Text of VA SB 487 (2024)

24103787D SENATE BILL NO. 487 Offered January 10, 2024 Prefiled January 9, 2024 A BILL to amend and reenact §2.2-2007 of the Code of Virginia and to amend the Code of Virginia by adding in Chapter 55.3 of Title 2.2 a section numbered 2.2-5514.2, relating to use of artificial intelligence by public bodies; prohibitions. ---------- Patron-- Aird ---------- Referred to Committee on General Laws and Technology ---------- Be it enacted by the General Assembly of Virginia: 1. That §2.2-2007 of the Code of Virginia is amended and reenacted and that the Code of Virginia is amended by adding in Chapter 55.3 of Title 2.2 a section numbered 2.2-5514.2 as follows: §2.2-2007. Powers of the CIO. A. The CIO shall promulgate regulations necessary or incidental to the performance of duties or execution of powers conferred under this chapter. The CIO shall also develop policies, standards, and guidelines for the planning, budgeting, procurement, development, maintenance, security, and operations of information technology for executive branch agencies. Such policies, standards, and guidelines shall include those necessary to: 1. Support state and local government exchange, acquisition, storage, use, sharing, and distribution of data and related technologies. 2. Support the development of electronic transactions including the use of electronic signatures as provided in §59.1-496. 3. Support a unified approach to information technology across the totality of state government, thereby assuring that the citizens and businesses of the Commonwealth receive the greatest possible security, value, and convenience from investments made in technology. 4. Ensure that the costs of information technology systems, products, data, and services are contained through the shared use of existing or planned equipment, data, or services. 5. Provide for the effective management of information technology investments through their entire life cycles, including identification, business case development, selection, procurement, implementation, operation, performance evaluation, and enhancement or retirement. Such policies, standards, and guidelines shall include, at a minimum, the periodic review by the CIO of agency Commonwealth information technology projects. 6. Establish an Information Technology Investment Management Standard based on acceptable technology investment methods to ensure that all executive branch agency technology expenditures are an integral part of the Commonwealth's performance management system, produce value for the agency and the Commonwealth, and are aligned with (i) agency strategic plans, (ii) the Governor's policy objectives, and (iii) the long-term objectives of the Council on Virginia's Future. B. In addition to other such duties as the Secretary may assign, the CIO shall: 1. Oversee and administer the Virginia Technology Infrastructure Fund created pursuant to §2.2-2023. 2. Report annually to the Governor, the Secretary, and the Joint Commission on Technology and Science created pursuant to §30-85 on the use and application of information technology by executive branch agencies to increase economic efficiency, citizen convenience, and public access to state government. 3. Prepare annually a report for submission to the Secretary, the Information Technology Advisory Council, and the Joint Commission on Technology and Science on a prioritized list of Recommended Technology Investment Projects (RTIP Report) based upon major information technology projects submitted for business case approval pursuant to this chapter. As part of the RTIP Report, the CIO shall develop and regularly update a methodology for prioritizing projects based upon the allocation of points to defined criteria. The criteria and their definitions shall be presented in the RTIP Report. For each project recommended for funding in the RTIP Report, the CIO shall indicate the number of points and how they were awarded. For each listed project, the CIO shall also report (i) all projected costs of ongoing operations and maintenance activities of the project for the next three biennia following project implementation; (ii) a justification and description for each project baseline change; and (iii) whether the project fails to incorporate existing standards for the maintenance, exchange, and security of data. This report shall also include trends in current projected information technology spending by executive branch agencies and secretariats, including spending on projects, operations and maintenance, and payments to VITA. Agencies shall provide all project and cost information required to complete the RTIP Report to the CIO prior to May 31 immediately preceding any budget biennium in which the project appears in the Governor's budget bill. 4. Provide oversight for executive branch agency efforts to modernize the planning, development, implementation, improvement, operations and maintenance, and retirement of Commonwealth information technology, including oversight for the selection, development and management of enterprise information technology. 5. Develop statewide technical and data standards and specifications for information technology and related systems, including (i) the efficient exchange of electronic information and technology, including infrastructure, between the public and private sectors in the Commonwealth and (ii) the utilization of nationally recognized technical and data standards for health information technology systems or software purchased by an executive branch agency. 6. Direct the compilation and maintenance of an inventory of information technology, including but not limited to personnel, facilities, equipment, goods, and contracts for services. 7. Provide for the centralized marketing, provision, leasing, and executing of licensing agreements for electronic access to public information and government services through the Internet, wireless devices, personal digital assistants, kiosks, or other such related media on terms and conditions as may be determined to be in the best interest of the Commonwealth. VITA may fix and collect fees and charges for (i) public information, media, and other incidental services furnished by it to any private individual or entity, notwithstanding the charges set forth in §2.2-3704, and (ii) such use and services it provides to any executive branch agency or local government. Nothing in this subdivision authorizing VITA to fix and collect fees for providing information services shall be construed to prevent access to the public records of any public body pursuant to the provisions of the Virginia Freedom of Information Act (§2.2-3700 et seq.). VITA is authorized, subject to the approval by the Secretary of Administration and any other affected Secretariat, to delegate the powers and responsibilities granted in this subdivision to any agency within the executive branch. 8. Periodically evaluate the feasibility of outsourcing information technology resources and services, and outsource those resources and services that are feasible and beneficial to the Commonwealth. 9. Have the authority to enter into and amend contracts, including contracts with one or more other public bodies, or public agencies or institutions or localities of the several states, of the United States or its territories, or the District of Columbia, for the provision of information technology services. 10. Develop, publish, and maintain policies and procedures concerning the development, procurement, implementation, utilization, and ongoing assessment of systems that employ artificial intelligence and are in use by public bodies. Such policies and procedures shall, at a minimum, include policies and procedures that (i) govern the procurement, implementation, and ongoing assessment of any such system by a public body; (ii) are sufficient to ensure that no such system (a) results in any unlawful discrimination against any individual or group of individuals or (b) has any unlawful disparate impact on any individual or group of individuals on the basis of any actual or perceived differentiating characteristic, including age, genetic information, color, ethnicity, race, creed, religion, national origin, ancestry, sex, gender identity or expression, sexual orientation, marital status, familial status, pregnancy, veteran status, disability, or lawful source of income; and (iii) require a public body to assess the likely impact of any such system before implementing such system and perform ongoing assessments of such system to ensure that no such system results in any such unlawful discrimination or disparate impact. C. Consistent with §2.2-2012, the CIO may enter into public-private partnership contracts to finance or implement information technology programs and projects. The CIO may issue a request for information to seek out potential private partners interested in providing programs or projects pursuant to an agreement under this subsection. The compensation for such services shall be computed with reference to and paid from the increased revenue or cost savings attributable to the successful implementation of the program or project for the period specified in the contract. The CIO shall be responsible for reviewing and approving the programs and projects and the terms of contracts for same under this subsection. The CIO shall determine annually the total amount of increased revenue or cost savings attributable to the successful implementation of a program or project under this subsection and such amount shall be deposited in the Virginia Technology Infrastructure Fund created in §2.2-2023. The CIO is authorized to use moneys deposited in the Fund to pay private partners pursuant to the terms of contracts under this subsection. All moneys in excess of that required to be paid to private partners, as determined by the CIO, shall be reported to the Comptroller and retained in the Fund. The CIO shall prepare an annual report to the Governor, the Secretary, and General Assembly on all contracts under this subsection, describing each information technology program or project, its progress, revenue impact, and such other information as may be relevant. D. Executive branch agencies shall cooperate with VITA in identifying the development and operational requirements of proposed information technology systems, products, data, and services, including the proposed use, functionality, and capacity, and the total cost of acquisition, operation, and maintenance. §2.2-5514.2. Prohibited artificial intelligence. A. For purposes of this section: "Artificial intelligence" means (i) an artificial system that (a) performs tasks under varying and unpredictable circumstances without significant human oversight or can learn from experience and improve such performance when exposed to data sets; (b) is developed in any context, including software or physical hardware, and solves tasks requiring human-like perception, cognition, planning, learning, communication, or physical action; or (c) is designed to think or act like a human, including a cognitive architecture or neural network, or act rationally, including an intelligent software agent or embodied robot that achieves goals using perception, planning, reasoning, learning, communication, decision-making or action, or (ii) a set of techniques, including machine learning, that is designed to approximate a cognitive task. "Public body" means the same as that term is defined in §2.2-5514. B. A public body shall not implement any system that employs artificial intelligence unless it has fulfilled the requirements of this section and complied with the artificial intelligence policies and procedures developed by the Chief Information Officer of the Commonwealth pursuant to subdivision B 10 of §2.2-2007. C. Prior to implementing any system that employs artificial intelligence, the public body shall performed an impact assessment, in accordance with the policies and procedures established pursuant to subdivision B 10 of §2.2-2007, to ensure that such system will not result in any unlawful discrimination against any individual or group of individuals or have any disparate impact on any individual or group of individuals. A public body shall additionally perform ongoing assessments of such system after implementation. If the public body, or the head of the public body, determines, in its discretion, that such system will result in any unlawful discrimination or disparate impact, the public body shall not implement such system or cease to use such system to the extent required to deter such effects. D. All public bodies that implement such systems shall annually report on initial and ongoing system assessments and provide an inventory of such systems used. Such report and inventory shall be transmitted to the appropriate entity annually. Public bodies in the legislative branch shall submit such report and inventory to the General Assembly. Public bodies in the judicial branch shall submit such report and inventory to the Executive Secretary of the Supreme Court of Virginia. Public bodies in the executive branch and any other public bodies not specified in this subsection shall submit such report and inventory to the Chief Information Officer of the Commonwealth.

CHAPTER 678 An Act to direct the Joint Commission on Technology and Science to examine the use of artificial intelligence by public bodies in the Commonwealth and the creation of a Commission on Artificial Intelligence; report. [S 487] Approved April 8, 2024 Be it enacted by the General Assembly of Virginia: 1. §1. That the Joint Commission on Technology and Science (JCOTS) shall, in consultation with relevant stakeholders, conduct an analysis of the use of artificial intelligence by public bodies in the Commonwealth and the creation of a Commission on Artificial Intelligence. The analysis shall include an examination of proper policies and procedures regarding artificial intelligence systems to (i) govern the procurement, implementation, and ongoing assessment of any such system by a public body; (ii) ensure that no such system results in any unlawful discrimination or unlawful disparate impact against any individual or group of individuals; and (iii) require a public body to assess the likely impact of using any such system and perform ongoing assessments to ensure that the use of any such system does not result in any such unlawful discrimination or disparate impact. The analysis shall also include an assessment of creating a Commission on Artificial Intelligence to advise the General Assembly on issues related to artificial intelligence, the proper composition of such a commission, and the proper duties of the commission in accordance with the provisions of clauses (i), (ii), and (iii). JCOTS shall submit a report of its findings and recommendations to the Chairmen of the House Committees on Appropriations and Communications, Technology and Innovation and the Senate Committees on Finance and Appropriations and General Laws and Technology no later than December 1, 2024.