Senate Bill 167
By: Senators Merritt of the 9th, Jones II of the 22nd, Kemp of the 38th, Islam Parkes of the
7th, Rhett of the 33rd and others
A BILL TO BE ENTITLED
AN ACT
To amend Title 10 of the Official Code of Georgia Annotated, relating to commerce and
trade, so as to provide broadly for private entities that employ certain AI systems to guard
against discrimination caused by such systems; to provide for a description of consequential
decisions for which use of automated decision systems shall be regulated; to provide for
developers and deployers to perform certain evaluations of the automated decision systems
they employ; to provide for notice to consumers when certain decisions are made using an
automated decision system; to provide for certain disclosures by developers of AI systems;
to provide for certain disclosures by deployers of AI systems; to provide for annual updates
to certain disclosures; to provide for notices to a consumer each time a decision is made
using an automated decision system; to provide requirements for such disclosures by
developers and deployers; to provide for exemptions; to provide for trade secret protections;
to provide for rule making; to provide for certain disclosed records by developers and
deployers to be exempt from open records requirements; to provide for enforcement by the
Attorney General; to provide for definitions; to provide for related matters; to repeal
conflicting laws; and for other purposes.
BE IT ENACTED BY THE GENERAL ASSEMBLY OF GEORGIA:
SECTION 1.
Title 10 of the Official Code of Georgia Annotated, relating to commerce and trade, is
amended by adding a new chapter to read as follows:
<ins>"CHAPTER 16
10-16-1.
As used in this chapter, the term:
(1)(A) 'Algorithmic discrimination' means the use of an artificial intelligence system
in a manner that discriminates, causes a disparate impact, or otherwise makes
unavailable the equal enjoyment of goods, services, or other activities or opportunities
as related to a consequential decision on the basis of actual or perceived age, color,
disability, ethnicity, genetic information, limited proficiency in the English language,
national origin, race, religion, pursuit or receipt of reproductive healthcare, sex, sexual
orientation, gender identity, veteran status, or other classification protected under the
laws of this state or federal law.
(B) Such term shall not include:
(i) The offer, license, or use of an automated decision system by a developer or
deployer for the sole purpose of:
(I) The developer's or deployer's self-testing to identify, mitigate, or prevent
discrimination or otherwise ensure compliance with state and federal law; or
(II) Expanding an applicant, customer, or participant pool to increase diversity or
redress historical discrimination; or
(ii) An act or omission by or on behalf of a private club or other establishment that
is not in fact open to the public, as set forth in Title II of the federal Civil Rights Act
of 1964, 42 U.S.C. Section 2000a(e), as amended.
</ins>
<ins>(2) 'Artificial intelligence system' or 'AI system' means an engineered or machine based
system that emulates the capability of a person to receive audio, visual, text, or any other
form of information and use the information received to emulate a human cognitive
process, including, but not limited to, learning, generalizing, reasoning, planning,
predicting, acting, or communicating; provided, however, that artificial intelligence
systems may vary in the forms of information they can receive and in the human
cognitive processes they can emulate.
(3)(A) 'Automated decision system' means a computational process derived from
machine learning, statistical modeling, data analytics, or an artificial intelligence system
that, when deployed, issues a simplified output, including, but not limited to, a score,
classification, or recommendation, that is used to assist or replace human discretionary
decision making and materially impacts natural persons.
(B) Such term shall not include a tool that does not assist or replace processes for
making consequential decisions and that does not materially impact natural persons,
including, but not limited to, a junk email filter, firewall, antivirus software, calculator,
spreadsheet, or other tool that does no more than organize data already in possession
of the deployer of the automated decision system.
(4) 'Consequential decision' means a decision that has a material effect on the provision
or denial to any consumer of, or on the cost or terms of:
(A) Education enrollment or education opportunities;
(B) Employment or employment opportunities;
(C) Essential government services;
(D) Financial or lending services;
(E) Healthcare services;
(F) Housing;
(G) Insurance; or
(H) Legal services.
</ins>
<ins>(5) 'Consumer' means an individual who is a Georgia resident.
(6) 'Deploy' means to use an automated decision system.
(7) 'Deployer' means a person doing business in this state that deploys an automated
decision system.
(8) 'Developer' means a person doing business in this state that develops or intentionally
and substantially modifies an artificial intelligence system.
(9) 'Healthcare services' shall have the same meaning as set forth in 42 U.S.C. Section
234(d)(2).
(10)(A) 'Intentional and substantial modification' or 'intentionally and substantially
modify' means a deliberate change made to an AI system that results in any increase in
or new reasonably foreseeable risk of algorithmic discrimination by such AI system.
(B) Such term shall not include a change made to an automated decision system if:
(i) The automated decision system continues to learn after the automated decision
system is:
(I) Offered, sold, leased, licensed, given, or otherwise made available to a deployer;
or
(II) Deployed;
(ii) The change is made to the automated decision system as a result of any learning
described in division (i) of this subparagraph;
(iii) The change was predetermined by the deployer, or a third party contracted by the
deployer, when the deployer or third party completed an initial impact assessment of
such automated decision system pursuant to subsection (e) of Code Section 10-16-3;
and
(iv) The change is included in technical documentation for the automated decision
system.
(11) 'Personal data' means any information, including derived data and unique identifiers,
that is linked or reasonably linkable, alone or in combination with other information, to
</ins>
<ins>an identified or identifiable individual or a device that identifies or is linked or reasonably
linkable to an individual.
(12) 'Trade secret' shall have the same meaning as set forth in Code Section 10-1-761.
10-16-2.
(a) No developer shall sell, distribute, or otherwise make available to deployers an
automated decision system that results in algorithmic discrimination.
(b) Except as provided in subsection (f) of this Code section, a developer of an automated
decision system shall provide certain information regarding such automated decision
system to the Attorney General, in a form and manner prescribed by the Attorney General.
Such information shall include, at a minimum:
(1) A general statement describing the reasonably foreseeable uses and known harmful
or inappropriate uses of the automated decision system;
(2) Documentation disclosing:
(A) The purpose of the automated decision system;
(B) The intended benefits and uses of the automated decision system;
(C) High-level summaries of the types of data used to train the automated decision
system;
(D) Known or reasonably foreseeable limitations of the automated decision system,
including known or reasonably foreseeable risks of algorithmic discrimination arising
from the intended uses of the automated decision system;
(E) The measures the developer has taken to mitigate known or reasonably foreseeable
risks of algorithmic discrimination;
(F) How the automated decision system was evaluated for performance and mitigation
of algorithmic discrimination before the automated decision system was offered, sold,
leased, licensed, given, or otherwise made available to the deployer;
</ins>
<ins>(G) The data governance measures used to cover the training data sets and the
measures used to examine the suitability of data sources, possible biases, and
appropriate mitigation;
(H) How the automated decision system should be used, not be used, and be monitored
by an individual when the automated decision system is used to make, or assist in
making, a consequential decision; and
(I) All other information necessary to allow the deployer to comply with the
requirements of Code Section 10-16-3; and
(3) Any additional documentation that is reasonably necessary to assist the deployer in
understanding the outputs and monitoring the performance of the automated decision
system for risks of algorithmic discrimination.
(c)(1) Except as provided in subsection (f) of this Code section, a developer that offers,
sells, leases, licenses, gives, or otherwise makes available to a deployer or other
developer an automated decision system shall make available to the deployer or other
developer, to the extent feasible, all of the information required to be provided to the
Attorney General by subsection (b) of this Code section, as well as the documentation
and information, through artifacts such as model cards, data set cards, or other impact
assessments, necessary for a deployer or third party contracted by a deployer to complete
an impact assessment pursuant to subsection (e) of Code Section 10-16-3.
(2) A developer that also serves as a deployer for an automated decision system is not
required to generate the documentation required by this subsection unless the automated
decision system is provided to an unaffiliated entity acting as a deployer.
(d)(1) A developer shall make available to the public, in a manner that is clear and
readily available on the developer's public website or in a public use case inventory, a
statement summarizing:
</ins>
<ins>(A) The types of automated decision systems that the developer has developed or
intentionally and substantially modified and currently makes available to a deployer or
other developer; and
(B) How the developer manages known or reasonably foreseeable risks of algorithmic
discrimination.
(2) A developer shall update the statement described in paragraph (1) of this subsection:
(A) As necessary to ensure that the statement remains accurate; and
(B) No later than 90 days after the developer intentionally and substantially modifies
any automated decision system described in such statement.
(e)(1) A developer of an automated decision system shall take steps to address risks of
algorithmic discrimination, invalidity, and errors, including, but not limited to, ensuring
suitability and representativeness of data sources, implementing data governance
measures, testing the automated decision system for disparate impact, and searching for
less discriminatory alternative decision methods. Developers shall continue assessing
and mitigating the risk of algorithmic discrimination in their automated decision systems
so long as such automated decision systems are in use by any deployer.
(2) A developer of an automated decision system shall disclose to the Attorney General,
in a form and manner prescribed by the Attorney General, and to all known deployers or
other developers of the automated decision system, any known or reasonably foreseeable
risks of algorithmic discrimination arising from the intended uses of the automated
decision system without unreasonable delay but no later than 90 days after the date on
which:
(A) The developer discovers through the developer's ongoing testing and analysis that
the developer's automated decision system has been deployed and has caused or is
reasonably likely to have caused algorithmic discrimination; or
(B) The developer receives from a deployer a credible report that the automated
decision system has been deployed and has caused algorithmic discrimination.
</ins>
<ins>(f)(1) A developer who discloses information to a deployer, to a consumer, or to the
general public pursuant to subsections (b) through (e) of this Code section may make
reasonable redactions for the purpose of protecting trade secrets.
(2) No developer shall redact information from its required disclosures to a deployer
under this Code section if the information is necessary for the deployer to comply with
its disclosure, explanation, impact assessment, or audit obligations under this chapter.
(3) To the extent that a developer redacts information pursuant to paragraph (1) of this
subsection, the developer shall notify the subjects of the disclosure and provide a basis
for the redaction.
(g) The Attorney General may require that a developer disclose to the Attorney General,
within seven days and in a form and manner prescribed by the Attorney General, any
documentation or records required by this Code section, including, but not limited to, the
statement or documentation described in subsection (b) of this Code section. The Attorney
General may evaluate such statement or documentation to ensure compliance with this
chapter, and, notwithstanding the provisions of Article 4 of Chapter 18 of Title 50, relating
to open records, such records shall not be open to inspection by or made available to the
public. In a disclosure pursuant to this subsection, a developer may designate the statement
or documentation as including proprietary information or a trade secret. To the extent that
any information contained in the statement or documentation includes information subject
to attorney-client privilege or work-product protection, the disclosure does not constitute
a waiver of the privilege or protection.
(h) A developer's compliance with this Code section shall not constitute a defense in a civil
or administrative action regarding claims that the developer violated any other provision
of this chapter or any other law.
</ins>
<ins>10-16-3.
(a) No deployer of an automated decision system shall use an automated decision system
in a manner that results in algorithmic discrimination.
(b) Except as provided in Code Section 10-16-6, a deployer of an automated decision
system shall implement a risk management policy and program to govern the deployer's
deployment of the automated decision system. The risk management policy and program
shall specify and incorporate the principles, processes, and personnel that the deployer uses
to identify, document, and mitigate known or reasonably foreseeable risks of algorithmic
discrimination. The risk management policy and program shall be an iterative process
planned, implemented, and regularly and systematically reviewed and updated over the life
cycle of an automated decision system, requiring regular, systematic review and updates.
A risk management policy and program implemented and maintained pursuant to this
subsection shall take into consideration:
(1) Either:
(A) The guidance and standards set forth in the latest version of the Artificial
Intelligence Risk Management Framework published by the National Institute of
Standards and Technology of the United States Department of Commerce, standard
ISO/IEC 42001 of the International Organization for Standardization, or another
nationally or internationally recognized risk management framework for artificial
intelligence systems, if the standards are substantially equivalent to or more stringent
than the requirements of this chapter; or
(B) Any risk management framework for artificial intelligence systems that the
Attorney General, in the Attorney General's discretion, may designate;
(2) The size and complexity of the deployer;
(3) The nature and scope of the automated decision systems deployed by the deployer,
including the intended uses of the automated decision systems; and
</ins>
<ins>(4) The sensitivity and volume of data processed in connection with the automated
decision systems deployed by the deployer.
(c) A risk management policy and program implemented pursuant to this Code section
may cover multiple automated decision systems deployed by the deployer.
(d) Each deployer shall establish and adhere to:
(1) Written standards, policies, procedures, and protocols for the acquisition, use of, or
reliance on automated decision systems developed by third-party developers, including
reasonable contractual controls ensuring that the developer statements and summaries
described in subsection (b) of Code Section 10-16-2 include all information necessary for
the deployer to fulfill its obligations under this Code section;
(2) Procedures for reporting any incorrect information or evidence of algorithmic
discrimination to a developer for further investigation and mitigation, as necessary; and
(3) Procedures to remediate and eliminate incorrect information from its automated
decision systems that the deployer has identified or has been reported to a developer.
(e) Except as otherwise provided for in this chapter:
(1) A deployer, or a third party contracted by the deployer, that deploys an automated
decision system shall complete an impact assessment for the automated decision system;
and
(2) A deployer, or a third party contracted by the deployer, shall complete an impact
assessment for a deployed automated decision system at least annually and within 90
days after any intentional and substantial modification to the automated decision system
is made available.
(f) An impact assessment completed pursuant to subsection (e) of this Code section shall
include, at a minimum, and to the extent reasonably known by or available to the deployer:
(1) A statement by the deployer disclosing the purpose, intended use cases, and
deployment context of, and benefits afforded by, the automated decision system;
</ins>
<ins>(2) An analysis of whether the deployment of the automated decision system poses any
known or reasonably foreseeable risks of:
(A) Algorithmic discrimination and, if so, the nature of the algorithmic discrimination
and the steps that have been taken to mitigate the risks;
(B) Limits on accessibility for individuals who are pregnant, breastfeeding, or disabled,
and, if so, what reasonable accommodations the deployer may provide that would
mitigate any such limitations on accessibility;
(C) Any violation of state or federal labor laws, including laws pertaining to wages,
occupational health and safety, and the right to organize; or
(D) Any physical or other intrusion upon the solitude or seclusion, or the private affairs
or concerns, of consumers if such intrusion:
(i) Would be offensive to a reasonable person; and
(ii) May be redressed under the laws of this state;
(3) A description of the categories of data the automated decision system processes as
inputs and the outputs the automated decision system produces;
(4) If the deployer used data to customize the automated decision system, an overview
of the categories of data the deployer used to customize the automated decision system;
(5) An analysis of the automated decision system's validity and reliability in accordance
with contemporary social science standards, and a description of any metrics used to
evaluate the performance and known limitations of the automated decision system;
(6) A description of any transparency measures taken concerning the automated decision
system, including any measures taken to disclose to a consumer that the automated
decision system is in use when the automated decision system is in use;
(7) A description of the post-deployment monitoring and user safeguards provided
concerning the automated decision system, including the oversight, use, and learning
process established by the deployer to address issues arising from the deployment of the
automated decision system; and
</ins>
<ins>(8) When such impact assessment is completed following an intentional and substantial
modification to an automated decision system, a statement disclosing the extent to which
the automated decision system was used in a manner that was consistent with, or varied
from, the developer's intended uses of the automated decision system.
(g) If the analysis required by paragraph (2) of subsection (f) of this Code section reveals
a risk of algorithmic discrimination, the deployer shall not deploy the automated decision
system until the developer or deployer takes reasonable steps to search for and implement
less discriminatory alternative decision methods.
(h) A single impact assessment may address a comparable set of automated decision
systems deployed by a deployer.
(i) If a deployer, or a third party contracted by the deployer, completes an impact
assessment for the purpose of complying with another applicable law or regulation, the
impact assessment shall satisfy the requirements established in this Code section if the
impact assessment is reasonably similar in scope and effect to the impact assessment that
would otherwise be completed pursuant to this Code section.
(j) A deployer shall maintain the most recently completed impact assessment for an
automated decision system, all records concerning each impact assessment, and all prior
impact assessments, if any, throughout the period of time that the automated decision
system is deployed and for at least three years following the final deployment of the
automated decision system.
(k) At least annually a deployer, or a third party contracted by the deployer, shall review
the deployment of each automated decision system deployed by the deployer to ensure that
the automated decision system is not causing algorithmic discrimination.
(l) Deployers shall publish on their public websites all impact assessments completed
within the preceding three years in a form and manner prescribed by the Attorney General.
</ins>
<ins>10-16-4.
(a) No later than the time that a deployer deploys an automated decision system to make,
or assist in making, a consequential decision concerning a consumer, the deployer shall:
(1) Notify the consumer that the deployer has deployed an automated decision system
to make, or assist in making, a consequential decision; and
(2) Provide to the consumer:
(A) A statement disclosing the purpose of the automated decision system and the
nature of the consequential decision;
(B) The contact information for the deployer;
(C) A description, in plain language, of the automated decision system, which
description shall, at a minimum, include:
(i) A description of the personal characteristics or attributes that the system will
measure or assess;
(ii) The method by which the system measures or assesses those attributes or
characteristics;
(iii) How those attributes or characteristics are relevant to the consequential decisions
for which the system should be used;
(iv) Any human components of such system;
(v) How any automated components of such system are used to inform such
consequential decision; and
(vi) A direct link to a publicly accessible page on the deployer's public website that
contains a plain-language description of the logic used in the system, including the
key parameters that affect the output of the system; the system's outputs; the types and
sources of data collected from natural persons and processed by the system when it
is used to make, or assists in making, a consequential decision; and the results of the
most recent impact assessment, or an active link to a web page where a consumer can
review those results; and
</ins>
<ins>(D) Instructions on how to access the statement required by Code Section 10-16-5.
(b) A deployer that has used an automated decision system to make, or assist in making,
a consequential decision concerning a consumer shall transmit to such consumer within one
business day after such decision a notice that includes:
(1) A specific and accurate explanation that identifies the principal factors and variables
that led to the consequential decision, including:
(A) The degree to which, and manner in which, the automated decision system
contributed to the consequential decision;
(B) The source or sources of the data processed by the automated decision system; and
(C) A plain-language explanation of how the consumer's personal data informed these
principal factors and variables when the automated decision system made, or assisted
in making, the consequential decision;
(2) Information about consumers' right to correct, and how the consumer can submit
corrections and provide supplementary information relevant to, the consequential
decision;
(3) What actions, if any, the consumer might have taken to secure a different decision
and the actions that the consumer might take to secure a different decision in the future;
(4) Information on opportunities to correct any incorrect personal data that the automated
decision system processed in making, or assisting in making, the consequential decision;
and
(5) Information on opportunities to appeal an adverse consequential decision concerning
the consumer arising from the deployment of an automated decision system, which
appeal shall, if technically feasible, allow for human review.
(c)(1) A deployer shall provide the notice, statement, contact information, and
description required by subsections (a) and (b) of this Code section:
(A) Directly to the consumer;
(B) In plain language;
</ins>
<ins>(C) In all languages in which the deployer, in the ordinary course of the deployer's
business, provides contracts, disclaimers, sale announcements, and other information
to consumers; and
(D) In a format that is accessible to consumers with disabilities.
(2) If the deployer is unable to provide the notice, statement, contact information, and
description directly to the consumer, the deployer shall make such information available
in a manner that is reasonably calculated to ensure that the consumer receives it.
(d) No deployer shall use an automated decision system to make, or assist in making, a
consequential decision if it cannot provide notices and explanations that satisfy the
requirements of this Code section.
10-16-5.
(a) Except as provided in Code Section 10-16-6, a deployer shall make available, in a
manner that is clear and readily available on the deployer's public website, a statement
summarizing:
(1) The types of automated decision systems that are currently deployed by the deployer;
(2) How the deployer manages known or reasonably foreseeable risks of algorithmic
discrimination that may arise from the deployment of each such automated decision
system; and
(3) In detail, the nature, source, and extent of the information collected and used by the
deployer.
(b) A deployer shall periodically update the statement described in subsection (a) of this
Code section.
10-16-6.
The provisions of subsections (b) and (e) of Code Section 10-16-3 shall not apply to a
deployer when:
</ins>
<ins>(1) The automated decision system is used to make, or is a contributing factor in making,
consequential decisions about fewer than 1,000 consumers in the preceding calendar year;
and
(2) At the time the deployer deploys the automated decision system and at all times while
the automated decision system is deployed:
(A) The deployer employs fewer than 15 full-time equivalent employees;
(B) The deployer does not use the deployer's own data to train the automated decision
system;
(C) The automated decision system is used for the intended uses that are disclosed to
the deployer as required by subsection (b) of Code Section 10-16-2;
(D) The automated decision system continues learning based on data derived from
sources other than the deployer's own data;
(E) The deployer makes available to consumers any impact assessment that the
developer of the automated decision system has completed and provided to the
deployer; and
(F) The deployer makes available to consumers any impact assessment that includes
information that is substantially similar to the information in the impact assessment
required under subsection (f) of Code Section 10-16-3.
10-16-7.
If a deployer deploys an automated decision system and subsequently discovers that the
automated decision system has caused algorithmic discrimination, the deployer, without
unreasonable delay, but no later than 90 days after the date of the discovery, shall send to
the Attorney General, in a form and manner prescribed by the Attorney General, a notice
disclosing the discovery.
</ins>
<ins>10-16-8.
A deployer who discloses information to the Attorney General, to a consumer, or to the
general public pursuant to this chapter may make reasonable redactions for the purpose of
protecting trade secrets. To the extent that a deployer redacts or withholds information
pursuant to this Code section, the deployer shall notify the consumer and provide a basis
for the redaction or withholding. Such notification shall comply with the requirements of
subsection (c) of Code Section 10-16-4.
10-16-9.
The Attorney General may require that a deployer, or a third party contracted by the
deployer, disclose to the Attorney General, no later than seven days after and in a form and
manner prescribed by the Attorney General, any documentation or records required by this
chapter. The Attorney General may evaluate the risk management policy, impact
assessment, or records to ensure compliance with this chapter, and the risk management
policy, impact assessment, and such records, notwithstanding the provisions of Article 4
of Chapter 18 of Title 50, relating to open records, shall not be open to inspection by or
made available to the public. In a disclosure pursuant to this Code section, a deployer may
designate the statement or documentation as including proprietary information or a trade
secret. To the extent that any information contained in the risk management policy, impact
assessment, or records is subject to attorney-client privilege or work-product protection,
the disclosure does not constitute a waiver of the privilege or protection.
10-16-10.
A deployer's compliance with the provisions of this chapter shall not constitute a defense
in a civil or administrative action regarding claims that the deployer violated any other
provision of this chapter or any other law.
</ins>
<ins>10-16-11.
(a) Except as provided in subsection (b) of this Code section, a deployer or other developer
that deploys, offers, sells, leases, licenses, gives, or otherwise makes available an artificial
intelligence system that is intended to interact with consumers shall ensure the disclosure
to each consumer who interacts with the artificial intelligence system that the consumer is
interacting with an artificial intelligence system.
(b) Disclosure is not required under subsection (a) of this Code section under
circumstances in which it would be obvious to a reasonable person that the person is
interacting with an artificial intelligence system.
10-16-12.
(a) Nothing in this chapter shall be construed to restrict a developer's, a deployer's, or other
person's ability to:
(1) Comply with federal, state, or municipal laws, ordinances, or regulations;
(2) Comply with a civil, criminal, or regulatory inquiry, investigation, subpoena, or
summons by a federal, state, municipal, or other governmental authority;
(3) Cooperate with a law enforcement agency concerning conduct or activity that the
developer, deployer, or other person reasonably and in good faith believes may violate
federal, state, or municipal laws, ordinances, or regulations;
(4) Comply with the rules of evidence in an ongoing court proceeding;
(5) Take immediate steps to protect an interest that is essential for the life or physical
safety of a consumer or another individual;
(6) Conduct research, testing, and development activities regarding an artificial
intelligence system or model, other than testing conducted under real-world conditions,
before the artificial intelligence system or model is used to make, or assist in making, a
consequential decision, or is otherwise placed on the market, deployed, or put into
service, as applicable;
</ins>
<ins>(7) Effectuate a product recall; or
(8) Assist another developer, deployer, or person with any of the obligations imposed
under this chapter.
(b) Nothing in this chapter applies to any artificial intelligence system that is acquired by
or for the federal government or any federal agency or department, including the United
States Department of Commerce, the United States Department of Defense, or the National
Aeronautics and Space Administration, unless the artificial intelligence system is an
automated decision system that is used to make, or assist in making, a decision concerning
employment or housing.
(c) If a developer, a deployer, or other person engages in an action pursuant to an
exemption set forth in this Code section, such developer, deployer, or other person bears
the burden of demonstrating that the action qualifies for the exemption.
(d) If a developer or deployer withholds information pursuant to an exemption set forth
in this Code section for which disclosure would otherwise be required by this chapter, such
developer or deployer shall notify the subject of disclosure and provide a basis for
withholding the information. Such notification shall comply with the requirements of
subsection (c) of Code Section 10-16-4.
10-16-13.
(a) A violation of the requirements established in this chapter shall be enforceable through
the provisions of Part 2 of Article 15 of Chapter 1 of this title, the 'Fair Business Practices
Act of 1975.'
(b) In any action commenced by the Attorney General to enforce this chapter, it is an
affirmative defense that the developer, deployer, or other person:
(1) Discovers a violation of this chapter as a result of:
(A) Adversarial testing or red teaming, as those terms are defined or used by the
National Institute of Standards and Technology; or
</ins>
<ins>(B) An internal review process;
(2) Cures the violation within seven days and reports the violation to the Attorney
General and any affected consumers;
(3) Is otherwise in compliance with the provisions of this chapter and:
(A) The latest version of the Artificial Intelligence Risk Management Framework
published by the National Institute of Standards and Technology of the United States
Department of Commerce and standard ISO/IEC 42001 of the International
Organization for Standardization;
(B) Another nationally or internationally recognized risk management framework for
artificial intelligence systems, if the standards are substantially equivalent to or more
stringent than the requirements of this chapter; or
(C) Any risk management framework for artificial intelligence systems that the
Attorney General, in the Attorney General's discretion, may designate and, if
designated, shall publicly disseminate; and
(4) Demonstrates that the violation was inadvertent, affected fewer than 100 consumers,
and could not have been discovered through reasonable diligence.
(c) A developer, deployer, or other person bears the burden of demonstrating to the
Attorney General that the requirements of subsection (b) of this Code section have been
satisfied.
(d) Nothing in this chapter, including the enforcement authority granted to the Attorney
General under this Code section, preempts or otherwise affects any right, claim, remedy,
presumption, or defense available at law or in equity. A rebuttable presumption or
affirmative defense established under this chapter applies only to an enforcement action
brought by the Attorney General pursuant to this Code section and does not apply to any
right, claim, remedy, presumption, or defense available at law or in equity.
</ins>
<ins>10-16-14.
The Attorney General may promulgate rules as necessary for the purpose of implementing
and enforcing this chapter.
10-16-15.
This chapter is declared to be remedial, with the purposes of protecting consumers and
ensuring consumers receive information about consequential decisions affecting them. The
provisions of this chapter granting rights or protections to consumers shall be construed
broadly and exemptions construed narrowly."
</ins> SECTION 2.
All laws and parts of laws in conflict with this Act are repealed.