2025 -- S 0627

========

LC001407

========

     STATE OF RHODE ISLAND

IN GENERAL ASSEMBLY

JANUARY SESSION, A.D. 2025

____________

A N   A C T

RELATING TO COMMERCIAL LAW -- GENERAL REGULATORY PROVISIONS --

ARTIFICIAL INTELLIGENCE ACT

     Introduced By: Senators DiPalma, Gu, Burke, Paolino, Urso, Zurier, and Pearson

     Date Introduced: March 07, 2025

     Referred To: Senate Artificial Intelligence & Emerging Tech

     It is enacted by the General Assembly as follows:

     SECTION 1. Title 6 of the General Laws entitled "COMMERCIAL LAW — GENERAL

REGULATORY PROVISIONS" is hereby amended by adding thereto the following chapter:

CHAPTER 61

ARTIFICIAL INTELLIGENCE ACT

     6-61-1. Short title.

     This act shall be known and may be cited as the "Artificial Intelligence Act"

     6-61-2. Definitions.

     As used in this chapter:

     (1) "Algorithmic discrimination" means:

     (i) Any use of an artificial intelligence system that results in any unlawful differential

treatment or impact that disfavors any individual or group of individuals on the basis of one or

more classifications protected under the laws of this state or federal law; and

     (ii) Does not include:

     (A) The offer, license or use of a high-risk artificial intelligence system by a developer,

integrator or deployer for the sole purpose of:

     (I) The developer's, integrator's or deployer's self-testing to identify, mitigate or prevent

discrimination or otherwise ensure compliance with state and federal law;

     (II) Expanding an applicant, customer or participant pool to increase diversity or redress

historic discrimination; or

     (B) An act or omission by or on behalf of a private club or other establishment not in fact

open to the public, as set forth in Title II of the Civil Rights Act of 1964, 42 USC § 2000a(e), as

amended from time to time.

     (2) "Artificial intelligence system" means any machine-based system that, for any explicit

or implicit objective, infers from the inputs such system receives how to generate outputs including,

but not limited to, content, decisions, predictions or recommendations, that can influence physical

or virtual environments.

     (3) "Consequential decision" means any decision or judgment that has a legal, material or

similarly significant effect on a consumer with respect to:

     (i) Employment, including any such decision or judgment made:

     (A) Concerning hiring, termination, compensation or promotion; or

     (B) By way of any automated task allocation that limits, segregates or classifies employees

for the purpose of assigning or determining material terms or conditions of employment;

     (ii) Education or vocational training, including any such decision or judgment made

concerning:

     (A) Assessments;

     (B) Student cheating or plagiarism detection;

     (C) Accreditation;

     (D) Certification;

     (E) Admissions; or

     (F) Financial aid or scholarships;

     (iii) The provision or denial, or terms and conditions, of:

     (A) Financial lending or credit services;

     (B) Housing or lodging including, but not limited to, rentals or short-term housing or

lodging;

     (C) Insurance; or

     (D) Legal services; or

     (iv) The provision or denial of:

     (A) Essential government services; or

     (B) Healthcare services.

     (4) "Consumer" means any individual who is a resident of this state.

     (5) "Deploy" means to use a high-risk artificial intelligence system to make, or as a

substantial factor in making, a consequential decision.

LC001407 - Page 2 of 25

     (6) "Deployer" means any person doing business in this state that deploys a high-risk

artificial intelligence system in this state.

     (7) "Developer" means any person doing business in this state that develops, or

intentionally and substantially modifies, an artificial intelligence system.

     (8) "General-purpose artificial intelligence model" means:

     (i) Any form of artificial intelligence system that:

     (A) Displays significant generality;

     (B) Is capable of competently performing a wide range of distinct tasks;

     (C) Can be integrated into a variety of downstream applications or systems; and

     (ii) Does not include any artificial intelligence model that is used for development,

prototyping and research activities before such artificial intelligence model is released on the

market.

     (9) "High-risk artificial intelligence system" means:

     (i) Any artificial intelligence system that, when deployed, makes, or is a substantial factor

in making, a consequential decision; and

     (ii) Does not include:

     (A) Any artificial intelligence system that is intended to:

     (I) Perform any narrow procedural task; or

     (II) Detect decision-making patterns, or deviations from decision-making patterns, unless

such artificial intelligence system is intended to replace or influence any assessment previously

completed by an individual without sufficient human review; or

     (B) Unless the technology, when deployed, makes, or is a substantial factor in making, a

consequential decision:

     (I) Any anti-fraud technology that does not make use of facial recognition technology;

     (II) Any artificial intelligence-enabled video game technology;

     (III) Any anti-malware, anti-virus, calculator, cybersecurity, database, data storage,

firewall, Internet domain registration, Internet-website loading, networking, robocall-filtering,

spam-filtering, spellchecking, spreadsheet, web-caching, web-hosting or similar technology;

     (IV) Any technology that performs tasks exclusively related to an entity's internal

management affairs including, but not limited to, ordering office supplies or processing payments;

or

     (V) Any technology that communicates with consumers in natural language for the purpose

of providing users with information, making referrals or recommendations and answering

questions, and is subject to an accepted use policy that prohibits generating content that is

LC001407 - Page 3 of 25

discriminatory or harmful;

     (10) "Integrator" means any person doing business in this state that, with respect to a given

high-risk artificial intelligence system:

     (i) Neither develops nor intentionally and substantially modifies the high-risk artificial

intelligence system; and

     (ii) Integrates the high-risk artificial intelligence system into a product or service such

person offers to any other person.

     (11) "Intentional and substantial modification" means:

     (i) Any deliberate change made to:

     (A) An artificial intelligence system that materially increases the risk of algorithmic

discrimination; or

     (B) A general-purpose artificial intelligence model that:

     (I) Affects compliance of the general-purpose artificial intelligence model;

     (II) Materially changes the purpose of the general-purpose artificial intelligence model; or

     (III) Materially increases the risk of algorithmic discrimination; and

     (ii) Does not include any change made to a high-risk artificial intelligence system, or the

performance of a high-risk artificial intelligence system, if:

     (A) The high-risk artificial intelligence system continues to learn after such high-risk

artificial intelligence system is:

     (I) Offered, sold, leased, licensed, given or otherwise made available to a deployer; or

     (II) Is deployed; and

     (B) Such change:

     (I) Is made to such high-risk artificial intelligence system as a result of any learning

described in subsection (11)(ii)(A) of this section;

     (II) Was predetermined by the deployer, or the third party contracted by the deployer, when

such deployer or third party completed the initial impact assessment of such high-risk artificial

intelligence system pursuant to § 6-61-4(c); and

     (III) Is included in the technical documentation for such high-risk artificial intelligence

system.

     (12) "Person" means any individual, association, corporation, limited liability company,

partnership, trust or other legal entity.

     (13) "Red-teaming" means an exercise that is conducted to identify the potential adverse

behaviors or outcomes of an artificial intelligence system, how such behaviors or outcomes occur

and stress test the safeguards against such behaviors or outcomes.

LC001407 - Page 4 of 25

     (14) "Substantial factor" means:

     (i) A factor that alters the outcome of a consequential decision and is generated by an

artificial intelligence system; and

     (ii) Includes, but is not limited to, any use of an artificial intelligence system to generate

any content, decision, prediction or recommendation concerning a consumer that is used as a basis

to make a consequential decision concerning the consumer. Substantial factor does not include any

output produced by an artificial intelligence system where an individual was involved in the data

processing that produced such output and such individual meaningfully considered such data as

part of such data processing and had the authority to change or influence the output produced by

such data processing.

     (15) "Synthetic digital content" means any digital content including, but not limited to, any

audio, image, text or video, that is produced or manipulated by an artificial intelligence system

including, but not limited to, a general-purpose artificial intelligence model.

     (16) "Trade secret" means information, including a formula, pattern, compilation, program,

device, method, technique, or process, that:

     (i) Derives independent economic value, actual or potential, from not being generally

known to, and not being readily ascertainable by proper means by, other persons who can obtain

economic value from its disclosure or use; and

     (ii) Is the subject of efforts that are reasonable under the circumstances to maintain its

secrecy.

     6-61-3. Artificial intelligence developers.

     (a) Beginning on October 1, 2026, a developer of a high-risk artificial intelligence system

shall use reasonable care to protect consumers from any known or reasonably foreseeable risks of

algorithmic discrimination arising from the intended and contracted uses of the high-risk artificial

intelligence system. In any enforcement action brought on or after said date by the attorney general

pursuant to the provisions of this chapter, there shall be a rebuttable presumption that a developer

used reasonable care as required under this section if the developer complied with the provisions

of this section or, if the developer enters into a contract with an integrator as set forth in § 6-61-

4(b), the developer and integrator complied with the provisions of this section and § 6-61-4.

     (b) Except as provided in § 6-61-4(c), a developer of a high-risk artificial intelligence

system shall, beginning on October 1, 2026, make available to each deployer, or other developer,

of the high-risk artificial intelligence system:

     (1) A general statement describing the reasonably foreseeable uses, and the known harmful

or inappropriate uses, of such high-risk artificial intelligence system;

LC001407 - Page 5 of 25

     (2) Documentation disclosing:

     (i) High-level summaries of the type of data used to train such high-risk artificial

intelligence system;

     (ii) The known or reasonably foreseeable limitations of such high-risk artificial intelligence

system including, but not limited to, the known or reasonably foreseeable risks of algorithmic

discrimination arising from the intended uses of such high-risk artificial intelligence system;

     (iii) The purpose of such high-risk artificial intelligence system;

     (iv) The intended benefits and uses of such high-risk artificial intelligence system; and

     (v) All other information necessary to enable such deployer to comply with the provisions

of this chapter;

     (3) Documentation describing:

     (i) How such high-risk artificial intelligence system was evaluated for performance, and

mitigation of algorithmic discrimination, before such high-risk artificial intelligence system was

offered, sold, leased, licensed, given or otherwise made available to such deployer;

     (ii) The data governance measures used to cover the training datasets and the measures

used to examine the suitability of data sources, possible biases and appropriate mitigation;

     (iii) The intended outputs of such high-risk artificial intelligence system;

     (iv) The measures the developer has taken to mitigate any known or reasonably foreseeable

risks of algorithmic discrimination that may arise from deployment of such high-risk artificial

intelligence system; and

     (v) How such high-risk artificial intelligence system should be used, not be used and be

monitored by an individual when such high-risk artificial intelligence system is used to make, or

as a substantial factor in making, a consequential decision.

     (4) Any additional documentation that is reasonably necessary to assist a deployer to:

     (i) Understand the outputs of such high-risk artificial intelligence system; and

     (ii) Monitor the performance of such high-risk artificial intelligence system for risks of

algorithmic discrimination.

     (c)(1) Except as provided in § 6-61-4(c), any developer that, on or after October 1, 2026,

offers, sells, leases, licenses, gives or otherwise makes available to a deployer or another developer

a high-risk artificial intelligence system shall, to the extent feasible, make available to the deployers

and other developers of such high-risk artificial intelligence system the documentation and

information necessary for a deployer, or the third party contracted by a deployer, to complete an

impact assessment pursuant to § 6-61-5(c). The developer shall make such documentation and

information available through artifacts such as model cards, dataset cards or other impact

LC001407 - Page 6 of 25

assessments.

     (2) A developer that also serves as a deployer for any high-risk artificial intelligence system

shall not be required to generate the documentation required by this section unless such high-risk

artificial intelligence system is provided to an unaffiliated entity acting as a deployer.

     (d)(1) Beginning on October 1, 2026, each developer shall make available, in a manner

that is clear and readily available on such developer's Internet website or in a public use case

inventory, a statement summarizing:

     (i) The types of high-risk artificial intelligence systems that such developer:

     (A) Has developed or intentionally and substantially modified; and

     (B) Currently makes available to a deployer or another developer; and

     (ii) How such developer manages any known or reasonably foreseeable risks of algorithmic

discrimination that may arise from development or intentional and substantial modification of the

types of high-risk artificial intelligence systems described in subsection (d)(1)(i)(A) of this section.

     (2) Each developer shall update the statement described in subsection (b)(1) of this section

as necessary to ensure that such statement remains accurate, and not later than ninety (90) days

after the developer intentionally and substantially modifies any high-risk artificial intelligence

system described in subsection (d)(1)(i) of this section.

     (e) Beginning on October 1, 2026, a developer of a high-risk artificial intelligence system

shall disclose to the attorney general, in a form and manner prescribed by the attorney general, and

to all known deployers or other developers of the high-risk artificial intelligence system, any known

or reasonably foreseeable risks of algorithmic discrimination arising from the intended uses of such

high-risk artificial intelligence system. The developer shall make such disclosures without

unreasonable delay but in no event later than ninety (90) days after the date on which:

     (1) The developer discovers, through the developer's ongoing testing and analysis, that the

high-risk artificial intelligence system has:

     (i) Been deployed; and

     (ii) Caused, or is reasonably likely to have caused, algorithmic discrimination to at least

one thousand (1,000) consumers; or

     (2) The developer receives, from a deployer of the high-risk artificial intelligence system,

a credible report disclosing that such high-risk artificial intelligence system has:

     (i) Been deployed; and

     (ii) Caused algorithmic discrimination to at least one thousand (1,000) consumers.

     (f) The provisions of subsections (b) through (e), inclusive, of this section shall not be

construed to require a developer to disclose any information:

LC001407 - Page 7 of 25

     (1) That is a trade secret or otherwise protected from disclosure under state or federal law;

or

     (2) The disclosure of which would present a security risk to the developer.

     (g) Beginning on October 1, 2026, the attorney general may require that a developer

disclose to the attorney general, as part of an investigation conducted by the attorney general and

in a form and manner prescribed by the attorney general, the general statement or documentation

described in subsection (b) of this section. The attorney general may evaluate such general

statement or documentation to ensure compliance with the provisions of this section. In disclosing

such general statement or documentation to the attorney general pursuant to this subsection, the

developer may designate such general statement or documentation as including any information

that is exempt from disclosure under subsection (f) of this section or the provisions of title 38

("access to public records"). To the extent such general statement or documentation includes such

information, such general statement or documentation shall be exempt from disclosure pursuant to

the provisions of this chapter or title 38. To the extent any information contained in such general

statement or documentation is subject to the attorney-client privilege or work product protection,

such disclosure shall not constitute a waiver of such privilege or protection.

     6-61-4. High-risk artificial intelligence system.

     (a) Beginning on October 1, 2026, if an integrator integrates a high-risk artificial

intelligence system into a product or service the integrator offers to any other person, such

integrator shall use reasonable care to protect consumers from any known or reasonably foreseeable

risks of algorithmic discrimination arising from the intended and contracted uses of such integrated

high-risk artificial intelligence system. In any enforcement action brought on or after said date by

the attorney general pursuant to the provisions of this chapter, there shall be a rebuttable

presumption that the integrator used reasonable care as required under this section if the integrator

complied with the provisions of this chapter.

     (b) Beginning on October 1, 2026, no integrator shall integrate a high-risk artificial

intelligence system into a product or service the integrator offers to any other person unless the

integrator has entered into a contract with the developer of the high-risk artificial intelligence

system. The contract shall be binding and clearly set forth the duties of the developer and integrator

with respect to the integrated high-risk artificial intelligence system including, but not limited to,

whether the developer or integrator shall be responsible for performing the developer's duties of §

6-61-3(b) and (c).

     (c) The provisions of § 6-61-3(b) and (c) shall not apply to a developer of an integrated

high-risk artificial intelligence system if, at all times while the integrated high-risk artificial

LC001407 - Page 8 of 25

intelligence system is integrated into a product or service an integrator offers to any other person,

the developer has entered into a contract with the integrator in which such integrator has agreed to

assume the developer's duties under § 6-61-3(b) and (c).

     (d)(1) Beginning on October 1, 2026, each integrator shall make available, in a manner that

is clear and readily available on such integrator's Internet website or in a public use case inventory,

a statement summarizing:

     (i) The types of high-risk artificial intelligence systems that such integrator has integrated

into products or services such integrator currently offers to any other person; and

     (ii) How such integrator manages any known or reasonably foreseeable risks of algorithmic

discrimination that may arise from the types of high-risk artificial intelligence systems described

in this chapter.

     (2) Each integrator shall update the statement described in subsection (d)(1) of this section:

     (i) As necessary to ensure that such statement remains accurate; and

     (ii) Not later than ninety (90) days after any intentional and substantial modification is

made to any high-risk artificial intelligence system described in subsection (d)(1) of this section.

     (e) The provisions of subsections (b) through (d), inclusive, of this section shall not be

construed to require a developer or integrator to disclose any information:

     (1) That is a trade secret or otherwise protected from disclosure under state or federal law;

or

     (2) The disclosure of which would present a security risk to the developer or integrator.

     (f) Beginning on October 1, 2026, the attorney general may require that a developer

disclose to the attorney general, as part of an investigation conducted by the attorney general and

in a form and manner prescribed by the attorney general, the general statement or documentation

described in subsection (b) of this section. The attorney general may evaluate such general

statement or documentation to ensure compliance with the provisions of this section. In disclosing

such general statement or documentation to the attorney general pursuant to this subsection, the

developer may designate such general statement or documentation as including any information

that is exempt from disclosure under subsection (e) of this section or the provisions of title 38

("access to public records"). To the extent such general statement or documentation includes such

information, such general statement or documentation shall be exempt from disclosure pursuant to

the provisions of this chapter or title 38. To the extent any information contained in such general

statement or documentation is subject to the attorney-client privilege or work product protection,

such disclosure shall not constitute a waiver of such privilege or protection.

     6-61-5. Reasonable care to protect from foreseeable risks.

LC001407 - Page 9 of 25

     (a) Beginning on October 1, 2026, each deployer of a high-risk artificial intelligence system

shall use reasonable care to protect consumers from any known or reasonably foreseeable risks of

algorithmic discrimination. In any enforcement action brought on or after said date by the attorney

general pursuant to the provisions of this chapter, there shall be a rebuttable presumption that a

section of a high-risk artificial intelligence system used reasonable care as required under this

subsection if the deployer complied with the provisions of this chapter.

     (b)(1) Beginning on October 1, 2026, and except as provided in subsection (g) of this

section, each deployer of a high-risk artificial intelligence system shall implement and maintain a

risk management policy and program to govern such deployer's deployment of the high-risk

artificial intelligence system. The risk management policy and program shall specify and

incorporate the principles, processes and personnel that the deployer shall use to identify, document

and mitigate any known or reasonably foreseeable risks of algorithmic discrimination. The risk

management policy shall be the product of an iterative process, the risk management program shall

be an iterative process and both the risk management policy and program shall be planned,

implemented and regularly and systematically reviewed and updated over the lifecycle of the high-

risk artificial intelligence system. Each risk management policy and program implemented and

maintained pursuant to this subsection shall be reasonable, considering:

     (i) The guidance and standards set forth in the latest version of:

     (A) The "Artificial Intelligence Risk Management Framework" published by the National

Institute of Standards and Technology;

     (B) ISO or IEC 42001 of the International Organization for Standardization; or

     (C) A nationally or internationally recognized risk management framework for artificial

intelligence systems, other than the guidance and standards specified in this subsection, that

imposes requirements that are substantially equivalent to, and at least as stringent as, the

requirements set forth in this section for risk management policies and programs;

     (ii) The size and complexity of the deployer;

     (iii) The nature and scope of the high-risk artificial intelligence systems deployed by the

deployer including, but not limited to, the intended uses of such high-risk artificial intelligence

systems; and

     (iv) The sensitivity and volume of data processed in connection with the high-risk artificial

intelligence systems deployed by the deployer.

     (2) A risk management policy and program implemented and maintained pursuant to

subsection (b)(1) of this section may cover multiple high-risk artificial intelligence systems

deployed by the deployer.

LC001407 - Page 10 of 25

     (c)(1) Except as provided in subsections (c)(3), (c)(4) and (g) of this section:

     (i) A deployer that deploys a high-risk artificial intelligence system on or after October 1,

2026, or a third party contracted by the deployer, shall complete an impact assessment of the high-

risk artificial intelligence system; and

     (ii) Beginning on October 1, 2026, a deployer, or a third party contracted by the deployer,

shall complete an impact assessment of a deployed high-risk artificial intelligence system:

     (A) At least annually; and

     (B) Not later than ninety (90) days after an intentional and substantial modification to such

high-risk artificial intelligence system is made available.

     (2)(i) Each impact assessment completed pursuant to this subsection shall include, at a

minimum and to the extent reasonably known by, or available to, the deployer:

     (A) A statement by the deployer disclosing the purpose, intended use cases and deployment

context of, and benefits afforded by, the high-risk artificial intelligence system;

     (B) An analysis of whether the deployment of the high-risk artificial intelligence system

poses any known or reasonably foreseeable risks of algorithmic discrimination and, if so, the nature

of such algorithmic discrimination and the steps that have been taken to mitigate such risks;

     (C) A description of:

     (I) The categories of data the high-risk artificial intelligence system processes as inputs;

and

     (II) The outputs such high-risk artificial intelligence system produces;

     (D) If the deployer used data to customize the high-risk artificial intelligence system, an

overview of the categories of data the deployer used to customize such high-risk artificial

intelligence system;

     (E) Any metrics used to evaluate the performance and known limitations of the high-risk

artificial intelligence system;

     (F) A description of any transparency measures taken concerning the high-risk artificial

intelligence system including, but not limited to, any measures taken to disclose to a consumer that

such high-risk artificial intelligence system is in use when such high-risk artificial intelligence

system is in use; and

     (G) A description of the post-deployment monitoring and user safeguards provided

concerning such high-risk artificial intelligence system including, but not limited to, the oversight,

use and learning process established by the deployer to address issues arising from deployment of

such high-risk artificial intelligence system.

     (ii) In addition to the statement, analysis, descriptions, overview and metrics required under

LC001407 - Page 11 of 25

subsection (c)(2) of this section, an impact assessment completed pursuant to this subsection

following an intentional and substantial modification made to a high-risk artificial intelligence

system on or after October 1, 2026, shall include a statement disclosing the extent to which the

high-risk artificial intelligence system was used in a manner that was consistent with, or varied

from, the developer's intended uses of such high-risk artificial intelligence system.

     (iii) A single impact assessment may address a comparable set of high-risk artificial

intelligence systems deployed by a deployer.

     (iv) If a deployer, or a third party contracted by the deployer, completes an impact

assessment for the purpose of complying with another applicable law or regulation, such impact

assessment shall be deemed to satisfy the requirements established in this subsection if such impact

assessment is reasonably similar in scope and effect to the impact assessment that would otherwise

be completed pursuant to this subsection.

     (v) A deployer shall maintain the most recently completed impact assessment of a high-

risk artificial intelligence system as required under this subsection, all records concerning each such

impact assessment and all prior impact assessments, if any, for a period of at least three (3) years

following the final deployment of the high-risk artificial intelligence system.

     (d) Except as provided in subsection (g) of this section, a deployer, or a third party

contracted by the deployer, shall review, not later than October 1, 2026, and at least annually

thereafter, the deployment of each high-risk artificial intelligence system deployed by the deployer

to ensure that such high-risk artificial intelligence system is not causing algorithmic discrimination.

     (e)(1) Beginning on October 1, 2026, and before a deployer deploys a high-risk artificial

intelligence system to make, or be a substantial factor in making, a consequential decision

concerning a consumer, the deployer shall:

     (i) Notify the consumer that the deployer has deployed a high-risk artificial intelligence

system to make, or be a substantial factor in making, such consequential decision; and

     (ii) Provide to the consumer:

     (A) A statement disclosing:

     (I) The purpose of such high-risk artificial intelligence system; and

     (II) The nature of such consequential decision;

     (B) The right to opt-out of any automated decision-making based on the consumer's

personal data;

     (C) Contact information for such deployer;

     (D) A description, in plain language, of such high-risk artificial intelligence system; and

     (E) Instructions on how to access the statement made available pursuant to subsection (f)

LC001407 - Page 12 of 25

of this section.

     (2) Beginning on October 1, 2026, a deployer that has deployed a high-risk artificial

intelligence system to make, or as a substantial factor in making, a consequential decision

concerning a consumer shall, if such consequential decision is adverse to the consumer, provide to

such consumer:

     (i) A statement disclosing the principal reason or reasons for such adverse consequential

decision including, but not limited to:

     (A) The degree to which, and manner in which, the high-risk artificial intelligence system

contributed to such adverse consequential decision;

     (B) The type of data that were processed by such high-risk artificial intelligence system in

making such adverse consequential decision; and

     (C) The source of the data described in this subsection;

     (ii) An opportunity to:

     (A) Examine the personal data that the high-risk artificial intelligence system processed in

making, or as a substantial factor in making, such adverse consequential decision; and

     (B) Correct any incorrect personal data described in this subsection; and

     (3)(i) Except as provided in this subsection, an opportunity to appeal such adverse

consequential decision if such adverse consequential decision is based upon inaccurate personal

data, taking into account both the nature of such personal data and the purpose for which such

personal data was processed. Such appeal shall, if technically feasible, allow for human review.

     (ii) No deployer shall be required to provide an opportunity to appeal pursuant to

subsection (e)(3)(i) of this section in any instance in which providing such opportunity to appeal is

not in the best interest of the consumer including, but not limited to, in any instance in which any

delay might pose a risk to the life or safety of the consumer.

     (iii) The deployer shall provide the notice, statements, information, description and

instructions required under the provisions of this subsection:

     (A) Directly to the consumer;

     (B) In plain language;

     (C) In all languages in which such deployer, in the ordinary course of such deployer's

business, provides contracts, disclaimers, sale announcements and other information to consumers;

and

     (D) In a format that is accessible to consumers with disabilities.

     (f)(1) Beginning on October 1, 2026, and except as provided in subsection (g) of this

section, each deployer shall make available, in a manner that is clear and readily available on such

LC001407 - Page 13 of 25

deployer's Internet website, a statement summarizing:

     (i) The types of high-risk artificial intelligence systems that are currently deployed by such

deployer;

     (ii) How such deployer manages any known or reasonably foreseeable risks of algorithmic

discrimination that may arise from deployment of each high-risk artificial intelligence system

described in this subsection; and

     (iii) In detail, the nature, source and extent of the information collected and used by such

deployer.

     (2) Each deployer shall periodically update the statement described in subsection(f)(1) of

this section.

     (g) The provisions of subsections (b) through (d), inclusive, of this section and subsection

(f) of this section shall not apply to a deployer if, at the time the deployer deploys a high-risk

artificial intelligence system and at all times while the high-risk artificial intelligence system is

deployed:

     (1) The deployer:

     (i) Has entered into a contract with the developer in which the developer has agreed to

assume the deployer's duties under subsections (b) through (d), inclusive, of this section and

subsection (f) of this section and

     (ii) Does not exclusively use such deployer's own data to train such high-risk artificial

intelligence system;

     (2) Such high-risk artificial intelligence system:

     (i) Is used for the intended uses that are disclosed to such deployer; and

     (ii) Continues learning based on a broad range of data sources and not solely based on the

deployer's own data; and

     (3) Such deployer makes available to consumers any impact assessment that:

     (i) The developer of such high-risk artificial intelligence system has completed and

provided to such deployer; and

     (ii) Includes information that is substantially similar to the information included in the

statement, analysis, descriptions, overview and metrics required pursuant to the provisions of this

section.

     (h) If a deployer deploys a high-risk artificial intelligence system on or after October 1,

2026, and subsequently discovers that the high-risk artificial intelligence system has caused

algorithmic discrimination to at least one thousand (1,000) consumers, the deployer shall send to

the attorney general, in a form and manner prescribed by the attorney general, a notice disclosing

LC001407 - Page 14 of 25

such discovery. The deployer shall send such notice to the attorney general without unreasonable

delay but in no event later than ninety (90) days after the date on which the deployer discovered

such algorithmic discrimination.

     (i) Nothing in subsections (b) through (h), inclusive, of this section shall be construed to

require a deployer to disclose any information that is a trade secret or otherwise protected from

disclosure under state or federal law. If a deployer withholds any information from a consumer

under this subsection, the deployer shall send notice to the consumer disclosing:

     (A) That the deployer is withholding such information from such consumer; and

     (B) The basis for the deployer's decision to withhold such information from such consumer.

     (j) Beginning on October 1, 2026, the attorney general may require that a deployer, or a

third party contracted by the deployer as set forth in subsection (c) of this section, as applicable,

disclose to the attorney general, as part of an investigation conducted by the attorney general, not

later than ninety (90) days after a request by the attorney general and in a form and manner

prescribed by the attorney general, the risk management policy implemented pursuant to subsection

(b) of this section, impact assessment completed pursuant to subsection (c) of this section or records

maintained pursuant to the provisions of subsection (c) of this section. The attorney general may

evaluate such risk management policy, impact assessment or records to ensure compliance with the

provisions of this section. In disclosing such risk management policy, impact assessment or records

to the attorney general pursuant to this subsection, the deployer or third-party contractor, as

applicable, may designate such risk management policy, impact assessment or records as including

any information that is exempt from disclosure under subsection (i) of this section or chapter 2 of

title 38 ("access to public records"). To the extent such risk management policy, impact assessment

or records include such information, such risk management policy, impact assessment or records

shall be exempt from disclosure pursuant to the provisions of this chapter or title 38. To the extent

any information contained in such risk management policy, impact assessment or record is subject

to the attorney-client privilege or work product protection, such disclosure shall not constitute a

waiver of such privilege or protection.

     6-61-6. Technical documentation.

     (a) Beginning on October 1, 2026, each developer of a general-purpose artificial

intelligence model shall, except as provided in subsection (b) of this section:

     (1)(i) Create and maintain technical documentation for the general-purpose artificial

intelligence model, which technical documentation shall:

     (A) Include the training and testing processes for such general-purpose artificial

intelligence model;

LC001407 - Page 15 of 25

     (B) Include at least the following information, as appropriate, considering the size and risk

profile of such general-purpose artificial intelligence model:

     (I) The tasks such general-purpose artificial intelligence model is intended to perform;

     (II) The type and nature of artificial intelligence systems in which such general-purpose

artificial intelligence model is intended to be integrated;

     (III) Acceptable use policies for such general-purpose artificial intelligence model;

     (IV) The date such general-purpose artificial intelligence model is released;

     (V) The methods by which such general-purpose artificial intelligence model is distributed;

and

     (VI) The modality and format of inputs and outputs for such general-purpose artificial

intelligence model.

     (C) Include a description of the data that were used for purposes of training, testing and

validation of such general-purpose artificial intelligence model, which description shall be

appropriate considering the size and risk profile of such general-purpose artificial intelligence

model and include, at a minimum, a description of the following:

     (I) The type and provenance of such data;

     (II) Curation methodologies used for such data;

     (III) How such data were obtained and selected;

     (IV) All measures used to identify unsuitable data sources; and

     (V) Where applicable, methods used to detect identifiable biases;

     (D) Be reviewed and revised at least annually or more frequently as necessary to maintain

the accuracy of such technical documentation;

     (E) Establish, implement and maintain a policy to comply with federal and state copyright

laws;

     (F) Create, implement, maintain and make available to persons that intend to integrate such

general-purpose artificial intelligence model into such persons' artificial intelligence systems

documentation and information that:

     (2) Enables such persons to:

     (i) Understand the capabilities and limitations of such general-purpose artificial

intelligence model; and

     (ii) Comply with such persons' obligations under this chapter;

     (3) Discloses, at a minimum:

     (i) The technical means required for such general-purpose artificial intelligence model to

be integrated into such persons' artificial intelligence systems;

LC001407 - Page 16 of 25

     (ii) The information listed in subsection (a)(1) of this section; and

     (iii) The description required under subsection (a)(1)(i)(C) of this section; and

     (4) Except as provided in subsection (b) of this section, is reviewed and revised at least

annually or more frequently as necessary to maintain the accuracy of such documentation and

information.

     (b)(1) The provisions of subsection (a)(1) and (a)(2)(c) of this section shall not apply to a

developer that develops, or intentionally and substantially modifies, a general-purpose artificial

intelligence model on or after October 1, 2026, if:

     (i) The developer releases such general-purpose artificial intelligence model under a free

and open-source license that allows for:

     (A) Access to, and modification, distribution and usage of, such general-purpose artificial

intelligence model; and

     (B) The parameters of such general-purpose artificial intelligence model to be made

publicly available as set forth in this subsection; and

     (ii) Unless such general-purpose artificial intelligence model is deployed as a high-risk

artificial intelligence system, the parameters of such general-purpose artificial intelligence model

including, but not limited to, the weights and information concerning the model architecture and

model usage for such general-purpose artificial intelligence model, are made publicly available; or

     (iii) The general-purpose artificial intelligence model is:

     (A) Not offered for sale in the market;

     (B) Not intended to interact with consumers; and

     (C) Solely utilized:

     (I) For an entity's internal purposes; or

     (II) Under an agreement between multiple entities for such entities' internal purposes.

     (3) The provisions of this section shall not apply to a developer that develops, or

intentionally and substantially modifies, a general-purpose artificial intelligence model on or after

October 1, 2026, if such general purpose artificial intelligence model performs tasks exclusively

related to an entity's internal management affairs including, but not limited to, ordering office

supplies or processing payments.

     (4) A developer that takes any action under an exemption established in this subsection

shall bear the burden of demonstrating that such action qualifies for such exemption.

     (5) A developer that is exempt under this subsection shall establish and maintain an

artificial intelligence risk management framework, which framework shall:

     (i) Be the product of an iterative process and ongoing efforts; and

LC001407 - Page 17 of 25

     (ii) Include, at a minimum:

     (A) An internal governance function;

     (B) A map function that shall establish the context to frame risks;

     (C) A risk management function; and

     (D) A function to measure identified risks by assessing, analyzing and tracking such risks.

     (c) Nothing in subsection (a) of this section shall be construed to require a developer to

disclose any information that is a trade secret or otherwise protected from disclosure under state or

federal law.

     (d) Beginning on October 1, 2026, the attorney general may require that a developer

disclose to the attorney general, as part of an investigation conducted by the attorney general, not

later than ninety (90) days after a request by the attorney general and in a form and manner

prescribed by the attorney general, any documentation maintained pursuant to this section. The

attorney general may evaluate such documentation to ensure compliance with the provisions of this

section. In disclosing any documentation to the attorney general pursuant to this subsection, the

developer may designate such documentation as including any information that is exempt from

disclosure under subsection (c) of this section or chapter 2 of title 38 ("access to public records").

To the extent such documentation includes such information, such documentation shall be exempt

from disclosure under the provision of this chapter or chapter 2 of title 38. To the extent any

information contained in such documentation is subject to the attorney-client privilege or work

product protection, such disclosure shall not constitute a waiver of such privilege or protection.

     6-61-7. Artificial intelligence system designation.

     (a) Beginning on October 1, 2026, and except as provided in subsections (b) and (c) of this

section, the developer of an artificial intelligence system including, but not limited to, a general-

purpose artificial intelligence model, that generates or manipulates synthetic digital content shall:

     (1) Ensure that the outputs of such artificial intelligence system are marked and detectable

as synthetic digital content, and that such outputs are so marked and detectable:

     (i) Not later than the time that consumers who did not create such outputs first interact

with, or are exposed to, such outputs; and

     (ii) In a manner that:

     (A) Is detectable by consumers; and

     (B) Complies with any applicable accessibility requirements; and

     (2) As far as technically feasible and in a manner that is consistent with any nationally or

internationally recognized technical standards, ensure that such developer's technical solutions are

effective, interoperable, robust and reliable, considering:

LC001407 - Page 18 of 25

     (i) The specificities and limitations of different types of synthetic digital content;

     (ii) The implementation costs; and

     (iii) The generally acknowledged state of the art.

     (b) If the synthetic digital content described in subsection (a) of this section is in an audio,

image or video format, and such synthetic digital content forms part of an evidently artistic,

creative, satirical, fictional analogous work or program, the disclosure required under said

subsection shall be limited to a disclosure that does not hinder the display or enjoyment of such

work or program.

     (c) The provisions of subsection (a) of this section shall not apply to:

     (1) Any synthetic digital content that:

     (i) Consists exclusively of text;

     (ii) Is published to inform the public on any matter of public interest; or

     (iii) Is unlikely to mislead a reasonable person consuming such synthetic digital content;

or

     (2) To the extent that any artificial intelligence system described in subsection (a) of this

section:

     (i) Performs an assistive function for standard editing;

     (ii) Does not substantially alter the input data provided by the developer or the semantics

thereof; or

     (iii) Is used to detect, prevent a violation of the provisions of this chapter or other laws or

regulations.

     6-61-8. Compliance with other laws.

     (a) Nothing in this chapter shall be construed to restrict a developer's, integrator's,

deployer's or other person's ability to:

     (1) Comply with federal, state or municipal law;

     (2) Comply with a civil, criminal or regulatory inquiry, investigation, subpoena or

summons by a federal, state, municipal or other governmental authority;

     (3) Cooperate with a law enforcement agency concerning conduct or activity that the

developer, integrator, deployer or other person reasonably and in good faith believes may violate

federal, state or municipal law;

     (4) Investigate, establish, exercise, prepare for or defend a legal claim;

     (5) Take immediate steps to protect an interest that is essential for the life or physical safety

of a consumer or another individual;

     (6)(i) By any means other than facial recognition technology, prevent, detect, protect

LC001407 - Page 19 of 25

against or respond to:

     (A) A security incident;

     (B) A malicious or deceptive activity; or

     (C) Identity theft, fraud, harassment or any other illegal activity.

     (ii) Investigate, report or prosecute the persons responsible for any action described in a

security incident; or

     (iii) Preserve the integrity or security of systems;

     (7) Engage in public or peer-reviewed scientific or statistical research in the public interest

that:

     (i) Adheres to all other applicable ethics and privacy laws; and

     (ii) Is conducted in accordance with:

     (A) The provisions of 45 CFR Part 46, as amended from time to time; or

     (B) Relevant requirements established by the federal Food and Drug Administration;

     (8) Conduct research, testing, development and integration activities regarding an artificial

intelligence system or model, other than testing conducted under real world conditions, before such

artificial intelligence system or model is placed on the market, deployed or put into service, as

applicable;

     (9) Effectuate a product recall;

     (10) Identify and repair technical errors that impair existing or intended functionality; or

     (11) Assist another developer, integrator, deployer or person with any of the obligations

imposed pursuant to the provisions of this chapter.

     (b) The obligations imposed on developers, integrators, deployers or other persons under

this chapter shall not apply where compliance by the developer, integrator, deployer or other person

with said provisions of this chapter shall violate an evidentiary privilege under the laws of this state.

     (c) Nothing in this chapter shall be construed to impose any obligation on a developer,

integrator, deployer or other person that adversely affects the rights or freedoms of any person

including, but not limited to, the rights of any person to freedom of speech or freedom of the press

guaranteed in:

     (1) The First Amendment to the United States Constitution; and

     (2) The Rhode Island Constitution, Article 1, § 21.

     (d) Nothing in this chapter shall be construed to apply to any developer, integrator,

deployer, or other person:

     (1) Insofar as such developer, integrator, deployer or other person develops, integrates,

deploys, puts into service or intentionally and substantially modifies, as applicable, a high-risk

LC001407 - Page 20 of 25

artificial intelligence system:

     (i) That has been approved, authorized, certified, cleared, developed, integrated or granted

by:

     (A) A federal agency, such as the federal Food and Drug Administration or the Federal

Aviation Administration, acting within the scope of such federal agency's authority; or

     (B) A regulated entity subject to supervision and regulation by the Federal Housing Finance

Agency; or

     (ii) In compliance with standards that are:

     (A) Established by:

     (I) Any federal agency including, but not limited to, the federal Office of the National

Coordinator for Health Information Technology; or

     (II) A regulated entity subject to supervision and regulation by the Federal Housing Finance

Agency; and

     (B) Substantially equivalent to, and at least as stringent as, the standards established in this

chapter;

     (2) Conducting research to support an application:

     (i) For approval or certification from any federal agency including, but not limited to, the

Federal Aviation Administration, the Federal Communications Commission, or the federal Food

and Drug Administration; or

     (ii) That is otherwise subject to review by any federal agency;

     (3) Performing work under, or in connection with, a contract with the United States

Department of Commerce, the United States Department of Defense, or the National Aeronautics

and Space Administration, unless such developer, integrator, deployer or other person is performing

such work on a high-risk artificial intelligence system that is used to make, or as a substantial factor

in making, a decision concerning employment or housing; or

     (4) That is a covered entity within the meaning of the Health Insurance Portability and

Accountability Act of 1996, Pub. L. 104-191, and the regulations promulgated thereunder, as both

may be amended from time to time, and providing healthcare recommendations that:

     (i) Are generated by an artificial intelligence system;

     (ii) Require a healthcare provider to take action to implement such recommendations; and

     (iii) Are not considered to be high risk.

     (e) Nothing in this chapter shall be construed to apply to any artificial intelligence system

that is acquired by or for the federal government or any federal agency or department including,

but not limited to, the United States Department of Commerce, the United States Department of

LC001407 - Page 21 of 25

Defense, or the National Aeronautics and Space Administration, unless such artificial intelligence

system is a high-risk artificial intelligence system that is used to make, or as a substantial factor in

making, a decision concerning employment or housing.

     (f) Any insurer, subject to the provisions of title 27, fraternal benefit society, within the

meaning of § 27-25-1, or health carrier, as defined in § 27-18.6-2, shall be deemed to be in full

compliance with the provisions of this chapter if such insurer, fraternal benefit society or health

carrier has implemented and maintains a written artificial intelligence systems program in

accordance with all requirements established by the insurance commissioner defined in § 27-2.4-

2.

     (g)(1) Any financial institution, out-of-state financial institution, Rhode Island credit

union, federal credit union or out-of-state credit union, or any branch or subsidiary thereof, shall

be deemed to be in full compliance with the provisions of this chapter if such financial institution,

out-of-state financial institution, Rhode Island credit union, federal credit union, out-of-state credit

union, branch or subsidiary is subject to examination by any state or federal prudential regulator

under any published guidance or regulations that apply to the use of high-risk artificial intelligence

systems and such guidance or regulations:

     (i) Impose requirements that are substantially equivalent to, and at least as stringent as, the

requirements set forth in this chapter; and

     (ii) At a minimum, require such financial institution, out-of-state financial institution,

Rhode Island credit union, federal credit union, out-of-state credit union, branch or subsidiary to:

     (A) Regularly audit such financial institution's, out-of-state financial institution's, Rhode

Island credit union's, federal credit union's, out-of-state credit union's, branch 's or subsidiary's use

of high-risk artificial intelligence systems for compliance with state and federal anti-discrimination

laws and regulations applicable to such financial institution, out-of-state financial institution,

Rhode Island credit union, federal credit union, out-of-state credit union, branch or subsidiary; and

     (B) Mitigate any algorithmic discrimination caused by the use of a high-risk artificial

intelligence system or any risk of algorithmic discrimination that is reasonably foreseeable as a

result of the use of a high-risk artificial intelligence system.

     (2) For the purposes of this section, "branch", "financial institution", "Rhode Island credit

union", and "federal credit union" have the same meaning as provided in § 19-1-1.

     (3) For the purposes of this section, "out-of-state financial institution" means a financial

institution whose principal office is located in any other state.

     (4) For the purposes of this section, "out-of-state credit union" means a credit union whose

principal office is located in any other state.

LC001407 - Page 22 of 25

     (h) If a developer, integrator, deployer or other person engages in any action pursuant to

an exemption set forth in subsections (a) through (g), inclusive, of this section, the developer,

integrator, deployer or other person bears the burden of demonstrating that such action qualifies for

such exemption.

     6-61-9. Enforcement.

     (a) The attorney general shall have exclusive authority to enforce the provisions of this

chapter.

     (b) Except as provided in subsection (f) of this section, during the period beginning on

October 1, 2026, and ending on September 30, 2027, the attorney general shall, prior to initiating

any action for a violation of any provision of this chapter, issue a notice of violation to the

developer, integrator, deployer, or other person if the attorney general determines that it is possible

to cure such violation. If the developer, integrator, deployer or other person fails to cure such

violation not later than sixty (60) days after receipt of the notice of violation, the attorney general

may bring an action pursuant to this chapter.

     (c) Except as provided in subsection (f) of this section, beginning on October 1, 2027, the

attorney general may, in determining whether to grant a developer, integrator, deployer or other

person the opportunity to cure a violation described in subsection (b) of this section, consider:

     (1) The number of violations;

     (2) The size and complexity of the developer, integrator, deployer or other person;

     (3) The nature and extent of the developer's, integrator's, deployer's or other person's

business;

     (4) The substantial likelihood of injury to the public;

     (5) The safety of persons or property; and

     (6) Whether such violation was likely caused by human or technical error.

     (d) Nothing in this chapter shall be construed as providing the basis for a private right of

action for violations of this chapter.

     (e) Except as provided in subsections (a) through (d), inclusive, of this section and

subsection (f) of this section, a violation of the requirements established in this chapter shall

constitute an unfair trade practice for purposes of § 6-13.1-5 and shall be enforced solely by the

attorney general.

     (f)(1) In any action commenced by the attorney general for any violation of this chapter, it

shall be an affirmative defense that the developer, integrator, deployer, or other person:

     (i) Discovered a violation of any provision of this chapter through red-teaming;

     (ii) Not later than sixty (60) days after discovering the violation as set forth in subsection

LC001407 - Page 23 of 25

(f)(1)(i) of this section:

     (A) Cures such violation; and

     (B) Provides to the attorney general, in a form and manner prescribed by the attorney

general, notice that such violation has been cured and evidence that any harm caused by such

violation has been mitigated; and

     (iii) Is otherwise in compliance with the latest version of:

     (A) The "Artificial Intelligence Risk Management Framework" published by the National

Institute of Standards and Technology;

     (B) ISO or IEC 42001 of the International Organization for Standardization;

     (C) A nationally or internationally recognized risk management framework for artificial

intelligence systems, other than the risk management frameworks specified in this subsection, that

imposes requirements that are substantially equivalent to, and at least as stringent as, the

requirements set forth in this chapter; or

     (D) Any risk management framework for artificial intelligence systems that is substantially

equivalent to, and at least as stringent as, the risk management frameworks described in this

subsection.

     (2) The developer, integrator, deployer or other person bears the burden of demonstrating

to the attorney general that the requirements established in subsection (f)(1) of this section have

been satisfied.

     (3) Nothing in this this chapter including, but not limited to, the enforcement authority

granted to the attorney general under this section, shall be construed to preempt or otherwise affect

any right, claim, remedy, presumption or defense available at law or in equity. Any rebuttable

presumption or affirmative defense established under this chapter shall apply only to an

enforcement action brought by the attorney general pursuant to this section and shall not apply to

any right, claim, remedy, presumption, or defense available at law or in equity.

     SECTION 2. This act shall take effect on October 1, 2025

========

LC001407

========

LC001407 - Page 24 of 25

EXPLANATION

BY THE LEGISLATIVE COUNCIL

OF

A N   A C T

RELATING TO COMMERCIAL LAW -- GENERAL REGULATORY PROVISIONS --

ARTIFICIAL INTELLIGENCE ACT

***

     This act would establish regulations to ensure the ethical development, integration, and

deployment of high-risk Artificial Intelligence (AI) systems, particularly those influencing

consequential decisions in areas like employment, education, lending, housing, healthcare, and

legal services. It would require developers, integrators, and deployers to use reasonable care to

prevent algorithmic discrimination, implement risk management policies, conduct regular impact

assessments, and provide transparency regarding the use of AI systems. The act also would require

developers to disclose known risks to the attorney general and affected parties, while deployers are

required to notify consumers when AI is used in decision-making and offer avenues to appeal

adverse outcomes. The act would further mandates that synthetic digital content generated by AI

be clearly marked, with exceptions for informational content. Additionally, this act would provide

exemptions for AI systems governed by equivalent federal standards, used for internal business

purposes, or developed for specific federal agencies. The attorney general would hold exclusive

enforcement authority, with a focus on encouraging compliance before pursuing legal action.

     This act would take effect on October 1, 2025

========

LC001407

========

LC001407 - Page 25 of 25