HSB 294 (LSB 1289YC (6) 91)

HOUSE FILE _____ 

BY  (PROPOSED COMMITTEE ON ECONOMIC GROWTH AND TECHNOLOGY BILL BY CHAIRPERSON SORENSEN)

A BILL FOR

An Act relating to artificial intelligence, including the use of artificial intelligence to create materials related to elections and protections in interactions with artificial intelligence systems, and making penalties applicable.
BE IT ENACTED BY THE GENERAL ASSEMBLY OF THE STATE OF IOWA:

DIVISION I
MATERIALS RELATED TO ELECTIONS

    Section 1.  Section 68A.405, Code 2025, is amended by adding the following new subsection:
   NEW SUBSECTION.  5.  a.  Published material generated through the use of artificial intelligence and designed to expressly advocate the nomination, election, or defeat of a candidate for public office or the passage or defeat of a ballot issue must contain a disclosure on the published material that the published material was generated using artificial intelligence. The disclosure must include the words “this material was generated using artificial intelligence”.
   b.  For purposes of this subsection, “artificial intelligence” means a machine-based system that can, for a given set of human-defined objectives, make predictions, recommendations, or decisions influencing real or virtual environments.
   c.  The board shall adopt rules for the implementation of this subsection.
   d.  A disclosure made in compliance with this subsection does not preclude a private right of action arising out of the publication of published material generated through the use of artificial intelligence.
DIVISION II
PROTECTIONS IN INTERACTIONS WITH ARTIFICIAL INTELLIGENCE SYSTEMS

    Sec. 2.  NEW SECTION.  554I.1  Definitions.
   As used in this chapter:
   1.  a.  “Algorithmic discrimination” means any use of an artificial intelligence system that results in unfavorable treatment due to an individual or group of individuals’ actual or perceived age, race, creed, color, sex, sexual orientation, national origin, religion, or disability.
   b.  “Algorithmic discrimination” does not include the offer, license, or use of an artificial intelligence system for the sole purpose of performing any of the following:
   (1)  Testing to identify, mitigate, or prevent discrimination or otherwise ensure compliance with state or federal law.
   (2)  Expanding an applicant, customer, or participant pool to increase diversity or redress historic discrimination.
   (3)  Any act or omission by or on behalf of a private club or other establishment not in fact open to the public, as established in the federal Civil Rights Act of 1964, Pub. L. No. 88-352, as amended.
   2.  “Artificial intelligence system” means any machine-based system that, for any explicit or implicit objective, infers from the inputs the system receives to generate outputs, including content, decisions, predictions, or recommendations, that can influence physical or virtual environments.
   3.  “Consequential decision” means any decision that has a material legal or similarly significant effect on the provision or denial of any of the following to an individual:
   a.  A pardon, parole, probation, or release.
   b.  Enrollment in education or an educational opportunity.
   c.  Employment.
   d.  A financial or lending service.
   e.  An essential government service.
   f.  A health care service, as health care is defined in section 144B.1.
   g.  Insurance.
   h.  A legal service.
   4.  “Deployer” means a person doing business in this state that uses a high-risk artificial intelligence system.
   5.  “Developer” means a person doing business in this state that develops or intentionally and substantially modifies a high-risk artificial intelligence system.
   6.  a.  “High-risk artificial intelligence system” means any artificial intelligence system that makes, or is a factor that would likely alter the outcome of, a consequential decision.
   b.  “High-risk artificial intelligence system” does not include any of the following:
   (1)  An artificial intelligence system that is only intended to do any of the following:
   (a)  Perform a narrow procedural task.
   (b)  Improve the result of a previously completed human activity.
   (c)  Perform a preparatory task relevant to a consequential decision.
   (d)  Detect any decision-making pattern or any deviation from a preexisting decision-making pattern.
   (2)  Antifraud technology.
   (3)  Antimalware technology.
   (4)  Antivirus technology.
   (5)  Calculators.
   (6)  Cybersecurity technology.
   (7)  Databases.
   (8)  Data storage technology.
   (9)  Firewalls.
   (10)  Internet domain registration technology.
   (11)  Internet website loading technology.
   (12)  Networking.
   (13)  Search engine or similar technology.
   (14)  Spam and robocall filtering technology.
   (15)  Spellchecking.
   (16)  Spreadsheets.
   (17)  Web caching technology.
   (18)  Web hosting technology.
   (19)  Any technology that communicates in natural language for the purpose of providing users with information, making referrals or recommendations, answering questions, or generating other content, and that is subject to an accepted use policy that prohibits generating content that is unlawful.
   7.  “Intentional and substantial modification” or “intentionally and substantially modifies” means a deliberate change made to an artificial intelligence system that materially increases the risk of algorithmic discrimination.
   8.  “Trade secret” means the same as defined in section 550.2.
    Sec. 3.  NEW SECTION.  554I.2  Algorithmic discrimination prohibited.
   1.  a.  A developer shall use reasonable care to protect individuals from any known or reasonably foreseeable risks of algorithmic discrimination arising from the intended and contracted uses of the developer’s high-risk artificial intelligence system.
   b.  There is a rebuttable presumption that a developer used reasonable care as required under this section if the developer complied with subsections 2 through 8 and any additional requirements established in rules adopted by the attorney general pursuant to section 554I.7.
   2.  A developer shall make all of the following available to a deployer or other developer that uses or intends to use the developer’s high-risk artificial intelligence system:
   a.  A general statement describing the reasonably foreseeable uses and known harmful or inappropriate uses of the high-risk artificial intelligence system.
   b.  Documentation for all of the following:
   (1)  Summaries of the types of data used to train the high-risk artificial intelligence system.
   (2)  The known or reasonably foreseeable limitations of the high-risk artificial intelligence system including but not limited to the known or reasonably foreseeable risks of algorithmic discrimination arising from the intended use of the high-risk artificial intelligence system.
   (3)  The purpose and intended uses of the high-risk artificial intelligence system.
   (4)  The intended outputs of the high-risk artificial intelligence system and how to understand the outputs.
   (5)  The intended benefits of the high-risk artificial intelligence system.
   (6)  How the high-risk artificial intelligence system was evaluated for performance and mitigation of algorithmic discrimination before the high-risk artificial intelligence system was sold, leased, licensed, given, or otherwise made available to the deployer or other developer.
   (7)  The actions or processes the deployer implemented to ensure the quality and consistency of training datasets, the measures used to examine the suitability of data sources, the measures used to evaluate possible biases in the training datasets and data sources, and the measures used to mitigate possible biases in training datasets and data sources.
   (8)  The measures the developer took to mitigate any known or reasonably foreseeable risks of algorithmic discrimination that may arise from using the high-risk artificial intelligence system.
   (9)  How the high-risk artificial intelligence system should be used, should not be used, and should be monitored when the high-risk artificial intelligence system is used to make, or is a factor that would likely alter the outcome of, a consequential decision.
   (10)  Instructions that are reasonably necessary to assist a deployer in monitoring the performance of the high-risk artificial intelligence system for any risk of algorithmic discrimination.
   3.  a.  A developer that offers, sells, leases, licenses, gives, or otherwise makes a high-risk artificial intelligence system available to a deployer shall provide documentation and information to the deployer necessary for the deployer to complete an impact assessment under section 554I.3. Materials and data include but are not limited to model cards, dataset cards, and other impact assessments.
   b.  This subsection shall not apply if the deployer is affiliated with the developer that is providing the high-risk artificial intelligence system.
   4.  A developer shall make a statement available in a manner that is clear and readily available on the developer’s internet site or in a public use case inventory that includes a summary of all of the following:
   a.  The types of high-risk artificial intelligence systems the developer has developed or intentionally and substantially modified and is currently making generally available to deployers.
   b.  How the developer manages known or reasonably foreseeable risks of algorithmic discrimination arising from development or intentional and substantial modification of the types of high-risk artificial intelligence systems described in paragraph “a”.
   5.  Each developer shall update the statement described in subsection 4 as necessary to ensure that the statement remains accurate, but no later than ninety days after the developer develops or intentionally and substantially modifies a high-risk artificial intelligence system.
   6.  a.  A developer shall disclose to the attorney general and to all known deployers or other developers of the high-risk artificial intelligence system any known or foreseeable risks of algorithmic discrimination arising from the intended uses of the high-risk artificial intelligence system.
   b.  A disclosure under paragraph “a” shall be given to the attorney general no later than ninety days after the earliest of any of the following occurs:
   (1)  The developer discovers through the developer’s ongoing testing and analysis that the developer’s high-risk artificial intelligence system has been used and has caused or is reasonably likely to have caused algorithmic discrimination.
   (2)  The developer receives from a deployer a credible report that the high-risk artificial intelligence system has been used and has caused algorithmic discrimination.
   7.  Subsections 2 through 6 do not require a developer to disclose a trade secret, information protected under state or federal law, or other confidential or proprietary information.
   8.  a.  The attorney general may require that a developer disclose to the attorney general any statement or documentation described in subsection 2 if the statement or documentation is relevant to an investigation conducted by the attorney general regarding a violation of this chapter.
   b.  To the extent that a statement or documentation requested by the attorney general pursuant to paragraph “a” includes proprietary information or a trade secret, the statement or documentation is exempt from disclosure. The developer may designate the statement or documentation as including proprietary information or a trade secret.
   c.  To the extent that a statement or documentation requested by the attorney general pursuant to paragraph “a” includes information subject to attorney-client privilege or work-product protection, the disclosure does not constitute a waiver of the privilege or protection.
    Sec. 4.  NEW SECTION.  554I.3  Impact assessments.
   1.  A deployer shall use reasonable care to protect individuals from any known or reasonably foreseeable risks of algorithmic discrimination. In any enforcement action brought by the attorney general, there is a rebuttable presumption that a deployer used reasonable care as required under this section if the deployer complied with subsections 2 through 7 and any additional requirements established in rules adopted by the attorney general pursuant to section 554I.7.
   2.  a.  A deployer shall implement a risk management policy and program to govern the deployer’s use of high-risk artificial intelligence systems.
   b.  The risk management policy and program shall specify and incorporate the principles, processes, and personnel that the deployer uses to identify, document, and mitigate known or reasonably foreseeable risks of algorithmic discrimination.
   c.  The risk management program shall be an iterative process that is planned, implemented, and regularly and systematically reviewed and updated for the duration of the deployer’s use of high-risk artificial intelligence systems.
   d.  Each risk management policy and program shall consider all of the following:
   (1)  The guidance and standards established by all of the following:
   (a)  Standards established in the most recent version of the artificial intelligence risk management framework published by the national institute of standards and technology of the United States department of commerce.
   (b)  Standard ISO/IEC 42001 of the international organization for standardization.
   (c)  A nationally or internationally recognized risk management framework for artificial intelligence systems.
   (d)  Standards designated by the attorney general.
   (2)  The size and complexity of the deployer.
   (3)  The nature and scope of the high-risk artificial intelligence system used by the deployer, including but not limited to the intended uses of the high-risk artificial intelligence system.
   (4)  The sensitivity and volume of data processed in connection with the high-risk artificial intelligence systems used by the deployer.
   3.  A risk management policy and program implemented pursuant to this section may cover more than one high-risk artificial intelligence system.
   4.  a.  A deployer, or a third party contracted by the deployer to use a high-risk artificial intelligence system, shall complete an impact assessment for the high-risk artificial intelligence system.
   b.  The impact assessment shall be completed no later than ninety days after a high-risk artificial intelligence system or an intentional and substantial modification of a high-risk artificial intelligence system is available for use.
   c.  Each impact assessment shall, at a minimum, include all of the following to the extent reasonably known by or available to the deployer:
   (1)  A statement disclosing all of the following:
   (a)  The purpose for using the high-risk artificial intelligence system.
   (b)  The context for using the high-risk artificial intelligence system.
   (c)  The benefits afforded by using the high-risk artificial intelligence system.
   (2)  An analysis of whether the use of the high-risk artificial intelligence system poses any known or foreseeable risk of algorithmic discrimination and, if so, the nature of the algorithmic discrimination and the steps that have been taken to mitigate the risks.
   (3)  A description of the categories of data the high-risk artificial intelligence system processes as inputs and the outputs the high-risk artificial intelligence system produces.
   (4)  Any metrics used to evaluate the performance and known limitations of the high-risk artificial intelligence system.
   (5)  A description of any transparency measures taken concerning the high-risk artificial intelligence system, such as measures taken to disclose to individuals that the high-risk artificial intelligence system is in use.
   (6)  A description of the post-use monitoring and user safeguards provided concerning the high-risk artificial intelligence system, such as the oversight process established by the deployer to address issues arising from using the high-risk artificial intelligence system.
   (7)  If the impact statement is being made subsequent to an intentional and substantial modification to a high-risk artificial intelligence system, a statement disclosing the extent to which the high-risk artificial intelligence system was used in a manner that was consistent with or varied from the developer’s intended uses of the high-risk artificial intelligence system.
   d.  A single impact statement may address a comparable set of high-risk artificial intelligence systems used by a deployer.
   5.  An impact assessment completed for the purpose of complying with another applicable law or regulation shall satisfy the requirements of this section if the impact assessment is reasonably similar in scope and effect to an impact assessment that would otherwise be completed pursuant to this section.
   6.  A deployer shall maintain the most recently completed impact assessment for a high-risk artificial intelligence system as required under this section and relevant records supporting the impact assessment for a period of at least three years following the final use of the high-risk artificial intelligence system.
   7.  A deployer shall review, at least annually, the deployment of each high-risk artificial intelligence system used by the deployer to ensure that the high-risk artificial intelligence system is not causing algorithmic discrimination.
    Sec. 5.  NEW SECTION.  554I.4  Disclosures of artificial intelligence system.
   1.  A deployer shall disclose to each individual that interacts with the artificial intelligence system that the individual is interacting with an artificial intelligence system. Developers who make a high-risk artificial intelligence system available in this state shall cooperate with deployers to allow deployers to fulfill the requirements of this subsection.
   2.  A disclosure under subsection 1 is not required in circumstances in which it would be obvious to a reasonable individual that the individual is interacting with an artificial intelligence system.
    Sec. 6.  NEW SECTION.  554I.5  Exclusions.
   1.  This chapter shall not be construed to restrict a developer’s, deployer’s, or other person’s ability to do any of the following:
   a.  Comply with federal, state, or municipal law.
   b.  Comply with a civil, criminal, or regulatory inquiry, investigation, subpoena, or summons by a federal, state, municipal, or other governmental authority.
   c.  Cooperate with a law enforcement agency concerning conduct or activity that a developer, deployer, or other person reasonably and in good faith believes may violate federal, state, or municipal law.
   d.  Investigate, establish, exercise, prepare for, or defend legal claims.
   e.  Take immediate steps to protect an interest that is essential for the life or physical safety of an individual.
   f.  Engage in public or peer-reviewed scientific or statistical research in the public interest that adheres to all other applicable ethics and privacy laws and is conducted in accordance with 45 C.F.R. pt. 46, as amended, or other relevant requirements established by the federal food and drug administration.
   g.  Conduct research, testing, and development activities regarding an artificial intelligence system, other than testing conducted under real-world conditions, before the artificial intelligence system is placed on the market, used, or otherwise put into service.
   h.  Effectuate a product recall.
   i.  Identify and repair technical errors that impair existing or intended functionality in a computer system or an artificial intelligence system.
   j.  Assist another developer, deployer, or person with any of the requirements of this chapter.
   2.  This chapter does not apply to a developer, deployer, or other person if the circumstances in which the high-risk artificial intelligence system was developed, used, or intentionally and substantially modified are described by any of the following:
   a.  The high-risk artificial intelligence system has been approved, authorized, certified, cleared, developed, or granted by a federal agency and the deployer, developer, or other person is described by any of the following:
   (1)  The person is acting under the authority of the federal agency that approved, authorized, certified, cleared, developed, or granted the high-risk artificial intelligence system.
   (2)  The person is in compliance with standards established by a federal agency for use of high-risk artificial intelligence systems if the requirements imposed by those standards are substantially similar or more restrictive than the requirements of this chapter.
   b.  The developer, deployer, or other person is conducting research to support an application for approval or certification from a federal agency.
   c.  The developer, deployer, or other person is performing work under or in connection with a contract with the United States department of commerce, the United States department of defense, or the national aeronautics and space administration, unless the developer, deployer, or other person is performing work on a high-risk artificial intelligence system that is used to make, or is a factor that would likely alter the outcome of, a decision concerning employment or housing.
   d.  The developer, deployer, or other person is a covered entity within the meaning of the Health Insurance Portability and Accountability Act of 1996, Pub. L. No. 104-191, as amended, and is providing health care recommendations that are generated by an artificial intelligence system, require a health care provider to take action to implement the recommendations, and are not likely to alter the outcome of a consequential decision.
   3.  This chapter does not apply to any artificial intelligence system that is acquired by or for the federal government, a federal agency, or federal department unless the artificial intelligence system is a high-risk artificial intelligence system used to make, or is a factor that would likely alter the outcome of, a decision concerning employment or housing.
   4.  A developer, deployer, or other person shall have the burden to prove an action qualifies for an exclusion under this section.
    Sec. 7.  NEW SECTION.  554I.6  Enforcement.
   1.  The attorney general shall have exclusive authority to enforce this chapter.
   2.  Prior to initiating any action for a violation of this chapter, the attorney general shall issue a notice of violation to the developer, deployer, or other person who allegedly violated the chapter. The notice shall contain all of the following:
   a.  A specific description of the alleged violation.
   b.  The actions the developer, deployer, or other person must take to cure the violation.
   3.  The attorney general may bring an action for the alleged violation if the alleged violation is not cured within ninety days of the date the developer, deployer, or other person received the notice of violation.
   4.  A violation of the requirements established in this chapter is an unlawful practice under section 714.16.
   5.  In any action commenced by the attorney general to enforce this chapter, it is an affirmative defense that the developer, deployer, or other person is described by all of the following:
   a.  The developer, deployer, or other person discovered and cured a violation of this chapter as a result of any of the following:
   (1)  Feedback that the developer, deployer, or other person encourages deployers or other users to provide to the developer, deployer, or other person.
   (2)  Adversarial testing or red teaming, as those terms are defined or used by the national institute of standards and technology.
   (3)  An internal review process.
   b.  The developer, deployer, or other person is otherwise in compliance with any of the following:
   (1)  The latest version of the artificial intelligence risk management framework as published by the national institute of standards and technology and standard ISO/IEC 42001 of the international organization for standardization.
   (2)  A nationally or internationally recognized risk management framework for artificial intelligence systems, if the requirements imposed by those standards are substantially similar or more restrictive than the requirements of this chapter.
   (3)  A risk management framework for artificial intelligence systems that the attorney general designated.
   6.  A developer, deployer, or other person bears the burden of demonstrating to the attorney general that the requirements of subsection 5 have been satisfied.
   7.  a.  Prior to initiating any action under this chapter, the attorney general shall consult with the department of health and human services to determine whether any complaint has been filed that is founded on the same act or omission that constitutes a violation of this chapter.
   b.  The attorney general shall not initiate any action to enforce the provisions of this chapter if a complaint has been filed with the department of health and human services relating to the act or omission that constitutes a violation of this chapter unless the complaint has been fully adjudicated or resolved.
   8.  This chapter shall not preempt or otherwise affect any right, claim, remedy, presumption, or defense available at law or in equity. Any rebuttable presumption or affirmative defense established under this chapter shall apply only to an enforcement action brought by the attorney general pursuant to this chapter and shall not apply to any right, claim, remedy, presumption, or defense available at law or in equity.
   9.  The attorney general shall post on its internet site how to properly file a complaint for a violation under this chapter.
   10.  This section does not provide a basis for a private right of action for violations of this chapter or any other law.
    Sec. 8.  NEW SECTION.  554I.7  Attorney general rulemaking authority.
   The attorney general shall adopt rules pursuant to chapter 17A to implement this chapter.
    Sec. 9.  Section 714.16, subsection 2, Code 2025, is amended by adding the following new paragraph:
   NEW PARAGRAPH.  r.  It is an unlawful practice for a person to violate any of the provisions of chapter 554I.
EXPLANATION
The inclusion of this explanation does not constitute agreement with
the explanation’s substance by the members of the general assembly.
   This bill relates to artificial intelligence (AI), including the use of artificial intelligence to create materials related to elections and protections in interactions with AI systems.
   DIVISION I —— MATERIALS RELATED TO ELECTIONS. The bill requires that published material generated through the use of AI, defined in this division, and designed to expressly advocate the nomination, election, or defeat of a candidate for public office or the passage or defeat of a ballot issue to include a disclosure that the published material was generated using AI. The disclosure must include the words “this material was generated using artificial intelligence”. A disclosure made in compliance with the bill does not preclude a private right of action arising out of the publication of published material generated through the use of AI.
   By operation of law, a person who willfully violates the division of the bill is guilty of a serious misdemeanor. A serious misdemeanor is punishable by confinement for no more than one year and a fine of at least $430 but not more than $2,560.
   DIVISION II —— PROTECTIONS IN INTERACTIONS WITH ARTIFICIAL INTELLIGENCE SYSTEMS. The bill defines “algorithmic discrimination” as any use of an AI system that results in unfavorable treatment due to an individual or group of individuals’ actual or perceived age, race, creed, color, sex, sexual orientation, national origin, religion, or disability. The bill lists several circumstances which do not constitute “algorithmic discrimination”.
   The bill defines “artificial intelligence system” as any machine-based system that, for any explicit or implicit objective, infers from the inputs the system receives to generate outputs, including but not limited to content, decisions, predictions, or recommendations, that can influence physical or virtual environments.
   The bill defines “consequential decision” as any decision that has a material legal or similarly significant effect on the provision or denial of a pardon, parole, probation, or release; an education enrollment or educational opportunity; employment; a financial or lending service; an essential government service; a health care service; insurance; or a legal service.
   The bill defines “deployer” as a person doing business in this state that uses a high-risk AI system.
   The bill defines “developer” as a person doing business in this state that develops or intentionally and substantially modifies a high-risk AI system.
   The bill defines “high-risk artificial intelligence system” as any AI system that makes, or is a factor that would likely alter the outcome of, a consequential decision. The bill lists several systems that do not constitute a “high-risk artificial intelligence system”.
   The bill defines “intentional and substantial modification” or “intentionally and substantially modifies” as a deliberate change made to an AI system that materially increases the risk of algorithmic discrimination.
   The bill defines “trade secret” as information, including but not limited to a formula, pattern, compilation, program, device, method, technique, or process that derives independent economic value, actual or potential, from not being generally known to, and not being readily ascertainable by proper means by a person able to obtain economic value from its disclosure or use; and is the subject of efforts that are reasonable under the circumstances to maintain its secrecy.
   The bill requires developers to use reasonable care to protect individuals from any known or reasonably foreseeable risks of algorithmic discrimination arising from the intended and contracted uses of the developer’s high-risk AI system. The bill creates a rebuttable presumption that a developer used reasonable care if the developer complied with certain requirements detailed in the bill and any additional requirements established in rules adopted by the attorney general.
   The bill requires a developer to make certain statements, documentation, and summaries related to the high-risk AI system, as detailed in the bill, available to a deployer or other developer that uses or intends to use the developer’s high-risk AI system.
   The bill requires a developer, if the developer offers, sells, leases, licenses, gives, or otherwise makes a high-risk AI system available to a deployer, to provide documentation and information to the deployer necessary for the deployer to complete an impact assessment. Documentation and information includes but is not limited to model cards, dataset cards, and other impact assessments. This requirement does not apply if the deployer is affiliated with the developer that is providing the high-risk AI system.
   The bill requires a developer to make a statement available in a manner that is clear and readily available on the developer’s internet site or in a public use case inventory that includes a summary of the types of high-risk AI systems the developer has developed or intentionally and substantially modified and is currently making generally available to deployers, and how the developer manages known or reasonably foreseeable risks of algorithmic discrimination arising from development or intentional and substantial modification of the types of high-risk AI systems. The bill requires developers to update the statement as necessary to ensure that the statement remains accurate, but no later than 90 days after the developer develops or intentionally and substantially modifies an AI system.
   The bill requires developers to disclose to the attorney general and to all known deployers or other developers of the high-risk AI system any known or foreseeable risks of algorithmic discrimination arising from the intended uses of the high-risk AI system. The disclosure must be given to the attorney general no later than 90 days after the developer discovers through the developer’s ongoing testing and analysis that the developer’s high-risk AI system has been used and has caused or is reasonably likely to have caused algorithmic discrimination; or the developer receives from a deployer a credible report that the high-risk AI system has been used and has caused algorithmic discrimination, whichever is earlier. The bill does not require a developer to disclose a trade secret, information protected under state or federal law, or other confidential or proprietary information.
   The bill authorizes the attorney general to require a developer to disclose to the attorney general any statement or documentation the bill requires the developer to make available to deployers and other developers if the statement or documentation is relevant to an investigation conducted by the attorney general regarding a violation of the bill. The bill makes statements and documentation provided to the attorney general exempt from disclosure to the extent the statement or documentation includes any proprietary information or any trade secret. The developer may designate the statement or documentation as including proprietary information or a trade secret. Disclosures of statements and documents to the attorney general that include information subject to attorney-client privilege or work-product protection do not constitute a waiver of the privilege or protection.
   The bill requires deployers to use reasonable care to protect individuals from any known or reasonably foreseeable risks of algorithmic discrimination. In any enforcement action brought by the attorney general, there is a rebuttable presumption that a deployer used reasonable care if the deployer implemented a risk management policy and program as detailed in the bill and complied with the bill’s requirements regarding impact statements.
   The bill requires deployers, or a third party contracted by a deployer to use a high-risk AI system, to complete an impact assessment for the high-risk AI system. Requirements for when the impact assessment must be completed and the contents of the impact assessment are detailed in the bill.
   The bill requires deployers to maintain the most recently completed impact assessment for a high-risk AI system and relevant records supporting the impact assessment for a period of at least three years following the final use of the high-risk AI system.
   The bill requires deployers to, at least annually, review the deployment of each high-risk AI system used by the deployer to ensure that the high-risk AI system is not causing algorithmic discrimination.
   The bill requires deployers to disclose to each individual that interacts with the AI system that the individual is interacting with an AI system. Developers who make a high-risk AI system available in this state must cooperate with deployers to allow deployers to fulfill the bill’s requirements. A disclosure that an individual is interacting with an AI system is not required in circumstances in which it would be obvious to a reasonable individual that the individual is interacting with an AI system.
   The bill clarifies that its provisions do not restrict a developer’s, deployer’s, or other person’s abilities to perform certain actions as detailed in the bill.
   The bill clarifies that its provisions do not apply to a developer, deployer, or other person that develops, uses, or intentionally and substantially modifies a high-risk AI system in certain circumstances detailed in the bill.
   The bill does not apply to an AI system that is acquired by or for the federal government, a federal agency, or a federal department unless the AI system is a high-risk AI system used to make, or is a factor that would likely alter the outcome of, a decision concerning employment or housing.
   The bill makes a developer, deployer, or other person responsible for proving an action qualifies for an exclusion from the bill’s provisions.
   The bill provides the attorney general with exclusive authority to enforce the bill’s provisions.
   The bill requires, prior to initiating any action for a violation of the bill’s provisions, the attorney general to issue a notice of violation to the developer, deployer, or other person who allegedly violated the bill’s provisions. The notice must contain a specific description of the alleged violation and the actions the developer, deployer, or other person must take to cure the violation. The bill authorizes the attorney general to bring an action for the alleged violation if the alleged violation is not cured within 90 days of the date the developer, deployer, or other person received the notice of violation.
   The bill details under what circumstances a developer, deployer, or other person has an affirmative defense to an alleged violation. The developer, deployer, or other person bears the burden of demonstrating to the attorney general that the person meets the requirements for an affirmative defense.
   The bill requires, prior to initiating any action under the bill’s provisions, the attorney general to consult with the department of health and human services (HHS) to determine whether any complaint has been filed that is founded on the same act or omission that constitutes a violation of the bill’s provisions. The attorney general is prohibited from initiating an action to enforce the bill’s provisions if a complaint has been filed with HHS relating to the same act or omission that constitutes a violation of the bill’s provisions unless the complaint has been fully adjudicated or resolved.
   The bill does not preempt or otherwise affect any right, claim, remedy, presumption, or defense available at law or in equity. Any rebuttable presumption or affirmative defense established under the bill’s provisions applies only to an enforcement action brought by the attorney general and does not apply to any right, claim, remedy, presumption, or defense available at law or in equity.
   The bill requires the attorney general to post on its internet site how to properly file a complaint for a violation of the bill’s provisions.
   The bill does not provide a basis for a private right of action for violations of the bill’s provisions or any other law.
   The bill requires the attorney general to adopt rules to implement the bill’s provisions.
   A violation of this division of the bill is an unlawful practice under Code section 714.16. Several types of remedies are available if a court finds that a person has committed an unlawful practice, including injunctive relief, disgorgement of moneys or property, and a civil penalty not to exceed $40,000 per violation.