Vermont 2025-2026 Regular Session

Vermont House Bill H0340 Compare Versions

Only one version of the bill is available at this time.

Old	New	Differences
1	1	BILL AS INTRODUCED H.340
2	2	2025 Page 1 of 23
3	3
4	4
5	5	VT LEG #378965 v.1
6	6	H.340 1
7	7	Introduced by Representatives Priestley of Bradford, Arsenault of Williston, 2
8	8	Berbeco of Winooski, Cole of Hartford, Logan of Burlington, 3
9	9	Masland of Thetford, McGill of Bridport, Sibilia of Dover, and 4
10	10	White of Waitsfield 5
11	11	Referred to Committee on 6
12	12	Date: 7
13	13	Subject: Commerce and trade; consumer protection; artificial intelligence 8
14	14	Statement of purpose of bill as introduced: This bill proposes to regulate 9
15	15	developers and deployers of automated decision systems used in consequential 10
16	16	decisions in an effort to avoid algorithmic discrimination towards consumers. 11
17	17	An act relating to regulating developers and deployers of certain automated 12
18	18	decision systems 13
19	19	It is hereby enacted by the General Assembly of the State of Vermont: 14
20	20	Sec. 1. 9 V.S.A. chapter 118 is added to read: 15
21	21	CHAPTER 118. ARTIFICIAL INTELLIGENCE 16
22	22	Subchapter 1. Algorithmic Discrimination and Automated Decision Systems 17
23	23	§ 4193a. DEFINITIONS 18
24	24	As used in this subchapter: 19 BILL AS INTRODUCED H.340
25	25	2025 Page 2 of 23
26	26
27	27
28	28	VT LEG #378965 v.1
29	29	(1)(A) “Algorithmic discrimination” means any condition in which the 1
30	30	use of an automated decision system results in a differential treatment or 2
31	31	impact that disfavors an individual on the basis of the individual’s actual or 3
32	32	perceived age, color, disability, ethnicity, genetic information, immigration or 4
33	33	citizenship status, limited proficiency in the English language, national origin, 5
34	34	race, religion, reproductive health, sex, sexual orientation, gender identity, 6
35	35	veteran status, or other classification protected under the laws of this State or 7
36	36	federal law. 8
37	37	(B) “Algorithmic discrimination” does not include: 9
38	38	(i) a developer’s or deployer’s testing of the developer’s or 10
39	39	deployer’s own automated decision system to identify, mitigate, and prevent 11
40	40	discrimination; 12
41	41	(ii) expanding an applicant, customer, or participant pool to 13
42	42	increase diversity or redress historical discrimination; or 14
43	43	(iii) an act or omission by or on behalf of a private club or other 15
44	44	establishment that is not in fact open to the public, as set forth in Title II of the 16
45	45	federal Civil Rights Act of 1964, 42 U.S.C.§ 2000a(e), as amended. 17
46	46	(2) “Auditor” refers to an independent entity, including an individual, a 18
47	47	nonprofit, a firm, a corporation, a partnership, a cooperative, or an association, 19
48	48	commissioned to perform an audit. 20 BILL AS INTRODUCED H.340
49	49	2025 Page 3 of 23
50	50
51	51
52	52	VT LEG #378965 v.1
53	53	(3)(A) “Automated decision system” means a computational process 1
54	54	derived from machine learning, statistical modeling, data analytics, or artificial 2
55	55	intelligence that issues an output, including a score, classification, or 3
56	56	recommendation. 4
57	57	(B) “Automated decision system” does not include any software used 5
58	58	primarily for basic computerized processes, such as antimalware, antivirus, 6
59	59	autocorrect functions, calculators, databases, data storage, electronic 7
60	60	communications, firewall, internet domain registration, website loading, 8
61	61	networking, spam and robocall filtering, spellcheck tools, spreadsheets, web 9
62	62	caching, web hosting, or any tool that relates only to nonemployment internal 10
63	63	management affairs such as ordering office supplies or processing payments, 11
64	64	and that do not materially affect the rights, liberties, benefits, safety, or welfare 12
65	65	of any individual within the State. 13
66	66	(4) “Consequential decision” means a decision that has a material, legal, 14
67	67	or similarly significant effect on the provision or denial to any consumer of, or 15
68	68	the cost, terms, or availability of: 16
69	69	(A) educational and vocational training, including: 17
70	70	(i) assessment or grading, including detecting student cheating or 18
71	71	plagiarism; 19
72	72	(ii) accreditation; 20
73	73	(iii) certification; 21 BILL AS INTRODUCED H.340
74	74	2025 Page 4 of 23
75	75
76	76
77	77	VT LEG #378965 v.1
78	78	(iv) admissions or enrollment; and 1
79	79	(v) financial aid or scholarships; 2
80	80	(B) employment or an employment opportunity, including: 3
81	81	(i) pay or promotion; 4
82	82	(ii) hiring or termination; and 5
83	83	(iii) automated task allocation; 6
84	84	(C) housing or lodging, including long-term or short-term rentals; 7
85	85	(D) essential utilities, including electricity, heat, water, internet or 8
86	86	telecommunications access, or transportation; 9
87	87	(E) family planning, including adoption services or reproductive 10
88	88	services, as well as assessments related to child protection services; 11
89	89	(F) health care or health insurance, including mental health care, 12
90	90	dental, or vision; 13
91	91	(G) financial services, including a financial service provided by a 14
92	92	mortgage company, mortgage broker, or creditor; 15
93	93	(H) law enforcement activities, including the allocation of law 16
94	94	enforcement personnel or assets, the enforcement of laws, maintaining public 17
95	95	order, or managing public safety; 18
96	96	(I) government services, including the determination, allocation, or 19
97	97	denial of public benefits and services; and 20 BILL AS INTRODUCED H.340
98	98	2025 Page 5 of 23
99	99
100	100
101	101	VT LEG #378965 v.1
102	102	(J) a reasonable accommodation or other right granted under the civil 1
103	103	rights laws of this State. 2
104	104	(5) “Consumer” means an individual who is a resident of the State. 3
105	105	(6) “Deployer” means a person doing business in this State that uses an 4
106	106	automated decision system in a consequential decision in the State or provides 5
107	107	an automated decision system for use in a consequential decision by the 6
108	108	general public in the State. A developer shall also be considered a deployer if 7
109	109	its actions satisfy this definition. 8
110	110	(7) “Deployer-employer” means a deployer that is an employer. 9
111	111	(8) “Developer” means a person doing business in this State that 10
112	112	designs, codes, or produces an automated decision system for use in a 11
113	113	consequential decision or creates a substantial change with respect to an 12
114	114	automated decision system for use in a consequential decision, whether for its 13
115	115	own use in the State or for use by a third party in the State. 14
116	116	(9) “Developer-employer” means a developer that is an employer. 15
117	117	(10) “Employee” means an individual who performs services for and 16
118	118	under the control and direction of an employer for wages or other 17
119	119	remuneration, including former employees, or natural persons employed as 18
120	120	independent contractors to carry out work in furtherance of an employer’s 19
121	121	business enterprise who are not themselves employers. 20 BILL AS INTRODUCED H.340
122	122	2025 Page 6 of 23
123	123
124	124
125	125	VT LEG #378965 v.1
126	126	(11) “Employer” means any person, firm, partnership, institution, 1
127	127	corporation, or association that employs one or more employees. 2
128	128	(12) “Software stack” means the group of individual software 3
129	129	components that work together to support the execution of an automated 4
130	130	decision system. 5
131	131	(13) “Substantial change” means any: 6
132	132	(A) deliberate change to an automated decision system that would 7
133	133	result in material inaccuracies in the reports created under section 4193f of this 8
134	134	title; or 9
135	135	(B) substantial change in the data that the automated decision system 10
136	136	uses as input or training data. 11
137	137	§ 4193b. ALGORITHMIC DISCRIMINATION 12
138	138	It shall be unlawful discrimination for a developer or deployer to use, sell, 13
139	139	or share an automated decision system for use in a consequential decision or a 14
140	140	product featuring an automated decision system for use in a consequential 15
141	141	decision that produces algorithmic discrimination. 16
142	142	§ 4193c. DEPLOYER AND DEVELOPER OBLIGATIONS 17
143	143	(a) Any deployer that employs an automated decision system for a 18
144	144	consequential decision shall inform the consumer prior to the use of the system 19
145	145	for a consequential decision in clear, conspicuous, and consumer-friendly 20
146	146	terms, made available in each of the languages in which the company offers its 21 BILL AS INTRODUCED H.340
147	147	2025 Page 7 of 23
148	148
149	149
150	150	VT LEG #378965 v.1
151	151	end services, that automated decision systems will be used to make a 1
152	152	consequential decision or to assist in making a consequential decision. 2
153	153	(b) Any notice provided by a deployer to the consumer pursuant to 3
154	154	subsection (a) of this section shall include: 4
155	155	(1) a description of the personal characteristics or attributes that the 5
156	156	system will measure or assess; 6
157	157	(2) the method by which the system measures or assesses those 7
158	158	attributes or characteristics; 8
159	159	(3) how those attributes or characteristics are relevant to the 9
160	160	consequential decisions for which the system should be used; 10
161	161	(4) any human components of the system; 11
162	162	(5) how any automated components of the system are used to inform the 12
163	163	consequential decision; and 13
164	164	(6) a direct link to a publicly accessible page on the deployer’s website 14
165	165	that contains a plain-language description of the: 15
166	166	(A) system’s outputs; 16
167	167	(B) types and sources of data collected from natural persons and 17
168	168	processed by the system when it is used to make, or assists in making, a 18
169	169	consequential decision; and 19
170	170	(C) results of the most recent impact assessment, or an active link to 20
171	171	a web page where a consumer can review those results. 21 BILL AS INTRODUCED H.340
172	172	2025 Page 8 of 23
173	173
174	174
175	175	VT LEG #378965 v.1
176	176	(c) Any deployer that employs an automated decision system for a 1
177	177	consequential decision shall provide the consumer with a single notice 2
178	178	containing a plain-language explanation of the decision that identifies the 3
179	179	principal reason or reasons for the consequential decision, including: 4
180	180	(1) the identity of the developer of the automated decision system used 5
181	181	in the consequential decision, if the deployer is not also the developer; 6
182	182	(2) a description of what the output of the automated decision system is, 7
183	183	such as a score, recommendation, or other similar description; 8
184	184	(3) the degree and manner to which the automated decision system 9
185	185	contributed to the decision; 10
186	186	(4) the types and sources of data processed by the automated decision 11
187	187	system in making the consequential decision; 12
188	188	(5) a plain language explanation of how the consumer’s personal data 13
189	189	informed the consequential decision; and 14
190	190	(6) what actions, if any, the consumer might have taken to secure a 15
191	191	different decision and the actions that the consumer might take to secure a 16
192	192	different decision in the future. 17
193	193	(d)(1) A deployer shall provide and explain a process for a consumer to 18
194	194	appeal a decision, which shall at minimum allow the consumer to: 19
195	195	(A) formally contest the decision; 20
196	196	(B) provide information to support their position; and 21 BILL AS INTRODUCED H.340
197	197	2025 Page 9 of 23
198	198
199	199
200	200	VT LEG #378965 v.1
201	201	(C) obtain meaningful human review of the decision. 1
202	202	(2) For an appeal made pursuant to subdivision (1) of this subsection: 2
203	203	(A) a deployer shall designate a human reviewer who: 3
204	204	(i) is trained and qualified to understand the consequential 4
205	205	decision being appealed, the consequences of the decision for the consumer, 5
206	206	how to evaluate and how to serve impartially, including by avoiding 6
207	207	prejudgment of the facts at issue, conflict of interest, and bias; 7
208	208	(ii) does not have a conflict of interest for or against the deployer 8
209	209	or the consumer; 9
210	210	(iii) was not involved in the initial decision being appealed; 10
211	211	(iv) shall enjoy protection from dismissal or its equivalent, 11
212	212	disciplinary measures, or other adverse treatment for exercising their functions 12
213	213	under this section; and 13
214	214	(v) shall be allocated sufficient human resources by the deployer 14
215	215	to conduct an effective appeal of the decision; and 15
216	216	(B) the human reviewer shall consider the information provided by 16
217	217	the consumer in their appeal and may consider other sources of information 17
218	218	relevant to the consequential decision. 18
219	219	(3) A deployer shall respond to a consumer’s appeal not later than 45 19
220	220	after receipt of the appeal. That period may be extended once by an additional 20
221	221	45 days where reasonably necessary, taking into account the complexity and 21 BILL AS INTRODUCED H.340
222	222	2025 Page 10 of 23
223	223
224	224
225	225	VT LEG #378965 v.1
226	226	number of appeals. The deployer shall inform the consumer of any extension 1
227	227	not later than 45 days after receipt of the appeal, together with the reasons for 2
228	228	the delay. 3
229	229	(e) The deployer or developer of an automated decision system is legally 4
230	230	responsible for the quality and accuracy of all consequential decisions made, 5
231	231	including any bias or algorithmic discrimination resulting from the operation 6
232	232	of the automated decision system. 7
233	233	(f) A developer shall not use, sell, or share an automated decision system 8
234	234	for use in a consequential decision or a product featuring an automated 9
235	235	decision system for use in a consequential decision that has not passed an 10
236	236	independent audit, in accordance with section 4193e of this title. If an 11
237	237	independent audit finds that an automated decision system for use in a 12
238	238	consequential decision does produce algorithmic discrimination, the developer 13
239	239	shall not use, sell, or share the system until the algorithmic discrimination has 14
240	240	been proven to be rectified by a post-adjustment audit. 15
241	241	(g) Except as provided in subsection 4193e(a) of this title, the rights and 16
242	242	obligations under this section may not be waived by any person, partnership, 17
243	243	association, or corporation. 18
244	244	§ 4193d. WHISTLEBLOWER PROTECTIONS 19
245	245	(a) Developer-employers and deployer-employers of automated decision 20
246	246	systems used in consequential decisions shall not: 21 BILL AS INTRODUCED H.340
247	247	2025 Page 11 of 23
248	248
249	249
250	250	VT LEG #378965 v.1
251	251	(1) prevent an employee from disclosing information to the Attorney 1
252	252	General, including through terms and conditions of employment or seeking 2
253	253	to enforce terms and conditions of employment, if the employee has reasonable 3
254	254	cause to believe the information indicates a violation of this subchapter; or 4
255	255	(2) retaliate against an employee for disclosing information to the 5
256	256	Attorney General pursuant to subdivision (1) of this subsection. 6
257	257	(b) Developer-employers and deployer-employers of automated decision 7
258	258	systems used in consequential decisions shall provide a clear notice to all 8
259	259	employees working on automated decision systems of their rights and 9
260	260	responsibilities under this subchapter, including the right of employees of 10
261	261	contractors and subcontractors to use the developer’s internal process for 11
262	262	making protected disclosures pursuant to subsection (c) of this section. A 12
263	263	developer-employer or deployer-employer is presumed to be in compliance 13
264	264	with the requirements of this subsection if the developer-employer or deployer-14
265	265	employer does either of the following: 15
266	266	(1) at all times: 16
267	267	(A) posts and displays within all workplaces maintained by 17
268	268	the developer-employer or deployer-employer a notice to all employees of 18
269	269	their rights and responsibilities under this subchapter; 19
270	270	(B) ensures that all new employees receive equivalent notice; and 20 BILL AS INTRODUCED H.340
271	271	2025 Page 12 of 23
272	272
273	273
274	274	VT LEG #378965 v.1
275	275	(C) ensures that employees who work remotely periodically receive 1
276	276	an equivalent notice; or 2
277	277	(2) not less frequently than once every year, provides written notice 3
278	278	to all employees of their rights and responsibilities under this subchapter and 4
279	279	ensures that the notice is received and acknowledged by all of those 5
280	280	employees. 6
281	281	(c) Each developer-employer shall provide a reasonable internal process 7
282	282	through which an employee may anonymously disclose information to the 8
283	283	developer if the employee believes in good faith that the information indicates 9
284	284	that the developer has violated any provision of this subchapter or any other 10
285	285	law, or has made false or materially misleading statements related to its safety 11
286	286	and security protocol, or failed to disclose known risks to employees, 12
287	287	including, at a minimum, a monthly update to the person who made the 13
288	288	disclosure regarding the status of the developer’s investigation of the 14
289	289	disclosure and the actions taken by the developer in response to the disclosure. 15
290	290	§ 4193e. AUDITS 16
291	291	(a) Prior to deployment of an automated decision system for use in a 17
292	292	consequential decision, six months after deployment, and at least every 18 18
293	293	months thereafter for each calendar year an automated decision system is in 19
294	294	use in consequential decisions after the first post-deployment audit, the 20
295	295	developer and deployer shall be jointly responsible for ensuring that an 21 BILL AS INTRODUCED H.340
296	296	2025 Page 13 of 23
297	297
298	298
299	299	VT LEG #378965 v.1
300	300	independent audit is conducted in compliance with the provisions of this 1
301	301	section to ensure that the product does not produce algorithmic discrimination 2
302	302	and complies with the provisions of this subchapter. The developer and 3
303	303	deployer shall enter into a contract specifying which party is responsible for 4
304	304	the costs, oversight, and results of the audit. Absent an agreement of 5
305	305	responsibility through contract, the developer and deployer shall be jointly and 6
306	306	severally liable for any violations of this section. Regardless of final findings, 7
307	307	the deployer or developer shall deliver all audits conducted under this section 8
308	308	to the Attorney General. 9
309	309	(b) A deployer or developer may contract with more than one auditor to 10
310	310	fulfill the requirements of this section. 11
311	311	(c) The audit shall include the following: 12
312	312	(1) an analysis of data management policies, including whether personal 13
313	313	or sensitive data relating to a consumer is subject to data security protection 14
314	314	standards that comply with the requirements of applicable State law; 15
315	315	(2) an analysis of the system validity and reliability according to each 16
316	316	specified use case listed in the entity’s reporting document filed by the 17
317	317	developer or deployer pursuant to section 4193f of this title; 18
318	318	(3) a comparative analysis of the system’s performance when used on 19
319	319	consumers of different demographic groups and a determination of whether the 20
320	320	system produces algorithmic discrimination in violation of this subchapter by 21 BILL AS INTRODUCED H.340
321	321	2025 Page 14 of 23
322	322
323	323
324	324	VT LEG #378965 v.1
325	325	each intended and foreseeable identified use as identified by the deployer and 1
326	326	developer pursuant to section 4193f of this title; 2
327	327	(4) an analysis of how the technology complies with existing relevant 3
328	328	federal, State, and local labor, civil rights, consumer protection, privacy, and 4
329	329	data privacy laws; and 5
330	330	(5) an evaluation of the developer’s or deployer’s documented risk 6
331	331	management policy and program as set forth in section 4193g of this title for 7
332	332	conformity with subsection 4193g(a) of this title. 8
333	333	(d) The Attorney General may adopt further rules as necessary to ensure 9
334	334	that audits under this section assess whether or not automated decision systems 10
335	335	used in consequential decisions produce algorithmic discrimination and 11
336	336	otherwise comply with the provisions of this subchapter. 12
337	337	(e) The independent auditor shall have complete and unredacted copies of 13
338	338	all reports previously filed by the deployer or developer pursuant to section 14
339	339	4193f of this title. 15
340	340	(f) An audit conducted under this section shall be completed in its entirety 16
341	341	without the assistance of an automated decision system. 17
342	342	(g)(1) An auditor shall be an independent entity, including an individual, 18
343	343	nonprofit, firm, corporation, partnership, cooperative, or association. 19 BILL AS INTRODUCED H.340
344	344	2025 Page 15 of 23
345	345
346	346
347	347	VT LEG #378965 v.1
348	348	(2) For the purposes of this subchapter, no auditor may be 1
349	349	commissioned by a developer or deployer of an automated decision system 2
350	350	used in consequential decisions if the auditor: 3
351	351	(A) has already been commissioned to provide any auditing or 4
352	352	nonauditing service, including financial auditing, cybersecurity auditing, or 5
353	353	consulting services of any type, to the commissioning company in the past 12 6
354	354	months; 7
355	355	(B) is or was involved in using, developing, integrating, offering, 8
356	356	licensing, or deploying the automated decision system; 9
357	357	(C) has or had an employment relationship with a developer or 10
358	358	deployer that uses, offers, or licenses the automated decision system; or 11
359	359	(D) has or had a direct financial interest or a material indirect 12
360	360	financial interest in a developer or deployer that uses, offers, or licenses the 13
361	361	automated decision system. 14
362	362	(3) Fees paid to auditors may not be contingent on the result of the audit 15
363	363	and the commissioning company shall not provide any incentives or bonuses 16
364	364	for a positive audit result. 17
365	365	(h) The Attorney General may adopt rules to ensure: 18
366	366	(1) the independence of auditors under this section; 19 BILL AS INTRODUCED H.340
367	367	2025 Page 16 of 23
368	368
369	369
370	370	VT LEG #378965 v.1
371	371	(2) that teams conducting audits incorporate feedback from communities 1
372	372	that may foreseeably be the subject of algorithmic discrimination with respect 2
373	373	to the automated decision system being audited; and 3
374	374	(3) that the requirements of an audit as set forth in subsection (c) of this 4
375	375	section are updated to reflect responsible evaluation practices and include 5
376	376	adequate information to enforce this subchapter. 6
377	377	§ 4193f. AUTOMATED DECISION SYSTEM REPORTING 7
378	378	REQUIREMENTS 8
379	379	(a) Every developer and deployer of an automated decision system used in 9
380	380	a consequential decision shall comply with the reporting requirements of this 10
381	381	section. Regardless of final findings, reports shall be filed with the Attorney 11
382	382	General prior to deployment of an automated decision system used in a 12
383	383	consequential decision and then annually, or after each substantial change to 13
384	384	the system, whichever comes first. 14
385	385	(b) Together with each report required to be filed under this section, 15
386	386	developers and deployers shall file with the Attorney General a copy of the last 16
387	387	completed independent audit required by this subchapter and a legal attestation 17
388	388	that the automated decision system used in a consequential decision: 18
389	389	(1) does not violate any provision of this subchapter; or 19 BILL AS INTRODUCED H.340
390	390	2025 Page 17 of 23
391	391
392	392
393	393	VT LEG #378965 v.1
394	394	(2) may violate or does violate one or more provisions of this article, 1
395	395	that there is a plan of remediation to bring the automated decision system into 2
396	396	compliance with this subchapter, and a summary of the plan of remediation. 3
397	397	(c) Developers of automated decision systems shall file with the Attorney 4
398	398	General a report containing the following: 5
399	399	(1) a description of the system including: 6
400	400	(A) a description of the system’s software stack; 7
401	401	(B) the purpose of the system and its expected benefits; and 8
402	402	(C) the system’s current and intended uses, including what 9
403	403	consequential decisions it will support and what stakeholders will be impacted; 10
404	404	(2) the intended outputs of the system and whether the outputs can be or 11
405	405	are otherwise appropriate to be used for any purpose not previously articulated; 12
406	406	(3) the methods for training of their models including: 13
407	407	(A) any pre-processing steps taken to prepare datasets for the training 14
408	408	of a model underlying an automated decision system; 15
409	409	(B) descriptions of the datasets upon which models were trained and 16
410	410	evaluated, how and why datasets were collected and the sources of those 17
411	411	datasets, and how that training data will be used and maintained; 18
412	412	(C) the quality and appropriateness of the data used in the automated 19
413	413	decision system’s design, development, testing, and operation; 20 BILL AS INTRODUCED H.340
414	414	2025 Page 18 of 23
415	415
416	416
417	417	VT LEG #378965 v.1
418	418	(D) whether the data contains sufficient breadth to address the range 1
419	419	of real-world inputs the automated decision system might encounter and how 2
420	420	any data gaps have been addressed; and 3
421	421	(E) steps taken to ensure compliance with privacy, data privacy, 4
422	422	data security, and copyright laws; 5
423	423	(4) use and data management policies; 6
424	424	(5) any other information necessary to allow the deployer to understand 7
425	425	the outputs and monitor the system for compliance with this subchapter; 8
426	426	(6) any other information necessary to allow the deployer to comply 9
427	427	with the requirements of subsection (d) of this section; 10
428	428	(7) a description of the system’s capabilities and any developer-imposed 11
429	429	limitations, including capabilities outside of its intended use, when the system 12
430	430	should not be used, any safeguards or guardrails in place to protect against 13
431	431	unintended, inappropriate, or disallowed uses, and testing of any safeguards or 14
432	432	guardrails; 15
433	433	(8) an internal risk assessment including documentation and results of 16
434	434	testing conducted to identify all reasonably foreseeable risks related to 17
435	435	algorithmic discrimination, validity and reliability, privacy and autonomy, and 18
436	436	safety and security, as well as actions taken to address those risks, and 19
437	437	subsequent testing to assess the efficacy of actions taken to address risks; and 20 BILL AS INTRODUCED H.340
438	438	2025 Page 19 of 23
439	439
440	440
441	441	VT LEG #378965 v.1
442	442	(9) whether the system should be monitored and, if so, how the system 1
443	443	should be monitored. 2
444	444	(d) Deployers of automated decision systems used in consequential 3
445	445	decisions shall file with the Attorney General a report containing the 4
446	446	following: 5
447	447	(1) a description of the system, including: 6
448	448	(A) a description of the system’s software stack; 7
449	449	(B) the purpose of the system and its expected benefits; and 8
450	450	(C) the system’s current and intended uses, including what 9
451	451	consequential decisions it will support and what stakeholders will be impacted; 10
452	452	(2) the intended outputs of the system and whether the outputs can be 11
453	453	or are otherwise appropriate to be used for any purpose not previously 12
454	454	articulated; 13
455	455	(3) whether the deployer collects revenue or plans to collect revenue 14
456	456	from use of the automated decision system in a consequential decision and, if 15
457	457	so, how it monetizes or plans to monetize use of the system; 16
458	458	(4) whether the system is designed to make consequential decisions 17
459	459	itself or whether and how it supports consequential decisions; 18
460	460	(5) a description of the system’s capabilities and any deployer-imposed 19
461	461	limitations, including capabilities outside of its intended use, when the system 20
462	462	should not be used, any safeguards or guardrails in place to protect against 21 BILL AS INTRODUCED H.340
463	463	2025 Page 20 of 23
464	464
465	465
466	466	VT LEG #378965 v.1
467	467	unintended, inappropriate, or disallowed uses, and testing of any safeguards or 1
468	468	guardrails; 2
469	469	(6) an assessment of the relative benefits and costs to the consumer 3
470	470	given the system’s purpose, capabilities, and probable use cases; 4
471	471	(7) an internal risk assessment including documentation and results of 5
472	472	testing conducted to identify all reasonably foreseeable risks related to 6
473	473	algorithmic discrimination, accuracy and reliability, privacy and autonomy, 7
474	474	and safety and security, as well as actions taken to address those risks, and 8
475	475	subsequent testing to assess the efficacy of actions taken to address risks; and 9
476	476	(8) whether the system should be monitored and, if so, how the 10
477	477	system should be monitored. 11
478	478	(e) The Attorney General shall: 12
479	479	(1) adopt rules: 13
480	480	(A) for a process whereby developers and deployers may request 14
481	481	redaction of portions of reports required under this section to ensure that they 15
482	482	are not required to disclose sensitive and protected information; and 16
483	483	(B) to determine reasonably foreseeable risks related to algorithmic 17
484	484	discrimination, validity and reliability, privacy and autonomy, and safety and 18
485	485	security, pursuant to subsections (c) and (d) of this section; and 19 BILL AS INTRODUCED H.340
486	486	2025 Page 21 of 23
487	487
488	488
489	489	VT LEG #378965 v.1
490	490	(2) maintain an online database that is accessible to the general public 1
491	491	with reports, redacted in accordance with this section, and audits required by 2
492	492	this subchapter, which shall be updated biannually. 3
493	493	(f) For automated decision systems already in deployment for use in 4
494	494	consequential decisions on or before July 1, 2025, developers and deployers 5
495	495	shall not later than 18 months after July 1, 2025 complete and file the reports 6
496	496	and complete the independent audit required by this subchapter. 7
497	497	§ 4193g. RISK MANAGEMENT POLICY AND PROGRAM 8
498	498	(a) Each developer or deployer of automated decision systems used in 9
499	499	consequential decisions shall plan, document, and implement a risk 10
500	500	management policy and program to govern development or deployment, as 11
501	501	applicable, of the automated decision system. The risk management policy and 12
502	502	program shall specify and incorporate the principles, processes, and personnel 13
503	503	that the deployer uses to identify, document, and mitigate known or reasonably 14
504	504	foreseeable risks of algorithmic discrimination covered under section 4193b of 15
505	505	this title. The risk management policy and program shall be an iterative 16
506	506	process planned, implemented, and regularly and systematically reviewed and 17
507	507	updated over the life cycle of an automated decision system, requiring regular, 18
508	508	systematic review and updates, including updates to documentation. A risk 19
509	509	management policy and program implemented and maintained pursuant to this 20
510	510	subsection shall be reasonable considering the: 21 BILL AS INTRODUCED H.340
511	511	2025 Page 22 of 23
512	512
513	513
514	514	VT LEG #378965 v.1
515	515	(1) guidance and standards set forth in version 1.0 of the Artificial 1
516	516	Intelligence Risk Management Framework published by the National Institute 2
517	517	of Standards and Technology in the U.S. Department of Commerce, or the 3
518	518	latest version of the Artificial Intelligence Risk Management Framework 4
519	519	published by the National Institute of Standards and Technology if, in the 5
520	520	Attorney General’s discretion, the latest version of the Artificial Intelligence 6
521	521	Risk Management Framework published by the National Institute of Standards 7
522	522	and Technology in the U.S. Department of Commerce is at least as stringent as 8
523	523	version 1.0; 9
524	524	(2) size and complexity of the developer or deployer; 10
525	525	(3) nature, scope, and intended uses of the automated decision system 11
526	526	developed or deployed for use in consequential decisions; and 12
527	527	(4) sensitivity and volume of data processed in connection with 13
528	528	the automated decision system. 14
529	529	(b) A risk management policy and program implemented pursuant to 15
530	530	subsection (a) of this section may cover multiple automated decision systems 16
531	531	developed by the same developer or deployed by the same deployer for use in 17
532	532	consequential decisions if sufficient. 18
533	533	(c) The Attorney General may require a developer or a deployer to 19
534	534	disclose the risk management policy and program implemented pursuant to 20 BILL AS INTRODUCED H.340
535	535	2025 Page 23 of 23
536	536
537	537
538	538	VT LEG #378965 v.1
539	539	subsection (a) of this section in a form and manner prescribed by the Attorney 1
540	540	General. The Attorney General may evaluate the risk management policy and 2
541	541	program to ensure compliance with this section. 3
542	542	§ 4193h. ENFORCEMENT AND RULEMAKING 4
543	543	(a) A person who violates this subchapter or rules adopted pursuant to this 5
544	544	subchapter commits an unfair and deceptive act in commerce in violation of 6
545	545	section 2453 of this title (Vermont Consumer Protection Act). A consumer 7
546	546	harmed by a violation is eligible to all remedies provided under the Vermont 8
547	547	Consumer Protection Act. 9
548	548	(b) The Attorney General has the same authority to adopt rules to 10
549	549	implement the provisions of this section and to conduct civil investigations, 11
550	550	enter into assurances of discontinuance, bring civil actions, and take other 12
551	551	enforcement actions as provided under chapter 63, subchapter 1 of this title. 13
552	552	Sec. 2. EFFECTIVE DATE 14
553	553	This act shall take effect on July 1, 2025. 15