Technology

Fostering Access, Innovation, and Responsibility in Artificial Intelligence Act established. Establishes the Fostering Access, Innovation, and Responsibility in Artificial Intelligence Act (FAIR AI Act) that requires a developer of a base artificial intelligence model, as defined in the bill, to clearly and conspicuously disclose, in a manner that is appropriate for the medium of the content and is easily accessible to the user of such model, in the terms of service governing the use of such model, certain elements related to the artificial intelligence system. The bill creates the FAIR AI Enforcement Fund for the purpose of supporting agency enforcement of artificial intelligence system misuse, bias, and workforce disruption. Finally, the bill limits the defenses available in any criminal or civil action against a defendant that is alleged to have developed, modified, or deployed an artificial intelligence system that caused harm to a plaintiff. The bill has a delayed effective date of July 1, 2027.

Employment decisions; automated decision systems; civil penalty. Provides that the Director of the Department of Human Resource Management shall require any state agency that uses an automated decision system as a substantial factor in any employment decision, as those terms are defined in the bill, to (i) ensure that such system and the use of such system complies with federal and state law, (ii) make certain disclosures, (iii) provide an opt-out mechanism, (iv) annually test such system, (v) ensure data security, and (vi) train agency staff on such system. The bill requires the Department and local government employers to establish and publicize a process for applicants for employment and employees to file concerns and complaints regarding the use of automated decision systems in such employment decisions and a process for the investigation and resolution of any such concerns and complaints. The bill also provides that no final employment decision shall be made by an employer without the involvement of a human decision maker, and no employer shall solely use any recommendation or prediction from an automated decision system to make a final employment decision. The bill subjects violating employers to civil penalties.

Consumer Data Protection Act; definition of "biometric data"; consent required for processing biometric data. Provides that, under the Consumer Data Protection Act, no consumer, controller, processor, or affiliate of the controller or processor shall process biometric data, defined separately in the bill, concerning an individual without obtaining the individual's consent, or, in the case of the processing of biometric data concerning a known child, without processing such data in accordance with the federal Children's Online Privacy Protection Act.

Virginia Telephone Privacy Protection Act; voice service providers; duty of care; caller identification authentication; civil penalties. Provides that a voice service provider, defined in the bill, owes an affirmative duty of care to take reasonable and effective measures to prevent the origination, transmission, and completion of unlawful calls. The bill requires voice service providers to implement caller identification authentication technology consistent with the Secure Telephone Identity Revisited and Secure Handling of Asserted information using toKENs (STIR/SHAKEN) authentication framework, defined in the bill, in all internet protocol network segments under its control and shall implement functionally equivalent authentication, verification, or mitigation measures in non-internet protocol network segments to the extent technically feasible. The bill provides that a violation of its provisions constitutes a prohibited practice under the Virginia Consumer Protection Act.

Consumer Data Protection Act; individual action for damages or penalty; social media platforms. Allows a parent or minor who suffers loss as the result of a violation of Consumer Data Protection Act provisions relating to social media platforms to initiate an action against a controller or processor in violation of such provisions. The bill requires a parent or minor to provide a controller or processor 30 days' written notice and an opportunity for the controller or processor to cure the noticed violation prior to initiating such an action.

Department of Law; Technology Governance and Coordination Program; report. Directs the Office of the Attorney General to establish a Technology Governance and Coordination Program to support the Commonwealth's response to emergent technologies, including artificial intelligence, algorithmic systems, biometric systems, and automated decision-making tools. The bill requires the Office of the Attorney General to submit an annual report to the Joint Commission on Technology and Science by December 1, 2026.

Department of Criminal Justice Services; law-enforcement agencies and sheriff's departments; policy on use of covered artificial intelligence systems. Requires the Department of Criminal Justice Services to establish a model policy for the use of a covered artificial intelligence system, defined in the bill, by any state or local law-enforcement agency or sheriff's department by October 1, 2026. The bill also requires each local law-enforcement agency and sheriff's department and the Department of State Police to establish and adopt a written policy for the use of a covered AI system by such agency or department that meets or exceeds the model policy established by the Department of Criminal Justice Services by January 1, 2027. The bill requires such policies be publicly available on the law-enforcement agency's or sheriff's department's website.