209:1 New Chapter; Use of Artificial Intelligence by State Agencies. Amend RSA by inserting after chapter 5-C the following new chapter:

CHAPTER 5-D

USE OF ARTIFICIAL INTELLIGENCE BY STATE AGENCIES

5-D:1 Definitions. In this chapter:

I. "Artificial intelligence" or "AI" is the ability of a machine to display human-like capabilities for cognitive tasks such as reasoning, learning, planning, and creativity. AI systems may adapt their behavior to a certain degree by analyzing the effects of previous actions and operating under varying and unpredictable circumstances without significant human oversight.

II. "Generative AI" is AI that can generate text, images, or other media in response to prompts.

III. "Deepfake" means a video, audio, or any other media of a person in which his or her face, body, or voice has been digitally altered so that he or she appears to be someone else, he or she appears to be saying something that he or she has never said, or he or she appears to be doing something that he or she has never done.

IV. "State agency" means any department, commission, board, institution, bureau, office, law enforcement, or other entity, by whatever name called, including the legislative and judicial branches of state government, established in the state constitution, statutes, session laws or executive orders.

5-D:2 Applicability. This chapter shall apply to all computer systems operated by any state agency as defined in RSA 5-D:1, IV. Excepted are systems used in research by state-funded institutions of higher learning. Also excepted are installed consumer systems in common personal use, including, but not limited to facial recognition used to unlock a smartphone.

5-D:3 Prohibition. The following uses of AI by state agencies shall be prohibited:

I. Classifying persons based on behavior, socio-economic status, or personal characteristics resulting in unlawful discrimination against any individual person or group of persons.

II. Real-time and remote biometric identification systems used for surveillance in public spaces, such as facial recognition, except by law enforcement with a warrant.

III. Deepfakes when used for any deceptive or malicious purpose.

5-D:4 Permitted Uses and Restrictions. Use of AI by state agencies shall be allowed under the following circumstances and with the following restrictions:

I. If an AI system produces a recommendation or a decision, and this recommendation or decision once implemented or executed cannot be reversed, then the recommendation or decision must be reviewed by a human who is in an appropriate responsible position and is aware of the limitations of the AI system before the recommendation or decision takes effect.

II. Such recommendations and decisions pertain to, but are not limited to, the following:

(a) Situations in which limitations on rights and freedoms of an individual person or group of persons are determined.

(b) Biometric identification to verify the identity of an individual person.

(c) Management and operation of critical infrastructure.

(d) Actions taken by law enforcement at the state and local levels.

(e) Interpreting and applying the laws of the state, including sentencing.

III. Any material produced by generative AI and that has not been reviewed, and possibly edited by a human in an appropriate responsible position, must be accompanied by disclosure that the content was generated by AI.

IV. In all other circumstances in which a human user is interacting with an AI system, either directly or indirectly, the user must be informed that they are interacting with an AI system.

5-D:5 Compliance.

I. All state agencies shall take the following actions no later than 9 months after the effective date of this chapter and report their compliance with the department of information technology:

(a) Review the use of AI in their computer systems to verify, to the best of their knowledge, that they comply with the provisions of this chapter and the department of information technology code of ethics for AI systems. Any AI system that is prohibited shall be removed.

(b) Modify all procedures relative to any use of AI that are inconsistent with this chapter so that these procedures are consistent with the requirements in this chapter.

II. Any AI systems newly deployed by a state agency after the effective date of this chapter shall comply with the provisions of this chapter and the department of information technology code of ethics for AI systems. All newly implemented procedures relative to any use of AI that are implemented by a state agency after the effective date of this chapter shall be consistent with the requirements in this chapter.

III. One year after the effective date of this chapter, the department of information technology shall provide to the governor, the speaker of the house of representatives, and the president of the senate a report summarizing AI systems identified by state agencies recording which of those systems were prohibited and removed in compliance with this chapter, which systems are allowed according to this chapter, and what procedures have been implemented to ensure that the procurement and use of these systems will be in compliance with this chapter. This report shall be updated annually to include new systems that state agencies have purchased. All such reports shall also be posted on the department of information technology's website.

5-D:6 Severability.

The provisions of this chapter are severable. If any provision of this chapter or its application is held invalid, that invalidity shall not affect other provisions or applications that can be given effect without the invalid provision or application.

209:2 Effective Date. This act shall take effect July 1, 2024.

Approved: July 12, 2024

Effective Date: July 01, 2024

209:1 New Chapter; Use of Artificial Intelligence by State Agencies. Amend RSA by inserting after chapter 5-C the following new chapter:

CHAPTER 5-D

USE OF ARTIFICIAL INTELLIGENCE BY STATE AGENCIES

5-D:1 Definitions. In this chapter:

I. "Artificial intelligence" or "AI" is the ability of a machine to display human-like capabilities for cognitive tasks such as reasoning, learning, planning, and creativity. AI systems may adapt their behavior to a certain degree by analyzing the effects of previous actions and operating under varying and unpredictable circumstances without significant human oversight.

II. "Generative AI" is AI that can generate text, images, or other media in response to prompts.

III. "Deepfake" means a video, audio, or any other media of a person in which his or her face, body, or voice has been digitally altered so that he or she appears to be someone else, he or she appears to be saying something that he or she has never said, or he or she appears to be doing something that he or she has never done.

IV. "State agency" means any department, commission, board, institution, bureau, office, law enforcement, or other entity, by whatever name called, including the legislative and judicial branches of state government, established in the state constitution, statutes, session laws or executive orders.

5-D:2 Applicability. This chapter shall apply to all computer systems operated by any state agency as defined in RSA 5-D:1, IV. Excepted are systems used in research by state-funded institutions of higher learning. Also excepted are installed consumer systems in common personal use, including, but not limited to facial recognition used to unlock a smartphone.

5-D:3 Prohibition. The following uses of AI by state agencies shall be prohibited:

I. Classifying persons based on behavior, socio-economic status, or personal characteristics resulting in unlawful discrimination against any individual person or group of persons.

II. Real-time and remote biometric identification systems used for surveillance in public spaces, such as facial recognition, except by law enforcement with a warrant.

III. Deepfakes when used for any deceptive or malicious purpose.

5-D:4 Permitted Uses and Restrictions. Use of AI by state agencies shall be allowed under the following circumstances and with the following restrictions:

I. If an AI system produces a recommendation or a decision, and this recommendation or decision once implemented or executed cannot be reversed, then the recommendation or decision must be reviewed by a human who is in an appropriate responsible position and is aware of the limitations of the AI system before the recommendation or decision takes effect.

II. Such recommendations and decisions pertain to, but are not limited to, the following:

(a) Situations in which limitations on rights and freedoms of an individual person or group of persons are determined.

(b) Biometric identification to verify the identity of an individual person.

(c) Management and operation of critical infrastructure.

(d) Actions taken by law enforcement at the state and local levels.

(e) Interpreting and applying the laws of the state, including sentencing.

III. Any material produced by generative AI and that has not been reviewed, and possibly edited by a human in an appropriate responsible position, must be accompanied by disclosure that the content was generated by AI.

IV. In all other circumstances in which a human user is interacting with an AI system, either directly or indirectly, the user must be informed that they are interacting with an AI system.

5-D:5 Compliance.

I. All state agencies shall take the following actions no later than 9 months after the effective date of this chapter and report their compliance with the department of information technology:

(a) Review the use of AI in their computer systems to verify, to the best of their knowledge, that they comply with the provisions of this chapter and the department of information technology code of ethics for AI systems. Any AI system that is prohibited shall be removed.

(b) Modify all procedures relative to any use of AI that are inconsistent with this chapter so that these procedures are consistent with the requirements in this chapter.

II. Any AI systems newly deployed by a state agency after the effective date of this chapter shall comply with the provisions of this chapter and the department of information technology code of ethics for AI systems. All newly implemented procedures relative to any use of AI that are implemented by a state agency after the effective date of this chapter shall be consistent with the requirements in this chapter.

III. One year after the effective date of this chapter, the department of information technology shall provide to the governor, the speaker of the house of representatives, and the president of the senate a report summarizing AI systems identified by state agencies recording which of those systems were prohibited and removed in compliance with this chapter, which systems are allowed according to this chapter, and what procedures have been implemented to ensure that the procurement and use of these systems will be in compliance with this chapter. This report shall be updated annually to include new systems that state agencies have purchased. All such reports shall also be posted on the department of information technology's website.

5-D:6 Severability.

The provisions of this chapter are severable. If any provision of this chapter or its application is held invalid, that invalidity shall not affect other provisions or applications that can be given effect without the invalid provision or application.

209:2 Effective Date. This act shall take effect July 1, 2024.

Approved: July 12, 2024

Effective Date: July 01, 2024