disclosures, responsible use, and compliance statements when requested by the Department of Human Services.

Insurers must submit to the OHIC and EOHHS, upon request, all information — including documents and software — that permits enforcement of this chapter.

Insurers must submit to OHIC and DBR, upon request, all information including documents and software that permits enforcement of this chapter.

Developers must produce documentation to the attorney general upon request as part of an investigation, with trade secret and attorney-client privilege protections preserved.

Deployers must produce risk management policies, impact assessments, and related records to the attorney general within 90 days of a request as part of an investigation, with trade secret and attorney-client privilege protections preserved.

Developers of general-purpose AI models must produce technical documentation to the attorney general within 90 days of a request as part of an investigation, with trade secret and attorney-client privilege protections preserved.

Developers must, upon request by the Attorney General, disclose the documentation described in subsection (B) within 90 days, in a form and manner prescribed by the Attorney General. Developers may designate materials as proprietary or trade secret. Attorney-client privilege and work-product protection are preserved; disclosure to the AG does not constitute waiver. Documents produced are not subject to disclosure under the South Carolina Freedom of Information Act.

Deployers must, upon request by the Attorney General, disclose within 90 days the risk management policy, impact assessment, or records maintained under Section 37-31-30, in a form and manner prescribed by the Attorney General. Deployers may designate materials as proprietary or trade secret. Attorney-client privilege and work-product protection are preserved; disclosure does not constitute waiver. Documents produced are not subject to disclosure under the South Carolina Freedom of Information Act.

Utilization review agents must make their use of artificial intelligence for utilization review available for audit and inspection by the Commissioner of Insurance at any time.

Persons using or distributing a pricing algorithm must, within 30 days of a written request from the Attorney General or FTC, produce a written report covering the algorithm's developer/distributor identity, whether the algorithm sets prices autonomously, the rules and data inputs used, data sources and collection frequency, whether the algorithm engages in price or wage discrimination, and any algorithm changes made between request receipt and report certification.

A senior corporate officer (CEO, Chief Economist, CTO, or officer of similar authority) must certify the accuracy of each pricing algorithm audit report under penalty of perjury.

Covered advanced AI system developers must provide to the Secretary of Energy, on request, materials necessary to carry out the evaluation program, including underlying code, training data, model weights, interface engines, and detailed information regarding training and model architecture.

Covered entities must make, keep, preserve, and make available to the Secretary of Labor records pertaining to compliance with Title II, and must file annual or special reports as the Secretary may require.

Large frontier developers must file a disclosure statement with the Office before developing, deploying, or operating a frontier model in New York. The disclosure must identify the developer's identity, business names, principal place of business, New York office addresses, beneficial ownership (5% threshold for private companies, 50% for public), and three designated points of contact. The disclosure must be renewed every two years, upon ownership transfer, or upon material change, whichever occurs first.

Suppliers of mental health chatbots seeking the affirmative defense must file their written policy with the Office of the Attorney General, providing: the supplier's name and address, the chatbot name, the written policy, and a $100 filing fee. Suppliers may also file policy revisions and additional documentation.

AI auditors must, prior to conducting any covered audit, enroll with the Government Operations Agency, pay the enrollment fee, and provide: (1) the auditor's name and contact information, (2) the types of AI systems or models the auditor is enrolling to audit, (3) any relevant certifications or accreditations and the identities of the certifying entities, (4) a written description of services (200 words max), and (5) a standard operating procedure describing audit procedures in sufficient detail for third-party best-practices assessment.

Healthcare providers and healthcare insurers must not use AI in the delivery of healthcare services or for the generation of medical records unless the AI system is both approved by the U.S. Food and Drug Administration and verified by a quality assurance laboratory.

AI businesses must obtain a certification from the Attorney General before entering the stream of commerce.

Any person deploying an AI product in Hawaii must submit affirmative proof establishing the product's safety to the Office of Artificial Intelligence Safety and Regulation before deployment.

Academic medical centers with existing AI-assisted therapy research programs must register those programs with the Department of Financial and Professional Regulation within 90 days after the Act's effective date.

Academic medical centers conducting AI-assisted therapy research must (1) register each qualified research program with the Department within 30 days of IRB approval, (2) submit annual reports summarizing participant counts, serious adverse events, protocol modifications, and scientific findings, and (3) notify the Department within 10 business days of any IRB suspension or termination of a research protocol.

Auto insurers seeking any rate change must file a complete rate application with the Director of Insurance, bear the burden of proving the requested rate is justified and complies with the Section, and obtain prior approval before the change takes effect (deemed-approval after 60 days absent disapproval, hearing, or a Director-initiated review).

Covered insurers must file a pre-deployment notice with the Commissioner at least 60 days before deploying a new ADS or materially modifying an existing system, including a system description, pre-deployment disparate impact testing results, training data description, input variables, and a compliance certification. Deployment is stayed if the Commissioner requests additional information within 15 days.

Any person who develops a high-risk advanced AI system, in whole or in part, in New York must register the system with the Secretary of State by applying for a license before or upon the system's active deployment. This duty applies irrespective of the system's location of operation and extends to any updates, modifications, upgrades, or expansions of the system's capabilities or intended uses. Systems that more likely than not qualify as high-risk must register. If the Secretary determines that an unregistered system qualifies as high-risk, the creators must cease development and all public or private use until registration is completed.

Insurers must submit to the Superintendent all AI-based algorithms and training data sets used or to be used in utilization review, with certifications that the algorithms (1) have minimized the risk of bias across protected characteristics, (2) adhere to evidence-based clinical guidelines, (3) do not rely on information non-compliant with utilization review requirements, and (4) do not independently create or change clinical standards or coverage criteria.

The Commissioner must establish a public registry for collecting, storing, and making publicly available impact assessments or summaries submitted by employers or vendors. Employers and vendors must submit impact assessments to this registry (per § 1052(1)(a)(xi)). The Commissioner must promulgate redaction rules for proprietary, sensitive, or privacy-threatening information.

Applicants for an independent verification organization license must file with the attorney general a comprehensive plan covering risk definitions, measurable outcome metrics, technical and operational requirements for developers and deployers, audit methodologies, governance oversight, incident disclosure requirements, corrective action procedures, verification revocation standards, and independence-ensuring policies.

Providers seeking to use an AI application for mental health services must submit testing results to the Health and Human Services Commission for evaluation, and the Commission must issue an order approving or disapproving the application's use.

Regulated entities seeking to operate an AI test project must submit a detailed application to the appropriate financial regulatory agency that includes a project description, an alternative compliance strategy identifying the regulation to be waived or modified and an alternative compliance method, an explanation of public interest benefit, absence of systemic and national security risk, AML/CFT consistency, a proposed termination date, scope limitations, a business plan, and an economic impact estimate. Where the alternative compliance strategy involves a regulation issued by a different agency, the application must be submitted to both the appropriate agency and the issuing agency, and both must jointly approve.

Providers of social media platforms must register annually with the Vermont Secretary of State by January 31, pay a $100 fee, submit contact information and the platform's current privacy policy and terms of service, and agree to statutory and AG-adopted product safety and privacy terms.

Providers of AI systems must register annually with the Vermont Secretary of State by January 31, pay a $100 fee, submit contact information, current privacy policies and terms of service, the system's data collection, storage, and security practices, and agree to statutory and AG-adopted product safety and privacy terms.

Health benefit plan providers must annually certify to the Alabama Department of Insurance that the AI used for medical necessity determinations on prior authorization requests complies with all of the following: (1) the AI does not rely on a group dataset to make determinations, (2) the AI is fairly and equitably applied, including in accordance with applicable HHS regulations and guidance, and (3) the AI does not discriminate, directly or indirectly, against any subscriber group or enrollee in violation of state or federal law, including HHS regulations and guidance.

Landlords and coordinators that use any algorithmic rent-setting tool must annually certify to the Georgia Attorney General, in the form prescribed, that the tool does not use or incorporate nonpublic competitor data in violation of subsection (b). They must also retain for at least five years: (1) contracts with rental pricing software vendors; (2) documentation describing data inputs used by any algorithmic rent-setting tool; (3) records of rental price recommendations generated; and (4) records sufficient to demonstrate independent pricing decisions.

Developers who use the federal-agency-agreement pathway must file a certification with the Attorney General, in a form prescribed by the Attorney General, attesting that they have entered into a qualifying agreement. Materially false or misleading certifications violate the Act.

Large frontier developers must, within 12 months of publishing their frontier AI framework and annually thereafter, provide the attorney general a written certification disclosing either that the developer has been in compliance with its framework during the prior year or describing any material deviations and corrective actions taken or planned.

Carriers must annually submit to the Division of Insurance by December 31 a prescribed form detailing AI algorithms and data training sets used or planned for use in utilization review, together with an attestation that such algorithms and training data have minimized bias risk across protected characteristics and adhere to evidence-based clinical guidelines.

Every covered entity must file an annual certification of compliance with the responsible capability scaling policy requirements with the Chief Information Officer.

Facilities using AI-based algorithms for clinical decision making must annually file an AI compliance statement with the Department of Health, in the form and manner prescribed by the department. Each statement must: (1) summarize the function and scope of the AI algorithms, (2) provide a logic or decision tree, (3) describe each training data set including its source, (4) attest that the algorithms and training data comply with responsible-use requirements and provide supporting evidence, and (5) describe the facility's process for overseeing and validating algorithm performance and compliance.

Insurers using AI-based algorithms in utilization review must annually file an AI compliance statement with the Insurance Department, in the form and manner prescribed by the department. Each statement must: (1) summarize the function and scope of the AI algorithms, (2) provide a logic or decision tree, (3) describe each training data set including its source, (4) attest that the algorithms and training data comply with responsible-use requirements and provide supporting evidence, and (5) describe the insurer's process for overseeing and validating algorithm performance and compliance.

MA or CHIP managed care plans using AI-based algorithms in utilization review must annually file an AI compliance statement with the Department of Human Services. Each statement must: (1) summarize the function and scope of the AI algorithms, (2) provide a logic or decision tree, (3) describe each training data set including its source, (4) attest that the algorithms and training data comply with responsible-use requirements and provide supporting evidence, and (5) describe the plan's oversight and validation process.

Facilities using AI-based algorithms for clinical decision making must annually file an AI compliance statement with the Department of Health. The statement must: (1) summarize the function and scope of the AI algorithms, (2) provide a logic or decision tree, (3) describe each training data set including its source, (4) attest that the algorithms and training data comply with responsible-use requirements and provide evidence of compliance, and (5) describe the facility's process for overseeing and validating AI performance and compliance.

Insurers using AI-based algorithms in utilization review must annually file an AI compliance statement with the Insurance Department. The statement must: (1) summarize the function and scope of the AI algorithms, (2) provide a logic or decision tree, (3) describe each training data set including its source, (4) attest compliance with responsible-use requirements and provide evidence, and (5) describe the insurer's process for overseeing and validating AI performance and compliance.

MA or CHIP managed care plans using AI-based algorithms in utilization review must annually file an AI compliance statement with the Department of Human Services. The statement must: (1) summarize the function and scope of the AI algorithms, (2) provide a logic or decision tree, (3) describe each training data set including its source, (4) attest compliance with responsible-use requirements and provide evidence, and (5) describe the plan's process for overseeing and validating AI performance and compliance.

The Texas Insurance Commissioner must develop and implement a certification process to verify that submitted AI-based algorithms and training datasets have minimized discrimination risk and adhere to evidence-based clinical guidelines.

Developers and deployers must file reports with the Attorney General prior to deployment of an automated decision system used in a consequential decision and then annually, or after each substantial change to the system, whichever comes first. Each report must be accompanied by a copy of the last completed independent audit and a legal attestation that the system either (1) does not violate any provision of this subchapter, or (2) may violate or does violate one or more provisions, together with a remediation plan and summary.

By December 31 of each year, each covered medical facility, research facility, company, or nonprofit organization must certify to the Attorney General that it is in compliance with the West Virginia Genomic Information Privacy Act. The certification must be submitted by an attorney representing the entity.