Read the full stored bill text
S T A T E O F N E W Y O R K
________________________________________________________________________
1169
2025-2026 Regular Sessions
I N S E N A T E
January 8, 2025
___________
Introduced by Sen. GONZALEZ -- read twice and ordered printed, and when
printed to be committed to the Committee on Internet and Technology
AN ACT to amend the civil rights law and the executive law, in relation
to the use of artificial intelligence systems
THE PEOPLE OF THE STATE OF NEW YORK, REPRESENTED IN SENATE AND ASSEM-
BLY, DO ENACT AS FOLLOWS:
1 Section 1. This act shall be known and may be cited as the "New York
2 artificial intelligence act (New York AI act)".
3 § 2. Legislative findings and intent. The legislature finds and
4 declares the following:
5 (a) A revolution in artificial intelligence (AI) has advanced to the
6 point that comprehensive regulations must be enacted to protect New
7 Yorkers.
8 (b) Artificial intelligence is already an integral part of New York-
9 ers' daily lives. In the private sector, AI is currently in use in areas
10 such as education, health care, employment, insurance, credit scoring,
11 public safety, retail, banking and financial services, media, and more
12 with little transparency or oversight. A growing body of research shows
13 that AI systems that are deployed without adequate testing, sufficient
14 oversight and robust guardrails can harm consumers and deny historically
15 disadvantaged groups the full measure of their civil rights and liber-
16 ties, thereby further entrenching inequalities. The legislature must act
17 to ensure that all uses of AI, especially those that affect important
18 life chances, are free from harmful biases, protect our privacy, and
19 work for the public good.
20 (c) Safe innovation must remain a priority for the state. New York
21 state is home to thousands of technology start-ups, many of which exper-
22 iment with new applications of AI and which have the potential to find
23 new ways to employ technology at the service of New Yorkers. The goal of
24 the legislature is to encourage safe innovation in the AI sector by
25 providing clear guidance for AI development, testing, and validation
EXPLANATION--Matter in ITALICS (underscored) is new; matter in brackets
[ ] is old law to be omitted.
LBD04409-01-5
S. 1169 2
1 both before a product is launched and throughout the product's life
2 cycle.
3 (d) New York must establish that the burden of responsibility of prov-
4 ing that AI products do not cause harm to New Yorkers will be shouldered
5 by the developers and deployers of AI. While government and civil socie-
6 ty must act to audit and enforce human rights laws around the use of AI,
7 the companies employing and profiting from the use of AI must lead in
8 ensuring that their products are free from algorithmic discrimination.
9 (e) Close collaboration and communication between New York state and
10 industry partners is key to ensuring that innovation can occur with
11 safeguards to protect all New Yorkers. This legislation will ensure that
12 lines of communication exist and that there is clear statutory authority
13 to investigate and prosecute entities that break the law.
14 (f) As new forms of AI are developed beyond what is currently techno-
15 logically feasible, the goal of the legislature is to use this section
16 as a guiding light for future regulations.
17 (g) Lastly, it is in the interest of all New Yorkers that certain uses
18 of AI that infringe on fundamental rights, deepen structural inequality,
19 or that result in unequal access to services shall be banned.
20 § 3. The civil rights law is amended by adding a new article 8-A to
21 read as follows:
22 ARTICLE 8-A
23 PROTECTIONS REGARDING USE OF ARTIFICIAL INTELLIGENCE
24 SECTION 85. DEFINITIONS.
25 86. UNLAWFUL DISCRIMINATORY PRACTICES.
26 86-A. DEPLOYER AND DEVELOPER OBLIGATIONS.
27 86-B. WHISTLEBLOWER PROTECTIONS.
28 87. AUDITS.
29 88. HIGH-RISK AI SYSTEM REPORTING REQUIREMENTS.
30 89. RISK MANAGEMENT POLICY AND PROGRAM.
31 89-A. SOCIAL SCORING AI SYSTEMS PROHIBITED.
32 89-B. ENFORCEMENT.
33 § 85. DEFINITIONS. THE FOLLOWING TERMS SHALL HAVE THE FOLLOWING MEAN-
34 INGS:
35 1. "ALGORITHMIC DISCRIMINATION" MEANS ANY CONDITION IN WHICH THE USE
36 OF AN AI SYSTEM CONTRIBUTES TO UNJUSTIFIED DIFFERENTIAL TREATMENT OR
37 IMPACTS, DISFAVORING PEOPLE BASED ON THEIR ACTUAL OR PERCEIVED AGE,
38 RACE, ETHNICITY, CREED, RELIGION, COLOR, NATIONAL ORIGIN, CITIZENSHIP OR
39 IMMIGRATION STATUS, SEXUAL ORIENTATION, GENDER IDENTITY, GENDER
40 EXPRESSION, MILITARY STATUS, SEX, DISABILITY, PREDISPOSING GENETIC CHAR-
41 ACTERISTICS, FAMILIAL STATUS, MARITAL STATUS, PREGNANCY, PREGNANCY
42 OUTCOMES, DISABILITY, HEIGHT, WEIGHT, REPRODUCTIVE HEALTH CARE OR AUTON-
43 OMY, STATUS AS A VICTIM OF DOMESTIC VIOLENCE OR OTHER CLASSIFICATION
44 PROTECTED UNDER STATE OR FEDERAL LAWS. ALGORITHMIC DISCRIMINATION SHALL
45 NOT INCLUDE:
46 (A) A DEVELOPER'S OR DEPLOYER'S TESTING OF THEIR OWN AI SYSTEM TO
47 IDENTIFY, MITIGATE, AND PREVENT DISCRIMINATORY BIAS;
48 (B) EXPANDING AN APPLICANT, CUSTOMER, OR PARTICIPANT POOL TO INCREASE
49 DIVERSITY OR REDRESS HISTORICAL DISCRIMINATION; OR
50 (C) AN ACT OR OMISSION BY OR ON BEHALF OF A PRIVATE CLUB OR OTHER
51 ESTABLISHMENT THAT IS NOT IN FACT OPEN TO THE PUBLIC, AS SET FORTH IN
52 TITLE II OF THE FEDERAL CIVIL RIGHTS ACT OF 1964, 42 U.S.C. SECTION
53 2000A(E), AS AMENDED.
54 2. "ARTIFICIAL INTELLIGENCE SYSTEM" OR "AI SYSTEM" MEANS A MACHINE-
55 BASED SYSTEM OR COMBINATION OF SYSTEMS, THAT FOR EXPLICIT AND IMPLICIT
56 OBJECTIVES, INFERS, FROM THE INPUT IT RECEIVES, HOW TO GENERATE OUTPUTS
S. 1169 3
1 SUCH AS PREDICTIONS, CONTENT, RECOMMENDATIONS, OR DECISIONS THAT CAN
2 INFLUENCE PHYSICAL OR VIRTUAL ENVIRONMENTS. ARTIFICIAL INTELLIGENCE
3 SHALL NOT INCLUDE ANY SOFTWARE USED PRIMARILY FOR BASIC COMPUTERIZED
4 PROCESSES, SUCH AS ANTI-MALWARE, ANTI-VIRUS, AUTO-CORRECT FUNCTIONS,
5 CALCULATORS, DATABASES, DATA STORAGE, ELECTRONIC COMMUNICATIONS, FIRE-
6 WALL, INTERNET DOMAIN REGISTRATION, INTERNET WEBSITE LOADING, NETWORK-
7 ING, SPAM AND ROBOCALL-FILTERING, SPELLCHECK TOOLS, SPREADSHEETS, WEB
8 CACHING, WEB HOSTING, OR ANY TOOL THAT RELATES ONLY TO INTERNAL MANAGE-
9 MENT AFFAIRS SUCH AS ORDERING OFFICE SUPPLIES OR PROCESSING PAYMENTS,
10 AND THAT DO NOT MATERIALLY AFFECT THE RIGHTS, LIBERTIES, BENEFITS, SAFE-
11 TY OR WELFARE OF ANY INDIVIDUAL WITHIN THE STATE.
12 3. "AUDITOR" SHALL REFER TO AN INDEPENDENT ENTITY INCLUDING BUT NOT
13 LIMITED TO AN INDIVIDUAL, NON-PROFIT, FIRM, CORPORATION, PARTNERSHIP,
14 COOPERATIVE, OR ASSOCIATION COMMISSIONED TO PERFORM AN AUDIT.
15 4. "CONSEQUENTIAL DECISION" MEANS A DECISION OR JUDGMENT THAT HAS A
16 MATERIAL, LEGAL OR SIMILARLY SIGNIFICANT EFFECT ON AN INDIVIDUAL'S LIFE
17 RELATING TO THE IMPACT OF, ACCESS TO, OR THE COST, TERMS, OR AVAILABILI-
18 TY OF, ANY OF THE FOLLOWING:
19 (A) EMPLOYMENT, WORKERS' MANAGEMENT, OR SELF-EMPLOYMENT, INCLUDING,
20 BUT NOT LIMITED TO, ALL OF THE FOLLOWING:
21 (I) PAY OR PROMOTION;
22 (II) HIRING OR TERMINATION; AND
23 (III) AUTOMATED TASK ALLOCATION.
24 (B) EDUCATION AND VOCATIONAL TRAINING, INCLUDING, BUT NOT LIMITED TO,
25 ALL OF THE FOLLOWING:
26 (I) ASSESSMENT OR GRADING, INCLUDING, BUT NOT LIMITED TO, DETECTING
27 STUDENT CHEATING OR PLAGIARISM;
28 (II) ACCREDITATION;
29 (III) CERTIFICATION;
30 (IV) ADMISSIONS; AND
31 (V) FINANCIAL AID OR SCHOLARSHIPS.
32 (C) HOUSING OR LODGING, INCLUDING RENTAL OR SHORT-TERM HOUSING OR
33 LODGING.
34 (D) ESSENTIAL UTILITIES, INCLUDING ELECTRICITY, HEAT, WATER, INTERNET
35 OR TELECOMMUNICATIONS ACCESS, OR TRANSPORTATION.
36 (E) FAMILY PLANNING, INCLUDING ADOPTION SERVICES OR REPRODUCTIVE
37 SERVICES, AS WELL AS ASSESSMENTS RELATED TO CHILD PROTECTIVE SERVICES.
38 (F) HEALTH CARE OR HEALTH INSURANCE, INCLUDING MENTAL HEALTH CARE,
39 DENTAL, OR VISION.
40 (G) FINANCIAL SERVICES, INCLUDING A FINANCIAL SERVICE PROVIDED BY A
41 MORTGAGE COMPANY, MORTGAGE BROKER, OR CREDITOR.
42 (H) LAW ENFORCEMENT ACTIVITIES, INCLUDING THE ALLOCATION OF LAW
43 ENFORCEMENT PERSONNEL OR ASSETS, THE ENFORCEMENT OF LAWS, MAINTAINING
44 PUBLIC ORDER, OR MANAGING PUBLIC SAFETY.
45 (I) GOVERNMENT SERVICES.
46 (J) LEGAL SERVICES.
47 5. "DEPLOYER" MEANS A PERSON, PARTNERSHIP, ASSOCIATION OR CORPORATION
48 THAT USES AN AI SYSTEM OR COMMERCE IN THE STATE OF NEW YORK OR PROVIDES
49 AN AI SYSTEM FOR USE BY THE GENERAL PUBLIC IN THE STATE OF NEW YORK. A
50 DEVELOPER MAY ALSO BE CONSIDERED A DEPLOYER IF ITS ACTIONS SATISFY THIS
51 DEFINITION.
52 6. "DEPLOYER-EMPLOYER" MEANS A DEPLOYER THAT IS AN EMPLOYER.
53 7. "DEVELOPER" MEANS A PERSON, PARTNERSHIP, OR CORPORATION THAT
54 DESIGNS, CODES, OR PRODUCES AN AI SYSTEM, OR CREATES A SUBSTANTIAL
55 CHANGE WITH RESPECT TO AN AI SYSTEM, WHETHER FOR ITS OWN USE IN THE
56 STATE OF NEW YORK OR FOR USE BY A THIRD PARTY IN THE STATE OF NEW YORK.
S. 1169 4
1 8. "DEVELOPER-EMPLOYER" MEANS A DEVELOPER THAT IS AN EMPLOYER.
2 9. "EMPLOYEE" MEANS AN INDIVIDUAL WHO PERFORMS SERVICES FOR AND UNDER
3 THE CONTROL AND DIRECTION OF AN EMPLOYER FOR WAGES OR OTHER REMUNERA-
4 TION, INCLUDING FORMER EMPLOYEES, OR NATURAL PERSONS EMPLOYED AS INDE-
5 PENDENT CONTRACTORS TO CARRY OUT WORK IN FURTHERANCE OF AN EMPLOYER'S
6 BUSINESS ENTERPRISE WHO ARE NOT THEMSELVES EMPLOYERS.
7 10. "EMPLOYER" MEANS ANY PERSON, FIRM, PARTNERSHIP, INSTITUTION,
8 CORPORATION, OR ASSOCIATION THAT EMPLOYS ONE OR MORE EMPLOYEES.
9 11. "END USER" MEANS ANY INDIVIDUAL OR GROUP OF INDIVIDUALS THAT:
10 (A) IS THE SUBJECT OF A CONSEQUENTIAL DECISION MADE ENTIRELY BY OR
11 WITH THE ASSISTANCE OF AN AI SYSTEM; OR
12 (B) INTERACTS, DIRECTLY OR INDIRECTLY, WITH THE RELEVANT AI SYSTEM ON
13 BEHALF OF AN INDIVIDUAL OR GROUP THAT IS THE SUBJECT OF A CONSEQUENTIAL
14 DECISION MADE ENTIRELY BY OR WITH THE ASSISTANCE OF AN AI SYSTEM.
15 12. "HIGH-RISK AI SYSTEM" MEANS ANY AI SYSTEM THAT, WHEN DEPLOYED:
16 (A) IS A SUBSTANTIAL FACTOR IN MAKING A CONSEQUENTIAL DECISION; OR (B)
17 WILL HAVE A MATERIAL IMPACT ON THE STATUTORY OR CONSTITUTIONAL RIGHTS,
18 CIVIL LIBERTIES, SAFETY, OR WELFARE OF AN INDIVIDUAL IN THE STATE.
19 13. "SOFTWARE STACK" MEANS THE GROUP OF INDIVIDUAL SOFTWARE COMPONENTS
20 THAT WORK TOGETHER TO SUPPORT THE EXECUTION OF AN AI SYSTEM.
21 14. "SUBSTANTIAL CHANGE" MEANS ANY (A) DELIBERATE MODIFICATION TO AN
22 AI SYSTEM THAT WOULD RESULT IN MATERIAL INACCURACIES IN THE REPORTS
23 CREATED UNDER SECTION EIGHTY-EIGHT OF THIS ARTICLE; OR (B) UNINTENTIONAL
24 AND SUBSTANTIAL CHANGE IN THE DATA THAT THE AI SYSTEM USES AS INPUT
25 DATA.
26 15. "SUBSTANTIAL FACTOR" MEANS A FACTOR THAT ASSISTS IN MAKING A
27 CONSEQUENTIAL DECISION OR IS CAPABLE OF ALTERING THE OUTCOME OF A CONSE-
28 QUENTIAL DECISION. "SUBSTANTIAL FACTOR" INCLUDES, BUT IS NOT LIMITED TO,
29 ANY USE OF AN AI SYSTEM TO GENERATE ANY CONTENT, DECISION, PREDICTION,
30 OR RECOMMENDATION THAT IS USED AS A BASIS, IN WHOLE OR IN PART, TO MAKE
31 A CONSEQUENTIAL DECISION REGARDING AN END USER.
32 § 86. UNLAWFUL DISCRIMINATORY PRACTICES. IT SHALL BE AN UNLAWFUL
33 DISCRIMINATORY PRACTICE:
34 1. FOR A DEVELOPER OR DEPLOYER TO USE, SELL, OR SHARE A HIGH-RISK AI
35 SYSTEM OR A PRODUCT FEATURING A HIGH-RISK AI SYSTEM THAT PRODUCES ALGO-
36 RITHMIC DISCRIMINATION; OR
37 2. FOR A DEVELOPER TO USE, SELL, OR SHARE A HIGH-RISK AI SYSTEM OR A
38 PRODUCT FEATURING A HIGH-RISK AI SYSTEM THAT HAS NOT PASSED AN INDEPEND-
39 ENT AUDIT, IN ACCORDANCE WITH SECTION EIGHTY-SEVEN OF THIS ARTICLE, THAT
40 HAS FOUND THAT THE PRODUCT DOES NOT IN FACT PRODUCE ALGORITHMIC DISCRIM-
41 INATION.
42 § 86-A. DEPLOYER AND DEVELOPER OBLIGATIONS. 1. (A) ANY DEPLOYER THAT
43 EMPLOYS A HIGH-RISK AI SYSTEM FOR A CONSEQUENTIAL DECISION MUST INFORM
44 THE END USER AT LEAST FIVE BUSINESS DAYS PRIOR TO THE USE OF SUCH SYSTEM
45 FOR THE MAKING OF A CONSEQUENTIAL DECISION IN CLEAR, CONSPICUOUS, AND
46 CONSUMER-FRIENDLY TERMS, MADE AVAILABLE IN EACH OF THE LANGUAGES IN
47 WHICH THE COMPANY OFFERS ITS END SERVICES, THAT AI SYSTEMS WILL BE USED
48 TO MAKE A DECISION OR TO ASSIST IN MAKING A DECISION. THE DEPLOYER MUST
49 ALLOW SUFFICIENT TIME AND OPPORTUNITY IN A CLEAR, CONSPICUOUS, AND
50 CONSUMER-FRIENDLY MANNER FOR THE CONSUMER TO OPT-OUT OF THE AUTOMATED
51 PROCESS AND FOR THE DECISION TO BE MADE BY A HUMAN REPRESENTATIVE. A
52 CONSUMER MAY NOT BE PUNISHED OR FACE ANY OTHER ADVERSE ACTION FOR OPTING
53 OUT OF A DECISION BY AN AI SYSTEM AND THE DEPLOYER MUST RENDER A DECI-
54 SION TO THE CONSUMER WITHIN FORTY-FIVE DAYS.
55 (B) IF A DEPLOYER EMPLOYS A HIGH-RISK AI SYSTEM FOR A CONSEQUENTIAL
56 DECISION TO DETERMINE WHETHER TO OR ON WHAT TERMS TO CONFER A BENEFIT ON
S. 1169 5
1 AN END USER, THE DEPLOYER SHALL OFFER THE END USER THE OPTION TO WAIVE
2 THEIR RIGHT TO ADVANCE NOTICE OF FIVE BUSINESS DAYS UNDER THIS SUBDIVI-
3 SION.
4 (C) IF THE END USER CLEARLY AND AFFIRMATIVELY WAIVES THEIR RIGHT TO
5 FIVE BUSINESS DAYS' NOTICE, THE DEPLOYER SHALL THEN INFORM THE END USER
6 AT LEAST ONE BUSINESS DAY BEFORE THE MAKING OF THE CONSEQUENTIAL DECI-
7 SION IN CLEAR, CONSPICUOUS, AND CONSUMER-FRIENDLY TERMS, MADE AVAILABLE
8 IN EACH OF THE LANGUAGES IN WHICH THE COMPANY OFFERS ITS END
9 SERVICES, THAT AI SYSTEMS WILL BE USED TO MAKE A DECISION OR TO ASSIST
10 IN MAKING A DECISION. THE DEPLOYER MUST ALLOW SUFFICIENT TIME
11 AND OPPORTUNITY IN A CLEAR, CONSPICUOUS, AND CONSUMER-FRIENDLY MANNER
12 FOR THE CONSUMER TO OPT-OUT OF THE AUTOMATED PROCESS AND FOR THE
13 DECISION TO BE MADE BY A HUMAN REPRESENTATIVE. A CONSUMER MAY NOT BE
14 PUNISHED OR FACE ANY OTHER ADVERSE ACTION FOR OPTING OUT OF A DECI-
15 SION BY AN AI SYSTEM AND THE DEPLOYER MUST RENDER A DECISION TO THE
16 CONSUMER WITHIN FORTY-FIVE DAYS.
17 2. ANY DEPLOYER THAT EMPLOYS A HIGH-RISK AI SYSTEM FOR A CONSEQUENTIAL
18 DECISION MUST INFORM THE END USER WITHIN FIVE DAYS IN A CLEAR, CONSPICU-
19 OUS, AND CONSUMER-FRIENDLY MANNER IF A CONSEQUENTIAL DECISION HAS BEEN
20 MADE ENTIRELY BY OR WITH ASSISTANCE OF AN AUTOMATED SYSTEM. THE DEPLOY-
21 ER MUST THEN PROVIDE AND EXPLAIN A PROCESS FOR THE END USER TO APPEAL
22 THE DECISION, WHICH MUST AT MINIMUM ALLOW THE END USER TO (A) FORMALLY
23 CONTEST THE DECISION, (B) PROVIDE INFORMATION TO SUPPORT THEIR POSITION,
24 AND (C) OBTAIN MEANINGFUL HUMAN REVIEW OF THE DECISION. A DEPLOYER MUST
25 RESPOND TO AN END USER'S APPEAL WITHIN FORTY-FIVE DAYS OF RECEIPT OF THE
26 APPEAL. THAT PERIOD MAY BE EXTENDED ONCE BY FORTY-FIVE ADDITIONAL DAYS
27 WHERE REASONABLY NECESSARY, TAKING INTO ACCOUNT THE COMPLEXITY AND
28 NUMBER OF APPEALS. THE DEPLOYER MUST INFORM THE END USER OF ANY SUCH
29 EXTENSION WITHIN FORTY-FIVE DAYS OF RECEIPT OF THE APPEAL, TOGETHER WITH
30 THE REASONS FOR THE DELAY.
31 3. THE DEPLOYER OR DEVELOPER OF A HIGH-RISK AI SYSTEM IS LEGALLY
32 RESPONSIBLE FOR QUALITY AND ACCURACY OF ALL CONSEQUENTIAL DECISIONS
33 MADE, INCLUDING ANY BIAS, ALGORITHMIC DISCRIMINATION, AND/OR MISINFOR-
34 MATION RESULTING FROM THE OPERATION OF THE AI SYSTEM.
35 4. THE RIGHTS AND OBLIGATIONS UNDER THIS SECTION MAY NOT BE WAIVED BY
36 ANY PERSON, PARTNERSHIP, ASSOCIATION OR CORPORATION.
37 § 86-B. WHISTLEBLOWER PROTECTIONS. 1. DEVELOPER-EMPLOYERS AND/OR
38 DEPLOYER-EMPLOYERS OF HIGH-RISK AI SYSTEMS SHALL NOT:
39 (A) PREVENT AN EMPLOYEE FROM DISCLOSING INFORMATION TO THE ATTORNEY
40 GENERAL, INCLUDING THROUGH TERMS AND CONDITIONS OF EMPLOYMENT OR SEEKING
41 TO ENFORCE TERMS AND CONDITIONS OF EMPLOYMENT, IF THE EMPLOYEE HAS
42 REASONABLE CAUSE TO BELIEVE THE INFORMATION INDICATES A VIOLATION OF
43 THIS ARTICLE; OR
44 (B) RETALIATE AGAINST AN EMPLOYEE FOR DISCLOSING INFORMATION TO THE
45 ATTORNEY GENERAL PURSUANT TO THIS SECTION.
46 2. AN EMPLOYEE HARMED BY A VIOLATION OF THIS ARTICLE MAY PETITION A
47 COURT FOR APPROPRIATE RELIEF AS PROVIDED IN SUBDIVISION FIVE OF SECTION
48 SEVEN HUNDRED FORTY OF THE LABOR LAW.
49 3. DEVELOPER-EMPLOYERS AND DEPLOYER-EMPLOYERS OF HIGH-RISK AI SYSTEMS
50 SHALL PROVIDE A CLEAR NOTICE TO ALL EMPLOYEES WORKING ON SUCH AI SYSTEMS
51 OF THEIR RIGHTS AND RESPONSIBILITIES UNDER THIS ARTICLE, INCLUDING THE
52 RIGHT OF EMPLOYEES OF CONTRACTORS AND SUBCONTRACTORS TO USE THE DEVELOP-
53 ER'S INTERNAL PROCESS FOR MAKING PROTECTED DISCLOSURES PURSUANT TO
54 SUBDIVISION FOUR OF THIS SECTION. A DEVELOPER-EMPLOYER OR DEPLOYER-EM-
55 PLOYER IS PRESUMED TO BE IN COMPLIANCE WITH THE REQUIREMENTS OF THIS
S. 1169 6
1 SUBDIVISION IF THE DEVELOPER-EMPLOYER OR DEPLOYER-EMPLOYER DOES EITHER
2 OF THE FOLLOWING:
3 (A) AT ALL TIMES POST AND DISPLAY WITHIN ALL WORKPLACES MAINTAINED BY
4 THE DEVELOPER-EMPLOYER OR DEPLOYER-EMPLOYER A NOTICE TO ALL EMPLOYEES OF
5 THEIR RIGHTS AND RESPONSIBILITIES UNDER THIS ARTICLE, ENSURE THAT ALL
6 NEW EMPLOYEES RECEIVE EQUIVALENT NOTICE, AND ENSURE THAT EMPLOYEES WHO
7 WORK REMOTELY PERIODICALLY RECEIVE AN EQUIVALENT NOTICE; OR
8 (B) NO LESS FREQUENTLY THAN ONCE EVERY YEAR, PROVIDES WRITTEN NOTICE
9 TO ALL EMPLOYEES OF THEIR RIGHTS AND RESPONSIBILITIES UNDER THIS ARTICLE
10 AND ENSURES THAT THE NOTICE IS RECEIVED AND ACKNOWLEDGED BY ALL OF THOSE
11 EMPLOYEES.
12 4. EACH DEVELOPER-EMPLOYER AND DEPLOYER-EMPLOYER SHALL PROVIDE A
13 REASONABLE INTERNAL PROCESS THROUGH WHICH AN EMPLOYEE MAY ANONYMOUSLY
14 DISCLOSE INFORMATION TO THE DEVELOPER IF THE EMPLOYEE BELIEVES IN GOOD
15 FAITH THAT THE INFORMATION INDICATES THAT THE DEVELOPER HAS VIOLATED ANY
16 PROVISION OF THIS ARTICLE OR ANY OTHER LAW, OR HAS MADE FALSE OR MATE-
17 RIALLY MISLEADING STATEMENTS RELATED TO ITS SAFETY AND SECURITY PROTO-
18 COL, OR FAILED TO DISCLOSE KNOWN RISKS TO EMPLOYEES, INCLUDING, AT A
19 MINIMUM, A MONTHLY UPDATE TO THE PERSON WHO MADE THE DISCLOSURE REGARD-
20 ING THE STATUS OF THE DEVELOPER'S INVESTIGATION OF THE DISCLOSURE AND
21 THE ACTIONS TAKEN BY THE DEVELOPER IN RESPONSE TO THE DISCLOSURE.
22 5. THIS SECTION DOES NOT LIMIT PROTECTIONS PROVIDED TO EMPLOYEES UNDER
23 SECTION SEVEN HUNDRED FORTY OF THE LABOR LAW.
24 § 87. AUDITS. 1. PRIOR TO DEPLOYMENT OF A HIGH-RISK AI SYSTEM, SIX
25 MONTHS AFTER DEPLOYMENT, AND AT LEAST EVERY EIGHTEEN MONTHS THEREAFTER
26 FOR EACH CALENDAR YEAR A HIGH-RISK AI SYSTEM IS IN USE AFTER THE FIRST
27 POST-DEPLOYMENT AUDIT, EVERY DEVELOPER OR DEPLOYER OF A HIGH-RISK AI
28 SYSTEM SHALL CAUSE TO BE CONDUCTED AT LEAST ONE THIRD-PARTY AUDIT IN
29 COMPLIANCE WITH THE PROVISIONS OF THIS SECTION TO ENSURE THAT THE PROD-
30 UCT DOES NOT PRODUCE ALGORITHMIC DISCRIMINATION AND COMPLIES WITH THE
31 PROVISIONS OF THIS ARTICLE. REGARDLESS OF FINAL FINDINGS, THE DEPLOYER
32 OR DEVELOPER SHALL DELIVER ALL AUDITS CONDUCTED UNDER THIS SECTION TO
33 THE ATTORNEY GENERAL.
34 2. A DEPLOYER OR DEVELOPER MAY HIRE MORE THAN ONE AUDITOR TO FULFILL
35 THE REQUIREMENTS OF THIS SECTION.
36 3. THE AUDIT SHALL INCLUDE THE FOLLOWING:
37 (A) AN ANALYSIS OF DATA MANAGEMENT POLICIES INCLUDING WHETHER PERSONAL
38 OR SENSITIVE DATA RELATING TO A CONSUMER IS SUBJECT TO DATA SECURITY
39 PROTECTION STANDARDS THAT COMPLY WITH THE REQUIREMENTS OF SECTION EIGHT
40 HUNDRED NINETY-NINE-BB OF THE GENERAL BUSINESS LAW;
41 (B) AN ANALYSIS OF THE SYSTEM ACCURACY AND RELIABILITY ACCORDING TO
42 EACH SPECIFIED USE CASE LISTED IN THE ENTITY'S REPORTING DOCUMENT FILED
43 BY THE DEVELOPER OR DEPLOYER UNDER SECTION EIGHTY-EIGHT OF THIS ARTICLE;
44 (C) DISPARATE IMPACTS AND A DETERMINATION OF WHETHER THE PRODUCT
45 PRODUCES ALGORITHMIC DISCRIMINATION IN VIOLATION OF THIS ARTICLE BY EACH
46 INTENDED AND FORESEEABLE IDENTIFIED USE AS IDENTIFIED BY THE DEPLOYER
47 AND DEVELOPER;
48 (D) ANALYSIS OF HOW THE TECHNOLOGY COMPLIES WITH EXISTING RELEVANT
49 FEDERAL, STATE, AND LOCAL PRIVACY AND DATA PRIVACY LAWS; AND
50 (E) AN EVALUATION OF THE DEVELOPER'S OR DEPLOYER'S DOCUMENTED RISK
51 MANAGEMENT POLICY AND PROGRAM REQUIRED UNDER SECTION EIGHTY-NINE OF THIS
52 ARTICLE FOR CONFORMITY WITH SUBDIVISION ONE OF SUCH SECTION EIGHTY-NINE.
53 4. THE ATTORNEY GENERAL MAY PROMULGATE FURTHER RULES AS NECESSARY TO
54 ENSURE THAT AUDITS UNDER THIS SECTION ASSESS WHETHER OR NOT AI SYSTEMS
55 PRODUCE ALGORITHMIC DISCRIMINATION AND OTHERWISE COMPLY WITH THE
56 PROVISIONS OF THIS ARTICLE.
S. 1169 7
1 5. THE INDEPENDENT AUDITOR SHALL HAVE COMPLETE AND UNREDACTED COPIES
2 OF ALL REPORTS PREVIOUSLY FILED BY THE DEPLOYER OR DEVELOPER UNDER
3 SECTION EIGHTY-EIGHT OF THIS ARTICLE.
4 6. AN AUDIT CONDUCTED UNDER THIS SECTION SHALL BE COMPLETED IN ITS
5 ENTIRETY WITHOUT THE ASSISTANCE OF AN AI SYSTEM.
6 7. (A) AN AUDITOR SHALL BE AN INDEPENDENT ENTITY INCLUDING BUT NOT
7 LIMITED TO AN INDIVIDUAL, NON-PROFIT, FIRM, CORPORATION, PARTNERSHIP,
8 COOPERATIVE, OR ASSOCIATION.
9 (B) FOR THE PURPOSES OF THIS ARTICLE, NO AUDITOR MAY BE COMMISSIONED
10 BY A DEVELOPER OR DEPLOYER OF AN AI SYSTEM IF SUCH ENTITY HAS ALREADY
11 BEEN COMMISSIONED TO PROVIDE ANY AUDITING OR NON-AUDITING SERVICE,
12 INCLUDING BUT NOT LIMITED TO FINANCIAL AUDITING, CYBERSECURITY AUDITING,
13 OR CONSULTING SERVICES OF ANY TYPE, TO THE COMMISSIONING COMPANY IN THE
14 PAST TWELVE MONTHS.
15 (C) FEES PAID TO AUDITORS MAY NOT BE CONTINGENT ON THE RESULT OF THE
16 AUDIT AND THE COMMISSIONING COMPANY SHALL NOT PROVIDE ANY INCENTIVES OR
17 BONUSES FOR A POSITIVE AUDIT RESULT.
18 8. THE ATTORNEY GENERAL MAY PROMULGATE FURTHER RULES TO ENSURE (A) THE
19 INDEPENDENCE OF AUDITORS UNDER THIS SECTION, AND (B) THAT TEAMS CONDUCT-
20 ING AUDITS INCORPORATE FEEDBACK FROM COMMUNITIES THAT MAY FORESEEABLY BE
21 THE SUBJECT OF ALGORITHMIC DISCRIMINATION WITH RESPECT TO THE AI SYSTEM
22 BEING AUDITED.
23 § 88. HIGH-RISK AI SYSTEM REPORTING REQUIREMENTS. 1. EVERY DEVELOPER
24 AND DEPLOYER OF A HIGH-RISK AI SYSTEM SHALL COMPLY WITH THE REPORTING
25 REQUIREMENTS OF THIS SECTION. REGARDLESS OF FINAL FINDINGS, REPORTS
26 SHALL BE FILED WITH THE ATTORNEY GENERAL PRIOR TO DEPLOYMENT OF A HIGH-
27 RISK AI SYSTEM AND THEN ANNUALLY, OR AFTER EACH SUBSTANTIAL CHANGE TO
28 THE SYSTEM, WHICHEVER COMES FIRST.
29 2. TOGETHER WITH EACH REPORT REQUIRED TO BE FILED UNDER THIS SECTION,
30 DEVELOPERS AND DEPLOYERS SHALL FILE WITH THE ATTORNEY GENERAL A COPY OF
31 THE LAST COMPLETED INDEPENDENT AUDIT REQUIRED BY THIS ARTICLE AND A
32 LEGAL ATTESTATION THAT THE HIGH-RISK AI SYSTEM: (A) DOES NOT VIOLATE
33 ANY PROVISION OF THIS ARTICLE; OR (B) MAY VIOLATE OR DOES VIOLATE ONE OR
34 MORE PROVISIONS OF THIS ARTICLE, THAT THERE IS A PLAN OF REMEDIATION TO
35 BRING THE HIGH-RISK AI SYSTEM INTO COMPLIANCE WITH THIS ARTICLE, AND A
36 SUMMARY OF SUCH PLAN OF REMEDIATION.
37 3. DEVELOPERS OF HIGH-RISK AI SYSTEMS SHALL FILE WITH THE ATTORNEY
38 GENERAL A REPORT CONTAINING THE FOLLOWING:
39 (A) A DESCRIPTION OF THE SYSTEM INCLUDING:
40 (I) A DESCRIPTION OF THE SYSTEM'S SOFTWARE STACK;
41 (II) THE PURPOSE OF THE SYSTEM;
42 (III) THE SYSTEM'S USE TO END USERS; AND
43 (IV) REASONABLY FORESEEABLE USES OUTSIDE OF THE CURRENT OR INTENDED
44 USES;
45 (V) HOW THE SYSTEM SHOULD BE USED OR NOT USED;
46 (B) THE INTENDED OUTPUTS OF THE SYSTEM AND WHETHER THE OUTPUTS CAN BE
47 OR ARE OTHERWISE APPROPRIATE TO BE USED FOR ANY PURPOSE NOT PREVIOUSLY
48 ARTICULATED;
49 (C) THE METHODS FOR TRAINING OF THEIR MODELS INCLUDING:
50 (I) ANY PRE-PROCESSING STEPS TAKEN TO PREPARE DATASETS FOR THE TRAIN-
51 ING OF A MODEL UNDERLYING A HIGH-RISK AI SYSTEM;
52 (II) DATASHEETS COMPREHENSIVELY DESCRIBING THE DATASETS UPON WHICH
53 MODELS WERE TRAINED AND EVALUATED, HOW AND WHY DATASETS WERE COLLECTED,
54 HOW THAT TRAINING DATA WILL BE USED AND MAINTAINED GOING FORWARD THROUGH
55 THE DEVELOPMENT CYCLE; AND
S. 1169 8
1 (III) STEPS TAKEN TO ENSURE COMPLIANCE WITH PRIVACY, DATA PRIVACY,
2 DATA SECURITY, AND COPYRIGHT LAWS;
3 (D) DETAILED USE AND DATA MANAGEMENT POLICIES;
4 (E) ANY OTHER INFORMATION NECESSARY TO ALLOW THE DEPLOYER TO UNDER-
5 STAND THE OUTPUTS AND MONITOR THE SYSTEM FOR COMPLIANCE WITH THIS ARTI-
6 CLE;
7 (F) ANY OTHER INFORMATION NECESSARY TO ALLOW THE DEPLOYER TO COMPLY
8 WITH THE REQUIREMENTS OF SUBDIVISION FOUR OF THIS SECTION; AND
9 (G) FOR ANY HIGH-RISK AI SYSTEM THAT IS A SUBSTANTIAL FACTOR IN MAKING
10 A CONSEQUENTIAL DECISION:
11 (I) A DETAILED DESCRIPTION OF THE PROPOSED USES OF THE SYSTEM, INCLUD-
12 ING WHAT CONSEQUENTIAL DECISIONS THE SYSTEM WILL SUPPORT;
13 (II) A DETAILED DESCRIPTION OF THE SYSTEM'S CAPABILITIES AND ANY
14 DEVELOPER-IMPOSED LIMITATIONS, INCLUDING CAPABILITIES OUTSIDE OF ITS
15 INTENDED USE, WHEN THE SYSTEM SHOULD NOT BE USED, ANY SAFEGUARDS OR
16 GUARDRAILS IN PLACE TO PROTECT AGAINST UNINTENDED, INAPPROPRIATE, OR
17 DISALLOWED USES, AND TESTING OF ANY SUCH SAFEGUARDS OR GUARDRAILS;
18 (III) AN INTERNAL RISK ASSESSMENT INCLUDING DOCUMENTATION AND RESULTS
19 OF TESTING CONDUCTED TO IDENTIFY ALL REASONABLY FORESEEABLE RISKS
20 RELATED TO ALGORITHMIC DISCRIMINATION, ACCURACY AND RELIABILITY, PRIVACY
21 AND AUTONOMY, AND SAFETY AND SECURITY, AS WELL AS ACTIONS TAKEN TO
22 ADDRESS THOSE RISKS, AND SUBSEQUENT TESTING TO ASSESS THE EFFICACY OF
23 ACTIONS TAKEN TO ADDRESS RISKS; AND
24 (IV) WHETHER THE SYSTEM SHOULD BE MONITORED, AND IF SO, HOW SUCH
25 SYSTEM SHOULD BE MONITORED.
26 4. DEPLOYERS OF HIGH-RISK AI SYSTEMS SHALL FILE WITH THE ATTORNEY
27 GENERAL A REPORT CONTAINING THE FOLLOWING:
28 (A) A DESCRIPTION OF THE SYSTEM INCLUDING:
29 (I) A DESCRIPTION OF THE SYSTEM'S SOFTWARE STACK;
30 (II) THE PURPOSE OF THE SYSTEM;
31 (III) THE SYSTEM'S USE TO END USERS; AND
32 (IV) REASONABLY FORESEEABLE USES OUTSIDE OF THE CURRENT OR INTENDED
33 USES;
34 (B) THE INTENDED OUTPUTS OF THE SYSTEM AND WHETHER THE OUTPUTS CAN BE
35 OR ARE OTHERWISE APPROPRIATE TO BE USED FOR ANY PURPOSE NOT PREVIOUSLY
36 ARTICULATED;
37 (C) ASSESSMENT OF THE RELATIVE BENEFITS AND COSTS TO THE CONSUMER
38 GIVEN THE SYSTEM'S PURPOSE, CAPABILITIES, AND PROBABLE USE CASES;
39 (D) WHETHER THE DEPLOYER COLLECTS REVENUE OR PLANS TO COLLECT REVENUE
40 FROM USE OF THE HIGH-RISK AI SYSTEM, AND IF SO, HOW IT MONETIZES OR
41 PLANS TO MONETIZE USE OF THE SYSTEM; AND
42 (E) FOR ANY HIGH-RISK AI SYSTEM THAT IS A SUBSTANTIAL FACTOR IN MAKING
43 A CONSEQUENTIAL DECISION:
44 (I) A DETAILED DESCRIPTION OF THE PROPOSED USES OF THE SYSTEM, INCLUD-
45 ING WHAT CONSEQUENTIAL DECISIONS THE SYSTEM WILL SUPPORT;
46 (II) WHETHER THE SYSTEM IS DESIGNED TO MAKE CONSEQUENTIAL DECISIONS
47 ITSELF OR WHETHER AND HOW IT SUPPORTS CONSEQUENTIAL DECISIONS;
48 (III) A DETAILED DESCRIPTION OF THE SYSTEM'S CAPABILITIES AND ANY
49 DEPLOYER-IMPOSED LIMITATIONS, INCLUDING CAPABILITIES OUTSIDE OF ITS
50 INTENDED USE, WHEN THE SYSTEM SHOULD NOT BE USED, ANY SAFEGUARDS OR
51 GUARDRAILS IN PLACE TO PROTECT AGAINST UNINTENDED, INAPPROPRIATE, OR
52 DISALLOWED USES, AND TESTING OF ANY SUCH SAFEGUARDS OR GUARDRAILS;
53 (IV) AN ASSESSMENT OF THE RELATIVE BENEFITS AND COSTS TO THE CONSUMER
54 GIVEN THE SYSTEM'S PURPOSE, CAPABILITIES, AND PROBABLE USE CASES;
55 (V) AN INTERNAL RISK ASSESSMENT INCLUDING DOCUMENTATION AND RESULTS OF
56 TESTING CONDUCTED TO IDENTIFY ALL REASONABLY FORESEEABLE RISKS RELATED
S. 1169 9
1 TO ALGORITHMIC DISCRIMINATION, ACCURACY AND RELIABILITY, PRIVACY AND
2 AUTONOMY, AND SAFETY AND SECURITY, AS WELL AS ACTIONS TAKEN TO ADDRESS
3 THOSE RISKS, AND SUBSEQUENT TESTING TO ASSESS THE EFFICACY OF ACTIONS
4 TAKEN TO ADDRESS RISKS; AND
5 (VI) WHETHER THE SYSTEM SHOULD BE MONITORED, AND IF SO, HOW SUCH
6 SYSTEM SHOULD BE MONITORED.
7 5. THE ATTORNEY GENERAL SHALL:
8 (A) PROMULGATE RULES FOR A PROCESS WHEREBY DEVELOPERS AND DEPLOYERS
9 MAY REQUEST REDACTION OF PORTIONS OF REPORTS REQUIRED UNDER THIS SECTION
10 TO ENSURE THAT THEY ARE NOT REQUIRED TO DISCLOSE SENSITIVE AND PROTECTED
11 INFORMATION; AND
12 (B) MAINTAIN AN ONLINE DATABASE THAT IS ACCESSIBLE TO THE GENERAL
13 PUBLIC WITH REPORTS, REDACTED IN ACCORDANCE WITH THIS SUBDIVISION, AND
14 AUDITS REQUIRED BY THIS ARTICLE WHICH SHALL BE UPDATED BIANNUALLY.
15 6. FOR HIGH-RISK AI SYSTEMS WHICH ARE ALREADY IN DEPLOYMENT AT THE
16 TIME OF THE EFFECTIVE DATE OF THIS ARTICLE, DEVELOPERS AND DEPLOYERS
17 SHALL HAVE EIGHTEEN MONTHS FROM SUCH EFFECTIVE DATE TO COMPLETE AND FILE
18 THE REPORTS AND INDEPENDENT AUDIT REQUIRED BY THIS ARTICLE.
19 § 89. RISK MANAGEMENT POLICY AND PROGRAM. 1. EACH DEVELOPER OR DEPLOY-
20 ER OF HIGH-RISK AI SYSTEMS SHALL PLAN, DOCUMENT, AND IMPLEMENT A RISK
21 MANAGEMENT POLICY AND PROGRAM TO GOVERN DEVELOPMENT OR DEPLOYMENT, AS
22 APPLICABLE, OF SUCH HIGH-RISK AI SYSTEM. THE RISK MANAGEMENT POLICY AND
23 PROGRAM SHALL SPECIFY AND INCORPORATE THE PRINCIPLES, PROCESSES, AND
24 PERSONNEL THAT THE DEPLOYER USES TO IDENTIFY, DOCUMENT, AND MITIGATE
25 KNOWN OR REASONABLY FORESEEABLE RISKS OF ALGORITHMIC DISCRIMINATION
26 COVERED UNDER SUBDIVISION ONE OF SECTION EIGHTY-SIX OF THIS ARTICLE. THE
27 RISK MANAGEMENT POLICY AND PROGRAM SHALL BE AN ITERATIVE PROCESS
28 PLANNED, IMPLEMENTED, AND REGULARLY AND SYSTEMATICALLY REVIEWED AND
29 UPDATED OVER THE LIFE CYCLE OF A HIGH-RISK AI SYSTEM, REQUIRING REGULAR,
30 SYSTEMATIC REVIEW AND UPDATES, INCLUDING UPDATES TO DOCUMENTATION. A
31 RISK MANAGEMENT POLICY AND PROGRAM IMPLEMENTED AND MAINTAINED PURSUANT
32 TO THIS SECTION SHALL BE REASONABLE CONSIDERING:
33 (A) THE GUIDANCE AND STANDARDS SET FORTH IN VERSION 1.0 OF THE "ARTI-
34 FICIAL INTELLIGENCE RISK MANAGEMENT FRAMEWORK" PUBLISHED BY THE NATIONAL
35 INSTITUTE OF STANDARDS AND TECHNOLOGY IN THE UNITED STATES DEPARTMENT OF
36 COMMERCE, OR THE LATEST VERSION OF THE "ARTIFICIAL INTELLIGENCE RISK
37 MANAGEMENT FRAMEWORK" PUBLISHED BY THE NATIONAL INSTITUTE OF STANDARDS
38 AND TECHNOLOGY IF, IN THE ATTORNEY GENERAL'S DISCRETION, THE LATEST
39 VERSION OF THE "ARTIFICIAL INTELLIGENCE RISK MANAGEMENT FRAMEWORK"
40 PUBLISHED BY THE NATIONAL INSTITUTE OF STANDARDS AND TECHNOLOGY IN THE
41 UNITED STATES DEPARTMENT OF COMMERCE IS AT LEAST AS STRINGENT AS VERSION
42 1.0;
43 (B) THE SIZE AND COMPLEXITY OF THE DEVELOPER OR DEPLOYER;
44 (C) THE NATURE, SCOPE, AND INTENDED USES OF THE HIGH-RISK AI SYSTEM
45 DEVELOPED OR DEPLOYED; AND
46 (D) THE SENSITIVITY AND VOLUME OF DATA PROCESSED IN CONNECTION WITH
47 THE HIGH-RISK AI SYSTEM.
48 2. A RISK MANAGEMENT POLICY AND PROGRAM IMPLEMENTED PURSUANT TO SUBDI-
49 VISION ONE OF THIS SECTION MAY COVER MULTIPLE HIGH-RISK AI SYSTEMS
50 DEVELOPED BY THE SAME DEVELOPER OR DEPLOYED BY THE SAME DEPLOYER IF
51 SUFFICIENT.
52 3. THE ATTORNEY GENERAL MAY REQUIRE A DEVELOPER OR A DEPLOYER TO
53 DISCLOSE THE RISK MANAGEMENT POLICY AND PROGRAM IMPLEMENTED PURSUANT TO
54 SUBDIVISION ONE OF THIS SECTION IN A FORM AND MANNER PRESCRIBED BY THE
55 ATTORNEY GENERAL. THE ATTORNEY GENERAL MAY EVALUATE THE RISK MANAGEMENT
56 POLICY AND PROGRAM TO ENSURE COMPLIANCE WITH THIS SECTION.
S. 1169 10
1 § 89-A. SOCIAL SCORING AI SYSTEMS PROHIBITED. NO PERSON, PARTNERSHIP,
2 ASSOCIATION OR CORPORATION SHALL DEVELOP, DEPLOY, USE, OR SELL AN AI
3 SYSTEM WHICH EVALUATES OR CLASSIFIES THE TRUSTWORTHINESS OF NATURAL
4 PERSONS OVER A CERTAIN PERIOD OF TIME BASED ON THEIR SOCIAL BEHAVIOR OR
5 KNOWN OR PREDICTED PERSONAL OR PERSONALITY CHARACTERISTICS, WITH THE
6 SOCIAL SCORE LEADING TO EITHER OR BOTH OF THE FOLLOWING:
7 1. DIFFERENTIAL TREATMENT OF CERTAIN NATURAL PERSONS OR WHOLE GROUPS
8 THEREOF IN SOCIAL CONTEXTS WHICH ARE UNRELATED TO THE CONTEXTS IN WHICH
9 THE DATA WAS ORIGINALLY GENERATED OR COLLECTED; OR
10 2. DIFFERENTIAL TREATMENT OF CERTAIN NATURAL PERSONS OR WHOLE GROUPS
11 THEREOF THAT IS UNJUSTIFIED OR DISPROPORTIONATE TO THEIR SOCIAL BEHAVIOR
12 OR ITS GRAVITY.
13 § 89-B. ENFORCEMENT. 1. WHENEVER THERE SHALL BE A VIOLATION OF ANY
14 PROVISION OF THIS ARTICLE, AN APPLICATION MAY BE MADE BY THE ATTORNEY
15 GENERAL IN THE NAME OF THE PEOPLE OF THE STATE OF NEW YORK, TO THE
16 SUPREME COURT HAVING JURISDICTION BY A SPECIAL PROCEEDING TO ISSUE AN
17 INJUNCTION, AND UPON NOTICE TO THE RESPONDENT OF NOT LESS THAN TEN DAYS,
18 TO ENJOIN AND RESTRAIN THE CONTINUANCE OF SUCH VIOLATION; AND IF IT
19 SHALL APPEAR TO THE SATISFACTION OF THE COURT THAT THE RESPONDENT HAS,
20 IN FACT, VIOLATED THIS ARTICLE, AN INJUNCTION MAY BE ISSUED BY THE
21 COURT, ENJOINING AND RESTRAINING ANY FURTHER VIOLATIONS, WITHOUT REQUIR-
22 ING PROOF THAT ANY PERSON HAS, IN FACT, BEEN INJURED OR DAMAGED THEREBY.
23 IN ANY SUCH PROCEEDING, THE COURT MAY MAKE ALLOWANCES TO THE ATTORNEY
24 GENERAL AS PROVIDED IN PARAGRAPH SIX OF SUBDIVISION (A) OF SECTION
25 EIGHTY-THREE HUNDRED THREE OF THE CIVIL PRACTICE LAW AND RULES, AND
26 DIRECT RESTITUTION. WHENEVER THE COURT SHALL DETERMINE THAT A VIOLATION
27 OF THIS ARTICLE HAS OCCURRED, THE COURT MAY IMPOSE A CIVIL PENALTY OF
28 NOT MORE THAN TWENTY THOUSAND DOLLARS FOR EACH VIOLATION.
29 2. THERE SHALL BE A PRIVATE RIGHT OF ACTION BY PLENARY PROCEEDING FOR
30 ANY PERSON HARMED BY ANY VIOLATION OF THIS ARTICLE BY ANY NATURAL PERSON
31 OR ENTITY. THE COURT SHALL AWARD COMPENSATORY DAMAGES AND LEGAL FEES TO
32 THE PREVAILING PARTY.
33 3. IN EVALUATING ANY MOTION TO DISMISS A PLENARY PROCEEDING COMMENCED
34 PURSUANT TO SUBDIVISION TWO OF THIS SECTION, THE COURT SHALL PRESUME THE
35 SPECIFIED AI SYSTEM WAS CREATED AND/OR OPERATED IN VIOLATION OF A SPECI-
36 FIED LAW OR LAWS AND THAT SUCH VIOLATION CAUSED THE HARM OR HARMS
37 ALLEGED.
38 (A) A DEFENDANT CAN REBUT PRESUMPTIONS MADE PURSUANT TO THIS SUBDIVI-
39 SION THROUGH CLEAR AND CONVINCING EVIDENCE THAT THE SPECIFIED AI SYSTEM
40 DID NOT CAUSE THE HARM OR HARMS ALLEGED AND/OR DID NOT VIOLATE THE
41 ALLEGED LAW OR LAWS. AN ALGORITHMIC AUDIT CAN BE CONSIDERED AS EVIDENCE
42 IN REBUTTING SUCH PRESUMPTIONS, BUT THE MERE EXISTENCE OF SUCH AN AUDIT,
43 WITHOUT ADDITIONAL EVIDENCE, SHALL NOT BE CONSIDERED CLEAR AND CONVINC-
44 ING EVIDENCE.
45 (B) WHERE SUCH PRESUMPTIONS ARE NOT REBUTTED PURSUANT TO THIS SUBDIVI-
46 SION, THE ACTION SHALL NOT BE DISMISSED.
47 (C) WHERE SUCH PRESUMPTIONS ARE REBUTTED PURSUANT TO THIS SUBDIVISION,
48 A MOTION TO DISMISS AN ACTION SHALL BE ADJUDICATED WITHOUT ANY CONSIDER-
49 ATION OF THIS SECTION.
50 4. THE SUPREME COURT IN THE STATE SHALL HAVE JURISDICTION OVER ANY
51 ACTION, CLAIM, OR LAWSUIT TO ENFORCE THE PROVISIONS OF THIS ARTICLE.
52 § 4. Section 296 of the executive law is amended by adding a new
53 subdivision 23 to read as follows:
54 23. IT SHALL BE AN UNLAWFUL DISCRIMINATORY PRACTICE UNDER THIS SECTION
55 FOR A DEPLOYER OR A DEVELOPER, AS SUCH TERMS ARE DEFINED IN SECTION
S. 1169 11
1 EIGHTY-FIVE OF THE CIVIL RIGHTS LAW, TO ENGAGE IN AN UNLAWFUL DISCRIMI-
2 NATORY PRACTICE UNDER SECTION EIGHTY-SIX OF THE CIVIL RIGHTS LAW.
3 § 5. This act shall take effect immediately.