A 8295: Regulates automated decision-making by government agencies; requires agencies to conduct impact assessments; requires disclosure of automated decision-making tools utilized by governmental agencies.

  
  STATE OF NEW YORK ________________________________________________________________________ 8295 2025-2026 Regular Sessions  IN ASSEMBLY May 12, 2025 ___________ Introduced by M. of A. OTIS -- read once and referred to the Committee on Science and Technology AN ACT to amend the state technology law, in relation to automated deci- sion-making by government agencies The People of the State of New York, represented in Senate and Assem- bly, do enact as follows: 1 Section 1. The state technology law is amended by adding a new article 2 5 to read as follows: 3 ARTICLE V 4 AUTOMATED DECISION-MAKING IN GOVERNMENT AGENCIES 5 Section 501. Definitions. 6 502. Disclosure of automated decision-making tools by government 7 agencies. 8 503. Impact assessments. 9 504. Submission to the governor and legislature. 10 § 501. Definitions. For the purpose of this article: 11 1. "Automated decision-making tool" shall mean any software that uses 12 algorithms, computational models, or artificial intelligence techniques, 13 or a combination thereof, to automate, support, or replace human deci- 14 sion-making. "Automated decision-making tool" shall not include any 15 software used primarily for basic computerized processes, such as calcu- 16 lators, spellcheck tools, autocorrect functions, spreadsheets, electron- 17 ic communications, or any tool that relates only to internal management 18 affairs such as ordering office supplies or processing payments, and 19 that do not materially affect the rights, liberties, benefits, safety or 20 welfare of any individual within the state. 21 2. "Meaningful human review" means review, oversight and control of 22 the automated decision-making process by one or more individuals who 23 understand the risks, limitations, and functionality of, and are trained 24 to use, the automated decision-making tool and who have the authority to 25 intervene or alter the decision under review, including but not limited EXPLANATION--Matter in italics (underscored) is new; matter in brackets [ ] is old law to be omitted. LBD11535-06-5 
 A. 8295 2 1 to the ability to approve, deny, or modify any decision recommended or 2 made by the automated tool. 3 3. "Government agency" shall mean: (a) the state or civil division 4 thereof; (b) a county, city, town or village; (c) a school district, 5 board of cooperative educational services, vocational education and 6 extension board or a school district as enumerated in section one of 7 chapter five hundred sixty-six of the laws of nineteen hundred sixty- 8 seven, as amended; (d) the state university of New York; (e) the city 9 university of New York; (f) a public improvement or special district 10 including police or fire districts; (g) a public authority, commission 11 or public benefit corporation; or (h) any other public corporation, 12 agency, instrumentality or unit of government which exercises govern- 13 mental power under the laws of this state. 14 § 502. Disclosure of automated decision-making tools by government 15 agencies. Any state agency that utilizes an automated decision-making 16 tool, as defined in section five hundred one of this article, shall 17 publish a list of such automated decision-making tools on such state 18 agency's website no later than the thirtieth of December next succeeding 19 the date on which this section takes effect, and annually thereafter. 20 Such disclosure shall include: 21 1. a description of the automated decision-making tool utilized 22 by such state agency; 23 2. the date that the state agency use of such automated decision- 24 making tool began; 25 3. a summary of the purpose and use of such automated decision- 26 making tool; and 27 4. any other information deemed relevant by the agency. 28 § 503. Impact assessments. 1. Government agencies seeking to utilize 29 or apply an automated decision-making tool permitted under section five 30 hundred two of this article with continued and operational meaningful 31 human review shall conduct or have conducted an impact assessment 32 substantially completed and bearing the signature of one or more indi- 33 viduals responsible for meaningful human review for the lawful applica- 34 tion and use of such automated decision-making tool. Following the first 35 impact assessment, an impact assessment shall be conducted in accordance 36 with this section at least once every two years. An impact assessment 37 shall be conducted prior to any material change to the automated deci- 38 sion-making tool that may change the outcome or effect of such tool. 39 Such impact assessments shall include: 40 (a) a description of the objectives of the automated decision-making 41 tool; 42 (b) an evaluation of the ability of the automated decision-making tool 43 to achieve its stated objectives; 44 (c) a description and evaluation of the objectives and development of 45 the automated decision-making including: 46 (i) a summary of the underlying algorithms, computational modes, and 47 artificial intelligence tools that are used within the automated deci- 48 sion-making tool; and 49 (ii) the design and training data used to develop the automated deci- 50 sion-making tool process; 51 (d) testing for: 52 (i) accuracy, fairness, bias and discrimination, and an assessment of 53 whether the use of the automated decision-making tool produces discrimi- 54 natory results on the basis of a consumer's or a class of consumers' 55 actual or perceived race, color, ethnicity, religion, national origin, 56 sex, gender, gender identity, sexual orientation, familial status, biom- 
 A. 8295 3 1 etric information, lawful source of income, or disability and outlines 2 mitigations for any identified performance differences in outcomes 3 across relevant groups impacted by such use; 4 (ii) any cybersecurity vulnerabilities and privacy risks resulting 5 from the deployment and use of the automated decision-making tool, and 6 the development or existence of safeguards to mitigate the risks; 7 (iii) any public health or safety risks resulting from the deployment 8 and use of the automated decision-making tool; 9 (iv) any reasonably foreseeable misuse of the automated decision-mak- 10 ing tool and the development or existence of safeguards against such 11 misuse; 12 (e) the extent to which the deployment and use of the automated deci- 13 sion-making tool requires input of sensitive and personal data, how that 14 data is used and stored, and any control users may have over their data; 15 and 16 (f) the notification mechanism or procedure, if any, by which individ- 17 uals impacted by the utilization of the automated decision-making tool 18 may be notified of the use of such automated decision-making tool and of 19 the individual's personal data, and informed of their rights and options 20 relating to such use. 21 2. Notwithstanding the provisions of this article or any other law, if 22 an impact assessment finds that the automated decision-making tool 23 produces discriminatory or biased outcomes, the government agency shall 24 cease any utilization, application, or function of such automated deci- 25 sion-making tool, and of any information produced using such tool. 26 § 504. Submission to the governor and legislature. 1. Each impact 27 assessment conducted pursuant to this article shall be submitted to the 28 governor, the temporary president of the senate, and the speaker of the 29 assembly at least thirty days prior to the implementation of the auto- 30 mated decision-making tool that is the subject of such assessment. 31 2. (a) The impact assessment of an automated decision-making tool 32 shall be published on the website of the relevant government agency. 33 (b) If the government agency makes a determination that the disclosure 34 of any information required in the impact assessment would result in a 35 substantial negative impact on health or safety of the public, infringe 36 upon the privacy rights of individuals, or significantly impair the 37 government agency's ability to protect its information technology or 38 operational assets, such government agency may redact such information, 39 provided that an explanatory statement on the process by which the 40 government agency made such determination is published along with the 41 redacted impact assessment. 42 (c) If the impact assessment covers any automated decision-making tool 43 that includes technology that is used to prevent, detect, protect 44 against or respond to security incidents, identity theft, fraud, harass- 45 ment, malicious or deceptive activities or other illegal activity, 46 preserve the integrity or security of tools, or to investigate, report 47 or prosecute those responsible for any such malicious or deceptive 48 action, such government agency may redact such information for the 49 purposes of this subdivision, provided that an explanatory statement on 50 the process by which the government agency made such determination is 51 published along with the redacted impact assessment. 52 § 2. The state technology law is amended by adding a new section 103-f 53 to read as follows: 54 § 103-f. Automated decision-making tool inventory. 1. The office shall 55 maintain an inventory of state automated decision-making tools. The 56 office shall issue guidance to state agencies identifying the data 
 A. 8295 4 1 elements to be collected and submitted to the office for such inventory, 2 including but not limited to the purpose and uses of such automated 3 decision-making tools. The inventory shall be posted on the New York 4 state open data website on the thirtieth of December next succeeding the 5 date on which this section takes effect, and annually thereafter. State 6 agencies shall submit information required by the office at least sixty 7 days in advance of the annual publication date. The office may withhold 8 certain information if it determines disclosure of this information 9 would jeopardize the security of information technology assets, or as 10 prescribed by article six of the public officers law. 11 2. For purposes of this section, "automated decision-making tool" 12 shall have the same meaning as the term is defined in section five 13 hundred one of this chapter. 14 3. The office may ask and shall receive from any state agency any 15 information or assistance necessary to carry out its powers and duties 16 under this section. 17 4. The office shall submit a copy of the artificial intelligence 18 inventory to the governor, the temporary president of the senate, and 19 the speaker of the assembly. 20 § 3. Disclosure of existing automated decision-making tools. Any 21 government agency, that directly or indirectly, utilizes an automated 22 decision-making tool, as defined in section 501 of the state technology 23 law, shall submit to the legislature a disclosure on the use of such 24 tool, no later than one year after the effective date of this section. 25 Such disclosure shall include: 26 (a) a description of the automated decision-making tool utilized by 27 such agency; 28 (b) a list of any software vendors related to such automated deci- 29 sion-making tool; 30 (c) the date that the use of such tool began; 31 (d) a summary of the purpose and use of such tool, including a 32 description of human decision-making and discretion supported or 33 replaced by the automated decision-making tool; 34 (e) whether any impact assessments for the automated decision-making 35 tool were conducted and the dates and summaries of the results of such 36 assessments where applicable; and 37 (f) any other information deemed relevant by the agency. 38 § 4. This act shall take effect immediately, provided that section one 39 of this act shall take effect one year after it shall have become a law.