2024 -- H 7521

========

LC004182

========

     STATE OF RHODE ISLAND

IN GENERAL ASSEMBLY

JANUARY SESSION, A.D. 2024

____________

A N   A C T

RELATING TO STATE AFFAIRS AND GOVERNMENT -- AUTOMATED DECISION

TOOLS -- ARTIFICIAL INTELLIGENCE

     Introduced By: Representatives Baginski, Carson, and Boylan

     Date Introduced: February 07, 2024

     Referred To: House Innovation, Internet, & Technology

     It is enacted by the General Assembly as follows:

     SECTION 1. Title 42 of the General Laws entitled "STATE AFFAIRS AND

GOVERNMENT" is hereby amended by adding thereto the following chapter:

CHAPTER 166

AUTOMATED DECISION TOOLS

     42-166-1. Definitions.

     As used in this chapter, the following terms shall have the following meanings:

     (1) "Algorithmic discrimination" means the condition in which an automated decision tool

contributes to unjustified differential treatment or impacts disfavoring people based on their actual

or perceived race, color, ethnicity, sex, religion, age, national origin, limited English proficiency,

disability, veteran status, genetic information, reproductive health, or any other classification

protected by state law.

      (2) "Artificial intelligence" means a machine-based system that can, for a given set of

human-defined objectives, make predictions, recommendations, or decisions influencing a real or

virtual environment.

     (3) "Automated decision tool" means a system or service that uses artificial intelligence

and has been specifically developed and marketed to, or specifically modified to, make or be a

controlling factor in making consequential decisions.

     (4) "Consequential decision" means a decision or judgment that has a legal, material, or

similarly significant effect on an individual's life relating to the impact of, access to, or the cost,

terms, or availability of, any of the following:

     (i) Employment, workers management, or self-employment including, but not limited to,

all of the following:

     (A) Pay or promotion;

     (B) Hiring or termination; or

     (C) Automated task allocation.

     (ii) Education and vocational training including, but not limited to, all of the following:

     (A) Assessment including, but not limited to, detecting student cheating or plagiarism;

     (B) Accreditation;

     (C) Certification;

     (D) Admissions; or

     (E) Financial aid or scholarships.

     (iii) Housing or lodging, including rental or short-term housing or lodging.

     (iv) Essential utilities, including electricity, heat, water, Internet or telecommunications

access, or transportation.

     (v) Family planning, including adoption services or reproductive services, as well as

assessments related to child protective services.

     (vi) Health care or health insurance, including mental health care, dental, or vision.

     (vii) Financial services, including a financial service provided by a mortgage company,

mortgage broker, or creditor.

     (viii) The criminal justice system including, but not limited to, all of the following:

     (A) Risk assessments for pretrial hearings;

     (B) Sentencing; or

     (C) Parole.

     (ix) Legal services, including private arbitration or mediation.

     (x) Voting.

     (xi) Access to benefits or services or assignment of penalties.

     (5) "Deployer" means a person, partnership, state or local government agency, or

corporation that uses an automated decision tool to make a consequential decision.

     (6) "Developer" means a person, partnership, state or local government agency, or

corporation that designs, codes, or produces an automated decision tool, or substantially modifies

an artificial intelligence system or service for the intended purpose of making, or being a controlling

factor in making, consequential decisions, whether for its own use or for use by a third party.

LC004182 - Page 2 of 9

     (7) "Impact assessment" means a documented risk-based evaluation of an automated

decision tool that meets the criteria of § 42-166-12.

     (8) "Sex" means and includes pregnancy, childbirth, and related conditions, gender

identity, intersex status, and sexual orientation.

     (9) "Significant update" means a new version, new release, or other update to an automated

decision tool that includes changes to its use case, key functionality, or expected outcomes.

     42-166-2. Assessments for automated decision tools.

     (a) On or before January 1, 2025, and annually thereafter, a deployer of an automated

decision tool shall perform an impact assessment for any automated decision tool the deployer uses

that includes all of the following:

     (1) A statement of the purpose of the automated decision tool and its intended benefits,

uses, and deployment contexts;

     (2) A description of the automated decision tool's outputs and how they are used to make,

or be a controlling factor in making, a consequential decision;

     (3) A summary of the type of data collected from natural persons and processed by the

automated decision tool when it is used to make, or be a controlling factor in making a

consequential decision;

     (4) A statement of the extent to which the deployer's use of the automated decision tool is

consistent with or varies from the statement required of the developer by § 42-166-4;

     (5) An analysis of potential adverse impacts on the basis of sex, race, color, ethnicity,

religion, age, national origin, limited English proficiency, disability, veteran status, or genetic

information from the deployer's use of the automated decision tool;

     (6) A description of the safeguards implemented, or that will be implemented, by the

deployer to address any reasonably foreseeable risks of algorithmic discrimination arising from the

use of the automated decision tool known to the deployer at the time of the impact assessment;

     (7) A description of how the automated decision tool will be used by a natural person, or

monitored when it is used, to make, or be a controlling factor in making, a consequential decision;

and.

     (8) A description of how the automated decision tool has been or will be evaluated for

validity or relevance.

     (b) On or before January 1, 2025, and annually thereafter, a developer of an automated

decision tool shall complete and document an assessment of any automated decision tool that it

designs, codes, or produces that includes all of the following:

     (1) A statement of the purpose of the automated decision tool and its intended benefits,

LC004182 - Page 3 of 9

uses, and deployment contexts;

     (2) A description of the automated decision tool's outputs and how they are used to make,

or be a controlling factor in making, a consequential decision;

     (3) A summary of the type of data collected from natural persons and processed by the

automated decision tool when it is used to make, or be a controlling factor in making, a

consequential decision;

     (4) An analysis of a potential adverse impact on the basis of sex, race, color, ethnicity,

religion, age, national origin, limited English proficiency, disability, veteran status, or genetic

information from the deployer's use of the automated decision tool;

     (5) A description of the measures taken by the developer to mitigate the risk known to the

developer of algorithmic discrimination arising from the use of the automated decision tool; and

     (6) A description of how the automated decision tool can be used by a natural person, or

monitored when it is used, to make, or be a controlling factor in making, a consequential decision.

     (c) A deployer or developer shall, in addition to the impact assessment required by

subsections (a) and (b) of this section, perform, as soon as feasible, an impact assessment with

respect to any significant update.

     (d) This section does not apply to a deployer with fewer than twenty-five (25) employees

unless, as of the end of the prior calendar year, the deployer deployed an automated decision tool

that impacted more than nine hundred ninety-nine (999) people per year.

     42-166-3. Notifications and requests not to be subject.

     (a) Notifications of consequential decisions.

     (1) A deployer shall, at or before the time an automated decision tool is used to make a

consequential decision, notify any natural person that is the subject of the consequential decision

that an automated decision tool is being used to make, or be a controlling factor in making, the

consequential decision.

     (2) A deployer shall provide to a natural person notified pursuant to this subsection all of

the following:

     (i) A statement of the purpose of the automated decision tool;

     (ii) Contact information for the deployer; and

     (iii) A plain language description of the automated decision tool that includes a description

of any human components and how any automated component is used to inform a consequential

decision.

     (b) Request to not be subject to the automated decision tool.

     (1) If a consequential decision is made solely based on the output of an automated decision

LC004182 - Page 4 of 9

tool, a deployer shall, if technically feasible, accommodate a natural person's request to not be

subject to the automated decision tool and to be subject to an alternative selection process or

accommodation.

     (2) After a request pursuant to subsection (b)(1) of this section, a deployer may reasonably

request, collect, and process information from a natural person for the purposes of identifying the

person and the associated consequential decision. If the person does not provide that information,

the deployer shall not be obligated to provide an alternative selection process or accommodation.

     42-166-4. Statement of intended uses of automated decision tools.

     (a) A developer shall provide a deployer with a statement regarding the intended uses of

the automated decision tool and documentation regarding all of the following:

     (1) The known limitations of the automated decision tool, including any reasonably

foreseeable risks of algorithmic discrimination arising from its intended use;

     (2) A description of the type of data used to program or train the automated decision tool;

and

     (3) A description of how the automated decision tool was evaluated for validity and

explainability before sale or licensing.

     (b) This section does not require the disclosure of trade secrets, as defined in chapter 41 of

title 6 ("uniform trade secrets act").

     42-166-5. Safeguards and designates.

     (a) Administrative and technical safeguards.

     (1) A deployer or developer shall establish, document, implement, and maintain a

governance program that contains reasonable administrative and technical safeguards to map,

measure, manage, and govern the reasonably foreseeable risks of algorithmic discrimination

associated with the use or intended use of an automated decision tool.

     (2) The safeguards required by this subsection shall be appropriate to all of the following:

     (i) The use or intended use of the automated decision tool;

     (ii) The deployer's or developer's role as a deployer or developer;

     (iii) The size, complexity, and resources of the deployer or developer;

     (iv) The nature, context, and scope of the activities of the deployer or developer in

connection with the automated decision tool; and

     (v) The technical feasibility and cost of available tools, assessments, and other means used

by a deployer or developer to map, measure, manage, and govern the risks associated with an

automated decision tool.

     (b) The governance program required by this section shall be designed to do all of the

LC004182 - Page 5 of 9

following:

     (1) Employee designates:

     (i) Designation of at least one employee to be responsible for overseeing and maintaining

the governance program and compliance with this chapter.

     (ii) An employee designated pursuant to this section shall have the authority to assert to

the employee's employer a good faith belief that the design, production, or use of an automated

decision tool fails to comply with the requirements of this chapter.

     (iii) An employer of an employee designated pursuant to this section shall conduct a prompt

and complete assessment of any compliance issue raised by that employee.

     (2) Identify and implement safeguards to address reasonably foreseeable risks of

algorithmic discrimination resulting from the use or intended use of an automated decision tool.

     (3) If established by a deployer, provide for the performance of impact assessments as

required by § 42-166-2.

     (4) If established by a developer, provide for compliance with §§ 42-166-3 and 42-166-4.

     (5) Conduct an annual and comprehensive review of policies, practices, and procedures to

ensure compliance with this chapter.

     (6) Maintain for two (2) years after completion the results of an impact assessment.

     (7) Evaluate and make reasonable adjustments to administrative and technical safeguards

in light of material changes in technology, the risks associated with the automated decision tool,

the state of technical standards, and changes in business arrangements or operations of the deployer

or developer.

     (c) This section does not apply to a deployer with fewer than twenty-five (25) employees

unless, as of the end of the prior calendar year, the deployer deployed an automated decision tool

that impacted more than nine hundred ninety-nine (999) people per year.

     42-166-6. Required publicly available information.

     A deployer or developer shall make publicly available, in a readily accessible manner, a

clear policy that provides a summary of both of the following:

     (1) The types of automated decision tools currently in use or made available to others by

the deployer or developer; and

     (2) How the deployer or developer manages the reasonably foreseeable risks of algorithmic

discrimination that may arise from the use of the automated decision tools it currently uses or makes

available to others.

     42-166-7. Algorithmic discrimination.

     (a) A deployer shall not use an automated decision tool that results in algorithmic

LC004182 - Page 6 of 9

discrimination.

     (b) Civil actions for algorithmic discrimination.

     (1) On and after January 1, 2026, a person may bring a civil action against a deployer for

violation of this section.

     (2) In an action brought pursuant to this section and § 42-166-8, the plaintiff shall have the

burden of proof to demonstrate that the deployer's use of the automated decision tool resulted in

algorithmic discrimination that caused actual harm to the person bringing the civil action.

     (c) In addition to any other remedy at law, a deployer that violates this section shall be

liable to a prevailing plaintiff for any of the following:

     (1) Compensatory damages;

     (2) Declaratory relief; and

     (3) Reasonable attorneys' fees and costs.

     42-166-8. Civil actions for algorithmic discrimination.

     (a) Parties authorized to bring civil actions.

     (1) Any of the following public entities may bring a civil action against a deployer or

developer for a violation of this chapter:

     (i) The attorney general; or

     (ii) A city or town solicitor with the consent of the attorney general.

     (2) A court may award in an action brought pursuant to this subsection all of the following:

     (i) Injunctive relief;

     (ii) Declaratory relief; and

     (iii) Reasonable attorneys' fees and litigation costs.

     (b) Written notice. An authorized party, before commencing an action pursuant to this

section for injunctive relief, shall provide forty-five (45) days written notice to a deployer or

developer of the alleged violations of this chapter.

     (c) Ability to cure.

     (1) The developer or deployer may cure, within forty-five (45) days of receiving the written

notice described in this section, the noticed violation and provide the person who gave the notice

an express written statement, made under penalty of perjury, that the violation has been cured and

that no further violations shall occur.

     (2) If the developer or deployer cures the noticed violation and provides the express written

statement pursuant to this section, a claim for injunctive relief shall not be maintained for the

noticed violation.

LC004182 - Page 7 of 9

     SECTION 2. This act shall take effect upon passage.

========

LC004182

========

LC004182 - Page 8 of 9

EXPLANATION

BY THE LEGISLATIVE COUNCIL

OF

A N   A C T

RELATING TO STATE AFFAIRS AND GOVERNMENT -- AUTOMATED DECISION

TOOLS -- ARTIFICIAL INTELLIGENCE

***

     This act would require a deployer and a developer of an automated decision tool to perform

an impact assessment that includes a statement of the purpose of the automated decision tool and

its intended benefits, uses, and deployment contexts.

     This act would also require a deployer to notify any natural person who is the subject of a

consequential decision when an automated decision tool is being used to make, or be a controlling

factor in making, a consequential decision and to provide that person with a statement of the

purpose of the automated decision tool.

     The act would, if a consequential decision is made solely based on the output of an

automated decision tool, further require a deployer to, if technically feasible, accommodate a

natural person’s request to not be subject to the automated decision tool and to be subject to an

alternative selection process or accommodation, as prescribed.

     Additionally, this act would prohibit a deployer from using an automated decision tool that

results in algorithmic discrimination and allow the attorney general and local solicitor to bring civil

actions against developers and deployers for algorithmic discrimination.

     This act would take effect upon passage.

========

LC004182

========

LC004182 - Page 9 of 9