SB167: SB167 Commerce and Trade; private entities that employ certain AI systems to guard against discrimination caused by such systems; provide

Georgia has no current law specifically governing artificial intelligence systems used to make important decisions about people, such as whether someone gets a job, a loan, an apartment, or health coverage. This bill would add a new chapter to Georgia's commerce and trade code (O.C.G.A. Title 10) covering 'automated decision systems,' meaning computer programs built with AI or data modeling that produce scores, classifications, or recommendations affecting people's lives. Companies that build these systems ('developers') and companies that use them ('deployers') would have to test for discriminatory effects, document known risks, and share information with each other and with the Attorney General. Deployers would generally have to complete yearly impact assessments, tell consumers when an automated system is used to make a consequential decision, explain the decision within one business day, and offer a way to appeal. Small deployers with fewer than 15 employees and limited use are exempt from some duties. Certain disclosed records would be shielded from Georgia's open records law, and the Attorney General would enforce the law under the Fair Business Practices Act, with an affirmative defense available for companies that self-detect and quickly fix violations.

• Creates a new chapter of Georgia law (O.C.G.A. Title 10, Chapter 16) banning 'algorithmic discrimination' caused by AI systems used in consequential decisions.
• Requires developers of AI systems to document known risks, testing methods, and mitigation steps, and share that information with deployers and the Attorney General.
• Requires deployers to adopt a risk management program, complete annual impact assessments, and review each automated decision system yearly for discriminatory effects.
• Requires deployers to notify consumers before and after an automated system is used in a consequential decision, and to explain the decision and offer an appeal, generally with human review if feasible.
• Exempts small deployers (fewer than 15 employees, limited data use, fewer than 1,000 affected consumers a year) from some of the risk management and impact assessment duties.
• Makes certain records developers and deployers give the Attorney General exempt from Georgia's open records law (O.C.G.A. § 50-18-70) and assigns enforcement to the Attorney General under the Fair Business Practices Act.

Businesses that build or use AI-driven decision tools in Georgia, especially in employment, lending, insurance, housing, healthcare, education, government services, and legal services; Georgia consumers subject to those automated decisions; and the Attorney General's office, which gains new enforcement and rulemaking duties.

If enacted, Georgians affected by AI-driven decisions on jobs, loans, housing, or benefits would get notice, an explanation, and a chance to appeal, while companies using such systems would face new testing, documentation, and disclosure duties enforced by the Attorney General, with penalties handled through existing consumer protection law.

• Section 1 (new O.C.G.A. § 10-16-1) defines key terms including 'algorithmic discrimination,' 'automated decision system,' 'consequential decision,' and 'deployer' and 'developer.'
• New O.C.G.A. § 10-16-2 bars developers from distributing AI systems that cause algorithmic discrimination and requires them to disclose risk information to the Attorney General and to deployers.
• New O.C.G.A. § 10-16-3 requires deployers to adopt a risk management program and complete impact assessments at least annually and within 90 days of major system changes.
• New O.C.G.A. § 10-16-4 requires deployers to notify consumers before using an automated system for a consequential decision and to explain the decision within one business day, including appeal rights.
• New O.C.G.A. § 10-16-6 exempts deployers with fewer than 15 employees and fewer than 1,000 affected consumers a year from certain risk management and assessment requirements.
• New O.C.G.A. § 10-16-9 shields disclosed risk management policies, impact assessments, and records from Georgia's open records law.
• New O.C.G.A. § 10-16-13 makes violations enforceable under the Fair Business Practices Act of 1975 and creates an affirmative defense for companies that self-discover and cure violations within seven days.
• New O.C.G.A. § 10-16-14 gives the Attorney General rulemaking authority to implement and enforce the chapter.

1. 2025-02-13Senate Read and Referred (Senate)
2. 2025-02-12Senate Hopper (Senate)

• Nikki Merritt (D, SD-009)Primary sponsor
• Harold Jones (D, SD-022)
• RaShaun Kemp (D, SD-038)
• Nabilah Islam Parkes (D, SD-007)
• Michael Rhett (D, SD-033)
• Donzella James (D, SD-028)
• Elena Parent (D, SD-044)
• Kenya Wicks (D, SD-034)
• Sally Harrell (D, SD-040)
• Randal Mangham (D, SD-055)

• artificial intelligence regulation
• consumer protection
• algorithmic discrimination
• employment and hiring technology
• Attorney General enforcement