On February 29, 2024, House Bill 7786 was introduced to the Rhode Island House of Representatives and was thereafter referred, on the same date, to the House Innovation, Internet, and Technology Committee. Notably, the bill is separate from House Bill 7521 for an Act relating to Automated Decision Tools which was introduced on February 7, 2024, and which was held by the House Innovation, Internet, and Technology Committee for further study.

Definitions

The bill defines a 'consequential decision' as 'a determination made by a deployer that has a legal or 14 similarly significant effect on an individual.'

A 'consequential artificial intelligence decision system (CAIDS)' is defined as 'machine-based systems or services that utilize machine learning, artificial intelligence, or similar techniques that provide outputs that are not predetermined, and have been specifically developed, or an AI system specifically modified, with the intended purpose of making or determining consequential decisions.'

Impact assessments

Deployers are entities that use a CAIDS to make consequential decisions. Under the bill, they must:

• implement and maintain a risk management program that establishes the policies, processes, and personnel that will be used to identify, mitigate, and document risks arising from the deployment of a CAIDS; and
• take into consideration, in implementing the risk management program:
  • the deployer's size and complexity;
  • the nature and scope of the CAIDS, including its intended use;
  • the sensitivity and volume of data processed in connection with the CAIDS; and
  • the cost of implementation and maintenance of the risk management system.

The impact assessment must be performed before deploying a CAIDS and annually thereafter, and conduct a new impact assessment if material changes are made to the purpose for which the CAIDS is used or the type of data it receives.

The bill also outlines that deployers should maintain documentation for a reasonable time period regarding:

• the purpose of the CAIDS;
• the potential for denial of housing, employer, credit, education, or healthcare, and steps taken to mitigate such risks;
• a description of data that will be processed by the CAIDS;
• transparency measures; and
• post-deployment monitoring and user safeguards.

Developers are also given a series of obligations under the bill. This includes providing the deployer with the technical capability to access or make available the information reasonably necessary to enable the deployer to be compliant with the above provisions on impact assessments. Alongside, the implementation and maintenance of a risk management program that will mitigate and document risks arising from the development of a CAIDS. The bill further outlines the objectives of the risk management program.

Impact assessments must be made available to the Rhode Island Attorney General upon request in the course of an investigation that requires the deployer or developer to disclose such contents.

You can read the bill here and track its progress using the search interface here.