Text of MD SB 936 (2025)

EXPLANATION: CAPITALS INDICATE MATTER ADDED TO EXISTING LAW. [Brackets] indicate matter deleted from existing law. *sb0936* SENATE BILL 936 I3, S1 5lr0853 CF 5lr3153 By: Senators Hester, Gile, and Love Introduced and read first time: January 28, 2025 Assigned to: Finance A BILL ENTITLED AN ACT concerning 1 Consumer Protection – High–Risk Artificial Intelligence – Developer and 2 Deployer Requirements 3 FOR the purpose of requiring a certain developer of and a certain deployer who uses a 4 certain high–risk artificial intelligence system to use reasonable care to protect 5 consumers from known and reasonably foreseeable risks of certain algorithmic 6 discrimination; prohibiting a developer from providing to a certain deployer or other 7 developer a high–risk artificial intelligence system unless certain disclosures are 8 provided to the deployer or developer; requiring a developer to make certain 9 documentation and information available to complete an impact assessment in a 10 certain manner; requiring a deployer to design, implement, and maintain a risk 11 management policy and program for the high–risk artificial intelligence system in 12 use by the deployer; requiring a deployer to complete an impact assessment of its 13 high–risk artificial intelligence system; requiring a deployer to provide certain 14 information to a consumer regarding the deployment of and decisions made by a 15 high–risk artificial intelligence system; requiring a deployer to provide consumers 16 with an opportunity to correct certain information and appeal a certain 17 consequential decision; authorizing the Attorney General to enforce this Act; 18 authorizing a consumer to bring a civil action against a deployer under certain 19 circumstances; and generally relating to the use of high–risk artificial intelligence 20 systems in the State. 21 BY adding to 22 Article – Commercial Law 23 Section 14–47A–01 through 14–47A–08 to be under the new subtitle “Subtitle 47A. 24 High–Risk Artificial Intelligence Developer Act” 25 Annotated Code of Maryland 26 (2013 Replacement Volume and 2024 Supplement) 27 SECTION 1. BE IT ENACTED BY THE GENERAL ASSEMBLY OF MARYLAND, 28 That the Laws of Maryland read as follows: 29 2 SENATE BILL 936 Article – Commercial Law 1 SUBTITLE 47A. HIGH–RISK ARTIFICIAL INTELLIGENCE DEVELOPER ACT. 2 14–47A–01. 3 (A) IN THIS SUBTITLE THE FOLLOWING WORDS HAVE THE MEANINGS 4 INDICATED. 5 (B) (1) “ALGORITHMIC DISCRIMINATION” MEANS THE USE OF AN 6 ARTIFICIAL INTELLIGENCE SYSTEM THAT RESULTS IN AN UNLAWFUL DIFFERENTIAL 7 TREATMENT OR IMPACT THAT DISFAVORS AN INDIVIDUAL OR GROUP OF 8 INDIVIDUALS ON THE BASIS OF THE INDIVIDUAL’S OR GROUP’S ACTUAL OR 9 PERCEIVED: 10 (I) AGE; 11 (II) COLOR; 12 (III) DISABILITY; 13 (IV) ETHNICITY; 14 (V) GENETIC INFORMATION; 15 (VI) LIMITED PROFICIENCY IN THE ENGLISH LANGUAGE; 16 (VII) NATIONAL ORIGIN; 17 (VIII) RACE; 18 (IX) RELIGION; 19 (X) REPRODUCTIVE HEALTH; 20 (XI) SEX; 21 (XII) SEXUAL ORIENTATION; 22 (XIII) VETERAN STATUS; OR 23 (XIV) CLASSIFICATION OTHERWISE PROTECTED UNDER STATE 24 OR FEDERAL LAW. 25 SENATE BILL 936 3 (2) “ALGORITHMIC DISCRIMINATION” DOES NOT INCLUDE: 1 (I) THE OFFER, LICENSE, OR USE OF A HIGH–RISK ARTIFICIAL 2 INTELLIGENCE SYSTEM BY A DEVELOPER OR DEPLOYER FOR THE SOLE PURPOSE OF 3 THE DEVELOPER’S OR DEPLOYER’S SELF–TESTING TO IDENTIFY, MITIGATE, OR 4 PREVENT DISCRIMINATION OR OTHERWISE ENSURE COMPLIANCE WITH STATE AND 5 FEDERAL LAW; 6 (II) THE EXPANSION OF AN APPLICANT, A CUSTOMER, OR A 7 PARTICIPANT POOL TO INCREASE DIVERSITY OR REDRESS HISTORICAL 8 DISCRIMINATION; OR 9 (III) AN ACT OR OMISSION BY OR ON BEHALF OF A PRIVATE CLUB 10 OR OTHER ESTABLISHMENT NOT IN FACT OPEN TO THE PUBLIC, AS PROVIDED BY 11 TITLE II OF THE CIVIL RIGHTS ACT OF 1964 UNDER 42 U.S.C. § 2000A(E). 12 (C) (1) “ARTIFICIAL INTELLIGENCE SYSTEM” MEANS A MACHINE 13 LEARNING–BASED SYSTEM THAT FOR ANY EXPLICIT OR IMPLICIT OBJECTIVE, 14 INFERS FROM THE INPUTS THE SYSTEM RECEIVES HOW TO GENERATE OUTPUTS, 15 INCLUDING CONTENT, DECISIONS, PREDICTIONS, OR RECOMMENDATIONS THAT CAN 16 INFLUENCE PHYSICAL OR VIRTUAL ENVIRONMENTS. 17 (2) “ARTIFICIAL INTELLIGENCE SYSTEM” DOES NOT INCLUDE AN 18 ARTIFICIAL INTELLIGENCE SYSTEM OR A MODEL THAT IS USED FOR DEVELOPMENT, 19 PROTOTYPING, AND RESEARCH ACTIVITIES BEFORE THE ARTIFICIAL INTELLIGENCE 20 SYSTEM OR MODEL IS RELEASED ON THE MARKET. 21 (D) “CONSEQUENTIAL DECISION” MEANS A DECISION THAT HAS A 22 MATERIALLY LEGAL OR SIMILARLY SIGNIFICANT EFFECT ON THE PROVISION OR 23 DENIAL TO A CONSUMER OF: 24 (1) PAROLE, PROBATION, A PARDON, OR ANY OTHER RELEASE FROM 25 INCARCERATION OR COURT SUPERVISION; 26 (2) EDUCATION ENROLLMENT OR EDUCATION OPPORTUNITY; 27 (3) ACCESS TO OR PROVISION OF EMPLOYMENT; 28 (4) FINANCIAL OR LENDING SERVICES; 29 (5) ACCESS TO OR THE PROVISION OF HEALTH CARE SERVICES; 30 4 SENATE BILL 936 (6) HOUSING; 1 (7) INSURANCE; 2 (8) MARITAL STATUS; OR 3 (9) LEGAL SERVICE. 4 (E) (1) “CONSUMER” MEANS AN INDIVIDUAL WHO IS A RESIDENT OF THE 5 STATE AND IS ACTING ONLY IN A PERSONAL OR HOUSEHOLD CONTEXT. 6 (2) “CONSUMER” DOES NOT INCLUDE AN INDIVIDUAL ACTING IN A 7 COMMERCIAL OR EMPLOYMENT CONTEXT. 8 (F) “DEPLOYER” MEANS A PERSON DOING BUSINESS IN THE STATE THAT 9 DEPLOYS OR USES A HIGH–RISK ARTIFICIAL INTELLIGENCE SYSTEM TO MAKE A 10 CONSEQUENTIAL DECISION IN THE STATE. 11 (G) “DEVELOPER” MEANS A PERSON DOING BUSINESS IN THE STATE THAT 12 DEVELOPS OR INTENTIONALLY AND SUBSTANTIALLY MODIFIES A HIGH–RISK 13 ARTIFICIAL INTELLIGENCE SYSTEM THAT IS OFFERED, SOLD, LEASED, GIVEN, OR 14 OTHERWISE PROVIDED TO CONSUMERS IN THE STATE. 15 (H) (1) “GENERAL–PURPOSE ARTIFICIAL INTELLIGENCE MODEL” MEANS 16 A MODEL USED BY AN ARTIFICIAL INTELLIGENCE SYSTEM THAT: 17 (I) DISPLAYS SIGNIFICANT GENERALITY; 18 (II) IS CAPABLE OF COMPETENTLY PERFORMING A WIDE RANGE 19 OF DISTINCT TASKS; AND 20 (III) CAN BE INTEGRATED INTO A VARIETY OF DOWNSTREAM 21 APPLICATIONS OR SYSTEMS. 22 (2) “GENERAL–PURPOSE ARTIFICIAL INTELLIGENCE MODEL” DOES 23 NOT INCLUDE AN ARTIFICIAL INTELLIGENCE MODEL THAT IS USED FOR 24 DEVELOPMENT, PROTOTYPING, AND RESEARCH ACTIVITIES BEFORE THE 25 ARTIFICIAL INTELLIGENCE MODEL IS RELEASED ON THE MARKET. 26 (I) “GENERATIVE ARTIFICIAL INTELLIGENCE” MEANS ARTIFICIAL 27 INTELLIGENCE THAT IS CAPABLE OF AND USED TO PRODUCE SYNTHETIC CONTENT, 28 INCLUDING AUDIO, IMAGES, TEXT, AND VIDEOS. 29 SENATE BILL 936 5 (J) “GENERATIVE ARTIFICIAL INTELLIGENCE SYSTEM” MEANS ANY 1 ARTIFICIAL INTELLIGENCE SYSTEM OR SERVICE THAT INCORPORATES GENERATIVE 2 ARTIFICIAL INTELLIGENCE. 3 (K) (1) “HIGH–RISK ARTIFICIAL INTELLIGENCE SYSTEM” MEANS AN 4 ARTIFICIAL INTELLIGENCE SYSTEM THAT IS SPECIFICALLY INTENDED TO 5 AUTONOMOUSLY MAKE, OR BE A SUBSTANTIAL FACTOR IN MAKING, A 6 CONSEQUENTIAL DECISION. 7 (2) “HIGH–RISK ARTIFICIAL INTELLIGENCE SYSTEM” DOES NOT 8 INCLUDE: 9 (I) AN ARTIFICIAL INTELLIGENCE SYSTEM THAT IS INTENDED 10 TO: 11 1. PERFORM A NARROW PROCEDURAL TASK; 12 2. IMPROVE THE RESULT OF A PREVIOUSLY COMPLETED 13 HUMAN ACTIVITY; 14 3. DETECT ANY DECISION–MAKING PATTERNS OR ANY 15 DEVIATIONS FROM PREEXISTING DECISION–MAKING PATTERNS; OR 16 4. PERFORM A PREPARATORY TASK TO AN ASSESSMENT 17 RELEVANT TO A CONSEQUENTIAL DECISION; OR 18 (II) THE FOLLOWING TECHNOLOGIES: 19 1. ANTIFRAUD TECHNOLOGY THAT DOES NOT USE 20 FACIAL RECOGNITION TECHNOLOGY; 21 2. ARTIFICIAL INTELLIGENCE–ENABLED VIDEO GAME 22 TECHNOLOGY; 23 3. ANTIMALWARE AND ANTIVIRUS TECHNOLOGY; 24 4. AUTONOMOUS VEHICLE TECHNOLOGY; 25 5. CALCULATORS; 26 6. CYBERSECURITY TECHNOLOGY; 27 7. DATABASES AND DATA STORAGE; 28 6 SENATE BILL 936 8. FIREWALL TECHNOLOGY; 1 9. INTERNET DOMAIN REGISTRATION; 2 10. INTERNET WEBSITE LOADING; 3 11. NETWORKING; 4 12. SPAM AND ROBOCALL FILTERING; 5 13. SPELLCHECKING TECHNOLOGY; 6 14. SPREADSHEETS; 7 15. WEB CACHING; 8 16. WEB HOSTING OR SIMILAR TECHNOLOGY; OR 9 17. TECHNOLOGY THAT COMMUNICATES WITH 10 CONSUMERS IN NATURAL LANGUAGE FOR THE PURPOSE OF PROVIDING USERS WITH 11 INFORMATION, MAKING REFERRALS OR RECOMMENDATIONS, AND ANSWERING 12 QUESTIONS AND IS SUBJECT TO AN ACCEPTABLE USE POLICY THAT PROHIBITS 13 GENERATING CONTENT THAT IS DISCRIMINATORY OR UNLAWFUL. 14 (L) (1) “INTENTIONAL AND SUBSTANTIAL MODIFICATION” MEANS A 15 DELIBERATE CHANGE MADE TO: 16 (I) AN ARTIFICIAL INTELLIGENCE SYSTEM THAT RESULTS IN A 17 NEW MATERIAL RISK OF ALGORITHMIC DISCRIMINATION; OR 18 (II) A GENERAL–PURPOSE ARTIFICIAL INTELLIGENCE MODEL 19 THAT: 20 1. AFFECTS COMPLIANCE OF THE GENERAL–PURPOSE 21 ARTIFICIAL INTELLIGENCE MODEL; 22 2. MATERIALLY CHANGES THE PURPOSE OF THE 23 GENERAL–PURPOSE ARTIFICIAL INTELLIGENCE MODEL; OR 24 3. RESULTS IN ANY NEW REASONABLY FORESEEABLE 25 RISK OF ALGORITHMIC DISCRIMINATION. 26 SENATE BILL 936 7 (2) “INTENTIONAL AND SUBSTANTIAL MODIFICATION” DOES NOT 1 INCLUDE A CHANGE MADE TO A HIGH–RISK ARTIFICIAL INTELLIGENCE SYSTEM, OR 2 THE PERFORMANCE OF A HIGH–RISK ARTIFICIAL INTELLIGENCE SYSTEM, IF: 3 (I) THE HIGH–RISK ARTIFICIAL INTELLIGENCE SYSTEM 4 CONTINUES TO LEARN AFTER THE HIGH–RISK ARTIFICIAL INTELLIGENCE SYSTEM IS 5 DEPLOYED OR OFFERED, SOLD, LEASED, LICENSED, GIVEN, OR OTHERWISE MADE 6 AVAILABLE TO A DEPLOYER; AND 7 (II) THE CHANGE: 8 1. IS MADE TO THE HIGH–RISK ARTIFICIAL 9 INTELLIGENCE SYSTEM AS A RESULT OF ANY LEARNING DESCRIBED IN ITEM (I) OF 10 THIS PARAGRAPH; 11 2. WAS PREDETERMINED BY THE DEPLOYER OR THE 12 THIRD PARTY CONTRACTED BY THE DEPLOYER; AND 13 3. INCLUDED AND CONCLUDED WITHIN THE INITIAL 14 IMPACT ASSESSMENT OF THE HIGH–RISK ARTIFICIAL INTELLIGENCE SYSTEM 15 UNDER § 14–47A–04(C) OF THIS SUBTITLE. 16 (M) (1) “PERSON” MEANS AN INDIVIDUAL, AN ASSOCIATION, A 17 COOPERATIVE, A CORPORATION, A LIMITED LIABILITY COMPANY, A PARTNERSHIP, 18 A TRUST, A JOINT VENTURE, OR ANY OTHER LEGAL OR COMMERCIAL ENTITY AND 19 ANY SUCCESSOR, REPRESENTATIVE, AGENCY, OR INSTRUMENTALITY THEREOF. 20 (2) “PERSON” DOES NOT INCLUDE A GOVERNMENTAL UNIT. 21 (N) “PRINCIPAL BASIS” MEANS THE USE OF AN OUTPUT OF A HIGH–RISK 22 ARTIFICIAL INTELLIGENCE SYSTEM TO MAKE A DECISION WITHOUT: 23 (1) HUMAN REVIEW, OVERSIGHT, INVOLVEMENT, OR INTERVENTION; 24 OR 25 (2) MEANINGFUL CONSIDERATION BY A HUMAN. 26 (O) (1) “SUBSTANTIAL FACTOR” MEANS A FACTOR GENERATED BY AN 27 ARTIFICIAL INTELLIGENCE SYSTEM THAT IS: 28 (I) THE PRINCIPAL BASIS FOR MAKING A CONSEQUENTIAL 29 DECISION; OR 30 8 SENATE BILL 936 (II) CAPABLE OF ALTERING THE OUTCOME OF A 1 CONSEQUENTIAL DECISION. 2 (2) “SUBSTANTIAL FACTOR” INCLUDES ANY USE OF AN ARTIFICIAL 3 INTELLIGENCE SYSTEM TO GENERATE ANY CONTENT, DECISION, PREDICTION, OR 4 RECOMMENDATION CONCERNING A CONSUMER THAT IS USED AS THE PRINCIPAL 5 BASIS TO MAKE A CONSEQUENTIAL DECISION CONCERNING THE CONSUMER. 6 (P) “SYNTHETIC CONTENT” MEANS INFORMATION, SUCH AS AUDIO CLIPS, 7 IMAGES, TEXT, AND VIDEO, THAT IS PRODUCED OR SIGNIFICANTLY MODIFIED OR 8 GENERATED BY ALGORITHMS, INCLUDING BY AN ARTIFICIAL INTELLIGENCE 9 SYSTEM. 10 14–47A–02. 11 THIS SUBTITLE DOES NOT APPLY TO: 12 (1) EXCEPT IN A SITUATION WHERE A HIGH–RISK ARTIFICIAL 13 INTELLIGENCE SYSTEM IS USED TO MAKE, OR IS A SUBSTANTIAL FACTOR IN MAKING, 14 A DECISION CONCERNING EMPLOYMENT OR HOUSING, A DEVELOPER OR DEPLOYER 15 THAT USES AN ARTIFICIAL INTELLIGENCE SYSTEM ACQUIRED BY OR FOR THE 16 FEDERAL GOVERNMENT OR ANY FEDERAL AGENCY OR DEPARTMENT, INCLUDING: 17 (I) THE U.S. DEPARTMENT OF COMMERCE; 18 (II) THE U.S. DEPARTMENT OF DEFENSE; AND 19 (III) THE NATIONAL AERONAUTICS AND SPACE 20 ADMINISTRATION; 21 (2) AN INSURER, OR A HIGH–RISK ARTIFICIAL INTELLIGENCE SYSTEM 22 DEVELOPED OR DEPLOYED BY AN INSURER FOR USE IN THE BUSINESS OF 23 INSURANCE, IF THE INSURER IS REGULATED AND SUPERVISED BY THE INSURANCE 24 ADMINISTRATION AND SUBJECT TO THE PROVISIONS UNDER TITLE 13 OF THIS 25 ARTICLE; OR 26 (3) A DEVELOPER, A DEPLOYER, OR ANY OTHER PERSON WHO: 27 (I) IS A COVERED ENTITY UNDER THE FEDERAL HEALTH 28 INSURANCE PORTABILITY AND ACCOUNTABILITY ACT OF 1996 UNDER 42 U.S.C. § 29 1320D THROUGH 1320D–9, AND THE CORRESPONDING FEDERAL REGULATIONS; 30 AND 31 SENATE BILL 936 9 (II) PROVIDES: 1 1. HEALTH CARE RECOMMENDATIONS GENERATED BY 2 AN ARTIFICIAL INTELLIGENCE SYSTEM IN WHICH A HEALTH CARE PROVIDER IS 3 REQUIRED TO TAKE ACTION TO IMPLEMENT THE HEALTH CARE 4 RECOMMENDATIONS; OR 5 2. SERVICES USING AN ARTIFICIAL INTELLIGENCE 6 SYSTEM FOR AN ADMINISTRATIVE, FINANCIAL, QUALITY MEASUREMENT, SECURITY, 7 OR PERFORMANCE IMPROVEMENT FUNCTION. 8 14–47A–03. 9 (A) (1) BEGINNING FEBRUARY 1, 2026, A DEVELOPER OF A 10 HIGH–RISK ARTIFICIAL INTELLIGENCE SYSTEM SHALL USE REASONABLE CARE TO 11 PROTECT CONSUMERS FROM ANY KNOWN OR REASONABLY FORESEEABLE RISKS OF 12 ALGORITHMIC DISCRIMINATION. 13 (2) IN AN ENFORCEMENT ACTION BROUGHT BY THE ATTORNEY 14 GENERAL UNDER THIS SUBTITLE, THERE SHALL BE A REBUTTABLE PRESUMPTION 15 THAT A DEVELOPER USED REASONABLE CARE AS REQUIRED UNDER THIS 16 SUBSECTION IF THE DEVELOPER COMPLIED WITH THE PROVISIONS OF THIS 17 SECTION. 18 (B) BEGINNING FEBRUARY 1, 2026, AND SUBJECT TO SUBSECTION (D) OF 19 THIS SECTION, A DEVELOPER OF A HIGH–RISK ARTIFICIAL INTELLIGENCE SYSTEM 20 MAY NOT OFFER, SELL, LEASE, GIVE, OR OTHERWISE PROVIDE TO A DEPLOYER, OR 21 OTHER DEVELOPER, A HIGH–RISK ARTIFICIAL INTELLIGENCE SYSTEM, UNLESS THE 22 DEVELOPER MAKES AVAILABLE TO THE DEPLOYER OR OTHER DEVELOPER: 23 (1) A STATEMENT DISCLOSING THE INTENDED USES OF THE 24 HIGH–RISK ARTIFICIAL INTELLIGENCE SYSTEM; 25 (2) DOCUMENTATION DISCLOSING: 26 (I) THE KNOWN OR REASONABLY FORESEEABLE LIMITATIONS 27 OF THE HIGH–RISK ARTIFICIAL INTELLIGENCE SYSTEM, INCLUDING THE KNOWN OR 28 REASONABLY FORESEEABLE RISKS OF ALGORITHMIC DISCRIMINATION ARISING 29 FROM THE INTENDED USES OF THE HIGH–RISK ARTIFICIAL INTELLIGENCE SYSTEM; 30 (II) THE PURPOSE OF THE HIGH–RISK ARTIFICIAL 31 INTELLIGENCE SYSTEM AND THE INTENDED BENEFITS AND USES OF THE HIGH–RISK 32 ARTIFICIAL INTELLIGENCE SYSTEM; 33 10 SENATE BILL 936 (III) A SUMMARY DESCRIBING THE MANNER IN WHICH THE 1 HIGH–RISK ARTIFICIAL INTELLIGENCE SYSTEM WAS EVALUATED FOR 2 PERFORMANCE BEFORE THE HIGH–RISK ARTIFICIAL INTELLIGENCE SYSTEM WAS 3 LICENSED, SOLD, LEASED, GIVEN, OR OTHERWISE MADE AVAILABLE TO A DEPLOYER; 4 (IV) THE MEASURES THE DEVELOPER HAS TAKEN TO MITIGATE 5 REASONABLY FORESEEABLE RISKS OF ALGORITHMIC DISCRIMINATION THAT THE 6 DEVELOPER KNOWS ARISES FROM DEPLOYMENT OR USE OF THE HIGH–RISK 7 ARTIFICIAL INTELLIGENCE SYSTEM; AND 8 (V) THE MANNER IN WHICH AN INDIVIDUAL CAN USE THE 9 HIGH–RISK ARTIFICIAL INTELLIGENCE SYSTEM AND MONITOR THE PERFORMANCE 10 OF THE HIGH–RISK ARTIFICIAL INTELLIGENCE SYSTEM FOR RISK OF ALGORITHMIC 11 DISCRIMINATION; 12 (3) DOCUMENTATION DESCRIBING: 13 (I) THE MANNER IN WHICH THE HIGH–RISK ARTIFICIAL 14 INTELLIGENCE SYSTEM WAS EVALUATED FOR PERFORMANCE, AND MITIGATION OF 15 ALGORITHMIC DISCRIMINATION BEFORE THE HIGH–RISK ARTIFICIAL 16 INTELLIGENCE SYSTEM WAS OFFERED, SOLD, LEASED, LICENSED, GIVEN, OR 17 OTHERWISE MADE AVAILABLE TO THE DEPLOYER OR OTHER DEVELOPER; 18 (II) A HIGH–LEVEL SUMMARY OF THE MANNER IN WHICH DATA 19 SOURCES WERE EVALUATED FOR POTENTIAL BIAS AND APPROPRIATE MITIGATIONS 20 WERE APPLIED; 21 (III) THE INTENDED OUTPUTS OF THE HIGH–RISK ARTIFICIAL 22 INTELLIGENCE SYSTEM; 23 (IV) THE MEASURES THE DEVELOPER HAS TAKEN TO MITIGATE 24 ANY KNOWN OR REASONABLY FORESEEABLE RISKS OF ALGORITHMIC 25 DISCRIMINATION THAT MAY ARISE FROM REASONABLY FORESEEABLE DEPLOYMENT 26 OF THE HIGH–RISK ARTIFICIAL INTELLIGENCE SYSTEM; AND 27 (V) THE MANNER IN WHICH THE HIGH–RISK ARTIFICIAL 28 INTELLIGENCE SYSTEM SHOULD BE USED, NOT USED, AND MONITORED BY AN 29 INDIVIDUAL WHEN BEING USED; AND 30 (4) ANY ADDITIONAL DOCUMENTATION THAT IS REASONABLY 31 NECESSARY TO ASSIST A DEPLOYER TO: 32 SENATE BILL 936 11 (I) UNDERSTAND THE OUTPUTS OF THE HIGH–RISK 1 ARTIFICIAL INTELLIGENCE SYSTEM; AND 2 (II) MONITOR THE PERFORMANCE OF THE HIGH–RISK 3 ARTIFICIAL INTELLIGENCE SYSTEM FOR RISKS OF ALGORITHMIC DISCRIMINATION. 4 (C) (1) SUBJECT TO SUBSECTION (D) OF THIS SECTION, A DEVELOPER 5 THAT, ON OR AFTER FEBRUARY 1, 2026, OFFERS, SELLS, LEASES, LICENSES, GIVES, 6 OR OTHERWISE MAKES AVAILABLE TO A DEPLOYER OR OTHER DEVELOPER A 7 HIGH–RISK ARTIFICIAL INTELLIGENCE SYSTEM, TO THE EXTENT PRACTICABLE, 8 SHALL MAKE AVAILABLE TO DEPLOYERS AND OTHER DEVELOPERS THE 9 DOCUMENTATION AND INFORMATION NECESSARY FOR A DEPLOYER OR THIRD 10 PARTY CONTRACTED BY A DEPLOYER TO COMPLETE AN IMPACT ASSESSMENT 11 UNDER § 14–47A–04(C) OF THIS SUBTITLE. 12 (2) THE DEVELOPER SHALL MAKE DOCUMENTATION AND 13 INFORMATION AVAILABLE AS REQUIRED UNDER PARAGRAPH (1) OF THIS 14 SUBSECTION THROUGH: 15 (I) ARTIFACTS, INCLUDING MODEL CARD FILES THAT 16 ACCOMPANY THE MODEL AND PROVIDE INFORMATION ABOUT DISCOVERABILITY, 17 REPRODUCIBILITY, AND SHARING; 18 (II) DATASET CARD FILES THAT: 19 1. ARE USED TO INFORM USERS ABOUT HOW TO 20 RESPONSIBLY USE THE DATA IN A DATASET; AND 21 2. CONTAIN INFORMATION ABOUT POTENTIAL BIASES 22 OF THE DATA; OR 23 (III) OTHER IMPACT ASSESSMENTS. 24 (D) (1) FOR ANY DISCLOSURE REQUIRED UNDER THIS SECTION, A 25 DEVELOPER, NOT LATER THAN 90 DAYS AFTER THE DEVELOPER PERFORMS AN 26 INTENTIONAL AND SUBSTANTIAL MODIFICATION TO A HIGH–RISK ARTIFICIAL 27 INTELLIGENCE SYSTEM, SHALL UPDATE THE DISCLOSURE TO ENSURE ACCURACY. 28 (2) A DEVELOPER THAT ALSO SERVES AS A DEPLOYER FOR ANY 29 HIGH–RISK ARTIFICIAL INTELLIGENCE SYSTEM IS NOT REQUIRED TO GENERATE 30 THE DOCUMENTATION REQUIRED UNDER THIS SECTION UNLESS THE HIGH–RISK 31 ARTIFICIAL INTELLIGENCE SYSTEM IS PROVIDED TO AN UNAFFILIATED ENTITY 32 ACTING AS A DEPLOYER OR AS OTHERWISE REQUIRED BY LAW. 33 12 SENATE BILL 936 (E) A HIGH–RISK ARTIFICIAL INTELLIGENCE SYSTEM SHALL BE PRESUMED 1 TO SATISFY THE APPLICABLE REQUIREMENTS UNDER THIS SECTION AND ANY 2 REGULATIONS ADOPTED IN ACCORDANCE WITH THIS SUBTITLE IF THE HIGH–RISK 3 ARTIFICIAL INTELLIGENCE SYSTEM IS IN CONFORMITY WITH THE LATEST VERSION 4 OF: 5 (1) THE ARTIFICIAL INTELLIGENCE RISK MANAGEMENT 6 FRAMEWORK PUBLISHED BY THE NATIONAL INSTITUTE OF STANDARDS AND 7 TECHNOLOGY; 8 (2) STANDARD ISO/IEC 42001 OF THE INTERNATIONAL 9 ORGANIZATION FOR STANDARDIZATION; OR 10 (3) ANOTHER NATIONALLY OR INTERNATIONALLY RECOGNIZED RISK 11 MANAGEMENT FRAMEWORK FOR ARTIFICIAL INTELLIGENCE SYSTEMS THAT IS 12 SUBSTANTIALLY EQUIVALENT TO, AND AT LEAST AS STRINGENT AS, THE 13 REQUIREMENTS ESTABLISHED UNDER THIS SECTION. 14 (F) THIS SECTION MAY NOT BE CONSTRUED TO REQUIRE A DEVELOPER TO 15 DISCLOSE ANY INFORMATION: 16 (1) THAT IS A TRADE SECRET, AS DEFINED IN § 11–1201 OF THIS 17 ARTICLE, OR OTHERWISE PROTECTED FROM DISCLOSURE UNDER STATE OR 18 FEDERAL LAW; OR 19 (2) THE DISCLOSURE OF WHICH WOULD: 20 (I) PRESENT A SECURITY RISK TO THE DEVELOPER; OR 21 (II) REQUIRE THE DEVELOPER TO DISCLOSE CONFIDENTIAL OR 22 PROPRIETARY INFORMATION. 23 (G) (1) EACH DEVELOPER OF A GENERATIVE ARTIFICIAL INTELLIGENCE 24 SYSTEM THAT GENERATES OR MODIFIES SYNTHETIC CONTENT SHALL ENSURE THAT 25 THE OUTPUTS OF THE HIGH–RISK ARTIFICIAL INTELLIGENCE SYSTEM: 26 (I) ARE MARKED AT THE TIME THE OUTPUT IS GENERATED AND 27 IN A MANNER THAT IS DETECTABLE BY CONSUMERS; AND 28 (II) COMPLY WITH ANY ACCESSIBILITY REQUIREMENTS. 29 SENATE BILL 936 13 (2) FOR SYNTHETIC CONTENT THAT IS AN AUDIO, IMAGE, OR VIDEO 1 FORMED AS PART OF AN ARTISTIC, CREATIVE, SATIRICAL, FICTIONAL ANALOGOUS 2 WORK OR PROGRAM, A MARKING OF HIGH–RISK ARTIFICIAL INTELLIGENCE 3 SYSTEMS UNDER PARAGRAPH (1) OF THIS SUBSECTION SHALL BE LIMITED IN A 4 MANNER NOT TO HINDER THE DISPLAY OR ENJOYMENT OF THE WORK OR PROGRAM. 5 (3) THE MARKING OF OUTPUTS REQUIRED UNDER PARAGRAPH (1) OF 6 THIS SUBSECTION DOES NOT APPLY TO: 7 (I) SYNTHETIC CONTENT THAT: 8 1. CONSISTS EXCLUSIVELY OF TEXT; 9 2. IS PUBLISHED TO INFORM THE PUBLIC ON ANY 10 MATTER OF PUBLIC INTEREST; OR 11 3. IS UNLIKELY TO MISLEAD A REASONABLE PERSON 12 CONSUMING THE SYNTHETIC CONTENT; OR 13 (II) THE OUTPUTS OF A HIGH–RISK ARTIFICIAL INTELLIGENCE 14 SYSTEM THAT: 15 1. PERFORMS AN ASSISTIVE FUNCTION FOR STANDARD 16 EDITING; 17 2. DOES NOT SUBSTANTIALLY ALTER THE INPUT DATA 18 PROVIDED BY THE DEVELOPER, OR IS USED TO DETECT, PREVENT, OR INVESTIGATE; 19 OR 20 3. PROSECUTES A CRIME AS AUTHORIZED BY LAW. 21 14–47A–04. 22 (A) (1) BEGINNING FEBRUARY 1, 2026, EACH DEPLOYER SHALL USE 23 REASONABLE CARE TO PROTECT CONSUMERS FROM ANY KNOWN OR REASONABLY 24 FORESEEABLE RISKS OF ALGORITHMIC DISCRIMINATION. 25 (2) IN AN ENFORCEMENT ACTION BROUGHT BY THE ATTORNEY 26 GENERAL UNDER THIS SUBTITLE, THERE SHALL BE A REBUTTABLE PRESUMPTION 27 THAT A DEPLOYER USED REASONABLE CARE AS REQUIRED UNDER THIS 28 SUBSECTION IF THE DEPLOYER COMPLIED WITH THE REQUIREMENTS OF THIS 29 SECTION. 30 14 SENATE BILL 936 (B) (1) BEGINNING FEBRUARY 1, 2026, AND SUBJECT TO PARAGRAPH (2) 1 OF THIS SUBSECTION, A DEPLOYER OF A HIGH–RISK ARTIFICIAL INTELLIGENCE 2 SYSTEM SHALL DESIGN, IMPLEMENT, AND MAINTAIN A RISK MANAGEMENT POLICY 3 AND PROGRAM FOR THE HIGH–RISK ARTIFICIAL INTELLIGENCE SYSTEM. 4 (2) EACH RISK MANAGEMENT POLICY DESIGNED, IMPLEMENTED, 5 AND MAINTAINED IN ACCORDANCE WITH PARAGRAPH (1) OF THIS SUBSECTION 6 SHALL: 7 (I) SPECIFY THE PRINCIPLES, PROCESSES, AND PERSONNEL 8 THAT THE DEPLOYER USES TO IDENTIFY, MITIGATE, AND DOCUMENT ANY RISK OF 9 ALGORITHMIC DISCRIMINATION THAT IS A REASONABLY FORESEEABLE 10 CONSEQUENCE OF DEPLOYING OR USING THE HIGH–RISK ARTIFICIAL 11 INTELLIGENCE SYSTEM; 12 (II) BE REGULARLY REVIEWED AND UPDATED OVER THE LIFE 13 CYCLE OF THE HIGH–RISK ARTIFICIAL INTELLIGENCE SYSTEM; AND 14 (III) BE REASONABLE AND IN CONSIDERATION OF THE 15 GUIDANCE AND STANDARDS PROVIDED IN THE LATEST VERSION OF: 16 1. THE ARTIFICIAL INTELLIGENCE RISK MANAGEMENT 17 FRAMEWORK PUBLISHED BY THE NATIONAL INSTITUTE OF STANDARDS AND 18 TECHNOLOGY; 19 2. STANDARD ISO/IEC 42001 OF THE INTERNATIONAL 20 ORGANIZATION FOR STANDARDIZATION; 21 3. ANOTHER NATIONALLY OR INTERNATIONALLY 22 RECOGNIZED RISK MANAGEMENT FRAMEWORK FOR ARTIFICIAL INTELLIGENCE 23 SYSTEMS WITH REQUIREMENTS THAT ARE SUBSTANTIALLY EQUIVALENT TO, AND AT 24 LEAST AS STRINGENT AS, THE REQUIREMENTS ESTABLISHED UNDER THIS SECTION; 25 OR 26 4. ANY RISK MANAGEMENT FRAMEWORK FOR 27 ARTIFICIAL INTELLIGENCE SYSTEMS THAT THE ATTORNEY GENERAL MAY 28 DESIGNATE AND IS SUBSTANTIALLY EQUIVALENT TO, AND AT LEAST AS STRINGENT 29 AS, THE GUIDANCE AND STANDARDS OF THE FRAMEWORK DESCRIBED IN ITEM 1 OF 30 THIS ITEM. 31 (3) A HIGH–RISK ARTIFICIAL INTELLIGENCE SYSTEM SHALL BE 32 PRESUMED TO SATISFY THE REQUIREMENTS UNDER THIS SECTION AND ANY 33 REGULATIONS ADOPTED IN ACCORDANCE WITH THIS SUBTITLE IF THE HIGH–RISK 34 SENATE BILL 936 15 ARTIFICIAL INTELLIGENCE SYSTEM IS IN CONFORMITY WITH THE LATEST VERSION 1 OF: 2 (I) THE ARTIFICIAL INTELLIGENCE RISK MANAGEMENT 3 FRAMEWORK PUBLISHED BY THE NATIONAL INSTITUTE OF STANDARDS AND 4 TECHNOLOGY; 5 (II) STANDARD ISO/IEC 42001 OF THE INTERNATIONAL 6 ORGANIZATION FOR STANDARDIZATION; OR 7 (III) ANOTHER NATIONALLY OR INTERNATIONALLY 8 RECOGNIZED RISK MANAGEMENT FRAMEWORK FOR ARTIFICIAL INTELLIGENCE 9 SYSTEMS THAT ARE SUBSTANTIALLY EQUIVALENT TO, AND AT LEAST AS STRINGENT 10 AS, THE REQUIREMENTS ESTABLISHED UNDER THIS SECTION. 11 (C) (1) SUBJECT TO PARAGRAPHS (2) AND (3) OF THIS SUBSECTION AND 12 EXCEPT AS PROVIDED IN PARAGRAPH (4) OF THIS SUBSECTION: 13 (I) ON OR AFTER FEBRUARY 1, 2026, BEFORE INITIAL 14 DEPLOYMENT OF A HIGH–RISK ARTIFICIAL INTELLIGENCE SYSTEM OR USE OF A 15 HIGH–RISK ARTIFICIAL INTELLIGENCE SYSTEM, A DEPLOYER SHALL COMPLETE AN 16 IMPACT ASSESSMENT OF THE HIGH–RISK ARTIFICIAL INTELLIGENCE SYSTEM; AND 17 (II) AT LEAST 90 DAYS BEFORE A SIGNIFICANT UPDATE TO A 18 HIGH–RISK ARTIFICIAL INTELLIGENCE SYSTEM IS MADE AVAILABLE, A DEPLOYER 19 SHALL COMPLETE AN IMPACT ASSESSMENT OF THE HIGH–RISK ARTIFICIAL 20 INTELLIGENCE SYSTEM IF THE UPDATE PRODUCES A NEW VERSION OR RELEASE OR 21 SIMILAR CHANGE TO THE HIGH–RISK ARTIFICIAL INTELLIGENCE SYSTEM THAT: 22 1. INTRODUCES SIGNIFICANT CHANGES TO THE USE 23 CASE OR KEY FUNCTIONALITY OF THE HIGH–RISK ARTIFICIAL INTELLIGENCE 24 SYSTEM; AND 25 2. RESULTS IN A NEW OR REASONABLY FORESEEABLE 26 RISK OF ALGORITHMIC DISCRIMINATION. 27 (2) EACH IMPACT ASSESSMENT COMPLETED UNDER PARAGRAPH (1) 28 OF THIS SUBSECTION SHALL INCLUDE: 29 (I) A STATEMENT BY THE DEPLOYER DISCLOSING THE 30 PURPOSE AND INTENDED USE CASES AND DEPLOYMENT CONTEXT OF, AND BENEFITS 31 AFFORDED BY, THE HIGH–RISK ARTIFICIAL INTELLIGENCE SYSTEM; 32 16 SENATE BILL 936 (II) AN ANALYSIS OF WHETHER THE DEPLOYMENT OF THE 1 HIGH–RISK ARTIFICIAL INTELLIGENCE SYSTEM: 2 1. POSES ANY KNOWN OR REASONABLY FORESEEABLE 3 RISKS OF ALGORITHMIC DISCRIMINATION; 4 2. THE NATURE OF ANY ALGORITHMIC 5 DISCRIMINATION; AND 6 3. THE STEPS THAT HAVE BEEN TAKEN TO MITIGATE 7 RISKS; 8 (III) FOR A POSTDEPLOYMENT IMPACT ASSESSMENT 9 COMPLETED UNDER THIS SUBSECTION, AN ANALYSIS OF WHETHER THE INTENDED 10 USE CASES OF THE HIGH–RISK ARTIFICIAL INTELLIGENCE SYSTEM, AS UPDATED, 11 WERE CONSISTENT WITH, OR VARIED FROM, THE DEVELOPER’S INTENDED USES OF 12 THE HIGH–RISK ARTIFICIAL INTELLIGENCE SYSTEM; 13 (IV) A DESCRIPTION OF THE CATEGORIES OF DATA THE 14 HIGH–RISK ARTIFICIAL INTELLIGENCE SYSTEM PROCESSES AS INPUTS AND THE 15 OUTPUTS THE HIGH–RISK ARTIFICIAL INTELLIGENCE SYSTEM PRODUCES; 16 (V) IF THE DEPLOYER USED DATA TO CUSTOMIZE THE 17 HIGH–RISK ARTIFICIAL INTELLIGENCE SYSTEM, AN OVERVIEW OF THE CATEGORIES 18 OF DATA THE DEPLOYER USED TO CUSTOMIZE THE HIGH–RISK ARTIFICIAL 19 INTELLIGENCE SYSTEM; 20 (VI) A LIST OF METRICS USED TO EVALUATE THE PERFORMANCE 21 AND KNOWN LIMITATIONS OF THE HIGH–RISK ARTIFICIAL INTELLIGENCE SYSTEM; 22 (VII) A DESCRIPTION OF TRANSPARENCY MEASURES TAKEN 23 CONCERNING THE HIGH–RISK ARTIFICIAL INTELLIGENCE SYSTEM, INCLUDING ANY 24 MEASURES TAKEN TO DISCLOSE TO A CONSUMER THAT A HIGH–RISK ARTIFICIAL 25 INTELLIGENCE SYSTEM IS IN USE WHEN THE CONSUMER IS ENGAGING OR 26 INTERACTING WITH A SYSTEM OR PRODUCT IN WHICH A HIGH–RISK ARTIFICIAL 27 INTELLIGENCE SYSTEM IS IN USE; 28 (VIII) A DESCRIPTION OF POSTDEPLOYMENT MONITORING AND 29 USER SAFEGUARDS RELATED TO THE HIGH–RISK ARTIFICIAL INTELLIGENCE 30 SYSTEM, INCLUDING THE OVERSIGHT PROCESS ESTABLISHED BY THE DEPLOYER TO 31 ADDRESS ISSUES ARISING FROM DEPLOYMENT OR USE OF A HIGH–RISK ARTIFICIAL 32 INTELLIGENCE SYSTEM; AND 33 SENATE BILL 936 17 (IX) AN ANALYSIS OF THE VALIDITY AND RELIABILITY OF THE 1 HIGH–RISK ARTIFICIAL INTELLIGENCE SYSTEM, IN ACCORDANCE WITH 2 CONTEMPORARY SOCIAL SCIENCE STANDARDS AND A DESCRIPTION OF METRICS TO 3 EVALUATE PERFORMANCE AND KNOWN LIMITATIONS OF THE HIGH–RISK 4 ARTIFICIAL INTELLIGENCE SYSTEM. 5 (3) A DEPLOYER SHALL MAINTAIN A COMPLETED IMPACT 6 ASSESSMENT OF A HIGH–RISK ARTIFICIAL INTELLIGENCE SYSTEM REQUIRED 7 UNDER THIS SECTION AND ALL RECORDS CONCERNING THE IMPACT ASSESSMENT 8 FOR AT LEAST 3 YEARS. 9 (4) A SINGLE IMPACT ASSESSMENT MAY ADDRESS A COMPARABLE 10 SET OF HIGH–RISK ARTIFICIAL INTELLIGENCE SYSTEMS DEPLOYED BY A DEPLOYER. 11 (D) BEGINNING FEBRUARY 1, 2026, BEFORE A DEPLOYER DEPLOYS A 12 HIGH–RISK ARTIFICIAL INTELLIGENCE SYSTEM, THE DEPLOYER SHALL: 13 (1) NOTIFY THE CONSUMER THAT THE DEPLOYER HAS DEPLOYED A 14 HIGH–RISK ARTIFICIAL INTELLIGENCE SYSTEM TO MAKE, OR BE A SUBSTANTIAL 15 FACTOR IN MAKING, A CONSEQUENTIAL DECISION ABOUT THE CONSUMER; AND 16 (2) PROVIDE TO THE CONSUMER: 17 (I) A STATEMENT DISCLOSING THE PURPOSE OF THE 18 HIGH–RISK ARTIFICIAL INTELLIGENCE SYSTEM AND THE NATURE OF THE 19 CONSEQUENTIAL DECISION; 20 (II) IF APPLICABLE, INFORMATION CONCERNING THE 21 CONSUMER’S RIGHT TO OPT OUT OF THE PROCESSING OF THE CONSUMER’S 22 PERSONAL DATA IN ACCORDANCE WITH STATE OR FEDERAL LAW; 23 (III) CONTACT INFORMATION FOR THE DEPLOYER; AND 24 (IV) A DESCRIPTION, IN PLAIN LANGUAGE, OF THE HIGH–RISK 25 ARTIFICIAL INTELLIGENCE SYSTEM, INCLUDING: 26 1. THE PERSONAL CHARACTERISTICS OR ATTRIBUTES 27 THE ARTIFICIAL INTELLIGENCE SYSTEM WILL MEASURE OR ASSESS AND THE 28 METHOD BY WHICH THE SYSTEM MEASURES OR ASSESSES PERSONAL 29 CHARACTERISTICS OR ATTRIBUTES; 30 18 SENATE BILL 936 2. THE RELEVANCE OF PERSONAL CHARACTERISTICS 1 OR ATTRIBUTES TO CONSEQUENTIAL DECISIONS RELATED TO THE ARTIFICIAL 2 INTELLIGENCE SYSTEM; 3 3. ANY HUMAN COMPONENTS OF THE ARTIFICIAL 4 INTELLIGENCE SYSTEM; 5 4. THE MANNER IN WHICH AUTOMATED COMPONENTS 6 OF THE ARTIFICIAL INTELLIGENCE SYSTEM ARE USED TO INFORM CONSEQUENTIAL 7 DECISIONS RELATED TO THE SYSTEM; AND 8 5. A DIRECT LINK TO A PUBLICLY ACCESSIBLE WEBPAGE 9 ON THE DEPLOYER’S WEBSITE THAT CONTAINS A DESCRIPTION IN PLAIN LANGUAGE 10 OF THE LOGIC USED IN THE ARTIFICIAL INTELLIGENCE SYSTEM, INCLUDING: 11 A. KEY PARAMETERS THAT AFFECT THE OUTPUT OF THE 12 SYSTEM; 13 B. THE TYPE AND SOURCE OF DATA COLLECTED FROM 14 INDIVIDUALS AND PROCESSED BY THE SYSTEM IN MAKING OR ASSISTING IN MAKING 15 A CONSEQUENTIAL DECISION; AND 16 C. THE RESULTS OF THE MOST RECENT IMPACT 17 ASSESSMENT REQUIRED UNDER THIS SECTION. 18 (E) BEGINNING FEBRUARY 1, 2026, AND SUBJECT TO SUBSECTION (F) OF 19 THIS SECTION, A DEPLOYER THAT HAS DEPLOYED A HIGH–RISK ARTIFICIAL 20 INTELLIGENCE SYSTEM SHALL, IF A CONSEQUENTIAL DECISION IS ADVERSE TO THE 21 CONSUMER, PROVIDE TO THE CONSUMER: 22 (1) A STATEMENT DISCLOSING THE PRINCIPAL REASON OR REASONS 23 FOR THE ADVERSE CONSEQUENTIAL DECISION, INCLUDING: 24 (I) THE DEGREE TO WHICH, AND MANNER IN WHICH, THE 25 HIGH–RISK ARTIFICIAL INTELLIGENCE SYSTEM CONTRIBUTED TO THE ADVERSE 26 CONSEQUENTIAL DECISION; 27 (II) THE TYPE OF DATA THAT WERE PROCESSED BY THE 28 HIGH–RISK ARTIFICIAL INTELLIGENCE SYSTEM IN MAKING THE ADVERSE 29 CONSEQUENTIAL DECISION; AND 30 (III) THE SOURCE OF THE DATA DESCRIBED IN ITEM (II) OF THIS 31 ITEM; AND 32 SENATE BILL 936 19 (2) AN OPPORTUNITY TO: 1 (I) CORRECT ANY INCORRECT PERSONAL DATA THAT THE 2 HIGH–RISK ARTIFICIAL INTELLIGENCE SYSTEM PROCESSED IN MAKING, OR USED AS 3 A SUBSTANTIAL FACTOR IN MAKING, THE ADVERSE CONSEQUENTIAL DECISION; AND 4 (II) APPEAL THE ADVERSE CONSEQUENTIAL DECISION, 5 ALLOWING FOR HUMAN REVIEW UNLESS PROVIDING THIS OPPORTUNITY: 6 1. IS NOT IN THE BEST INTEREST OF THE CONSUMER; OR 7 2. MAY CAUSE A DELAY THAT POSES A RISK TO THE LIFE 8 OR SAFETY OF THE CONSUMER. 9 (F) THE DEPLOYER SHALL PROVIDE THE INFORMATION REQUIRED UNDER 10 SUBSECTION (E) OF THIS SUBSECTION: 11 (1) DIRECTLY TO THE CONSUMER; 12 (2) IN PLAIN LANGUAGE THAT IS TRANSLATED TO ANY LANGUAGES IN 13 WHICH THE DEPLOYER, IN THE ORDINARY COURSE OF SUCH DEPLOYER’S BUSINESS, 14 PROVIDES CONTRACTS, DISCLAIMERS, SALE ANNOUNCEMENTS, AND ANY OTHER 15 INFORMATION TO CONSUMERS; AND 16 (3) IN A FORMAT THAT IS ACCESSIBLE TO CONSUMERS WITH 17 DISABILITIES. 18 14–47A–05. 19 (A) THE REQUIREMENTS OF THIS SUBTITLE MAY NOT BE CONSTRUED TO 20 RESTRICT A DEVELOPER’S, A DEPLOYER’S, OR ANOTHER PERSON’S ABILITY TO: 21 (1) COMPLY WITH FEDERAL, STATE, OR LOCAL LAW; 22 (2) COMPLY WITH A CIVIL, CRIMINAL, OR REGULATORY INQUIRY, AN 23 INVESTIGATION, OR A SUBPOENA OR SUMMONS BY A FEDERAL, STATE, LOCAL, OR 24 OTHER GOVERNMENTAL AUTHORITY; 25 (3) COOPERATE WITH A LAW ENFORCEMENT AGENCY CONCERNING 26 CONDUCT OR ACTIVITY THAT THE DEVELOPER, DEPLOYER, OR OTHER PERSON 27 REASONABLY AND IN GOOD FAITH BELIEVES MAY VIOLATE FEDERAL, STATE, OR 28 LOCAL LAW; 29 20 SENATE BILL 936 (4) INVESTIGATE, ESTABLISH, EXERCISE, PREPARE FOR, OR DEFEND 1 A LEGAL CLAIM; 2 (5) TAKE IMMEDIATE STEPS TO PROTECT AN INTEREST THAT IS 3 ESSENTIAL FOR THE LIFE OR PHYSICAL SAFETY OF A CONSUMER OR ANOTHER 4 INDIVIDUAL; 5 (6) (I) BY ANY MEANS OTHER THAN FACIAL RECOGNITION 6 TECHNOLOGY, PREVENT, DETECT, PROTECT AGAINST, OR RESPOND TO: 7 1. A SECURITY INCIDENT; 8 2. A MALICIOUS OR DECEPTIVE ACTIVITY; OR 9 3. IDENTITY THEFT, FRAUD, HARASSMENT, OR ANY 10 OTHER ILLEGAL ACTIVITY; 11 (II) INVESTIGATE, REPORT, OR PROSECUTE THE PERSONS 12 RESPONSIBLE FOR ANY ACTION DESCRIBED IN ITEM (I) OF THIS ITEM; OR 13 (III) PRESERVE THE INTEGRITY OR SECURITY OF SYSTEMS; 14 (7) ENGAGE IN PUBLIC OR PEER–REVIEWED SCIENTIFIC OR 15 STATISTICAL RESEARCH IN THE PUBLIC INTEREST THAT: 16 (I) ADHERES TO ALL OTHER APPLICABLE ETHICS AND PRIVACY 17 LAWS; AND 18 (II) IS APPROVED, MONITORED, AND GOVERNED BY AN 19 INSTITUTIONAL REVIEW BOARD OR SIMILAR INDEPENDENT OVERSIGHT ENTITY 20 THAT DETERMINES: 21 1. WHETHER THE EXPECTED BENEFITS OF THE 22 RESEARCH OUTWEIGH THE RISKS ASSOCIATED WITH THE RESEARCH; AND 23 2. WHETHER THE DEVELOPER OR DEPLOYER HAS 24 IMPLEMENTED REASONABLE SAFEGUARDS TO MITIGATE THE RISKS ASSOCIATED 25 WITH THE RESEARCH; 26 (8) CONDUCT RESEARCH, TESTING, AND DEVELOPMENT ACTIVITIES 27 REGARDING AN ARTIFICIAL INTELLIGENCE SYSTEM OR MODEL, OTHER THAN 28 TESTING CONDUCTED UNDER REAL–WORLD CONDITIONS, BEFORE AN ARTIFICIAL 29 SENATE BILL 936 21 INTELLIGENCE SYSTEM OR MODEL IS PLACED ON THE MARKET, DEPLOYED OR PUT 1 INTO SERVICE, AS APPLICABLE; 2 (9) EFFECTUATE A PRODUCT RECALL; 3 (10) IDENTIFY AND REPAIR TECHNICAL ERRORS THAT IMPAIR 4 EXISTING OR INTENDED FUNCTIONALITY; OR 5 (11) ASSIST ANOTHER DEVELOPER, DEPLOYER, OR PERSON WITH ANY 6 OF THE OBLIGATIONS IMPOSED UNDER THIS SUBTITLE. 7 (B) THE OBLIGATIONS IMPOSED ON DEVELOPERS, DEPLOYERS, OR OTHER 8 PERSONS UNDER THIS SUBTITLE MAY NOT APPLY WHEN COMPLIANCE BY THE 9 DEVELOPER, DEPLOYER, OR OTHER PERSON WOULD VIOLATE AN EVIDENTIARY 10 PRIVILEGE UNDER THE LAWS OF THE STATE. 11 14–47A–06. 12 (A) A PERSON WHO VIOLATES THIS SUBTITLE IS SUBJECT TO A FINE NOT 13 EXCEEDING $1,000 AND, AS APPLICABLE, REASONABLE ATTORNEY’S FEES, 14 EXPENSES, AND COSTS, AS DETERMINED BY THE COURT. 15 (B) A PERSON WHO WILLFULLY VIOLATES THIS SUBTITLE IS SUBJECT TO A 16 FINE OF AT LEAST $1,000 AND NOT EXCEEDING $10,000 AND, AS APPLICABLE, 17 REASONABLE ATTORNEY’S FEES, EXPENSES, AND COSTS, AS DETERMINED BY THE 18 COURT. 19 (C) EACH VIOLATION OF THIS SUBTITLE IS A SEPARATE VIOLATION 20 SUBJECT TO THE CIVIL PENALTIES IMPOSED UNDER THIS SECTION. 21 14–47A–07. 22 (A) THE ATTORNEY GENERAL MAY ENFORCE THIS SUBTITLE. 23 (B) TO CARRY OUT THE REQUIREMENTS OF THIS SUBTITLE, THE ATTORNEY 24 GENERAL MAY: 25 (1) REQUIRE THAT A DEVELOPER DISCLOSE TO THE ATTORNEY 26 GENERAL: 27 (I) A STATEMENT OR DOCUMENTATION DESCRIBED IN THIS 28 SUBTITLE RELEVANT TO AN INVESTIGATION CONDUCTED BY THE ATTORNEY 29 GENERAL; AND 30 22 SENATE BILL 936 (II) A RISK MANAGEMENT POLICY DESIGNED AND 1 IMPLEMENTED, AN IMPACT ASSESSMENT COMPLETED, OR A RECORD MAINTAINED 2 UNDER THIS SUBTITLE RELEVANT TO AN INVESTIGATION CONDUCTED BY THE 3 ATTORNEY GENERAL; 4 (2) SUBJECT TO SUBSECTION (C) OF THIS SECTION, INITIATE A CIVIL 5 ACTION AGAINST A PERSON THAT VIOLATES THIS SUBTITLE; AND 6 (3) ADOPT REGULATIONS. 7 (C) (1) BEFORE BRINGING AN ACTION AGAINST A DEVELOPER OR 8 DEPLOYER FOR A VIOLATION OF THIS SUBTITLE, THE ATTORNEY GENERAL, IN 9 CONSULTATION WITH THE DEVELOPER OR DEPLOYER, SHALL DETERMINE IF IT IS 10 POSSIBLE TO CURE THE VIOLATION. 11 (2) IF IT IS POSSIBLE TO CURE THE VIOLATION, THE ATTORNEY 12 GENERAL MAY ISSUE A NOTICE OF VIOLATION TO THE DEVELOPER OR DEPLOYER 13 AND AFFORD THE DEVELOPER OR DEPLOYER THE OPPORTUNITY TO CURE THE 14 VIOLATION WITHIN 45 DAYS AFTER THE RECEIPT OF THE NOTICE OF VIOLATION. 15 (3) IN DETERMINING WHETHER TO GRANT A DEVELOPER OR 16 DEPLOYER AN OPPORTUNITY TO CURE A VIOLATION, THE ATTORNEY GENERAL 17 SHALL CONSIDER: 18 (I) THE NUMBER OF VIOLATIONS; 19 (II) THE SIZE AND COMPLEXITY OF THE DEVELOPER OR 20 DEPLOYER; 21 (III) THE NATURE AND EXTENT OF THE DEVELOPER’S OR 22 DEPLOYER’S BUSINESS; 23 (IV) WHETHER THERE IS A SUBSTANTIAL LIKELIHOOD OF 24 INJURY TO THE PUBLIC; 25 (V) THE SAFETY OF PERSONS OR PROPERTY; AND 26 (VI) WHETHER A VIOLATION WAS LIKELY CAUSED BY A HUMAN 27 OR TECHNICAL ERROR. 28 (4) IF A DEVELOPER OR DEPLOYER FAILS TO CURE A VIOLATION 29 WITHIN 45 DAYS AFTER THE RECEIPT OF A NOTICE OF VIOLATION UNDER 30 SENATE BILL 936 23 PARAGRAPH (3) OF THIS SUBSECTION, THE ATTORNEY GENERAL MAY PROCEED 1 WITH THE ACTION. 2 (D) IN AN ACTION BROUGHT BY THE ATTORNEY GENERAL UNDER THIS 3 SECTION, IT IS AN AFFIRMATIVE DEFENSE IF: 4 (1) A VIOLATION OF ANY PROVISION OF THIS SUBTITLE IS 5 DISCOVERED THROUGH RED–TEAMING, WHICH IS ADVERSARIAL TESTING 6 CONDUCTED FOR THE PURPOSE OF: 7 (I) IDENTIFYING THE POTENTIAL ADVERSE BEHAVIORS OR 8 OUTCOMES OF AN ARTIFICIAL INTELLIGENCE SYSTEM; 9 (II) IDENTIFYING HOW THE BEHAVIORS OR OUTCOMES OCCUR; 10 AND 11 (III) STRESS TESTING THE SAFEGUARDS AGAINST THE 12 BEHAVIORS OR OUTCOMES; AND 13 (2) NOT LATER THAN 45 DAYS AFTER DISCOVERING A VIOLATION 14 UNDER ITEM (1) OF THIS SUBSECTION, THE DEVELOPER OR DEPLOYER: 15 (I) CURES THE VIOLATION; 16 (II) PROVIDES NOTICE TO THE ATTORNEY GENERAL IN A FORM 17 AND MANNER PRESCRIBED BY THE ATTORNEY GENERAL THAT THE VIOLATION HAS 18 BEEN CURED AND EVIDENCE THAT ANY HARM CAUSED BY SUCH VIOLATION HAS 19 BEEN MITIGATED; AND 20 (III) IS OTHERWISE IN COMPLIANCE WITH THE REQUIREMENTS 21 OF THIS SUBTITLE. 22 14–47A–08. 23 A CONSUMER MAY BRING A CIVIL ACTION AGAINST A DEPLOYER IF: 24 (1) THE CONSUMER INITIALLY FILED A TIMELY ADMINISTRATIVE 25 CHARGE OR COMPLAINT UNDER FEDERAL, STATE, OR LOCAL LAW ALLEGING A 26 DISCRIMINATORY ACT BY THE DEPLOYER AS A RESULT OF A CONSEQUENTIAL 27 DECISION ABOUT THE CONSUMER THAT IS MADE BY A HIGH–RISK ARTIFICIAL 28 INTELLIGENCE SYSTEM OF THE DEPLOYER; 29 24 SENATE BILL 936 (2) AT LEAST 180 DAYS HAVE ELAPSED SINCE THE DATE OF FILING OF 1 THE ADMINISTRATIVE COMPLAINT; AND 2 (3) THE CIVIL ACTION IS FILED NOT MORE THAN 2 YEARS AFTER THE 3 OCCURRENCE OF THE ALLEGED DISCRIMINATORY ACT. 4 SECTION 2. AND BE IT FURTHER ENACTED, That, if any provision of this Act or 5 the application of any provision of this Act to any person or circumstance is held invalid for 6 any reason in a court of competent jurisdiction, the invalidity does not affect other 7 provisions or any other application of this Act that can be given effect without the invalid 8 provision or application, and for this purpose the provisions of this Act are declared 9 severable. 10 SECTION 3. AND BE IT FURTHER ENACTED, That this Act shall take effect 11 October 1, 2025. 12