S. 1169--B 2
life chances, are free from harmful biases, protect our privacy, and
work for the public good.
(c) Safe innovation must remain a priority for the state. New York
state is home to thousands of technology start-ups, many of which exper-
iment with new applications of AI and which have the potential to find
new ways to employ technology at the service of New Yorkers. The goal of
the legislature is to encourage safe innovation in the AI sector by
providing clear guidance for AI development, testing, and validation
both before a product is launched and throughout the product's life
cycle.
(d) New York must establish that the burden of responsibility of prov-
ing that AI products do not cause harm to New Yorkers will be shouldered
by the developers and deployers of AI. While government and civil socie-
ty must act to audit and enforce human rights laws around the use of AI,
the companies employing and profiting from the use of AI must lead in
ensuring that their products are free from algorithmic discrimination.
(e) Close collaboration and communication between New York state and
industry partners is key to ensuring that innovation can occur with
safeguards to protect all New Yorkers. This legislation will ensure that
lines of communication exist and that there is clear statutory authority
to investigate and prosecute entities that break the law.
(f) As new forms of AI are developed beyond what is currently techno-
logically feasible, the goal of the legislature is to use this section
as a guiding light for future regulations.
(g) Lastly, it is in the interest of all New Yorkers that certain uses
of AI that infringe on fundamental rights, deepen structural inequality,
or that result in unequal access to services shall be banned.
§ 3. The civil rights law is amended by adding a new article 10-A to
read as follows:
ARTICLE 10-A
PROTECTIONS REGARDING USE OF ARTIFICIAL INTELLIGENCE
SECTION 105. DEFINITIONS.
106. UNLAWFUL DISCRIMINATORY PRACTICE.
107. JURISDICTIONAL SCOPE.
108. DEPLOYER AND DEVELOPER OBLIGATIONS.
109. WHISTLEBLOWER PROTECTIONS.
110. AUDITS.
111. HIGH-RISK AI SYSTEM REPORTING REQUIREMENTS.
112. RISK MANAGEMENT POLICY AND PROGRAM.
113. SOCIAL SCORING AI SYSTEMS PROHIBITED.
114. ENFORCEMENT.
115. SEVERABILITY.
§ 105. DEFINITIONS. THE FOLLOWING TERMS SHALL HAVE THE FOLLOWING MEAN-
INGS:
1. "ALGORITHMIC DISCRIMINATION" MEANS ANY CONDITION IN WHICH THE USE
OF AN AI SYSTEM CONTRIBUTES TO UNJUSTIFIED DIFFERENTIAL TREATMENT OR
IMPACTS, DISFAVORING PEOPLE BASED ON THEIR ACTUAL OR PERCEIVED AGE,
RACE, ETHNICITY, CREED, RELIGION, COLOR, NATIONAL ORIGIN, CITIZENSHIP OR
IMMIGRATION STATUS, SEXUAL ORIENTATION, GENDER IDENTITY, GENDER
EXPRESSION, MILITARY STATUS, SEX, DISABILITY, PREDISPOSING GENETIC CHAR-
ACTERISTICS, FAMILIAL STATUS, MARITAL STATUS, STATUS AS A VICTIM OF
DOMESTIC VIOLENCE OR OTHER CLASSIFICATION PROTECTED UNDER STATE OR
FEDERAL LAWS. ALGORITHMIC DISCRIMINATION SHALL NOT INCLUDE:
(A) A DEVELOPER'S OR DEPLOYER'S TESTING OF THEIR OWN AI SYSTEM TO
IDENTIFY, MITIGATE, AND PREVENT DISCRIMINATORY BIAS;
S. 1169--B 3
(B) EXPANDING AN APPLICANT, CUSTOMER, OR PARTICIPANT POOL TO INCREASE
DIVERSITY OR REDRESS HISTORICAL DISCRIMINATION; OR
(C) AN ACT OR OMISSION BY OR ON BEHALF OF A PRIVATE CLUB OR OTHER
ESTABLISHMENT THAT IS NOT IN FACT OPEN TO THE PUBLIC, AS SET FORTH IN
TITLE II OF THE FEDERAL CIVIL RIGHTS ACT OF 1964, 42 U.S.C. SECTION
2000A(E), AS AMENDED.
2. "ARTIFICIAL INTELLIGENCE SYSTEM" OR "AI SYSTEM" MEANS A MACHINE-
BASED SYSTEM OR COMBINATION OF SYSTEMS, THAT FOR A GIVEN SET OF HUMAN-
DEFINED OBJECTIVES, MAKES PREDICTIONS, RECOMMENDATIONS, OR DECISIONS
INFLUENCING REAL OR VIRTUAL ENVIRONMENTS, AND THAT USES MACHINE- AND
HUMAN-BASED INPUTS TO PERCEIVE REAL AND VIRTUAL ENVIRONMENTS, ABSTRACTS
SUCH PERCEPTIONS INTO MODELS THROUGH ANALYSIS IN AN AUTOMATED MANNER,
AND USES MODEL INFERENCE TO FORMULATE OPTIONS FOR INFORMATION OR ACTION.
ARTIFICIAL INTELLIGENCE SYSTEM SHALL NOT INCLUDE:
(A) ANY SYSTEM THAT (I) IS USED BY A BUSINESS ENTITY SOLELY FOR INTER-
NAL PURPOSES AND (II) IS NOT USED AS A SUBSTANTIAL FACTOR IN A CONSE-
QUENTIAL DECISION; OR
(B) ANY SOFTWARE USED PRIMARILY FOR NARROW PROCEDURAL TASKS OR BASIC
COMPUTERIZED PROCESSES, SUCH AS ANTI-MALWARE, ANTI-VIRUS, AUTO-CORRECT
FUNCTIONS, CALCULATORS, DATABASES, DATA STORAGE, ELECTRONIC COMMUNI-
CATIONS, FIREWALL, INTERNET DOMAIN REGISTRATION, INTERNET WEBSITE LOAD-
ING, NETWORKING, SPAM AND ROBOCALL-FILTERING, SPELLCHECK TOOLS, SPREAD-
SHEETS, WEB CACHING, WEB HOSTING, OR ANY TOOL THAT RELATES ONLY TO
INTERNAL MANAGEMENT AFFAIRS SUCH AS ORDERING OFFICE SUPPLIES OR PROCESS-
ING PAYMENTS, AND THAT DO NOT MATERIALLY AFFECT THE RIGHTS, LIBERTIES,
BENEFITS, SAFETY OR WELFARE OF ANY INDIVIDUAL WITHIN THE STATE.
3. "AUDITOR" SHALL REFER TO AN INDEPENDENT ENTITY INCLUDING BUT NOT
LIMITED TO AN INDIVIDUAL, NON-PROFIT, FIRM, CORPORATION, PARTNERSHIP,
COOPERATIVE, ASSOCIATION, ACADEMIC INSTITUTION, OR GROUP AFFILIATED WITH
AN ACADEMIC INSTITUTION, COMMISSIONED TO PERFORM AN AUDIT.
4. "CONSEQUENTIAL DECISION" MEANS A DECISION OR JUDGMENT THAT HAS A
MATERIAL, LEGAL OR SIMILARLY SIGNIFICANT EFFECT ON AN INDIVIDUAL'S
ACCESS TO, OR THE COST, TERMS, OR AVAILABILITY OF, ANY OF THE FOLLOWING:
(A) EMPLOYMENT, WORKERS' MANAGEMENT, OR SELF-EMPLOYMENT, INCLUDING,
BUT NOT LIMITED TO, ALL OF THE FOLLOWING:
(I) PAY OR PROMOTION; AND
(II) HIRING OR TERMINATION.
(B) EDUCATION AND VOCATIONAL TRAINING, INCLUDING, BUT NOT LIMITED TO,
ALL OF THE FOLLOWING:
(I) ACCREDITATION;
(II) CERTIFICATION;
(III) ADMISSIONS; AND
(IV) FINANCIAL AID OR SCHOLARSHIPS.
(C) HOUSING OR LODGING, INCLUDING RENTAL OR SHORT-TERM HOUSING OR
LODGING.
(D) FAMILY PLANNING, INCLUDING ADOPTION SERVICES OR REPRODUCTIVE
SERVICES, AS WELL AS ASSESSMENTS RELATED TO CHILD PROTECTIVE SERVICES.
(E) HEALTH CARE OR HEALTH INSURANCE, INCLUDING MENTAL HEALTH CARE,
DENTAL, OR VISION, EXCEPT FOR RADIOLOGY.
(F) FINANCIAL SERVICES, INCLUDING A FINANCIAL SERVICE PROVIDED BY A
MORTGAGE COMPANY, MORTGAGE BROKER, OR CREDITOR.
(G) LEGAL SERVICES.
5. "COVERED DEPLOYER" MEANS A DEPLOYER THAT USES A HIGH-RISK AI SYSTEM
TO MAKE ONE OR MORE CONSEQUENTIAL DECISIONS WITH RESPECT TO COVERED
SUBJECTS.
S. 1169--B 4
6. "DEPLOYER" MEANS ANY PERSON, PARTNERSHIP, ASSOCIATION OR CORPO-
RATION THAT USES OR MAKES AN AI SYSTEM AVAILABLE TO ONE OR MORE THIRD
PARTIES INCLUDING THE GENERAL PUBLIC FOR USE, MODIFICATION, COPYING, OR
A COMBINATION THEREOF WITH THEIR SOFTWARE. A DEPLOYER SHALL NOT INCLUDE
ANY NATURAL PERSON USING AN AI SYSTEM FOR PERSONAL USE. A DEVELOPER MAY
ALSO BE CONSIDERED A DEPLOYER IF ITS ACTIONS SATISFY THIS DEFINITION.
7. "COVERED DEVELOPER" MEANS A DEVELOPER THAT TRAINED OR INITIATED THE
TRAINING OF AN AI SYSTEM THAT IS USED TO MAKE ONE OR MORE CONSEQUENTIAL
DECISIONS WITH RESPECT TO COVERED SUBJECTS.
8. "DEVELOPER" MEANS A PERSON, PARTNERSHIP, OR CORPORATION THAT
TRAINED OR INITIATED THE TRAINING OF AN AI SYSTEM, OR CREATES A SUBSTAN-
TIAL CHANGE WITH RESPECT TO AN AI SYSTEM, WHETHER FOR ITS OWN USE IN THE
STATE OF NEW YORK OR FOR USE BY A THIRD PARTY. A DEPLOYER MAY ALSO BE
CONSIDERED A DEVELOPER IF ITS ACTIONS SATISFY THIS DEFINITION.
9. "EMPLOYEE" MEANS AN INDIVIDUAL WHO PERFORMS SERVICES FOR AND UNDER
THE CONTROL AND DIRECTION OF AN EMPLOYER FOR WAGES OR OTHER REMUNERA-
TION, INCLUDING FORMER EMPLOYEES, OR NATURAL PERSONS EMPLOYED AS INDE-
PENDENT CONTRACTORS TO CARRY OUT WORK IN FURTHERANCE OF AN EMPLOYER'S
BUSINESS ENTERPRISE WHO ARE NOT THEMSELVES EMPLOYERS.
10. "EMPLOYER" MEANS ANY PERSON, FIRM, PARTNERSHIP, INSTITUTION,
CORPORATION, OR ASSOCIATION THAT EMPLOYS ONE OR MORE EMPLOYEES.
11. "COVERED AGENT" MEANS ANY INDIVIDUAL THAT INTERACTS, DIRECTLY OR
INDIRECTLY, WITH A RELEVANT AI SYSTEM, DEVELOPER, OR DEPLOYER ON BEHALF
OF A COVERED SUBJECT WITH THE EXPRESS CONSENT OF SUCH COVERED SUBJECT.
12. "COVERED SUBJECT" MEANS ANY INDIVIDUAL OR GROUP OF INDIVIDUALS
THAT IS THE SUBJECT OF A CONSEQUENTIAL DECISION MADE ENTIRELY BY OR WITH
THE ASSISTANCE OF AN AI SYSTEM.
13. "FAIR MARKET VALUE" SHALL HAVE THE SAME MEANING AS SUCH TERM IS
DEFINED IN 20 NYCRR 3-2.3.
14. "HIGH-RISK AI SYSTEM" MEANS ANY AI SYSTEM THAT, WHEN DEPLOYED:
(A) IS A SUBSTANTIAL FACTOR IN MAKING A CONSEQUENTIAL DECISION; OR (B)
WILL HAVE A MATERIAL IMPACT ON THE STATUTORY OR CONSTITUTIONAL RIGHTS,
CIVIL LIBERTIES, SAFETY, OR WELFARE OF AN INDIVIDUAL IN THE STATE.
15. "ISO 42001" MEANS INTERNATIONAL STANDARD ISO/IEC 42001:2023
(INFORMATION TECHNOLOGY -- ARTIFICIAL INTELLIGENCE -- MANAGEMENT
SYSTEM), PUBLISHED BY THE INTERNATIONAL ORGANIZATION FOR STANDARDIZATION
ON DECEMBER EIGHTEENTH, TWO THOUSAND TWENTY-THREE.
16. "RISK MANAGEMENT POLICY AND PROGRAM" MEANS THE RISK MANAGEMENT
POLICY AND PROGRAM CREATED PURSUANT TO SECTION ONE HUNDRED TWELVE OF
THIS ARTICLE.
17. "SUBSTANTIAL CHANGE" MEANS ANY NEW VERSION, NEW RELEASE, OR ANY
OTHER INTENTIONAL UPDATE TO AN AI SYSTEM THAT RESULTS IN SIGNIFICANT AND
MATERIAL CHANGES TO SUCH AI SYSTEM'S APPROPRIATE USE CASES, KEY FUNC-
TIONALITY, OR EXPECTED OUTCOMES, INCLUDING BUT NOT LIMITED TO:
(A) SIGNIFICANT AND MATERIAL CHANGES TO THE AI SYSTEM'S TRAINING DATA;
(B) SIGNIFICANT AND MATERIAL CHANGES TO THE AI SYSTEM'S DECISION
CRITERIA IN AN APPROPRIATE USE CASE; AND
(C) SIGNIFICANT AND MATERIAL EXPANSIONS OR CONTRACTIONS OF THE AI
SYSTEM'S APPROPRIATE USE CASES.
18. "SUBSTANTIAL FACTOR" MEANS A FACTOR THAT IS (A) MATERIAL IN MAKING
A CONSEQUENTIAL DECISION, OR (B) IS CAPABLE OF ALTERING THE OUTCOME OF A
CONSEQUENTIAL DECISION.
19. "MEANINGFUL HUMAN REVIEW" SHALL MEAN REVIEW, OVERSIGHT AND CONTROL
OF THE AI SYSTEM BY ONE OR MORE INDIVIDUALS WHO UNDERSTAND THE RISKS,
LIMITATIONS, AND FUNCTIONALITY OF, AND ARE TRAINED TO USE, THE AI SYSTEM
AND WHO HAVE THE AUTHORITY TO INTERVENE OR ALTER THE DECISION UNDER
S. 1169--B 5
REVIEW, INCLUDING BUT NOT LIMITED TO THE ABILITY TO APPROVE, DENY, OR
MODIFY ANY DECISION RECOMMENDED OR MADE BY THE AI SYSTEM.
§ 106. UNLAWFUL DISCRIMINATORY PRACTICE. IT SHALL BE AN UNLAWFUL
DISCRIMINATORY PRACTICE FOR A DEVELOPER OR DEPLOYER TO FAIL TO TAKE
REASONABLE CARE TO PREVENT FORESEEABLE RISK OF ALGORITHMIC DISCRIMI-
NATION THAT IS A CONSEQUENCE OF THE USE, SALE, OR SHARING OF A HIGH-RISK
AI SYSTEM OR A PRODUCT FEATURING A HIGH-RISK AI SYSTEM.
§ 107. JURISDICTIONAL SCOPE. 1. THIS ARTICLE APPLIES TO DEVELOPERS AND
DEPLOYERS THAT CONDUCT BUSINESS IN NEW YORK OR PRODUCE PRODUCTS OR
SERVICES THAT ARE TARGETED TO RESIDENTS OF NEW YORK.
2. THIS ARTICLE DOES NOT APPLY TO ANY DEVELOPER OR DEPLOYER THAT IS:
(A) THE NEW YORK STATE GOVERNMENT, INCLUDING ANY DEPARTMENT, PUBLIC
AUTHORITY, BOARD, BUREAU, COMMISSION, DIVISION, OFFICE, COUNCIL, COMMIT-
TEE OR OFFICER OF THE STATE;
(B) A LOCAL GOVERNMENT, INCLUDING ANY COUNTY, CITY, TOWN, VILLAGE,
SCHOOL DISTRICT, BOARD OF COOPERATIVE EDUCATIONAL SERVICES, COUNTY VOCA-
TIONAL EDUCATION AND EXTENSION BOARD, DISTRICT CORPORATION OR MUNICIPAL
CORPORATION; OR
(C) THE STATE UNIVERSITY OF NEW YORK, THE CITY UNIVERSITY OF NEW YORK
OR A COMMUNITY COLLEGE.
§ 108. DEPLOYER AND DEVELOPER OBLIGATIONS. 1. ANY COVERED DEPLOYER
SHALL INFORM THE COVERED SUBJECT AND COVERED AGENT, IF APPLICABLE, AT
THE IMMEDIATE ONSET OF AN ENGAGEMENT BETWEEN THE COVERED SUBJECT AND THE
COVERED DEPLOYER AS TO THE USE OF A HIGH-RISK AI SYSTEM FOR THE MAKING
OF A CONSEQUENTIAL DECISION IN CLEAR, CONSPICUOUS, AND CONSUMER-FRIENDLY
TERMS, MADE AVAILABLE IN EACH OF THE LANGUAGES IN WHICH THE COMPANY
OFFERS ITS END SERVICES, THAT AI SYSTEMS WILL BE USED TO MAKE A DECISION
OR TO ASSIST IN MAKING A DECISION; PROVIDED, HOWEVER, THAT WHERE THERE
IS AN URGENT NECESSITY FOR A DECISION TO BE MADE TO CONFER A BENEFIT TO
THE COVERED SUBJECT, INCLUDING, BUT NOT LIMITED TO, SOCIAL BENEFITS,
HOUSING ACCESS, OR DISPENDING OF EMERGENCY FUNDS, AND COMPLIANCE WITH
THIS SECTION WOULD CAUSE IMMINENT DETRIMENT TO THE WELFARE OF THE
COVERED SUBJECT, SUCH OBLIGATION SHALL BE CONSIDERED WAIVED; PROVIDED
FURTHER, THAT NOTHING IN THIS SECTION SHALL BE CONSTRUED TO WAIVE A
NATURAL PERSON'S OPTION TO REQUEST HUMAN REVIEW OF THE DECISION.
2. (A) ANY COVERED DEPLOYER SHALL INFORM THE COVERED SUBJECT AND
COVERED AGENT, IF APPLICABLE, WITHIN TEN DAYS IN A CLEAR, CONSPICUOUS
AND CONSUMER-FRIENDLY MANNER THAT A HIGH-RISK AI SYSTEM HAS BEEN USED TO
MAKE A CONSEQUENTIAL DECISION. THE DEPLOYER SHALL THEN PROVIDE AND
EXPLAIN A PROCESS FOR THE COVERED SUBJECT OR COVERED AGENT TO APPEAL THE
DECISION, WHICH SHALL AT MINIMUM ALLOW THE COVERED SUBJECT OR COVERED
AGENT TO (I) FORMALLY CONTEST THE DECISION, (II) PROVIDE INFORMATION TO
SUPPORT THEIR POSITION, AND (III) OBTAIN MEANINGFUL HUMAN REVIEW OF THE
DECISION. A DEPLOYER SHALL RESPOND TO A COVERED SUBJECT'S OR COVERED
AGENT'S APPEAL WITHIN FORTY-FIVE DAYS OF RECEIPT OF THE APPEAL. THAT
PERIOD MAY BE EXTENDED ONCE BY FORTY-FIVE ADDITIONAL DAYS WHERE REASON-
ABLY NECESSARY, TAKING INTO ACCOUNT THE COMPLEXITY AND NUMBER OF
APPEALS. THE DEPLOYER SHALL INFORM THE COVERED SUBJECT OR COVERED AGENT,
IF APPLICABLE, OF ANY SUCH EXTENSION WITHIN FORTY-FIVE DAYS OF RECEIPT
OF THE APPEAL, TOGETHER WITH THE REASONS FOR THE DELAY.
(B) A COVERED SUBJECT SHALL BE ENTITLED TO NO MORE THAN ONE APPEAL
WITH RESPECT TO THE SAME CONSEQUENTIAL DECISION IN A SIX-MONTH PERIOD.
3. THE COVERED DEPLOYER OR COVERED DEVELOPER IS LEGALLY RESPONSIBLE
FOR QUALITY AND ACCURACY OF ALL CONSEQUENTIAL DECISIONS MADE, INCLUDING
ANY BIAS OR ALGORITHMIC DISCRIMINATION RESULTING FROM THE OPERATION OF
THE AI SYSTEM ON THEIR BEHALF.
S. 1169--B 6
4. EACH COVERED DEPLOYER SHALL CONDUCT MEANINGFUL HUMAN REVIEW OF EACH
CONSEQUENTIAL DECISION MADE WITH A HIGH-RISK AI SYSTEM.
5. THE RIGHTS AND OBLIGATIONS UNDER THIS SECTION MAY NOT BE WAIVED BY
ANY PERSON, PARTNERSHIP, ASSOCIATION OR CORPORATION.
6. (A) IF A DEVELOPER INTENDS THAT AN AI SYSTEM SHALL NOT BE USED AS A
HIGH-RISK AI SYSTEM, SUCH DEVELOPER SHALL:
(I) ENTER INTO A WRITTEN AND FULLY EXECUTED CONTRACTUAL AGREEMENT WITH
EACH DEPLOYER AUTHORIZED TO USE THE ARTIFICIAL INTELLIGENCE SYSTEM
DEVELOPED BY SUCH DEVELOPER, INCLUDING THE DEVELOPER IF THEY ARE ALSO A
DEPLOYER, THAT SUCH ARTIFICIAL INTELLIGENCE SYSTEM WILL NOT BE USED AS A
HIGH-RISK AI SYSTEM;
(II) IMPLEMENT REASONABLE TECHNICAL SAFEGUARDS DESIGNED TO PREVENT OR
DETECT HIGH-RISK AI SYSTEM USE CASES OR OTHERWISE DEMONSTRATE REASONABLE
STEPS TAKEN TO ENSURE THAT ANY UNAUTHORIZED DEPLOYMENTS OF ITS AI
SYSTEMS ARE NOT BEING USED AS A HIGH-RISK AI SYSTEM;
(III) PROMINENTLY DISPLAY ON ITS WEBSITE, IN MARKETING MATERIALS, AND
IN ALL LICENSING AGREEMENTS OFFERED TO PROSPECTIVE DEPLOYERS OF ITS AI
SYSTEM THAT THE AI SYSTEM CANNOT BE USED AS A HIGH-RISK AI SYSTEM; AND
(IV) MAINTAIN RECORDS OF DEPLOYER AGREEMENTS FOR A PERIOD OF NOT LESS
THAN FIVE YEARS.
(B) DEVELOPERS THAT HAVE FULLY EXECUTED CONTRACTUAL AGREEMENTS IN
FORCE AND EFFECT WITH DEPLOYERS AS OF THE EFFECTIVE DATE OF THIS SECTION
GOVERNING DEPLOYMENT OF AN AI SYSTEM SHALL: (I) BE DEEMED TO BE IN
COMPLIANCE WITH PARAGRAPH (A) OF THIS SUBDIVISION FOR A PERIOD OF EIGH-
TEEN MONTHS FOLLOWING THE EFFECTIVE DATE OF THIS SECTION AND (II) BEGIN-
NING EIGHTEEN MONTHS FOLLOWING THE EFFECTIVE DATE OF THIS SECTION,
COMPLY WITH THIS SUBDIVISION BY AMENDMENT OF THE EXISTING CONTRACTUAL
AGREEMENT OR BY CREATION OF A NEW FULLY EXECUTED CONTRACTUAL AGREEMENT
THAT SATISFIES THE REQUIREMENTS OF PARAGRAPH (A) OF THIS SUBDIVISION.
§ 109. WHISTLEBLOWER PROTECTIONS. 1. COVERED DEVELOPERS AND COVERED
DEPLOYERS SHALL NOT:
(A) PREVENT ANY OF THEIR EMPLOYEES FROM DISCLOSING INFORMATION TO THE
ATTORNEY GENERAL, INCLUDING THROUGH TERMS AND CONDITIONS OF EMPLOYMENT
OR SEEKING TO ENFORCE TERMS AND CONDITIONS OF EMPLOYMENT, IF THE EMPLOY-
EE HAS REASONABLE CAUSE TO BELIEVE THE INFORMATION INDICATES A VIOLATION
OF THIS ARTICLE; OR
(B) RETALIATE AGAINST AN EMPLOYEE FOR DISCLOSING INFORMATION TO THE
ATTORNEY GENERAL PURSUANT TO THIS SECTION.
2. AN EMPLOYEE HARMED BY A VIOLATION OF THIS ARTICLE MAY PETITION A
COURT FOR APPROPRIATE RELIEF AS PROVIDED IN SUBDIVISION FIVE OF SECTION
SEVEN HUNDRED FORTY OF THE LABOR LAW.
3. COVERED DEVELOPERS AND COVERED DEPLOYERS SHALL PROVIDE A CLEAR
NOTICE TO ALL OF THEIR EMPLOYEES WORKING ON SUCH AI SYSTEMS OF THEIR
RIGHTS AND RESPONSIBILITIES UNDER THIS ARTICLE, INCLUDING THE RIGHT OF
EMPLOYEES OF CONTRACTORS AND SUBCONTRACTORS TO USE, AS RELEVANT, THE
DEVELOPER'S OR DEPLOYER'S INTERNAL PROCESS FOR MAKING PROTECTED DISCLO-
SURES PURSUANT TO SUBDIVISION FOUR OF THIS SECTION. A DEVELOPER OR
DEPLOYER IS PRESUMED TO BE IN COMPLIANCE WITH THE REQUIREMENTS OF THIS
SUBDIVISION IF THE DEVELOPER OR DEPLOYER DOES EITHER OF THE FOLLOWING:
(A) AT ALL TIMES POST AND DISPLAY WITHIN ALL WORKPLACES MAINTAINED BY
THE DEVELOPER OR DEPLOYER A NOTICE TO ALL EMPLOYEES OF THEIR RIGHTS AND
RESPONSIBILITIES UNDER THIS ARTICLE, ENSURE THAT ALL NEW EMPLOYEES
RECEIVE EQUIVALENT NOTICE, AND ENSURE THAT EMPLOYEES WHO WORK REMOTELY
PERIODICALLY RECEIVE AN EQUIVALENT NOTICE; OR
(B) NO LESS FREQUENTLY THAN ONCE EVERY YEAR, PROVIDE WRITTEN NOTICE TO
ALL EMPLOYEES OF THEIR RIGHTS AND RESPONSIBILITIES UNDER THIS ARTICLE
S. 1169--B 7
AND ENSURE THAT THE NOTICE IS RECEIVED AND ACKNOWLEDGED BY ALL OF THOSE
EMPLOYEES.
4. EACH COVERED DEVELOPER AND COVERED DEPLOYER SHALL PROVIDE A REASON-
ABLE INTERNAL PROCESS THROUGH WHICH AN EMPLOYEE MAY ANONYMOUSLY DISCLOSE
INFORMATION TO THE DEVELOPER OR DEPLOYER IF THE EMPLOYEE BELIEVES IN
GOOD FAITH THAT THE INFORMATION INDICATES THAT THE DEVELOPER OR DEPLOYER
HAS VIOLATED ANY PROVISION OF THIS ARTICLE OR ANY OTHER LAW, OR HAS MADE
FALSE OR MATERIALLY MISLEADING STATEMENTS RELATED TO ITS RISK MANAGEMENT
POLICY AND PROGRAM, OR FAILED TO DISCLOSE KNOWN RISKS TO EMPLOYEES,
INCLUDING, AT A MINIMUM, A MONTHLY UPDATE TO THE PERSON WHO MADE THE
DISCLOSURE REGARDING THE STATUS OF THE DEVELOPER'S OR DEPLOYER'S INVES-
TIGATION OF THE DISCLOSURE AND THE ACTIONS TAKEN BY THE DEVELOPER OR
DEPLOYER IN RESPONSE TO THE DISCLOSURE.
5. THIS SECTION DOES NOT LIMIT PROTECTIONS PROVIDED TO EMPLOYEES UNDER
SECTION SEVEN HUNDRED FORTY OF THE LABOR LAW.
§ 110. AUDITS. 1. COVERED DEVELOPERS SHALL CAUSE TO BE CONDUCTED
AUDITS IN ACCORDANCE WITH THIS SECTION.
(A) A COVERED DEVELOPER SHALL COMPLETE AT LEAST:
(I) A FIRST AUDIT WITHIN SIX MONTHS AFTER COMPLETION OF DEVELOPMENT OF
THE HIGH-RISK AI SYSTEM AND THE INITIAL OFFERING OF THE HIGH-RISK AI
SYSTEM TO A DEPLOYER FOR DEPLOYMENT OR, IF THE DEVELOPER IS FIRST
DEPLOYER TO DEPLOY THE HIGH-RISK AI SYSTEM, AFTER INITIAL DEPLOYMENT;
AND
(II) ONE AUDIT EVERY ONE YEAR FOLLOWING THE SUBMISSION OF THE FIRST
AUDIT.
(B) A DEVELOPER AUDIT UNDER THIS SECTION SHALL INCLUDE:
(I) AN EVALUATION AND DETERMINATION OF WHETHER THE DEVELOPER HAS TAKEN
REASONABLE CARE TO PREVENT FORESEEABLE RISK OF ALGORITHMIC DISCRIMI-
NATION WITH RESPECT TO SUCH HIGH-RISK AI SYSTEM; AND
(II) AN EVALUATION OF THE DEVELOPER'S DOCUMENTED RISK MANAGEMENT POLI-
CY AND PROGRAM REQUIRED UNDER SECTION ONE HUNDRED TWELVE OF THIS ARTICLE
FOR CONFORMITY WITH SUBDIVISION ONE OF SUCH SECTION ONE HUNDRED TWELVE.
(C) NOTWITHSTANDING PARAGRAPH (B) OF THIS SUBDIVISION, SATISFACTORY
AUDITS UNDER ISO 42001 COMPLETED IN ACCORDANCE WITH PARAGRAPH (A) OF
THIS SUBDIVISION SHALL BE DEEMED TO SATISFY A DEVELOPER'S DUTY UNDER
THIS SUBDIVISION.
2. COVERED DEPLOYERS SHALL CAUSE TO BE CONDUCTED AUDITS IN ACCORDANCE
WITH THIS SECTION.
(A) A COVERED DEPLOYER SHALL COMPLETE AT LEAST:
(I) A FIRST AUDIT WITHIN SIX MONTHS AFTER INITIAL DEPLOYMENT;
(II) A SECOND AUDIT WITHIN ONE YEAR FOLLOWING THE SUBMISSION OF THE
FIRST AUDIT; AND
(III) ONE AUDIT EVERY TWO YEARS FOLLOWING THE SUBMISSION OF THE SECOND
AUDIT.
(B) A DEPLOYER AUDIT UNDER THIS SECTION SHALL INCLUDE:
(I) AN EVALUATION AND DETERMINATION OF WHETHER THE DEPLOYER HAS TAKEN
REASONABLE CARE TO PREVENT FORESEEABLE RISK OF ALGORITHMIC DISCRIMI-
NATION WITH RESPECT TO SUCH HIGH-RISK AI SYSTEM;
(II) AN EVALUATION OF SYSTEM ACCURACY AND RELIABILITY WITH RESPECT TO
SUCH HIGH-RISK AI SYSTEM'S DEPLOYER-INTENDED AND ACTUAL USE CASES; AND
(III) AN EVALUATION OF THE DEPLOYER'S DOCUMENTED RISK MANAGEMENT POLI-
CY AND PROGRAM REQUIRED UNDER SECTION ONE HUNDRED TWELVE OF THIS ARTICLE
FOR CONFORMITY WITH SUBDIVISION ONE OF SUCH SECTION ONE HUNDRED TWELVE.
(C) NOTWITHSTANDING PARAGRAPH (B) OF THIS SUBDIVISION, SATISFACTORY
AUDITS UNDER ISO 42001 COMPLETED IN ACCORDANCE WITH PARAGRAPH (A) OF
S. 1169--B 8
THIS SUBDIVISION SHALL BE DEEMED TO SATISFY A COVERED DEPLOYER'S DUTY
UNDER THIS SUBDIVISION.
3. (A) AUDITS UNDER THIS SECTION SHALL BE CONDUCTED BY ONE OR MORE
THIRTY-PARTY AUDITORS. A DEPLOYER OR DEVELOPER MAY HIRE MORE THAN ONE
AUDITOR TO FULFILL THE REQUIREMENTS OF THIS SECTION.
(B) AN AUDITOR SHALL BE AN INDEPENDENT ENTITY INCLUDING, BUT NOT
LIMITED TO, AN INDIVIDUAL, NON-PROFIT, FIRM, CORPORATION, PARTNERSHIP,
COOPERATIVE, OR ASSOCIATION.
(C) FOR THE PURPOSES OF THIS ARTICLE, NO AUDITOR MAY BE COMMISSIONED
BY A COVERED DEVELOPER OR COVERED DEPLOYER IF SUCH ENTITY:
(I) HAS ALREADY BEEN COMMISSIONED TO PROVIDE ANY AUDITING OR NON-AU-
DITING SERVICE INCLUDING, BUT NOT LIMITED, TO FINANCIAL AUDITING,
CYBERSECURITY AUDITING, OR CONSULTING SERVICES OF ANY TYPE, TO THE
COMMISSIONING COMPANY IN THE PAST TWELVE MONTHS; OR
(II) IS, WILL BE, OR PLANS TO BE ENGAGED IN THE BUSINESS OF DEVELOPING
OR DEPLOYING AN AI SYSTEM THAT CAN COMPETE COMMERCIALLY WITH SUCH DEVEL-
OPER'S OR DEPLOYER'S AI SYSTEM IN THE FIVE YEARS FOLLOWING AN AUDIT.
(D) FEES PAID TO AUDITORS MAY NOT BE CONTINGENT ON THE RESULT OF THE
AUDIT AND THE COMMISSIONING COMPANY SHALL NOT PROVIDE ANY INCENTIVES OR
BONUSES FOR A POSITIVE AUDIT RESULT.
4. NOTWITHSTANDING SUBDIVISION THREE OF THIS SECTION, A COVERED DEVEL-
OPER OR COVERED DEPLOYER MAY CONDUCT AUDITS UNDER THIS SECTION USING AN
AUDITOR THAT IS AN EMPLOYEE OF SUCH DEVELOPER OR DEPLOYER, IF THE COST
OF AN AUDIT THAT COMPLIES WITH SUBDIVISION THREE EXCEEDS ONE PERCENT OF
THE FAIR MARKET VALUE OF SUCH DEVELOPER OR DEPLOYER.
5. AT THE ATTORNEY GENERAL'S DISCRETION, THE ATTORNEY GENERAL MAY:
(A) PROMULGATE FURTHER RULES AS NECESSARY TO ENSURE THAT AUDITS UNDER
THIS SECTION ASSESS WHETHER OR NOT AI SYSTEMS PRODUCE ALGORITHMIC
DISCRIMINATION AND OTHERWISE COMPLY WITH THE PROVISIONS OF THIS ARTICLE;
AND
(B) RECOMMEND AN UPDATED AI SYSTEM AUDITING FRAMEWORK TO THE LEGISLA-
TURE, WHERE SUCH RECOMMENDATIONS ARE BASED ON A STANDARD OR FRAMEWORK
(I) DESIGNED TO EVALUATE THE RISKS OF AI SYSTEMS, AND (II) THAT IS
NATIONALLY OR INTERNATIONALLY RECOGNIZED AND CONSENSUS-DRIVEN, INCLUDING
BUT NOT LIMITED TO A RELEVANT FRAMEWORK OR STANDARD CREATED BY THE
INTERNATIONAL ORGANIZATION FOR STANDARDIZATION.
6. THE INDEPENDENT AUDITOR SHALL HAVE COMPLETE AND UNREDACTED COPIES
OF ALL REPORTS PREVIOUSLY FILED BY THE DEPLOYER OR DEVELOPER UNDER
SECTION ONE HUNDRED ELEVEN OF THIS ARTICLE.
7. AN AUDIT CONDUCTED UNDER THIS SECTION MAY BE COMPLETED IN PART, BUT
SHALL NOT BE COMPLETED ENTIRELY, WITH THE ASSISTANCE OF AN AI SYSTEM.
(A) ACCEPTABLE AUDITOR USES OF AN AI SYSTEM INCLUDE, BUT ARE NOT
LIMITED TO:
(I) USE OF AN AUDITED HIGH-RISK AI SYSTEM IN A CONTROLLED ENVIRONMENT
WITHOUT IMPACTS ON COVERED SUBJECTS FOR SYSTEM TESTING PURPOSES; OR
(II) DETECTING PATTERNS IN THE BEHAVIOR OF AN AUDITED AI SYSTEM.
(B) AN AUDITOR SHALL NOT:
(I) USE A DIFFERENT HIGH-RISK AI SYSTEM THAT IS NOT THE SUBJECT OF AN
AUDIT TO COMPLETE AN AUDIT; OR
(II) USE AN AI SYSTEM TO DRAFT AN AUDIT UNDER THIS SECTION WITHOUT
MEANINGFUL HUMAN REVIEW AND OVERSIGHT.
8. THE ATTORNEY GENERAL MAY PROMULGATE FURTHER RULES TO ENSURE (A) THE
INDEPENDENCE OF AUDITORS UNDER THIS SECTION, AND (B) THAT TEAMS CONDUCT-
ING AUDITS INCORPORATE FEEDBACK FROM COMMUNITIES THAT MAY FORESEEABLY BE
THE SUBJECT OF ALGORITHMIC DISCRIMINATION WITH RESPECT TO THE AI SYSTEM
BEING AUDITED.
S. 1169--B 9
9. IF A DEVELOPER OR DEPLOYER HAS AN AUDIT COMPLETED FOR THE PURPOSE
OF COMPLYING WITH ANOTHER APPLICABLE FEDERAL, STATE, OR LOCAL LAW OR
REGULATION, AND THE AUDIT OTHERWISE SATISFIES ALL OTHER REQUIREMENTS OF
THIS SECTION, SUCH AUDIT SHALL BE DEEMED TO SATISFY THE REQUIREMENTS OF
THIS SECTION.
§ 111. HIGH-RISK AI SYSTEM REPORTING REQUIREMENTS. 1. EVERY COVERED
DEVELOPER AND COVERED DEPLOYER SHALL COMPLY WITH THE REPORTING REQUIRE-
MENTS OF THIS SECTION.
2. TOGETHER WITH EACH REPORT REQUIRED TO BE FILED UNDER THIS SECTION,
EVERY COVERED DEVELOPER AND COVERED DEPLOYER SHALL FILE WITH THE DEPART-
MENT OF FINANCIAL SERVICES A COPY OF THE LAST COMPLETED AUDIT REQUIRED
BY THIS ARTICLE.
3. COVERED DEVELOPERS OF HIGH-RISK AI SYSTEMS SHALL COMPLETE AND FILE
WITH THE DEPARTMENT OF FINANCIAL SERVICES REPORTS IN ACCORDANCE WITH
THIS SUBDIVISION.
(A) A COVERED DEVELOPER SHALL COMPLETE AND FILE WITH THE DEPARTMENT OF
FINANCIAL SERVICES AT LEAST:
(I) A FIRST REPORT WITHIN SIX MONTHS AFTER COMPLETION OF DEVELOPMENT
OF THE HIGH-RISK AI SYSTEM AND THE INITIAL OFFERING OF THE HIGH-RISK AI
SYSTEM TO A DEPLOYER FOR DEPLOYMENT OR, IF THE DEVELOPER IS FIRST
DEPLOYER TO DEPLOY THE HIGH-RISK AI SYSTEM, AFTER INITIAL DEPLOYMENT;
(II) ONE REPORT ANNUALLY FOLLOWING THE SUBMISSION OF THE FIRST REPORT;
AND
(III) ONE REPORT WITHIN SIX MONTHS OF ANY SUBSTANTIAL CHANGE TO THE
HIGH-RISK AI SYSTEM.
(B) A DEVELOPER REPORT UNDER THIS SECTION SHALL INCLUDE:
(I) A DESCRIPTION OF THE SYSTEM INCLUDING:
(A) THE USES OF THE HIGH-RISK AI SYSTEM THAT THE DEVELOPER INTENDS;
AND
(B) ANY EXPLICITLY UNINTENDED OR DISALLOWED USES OF THE HIGH-RISK AI
SYSTEM;
(II) AN OVERVIEW OF HOW THE HIGH-RISK AI SYSTEM WAS DEVELOPED;
(III) AN OVERVIEW OF THE HIGH-RISK AI SYSTEM'S TRAINING DATA; AND
(IV) IF THE DEVELOPER CONDUCTED AN AUDIT IN ACCORDANCE WITH SUBDIVI-
SION FOUR OF SECTION ONE HUNDRED TEN OF THIS ARTICLE, AN OVERVIEW OF THE
AUDIT, INCLUDING HOW THE AUDIT WAS STRUCTURED, HOW THE AUDIT WAS
CONDUCTED, AND INFORMATION ON THE AUDITOR; AND
(V) ANY OTHER INFORMATION NECESSARY TO ALLOW A COVERED DEPLOYER TO:
(A) UNDERSTAND THE OUTPUTS AND MONITOR THE SYSTEM FOR COMPLIANCE WITH
THIS ARTICLE; AND
(B) FULFILL ITS DUTIES UNDER THIS ARTICLE.
4. COVERED DEPLOYERS SHALL COMPLETE AND FILE WITH THE DEPARTMENT OF
FINANCIAL SERVICES REPORTS IN ACCORDANCE WITH THIS SUBDIVISION.
(A) A COVERED DEPLOYER SHALL COMPLETE AND FILE WITH THE DEPARTMENT OF
FINANCIAL SERVICES AT LEAST:
(I) A FIRST REPORT WITHIN SIX MONTHS AFTER INITIAL DEPLOYMENT;
(II) A SECOND REPORT WITHIN ONE YEAR FOLLOWING THE COMPLETION AND
FILING OF THE FIRST REPORT;
(III) ONE REPORT EVERY TWO YEARS FOLLOWING THE COMPLETION AND FILING
OF THE SECOND REPORT; AND
(IV) ONE REPORT WITHIN SIX MONTHS OF ANY SUBSTANTIAL CHANGE TO THE
HIGH-RISK AI SYSTEM.
(B) A DEPLOYER REPORT UNDER THIS SECTION SHALL INCLUDE:
(I) A DESCRIPTION OF THE SYSTEM INCLUDING:
(A) THE DEPLOYER'S ACTUAL, INTENDED, OR PLANNED USES OF THE HIGH-RISK
AI SYSTEM WITH RESPECT TO CONSEQUENTIAL DECISIONS; AND
S. 1169--B 10
(B) WHETHER THE DEPLOYER IS USING THE HIGH-RISK AI SYSTEM FOR ANY
DEVELOPER UNINTENDED OR DISALLOWED USES; AND
(II) AN IMPACT ASSESSMENT INCLUDING:
(A) WHETHER THE HIGH-RISK AI SYSTEM POSES A RISK OF ALGORITHMIC
DISCRIMINATION AND THE STEPS TAKEN TO ADDRESS THE RISK OF ALGORITHMIC
DISCRIMINATION;
(B) IF THE HIGH-RISK AI SYSTEM IS OR WILL BE MONETIZED, HOW IT IS OR
IS PLANNED TO BE MONETIZED; AND
(C) AN EVALUATION OF THE COSTS AND BENEFITS TO CONSUMERS AND OTHER
COVERED SUBJECTS; AND
(III) IF THE DEPLOYER CONDUCTED AN AUDIT IN ACCORDANCE WITH SUBDIVI-
SION FOUR OF SECTION ONE HUNDRED TEN OF THIS ARTICLE, AN OVERVIEW OF THE
AUDIT, INCLUDING HOW THE AUDIT WAS STRUCTURED, HOW THE AUDIT WAS
CONDUCTED, AND INFORMATION ON THE AUDITOR.
(C) A COVERED DEPLOYER THAT IS ALSO A COVERED DEVELOPER AND IS
REQUIRED TO SUBMIT REPORTS UNDER SUBDIVISION THREE OF THIS SECTION MAY
SUBMIT A SINGLE JOINT REPORT PROVIDED IT CONTAINS THE INFORMATION
REQUIRED IN THIS SUBDIVISION.
5. THE ATTORNEY GENERAL SHALL PROMULGATE RULES FOR A PROCESS WHEREBY
COVERED DEVELOPERS AND COVERED DEPLOYERS MAY REQUEST REDACTION OF
PORTIONS OF REPORTS REQUIRED UNDER THIS SECTION TO ENSURE THAT THEY ARE
NOT REQUIRED TO DISCLOSE SENSITIVE AND PROTECTED INFORMATION.
6. FOR HIGH-RISK AI SYSTEMS WHICH ARE ALREADY IN DEPLOYMENT AT THE
TIME OF THE EFFECTIVE DATE OF THIS ARTICLE, COVERED DEVELOPERS AND
COVERED DEPLOYERS SHALL HAVE EIGHTEEN MONTHS FROM SUCH EFFECTIVE DATE TO
COMPLETE AND FILE THE FIRST REPORT AND ASSOCIATED INDEPENDENT AUDIT
REQUIRED BY THIS ARTICLE.
(A) EACH COVERED DEVELOPER SHALL THEREAFTER FILE AT LEAST ONE REPORT
ANNUALLY FOLLOWING THE SUBMISSION OF THE FIRST REPORT UNDER THIS SUBDI-
VISION.
(B) EACH COVERED DEPLOYER SHALL THEREAFTER FILE AT LEAST ONE REPORT
EVERY TWO YEARS FOLLOWING THE SUBMISSION OF THE FIRST REPORT UNDER THIS
SUBDIVISION.
§ 112. RISK MANAGEMENT POLICY AND PROGRAM. 1. EACH COVERED DEVELOPER
OR COVERED DEPLOYER SHALL PLAN, DOCUMENT, AND IMPLEMENT A RISK MANAGE-
MENT POLICY AND PROGRAM TO GOVERN DEVELOPMENT OR DEPLOYMENT, AS APPLICA-
BLE, OF SUCH HIGH-RISK AI SYSTEM. THE RISK MANAGEMENT POLICY AND
PROGRAM SHALL SPECIFY AND INCORPORATE THE PRINCIPLES, PROCESSES, AND
PERSONNEL THAT THE DEVELOPER OR DEPLOYER USES TO IDENTIFY, DOCUMENT, AND
MITIGATE KNOWN OR REASONABLY FORESEEABLE RISKS OF ALGORITHMIC DISCRIMI-
NATION COVERED UNDER SUBDIVISION ONE OF SECTION ONE HUNDRED SIX OF THIS
ARTICLE. THE RISK MANAGEMENT POLICY AND PROGRAM SHALL BE AN ITERATIVE
PROCESS PLANNED, IMPLEMENTED, AND REGULARLY AND SYSTEMATICALLY REVIEWED
AND UPDATED OVER THE LIFE CYCLE OF A HIGH-RISK AI SYSTEM, REQUIRING
REGULAR, SYSTEMATIC REVIEW AND UPDATES, INCLUDING UPDATES TO DOCUMENTA-
TION. A RISK MANAGEMENT POLICY AND PROGRAM IMPLEMENTED AND MAINTAINED
PURSUANT TO THIS SECTION SHALL BE REASONABLE CONSIDERING:
(A) THE GUIDANCE AND STANDARDS SET FORTH IN:
(I) VERSION 1.0 OF THE "ARTIFICIAL INTELLIGENCE RISK MANAGEMENT FRAME-
WORK" PUBLISHED BY THE NATIONAL INSTITUTE OF STANDARDS AND TECHNOLOGY IN
THE UNITED STATES DEPARTMENT OF COMMERCE,
(II) ISO 42001, OR
(III) ANOTHER SUBSTANTIALLY EQUIVALENT FRAMEWORK SELECTED AT THE
DISCRETION OF THE ATTORNEY GENERAL, IF SUCH FRAMEWORK WAS DESIGNED TO
MANAGE RISKS ASSOCIATED WITH AI SYSTEMS, IS NATIONALLY OR INTERNA-
TIONALLY RECOGNIZED AND CONSENSUS-DRIVEN, AND IS AT LEAST AS STRINGENT
S. 1169--B 11
AS VERSION 1.0 OF THE "ARTIFICIAL INTELLIGENCE RISK MANAGEMENT FRAME-
WORK" PUBLISHED BY THE NATIONAL INSTITUTE OF STANDARDS AND TECHNOLOGY OR
ISO 42001;
(B) THE SIZE AND COMPLEXITY OF THE DEVELOPER OR DEPLOYER;
(C) THE NATURE, SCOPE, AND INTENDED USES OF THE HIGH-RISK AI SYSTEM
DEVELOPED OR DEPLOYED; AND
(D) THE SENSITIVITY AND VOLUME OF DATA PROCESSED IN CONNECTION WITH
THE HIGH-RISK AI SYSTEM.
2. A RISK MANAGEMENT POLICY AND PROGRAM IMPLEMENTED PURSUANT TO SUBDI-
VISION ONE OF THIS SECTION MAY COVER MULTIPLE HIGH-RISK AI SYSTEMS
DEVELOPED BY THE SAME DEVELOPER OR DEPLOYED BY THE SAME DEPLOYER IF
SUFFICIENT.
3. THE ATTORNEY GENERAL MAY REQUIRE A COVERED DEVELOPER OR A COVERED
DEPLOYER TO DISCLOSE THE RISK MANAGEMENT POLICY AND PROGRAM IMPLEMENTED
PURSUANT TO SUBDIVISION ONE OF THIS SECTION IN A FORM AND MANNER
PRESCRIBED BY THE ATTORNEY GENERAL. THE ATTORNEY GENERAL MAY EVALUATE
THE RISK MANAGEMENT POLICY AND PROGRAM TO ENSURE COMPLIANCE WITH THIS
SECTION.
4. NOTWITHSTANDING SUBDIVISION ONE OF THIS SECTION, A DEVELOPER THAT
IS IN COMPLIANCE WITH THE DUTIES UNDER SECTION FOURTEEN HUNDRED TWENTY-
TWO OF THE GENERAL BUSINESS LAW SHALL BE DEEMED IN COMPLIANCE WITH THIS
SECTION.
§ 113. SOCIAL SCORING AI SYSTEMS PROHIBITED. NO PERSON, PARTNERSHIP,
ASSOCIATION OR CORPORATION SHALL DEVELOP, DEPLOY, USE, OR SELL AN AI
SYSTEM WHICH EVALUATES OR CLASSIFIES THE TRUSTWORTHINESS OF NATURAL
PERSONS OVER A CERTAIN PERIOD OF TIME BASED ON THEIR SOCIAL BEHAVIOR OR
KNOWN OR PREDICTED PERSONAL OR PERSONALITY CHARACTERISTICS, WITH THE
SOCIAL SCORE LEADING TO ANY OF THE FOLLOWING:
1. DIFFERENTIAL TREATMENT OF CERTAIN NATURAL PERSONS OR WHOLE GROUPS
THEREOF IN SOCIAL CONTEXTS WHICH ARE UNRELATED TO THE CONTEXTS IN WHICH
THE DATA WAS ORIGINALLY GENERATED OR COLLECTED;
2. DIFFERENTIAL TREATMENT OF CERTAIN NATURAL PERSONS OR WHOLE GROUPS
THEREOF THAT IS UNJUSTIFIED OR DISPROPORTIONATE TO THEIR SOCIAL BEHAVIOR
OR ITS GRAVITY; OR
3. THE INFRINGEMENT OF ANY RIGHT GUARANTEED UNDER THE UNITED STATES
CONSTITUTION, THE NEW YORK CONSTITUTION, OR STATE OR FEDERAL LAW.
§ 114. ENFORCEMENT. 1. WHENEVER THERE SHALL BE A VIOLATION OF SECTION
ONE HUNDRED SEVEN, ONE HUNDRED EIGHT, ONE HUNDRED TEN, ONE HUNDRED ELEV-
EN, ONE HUNDRED TWELVE, OR ONE HUNDRED THIRTEEN OF THIS ARTICLE, AN
APPLICATION MAY BE MADE BY THE ATTORNEY GENERAL IN THE NAME OF THE
PEOPLE OF THE STATE OF NEW YORK, TO THE SUPREME COURT HAVING JURISDIC-
TION TO ISSUE AN INJUNCTION, AND UPON NOTICE TO THE RESPONDENT OF NOT
LESS THAN TEN DAYS, TO ENJOIN AND RESTRAIN THE CONTINUANCE OF SUCH
VIOLATION; AND IF IT SHALL APPEAR TO THE SATISFACTION OF THE COURT THAT
THE RESPONDENT HAS, IN FACT, VIOLATED THIS ARTICLE, AN INJUNCTION MAY BE
ISSUED BY THE COURT, ENJOINING AND RESTRAINING ANY FURTHER VIOLATIONS,
WITHOUT REQUIRING PROOF THAT ANY PERSON HAS, IN FACT, BEEN INJURED OR
DAMAGED THEREBY. IN ANY SUCH PROCEEDING, THE COURT MAY MAKE ALLOWANCES
TO THE ATTORNEY GENERAL AS PROVIDED IN PARAGRAPH SIX OF SUBDIVISION (A)
OF SECTION EIGHTY-THREE HUNDRED THREE OF THE CIVIL PRACTICE LAW AND
RULES, AND DIRECT RESTITUTION. WHENEVER THE COURT SHALL DETERMINE THAT A
VIOLATION OF THIS ARTICLE HAS OCCURRED:
(A) BY A DEVELOPER, THE COURT MAY IMPOSE A CIVIL PENALTY OF NOT MORE
THAN TWENTY-FIVE THOUSAND DOLLARS FOR EACH VIOLATION; OR
(B) BY A DEPLOYER, THE COURT MAY IMPOSE A CIVIL PENALTY OF NOT MORE
THAN TEN THOUSAND DOLLARS FOR EACH VIOLATION.
S. 1169--B 12
2. IN EVALUATING ANY MOTION TO DISMISS A PROCEEDING COMMENCED PURSUANT
TO THIS SECTION, THE COURT SHALL PRESUME THE SPECIFIED AI SYSTEM WAS
CREATED AND/OR OPERATED IN VIOLATION OF A SPECIFIED LAW OR LAWS AND THAT
SUCH VIOLATION CAUSED THE HARM OR HARMS ALLEGED.
(A) A DEFENDANT CAN REBUT PRESUMPTIONS MADE PURSUANT TO THIS SUBDIVI-
SION THROUGH CLEAR AND CONVINCING EVIDENCE THAT THE SPECIFIED AI SYSTEM
DID NOT CAUSE THE HARM OR HARMS ALLEGED AND/OR DID NOT VIOLATE THE
ALLEGED LAW OR LAWS. AN ALGORITHMIC AUDIT CAN BE CONSIDERED AS EVIDENCE
IN REBUTTING SUCH PRESUMPTIONS, BUT THE MERE EXISTENCE OF SUCH AN AUDIT,
WITHOUT ADDITIONAL EVIDENCE, SHALL NOT BE CONSIDERED CLEAR AND CONVINC-
ING EVIDENCE.
(B) WHERE SUCH PRESUMPTIONS ARE NOT REBUTTED PURSUANT TO THIS SUBDIVI-
SION, THE ACTION SHALL NOT BE DISMISSED.
(C) WHERE SUCH PRESUMPTIONS ARE REBUTTED PURSUANT TO THIS SUBDIVISION,
A MOTION TO DISMISS AN ACTION SHALL BE ADJUDICATED WITHOUT ANY CONSIDER-
ATION OF THIS SECTION.
3. THE SUPREME COURT IN THE STATE SHALL HAVE JURISDICTION OVER ANY
ACTION, CLAIM, OR LAWSUIT TO ENFORCE THE PROVISIONS OF THIS ARTICLE.
§ 115. SEVERABILITY. IF ANY CLAUSE, SENTENCE, PARAGRAPH, SUBDIVISION,
SECTION OR PART OF THIS ARTICLE SHALL BE ADJUDGED BY ANY COURT OF COMPE-
TENT JURISDICTION TO BE INVALID, SUCH JUDGMENT SHALL NOT AFFECT, IMPAIR,
OR INVALIDATE THE REMAINDER THEREOF, BUT SHALL BE CONFINED IN ITS OPERA-
TION TO THE CLAUSE, SENTENCE, PARAGRAPH, SUBDIVISION, SECTION, OR PART
THEREOF DIRECTLY INVOLVED IN THE CONTROVERSY IN WHICH SUCH JUDGMENT
SHALL HAVE BEEN MADE.
§ 4. Section 296 of the executive law is amended by adding a new
subdivision 23 to read as follows:
23. IT SHALL BE AN UNLAWFUL DISCRIMINATORY PRACTICE UNDER THIS SECTION
FOR A DEPLOYER OR A DEVELOPER, AS SUCH TERMS ARE DEFINED IN SECTION ONE
HUNDRED FIVE OF THE CIVIL RIGHTS LAW, TO ENGAGE IN AN UNLAWFUL DISCRIMI-
NATORY PRACTICE UNDER SECTION ONE HUNDRED SIX OF THE CIVIL RIGHTS LAW.
§ 5. This act shall take effect one year after it shall have become a
law; provided, however, that section 110 of article 10-A of the civil
rights law as added by section three of this act shall take effect two
years after it shall have become a law.
