HB 60 — ARTIFICIAL INTELLIGENCE ACT

(f)d cybersecurity;r e 22 K.

(g)"high-risk databases;artificial intelligence system" means c e s k 23 any artificial intelligence system that when deployed makes or e a n b 24 is a substantial factor in making a consequential decision, but u [ does not include:

(h).230826.6 data- storage;5 - HJC/HB 60 (1) anti-fraud technology;

(i)(2) firewalls;anti-malware technology;

(j)(3) internetantivirus domaintechnology; registration;

(k)(4) internetcybersecurity websitetechnology; loading;

(l)(5) networking;databases;

(m)(6) spamdatabase, andspreadsheet robocallor filtering;other technology that does no more than organize data already in possession of a deployer;

(n)(7) spelldata checking;storage;

(o)(8) spreadsheets;firewall technology;

(p)(9) webinternet caching;domain registration;

(q)(10) webinternet hostingwebsite orloading; similar technology;

or(11) (r)networking; technology that communicates with consumers in natural language for the purpose of providing e t 17 users with information, making referrals or recommendations and w l n d 18 answering questions and is subject to an accepted use policy = = 19 a l that prohibits generating content that is discriminatory or i a e r 20 harmful;

a(12) tspam mand mrobocall 21filtering; K.

"intentional(13) andspell substantialchecking modification"technology; and d r e 22 "intentionally and substantially modifies" means a deliberate c e s k 23 change made to an artificial intelligence system that results e a n b 24 in a new reasonably foreseeable risk of algorithmic u [ discrimination, but does not include a change made to a high- .228797.3 - 6 - risk artificial intelligence system or the performance of a high-risk artificial intelligence system when:

(14) transcription and transition technology;

e t 17 (15) web caching;

w l n d 18 (16) web hosting or similar technology;

or = = 19 (17) technology that communicates with a l i a e r 20 consumers solely in spoken or written natural language for the a t m m 21 purpose of providing consumers with information, making d r e 22 referrals or recommendations and answering questions:

c e s k 23 (a) subject to the deployer's accepted e a n b 24 use policy as explicitly accepted by the consumer that may u [ prohibit generation of specific content by the technology;

and .230826.6 - 6 - HJC/HB 60 (b) that is not used to take any autonomous action without consumer intervention;

L.

"intentional and substantial modification" and "intentionally and substantially modifies" means a deliberate and material change made to an artificial intelligence system that results in a new reasonably foreseeable risk of algorithmic discrimination, but does not include a change made to a high-risk artificial intelligence system or the performance of a high-risk artificial intelligence system when:

(2) the change is made as a result of system learning after being made available to a deployer or being e t 17 deployed;

w l n d 18 (3) the change was predetermined by the = = 19 deployer or a third party contracted by the deployer when the a l i a e r 20 deployer or third party completed an impact assessment of the a t m m 21 high-risk artificial intelligence system pursuant to Section 6 d r e 22 of the Artificial Intelligence Act;

or c e s k 23 (4) the change is included in technical e ta 17n b 24 documentation for the high-risk artificial intelligence system;

wu l[ nM. d 18 L.

"offered"machine orlearning" mademeans available"the includesdevelopment aand gift,.230826.6 =- =7 19- aHJC/HB l60 lease,incorporation sale or other conveyance of analgorithms artificial intelligence i a e r 20 system to abuild recipientdata-derived deployerstatistical ormodels athat developerare othercapable thanof thedrawing ainferences tfrom mpreviously munseen 21data originalwithout systemexplicit developer;human instruction;

dN. r e 22 M.

"recipient""offered meansor amade deployeravailable" whoincludes hasa receivedgift, anlease, csale eor sother kconveyance 23of an artificial intelligence system fromto a developerrecipient deployer or a developer eother athan nthe boriginal 24 who has received an artificial intelligence system from another u [ developer;

.228797.3 - 7 - N.

"risk incident" means an incident when a developer discovers or receives a credible report from a deployer that a high-risk artificial intelligence system offered or made available by the developer has caused or is reasonably likely to have caused algorithmic discrimination;

"substantial"recipient" factor"means means:a deployer who has received an artificial intelligence system from a developer or a developer who has received an artificial intelligence system from another developer;

(1)P. a factor that:

(a)"risk assistsincident" inmeans makingan incident when a consequentialdeveloper decision;discovers or receives a credible report from a deployer that a high-risk artificial intelligence system offered or made available by the developer has caused or is reasonably likely to have caused algorithmic discrimination;

(b)e ist capable17 ofQ. altering, advising or influencing the outcome of a consequential decision;

and"substantial (c)factor" ismeans a decision, score, w l n d 18 label, prediction or recommendation generated by an artificial = = 19 intelligence system;system that is used as a basis or partial basis to a l i a e r 20 make a consequential decision;

orand (2) content, decisions, labels, predictions, recommendations or scores generated by an artificial intelligence system concerning a consumer that are used as a e t 17m basis,m partial21 basisR. or recommendation to make a consequential w l n d 18 decision concerning the consumer;

and"trade =secret" =means 19information, including a ld P.r e 22 formula, pattern, compilation, program, device, method, c e s k 23 technique or process, that:

"tradee secret"a meansn information,b including24 a(1) iderives aindependent eeconomic rvalue, 20actual formula,u pattern,[ compilation,or program,potential, device,from method,not abeing tgenerally mknown mto 21and techniquenot orbeing process,.230826.6 that:- 8 - HJC/HB 60 readily ascertainable by proper means by other persons who could obtain economic value from the information's disclosure or use;

d r e 22 (1) derives independent economic value, actual c e s k 23 or potential, from not being generally known to and not being e a n b 24 readily ascertainable by proper means by other persons who u [ could obtain economic value from the information's disclosure .228797.3 - 8 - or use;

(1) a general summary describing the e t 17 reasonably foreseeable uses and known harmful or inappropriate w l n d 18 uses of the system;

and e= t= 1719 (2) documentation disclosing:

wa l ni da 18e r 20 (a) the purpose, intended uses and =a =t 19m am l21 benefits of the system;

id ar e r22 20 (b) a high-level summary of the typetypes of ac te ms mk 2123 data used to train the system;

de ra en 22b 24 (c) known or reasonable foreseeable cu e[ s k 23 limitations of the system, including the risk of algorithmic e.230826.6 a- n9 b- 24HJC/HB 60 discrimination arising from the intended use of the system;

u [ (d) how the system was evaluated for .228797.3 - 9 - performance and mitigation of algorithmic discrimination prior to being offered or made available to the deployer, including:

(e) the data governance measures governingused theto datacover setsthe usedtraining todatasets trainand the system,measures used to examine the suitability of data sources, possible biases and bias mitigation;

(g) the measures the developer has taken to mitigate known or reasonably foreseeable risks of e t 17 algorithmic discrimination that are reasonably foreseeable from w l n d 18 the use of the system;

= = 19 (h) how the system should be used and a l i a e tr 1720 monitored by the deployer;

wa lt nm dm 1821 (i) any additional information that is =d =r 19e a22 l reasonably necessary to assist the deployer in understanding ic a e rs 20k 23 the outputs and monitoring the performance of the system for e a tn mb m24 21 risks of algorithmic discrimination;

and du r[ e 22 (j) any other information necessary to c.230826.6 e- s10 k- 23HJC/HB 60 allow the deployer to comply with the requirements of thisthe eArtificial aIntelligence nAct; b 24 section;

u [ C.

except for information excluded pursuant to .228797.3 - 10 - Subsection C of Section 4 of the Artificial Intelligence Act, to the extent feasiblefeasible, make available to the recipientdeployer the necessary information to conduct an impact assessment as required pursuant to Section 6 of the Artificial Intelligence Act.

SuchThe information shall include modelcomprehensive cards,information datasetabout cardsthe orhigh-risk previousartificial impactintelligence assessments relevant to the system, itsincluding: development or use;

D.(1) the name, version and a brief description of the system;

post(2) on the developer'sintended websiteuse inof athe clearsystem; and readily available manner a statement or public-use case inventory that summarizes:

(1)(3) theinformation typesabout ofthe high-riskdata artificialset intelligenceused systemsto thattrain the developersystem, hasincluding developedall ormodel intentionallyinput data and substantiallytraining modifieddata, anddemographic currentlycomposition, offersdata orcollection makesmethods, availabledata tosources, recipients;preprocessing steps, potential biases and known e t 17 limitations;

and (2) how the developer manages known or reasonably foreseeable risks of algorithmic discrimination that e t 17 may arise from the use or intentional and substantial w l n d 18 modification(4) oflimitations theor systemsrisks listedassociated onwith the developer's website = = 19 asystem's luse; pursuant to this subsection;

and a l i a e r 20 E.(5) previous impact assessments relevant to a t m m 21 the system, its development or use;

ensure that the statement or public-use case a t m m 21 inventory posted pursuant to this section remains accurate and d r e 22 isD. updated within ninety days of an intentional and substantial c e s k 23 modification of a high-risk artificial intelligence system e a n b 24 offered or made available by the developer to recipients.

upost [on SECTIONthe 4.developer's website in a clear and c e s k 23 readily available manner a statement or public-use case e a n b 24 inventory that summarizes:

[NEWu MATERIAL][ RISK(1) INCIDENTS--REQUIREDthe .228797.3types of high-risk artificial .230826.6 - 11 - DISCLOSUREHJC/HB AND60 SUBMISSION--EXCEPTIONS.--intelligence A.systems that the developer has developed or intentionally and substantially modified and currently offers or makes available to recipients;

Within ninety days of a risk incident and in(2) ahow form and manner prescribed by the state department of justice, a developer shallmanages discloseknown toor thereasonably departmentforeseeable andrisks all known recipients of thealgorithmic high-riskdiscrimination artificial intelligence system that ismay thearise basisfrom of the riskuse incidentor theintentional known and foreseeablesubstantial risksmodification of algorithmicthe discriminationsystems thatlisted mayon arise from the intendeddeveloper's useswebsite ofpursuant theto system.this subsection;

B.and E.

Withinensure ninetythat daysthe ofstatement aor requestpublic-use bycase theinventory stateposted departmentpursuant ofto justice,this asection developerremains shallaccurate submitand tois theupdated departmentwithin aninety copydays of thean summaryintentional and documentationsubstantial themodification developerof hasa madehigh-risk availableartificial tointelligence recipientssystem pursuantoffered toor Sectionmade 3available ofby the Artificialdeveloper Intelligenceto Act.recipients.

ASECTION developer4. may designate the summary or documentation as including proprietary information or a trade secret.

To[NEW theMATERIAL] extentRISK thatINCIDENTS--REQUIRED informationDISCLOSURE containedAND inSUBMISSION--EXCEPTIONS.-- theA. summary or documentation includes information e t 17 subject to attorney-client privilege or work-product w l n d 18 protection, compliance with this section does not constitute a = = 19 a l waiver of the privilege or protection.

Within ninety days of a risk incident and in a e t 17 form and manner prescribed by the department, a developer shall w l n d 18 disclose to the department and all known recipients of the = = 19 high-risk artificial intelligence system that is the basis of a l i a e r 20 C.the risk incident the known and foreseeable risks of a t m m 21 algorithmic discrimination that may arise from the intended d r e 22 uses of the system.

As part of a disclosure, notice or submission a t m m 21 pursuant to the Artificial Intelligence Act, a developer shall d r e 22 not be required to disclose a trade secret, information c e s k 23 protectedB. from disclosure by state or federal law or e a n b 24 information that would create a security risk to the developer.

Within ninety days of a request by the e a n b 24 department, a developer shall submit to the department a copy u [ Suchof disclosure,the noticesummary orand submissiondocumentation shallthe bedeveloper exempthas frommade .228797.3.230826.6 - 12 - disclosureHJC/HB 60 available to recipients pursuant to theSection Inspection3 of Publicthe RecordsArtificial Intelligence Act.

A developer may designate the summary or documentation as including a trade secret.

To the extent that information contained in the summary or documentation includes information subject to attorney-client privilege or work- product protection, compliance with this section does not constitute a waiver of the privilege or protection.

C.

As part of a disclosure, notice or submission pursuant to the Artificial Intelligence Act, a developer shall not be required to disclose a trade secret, information protected from disclosure by state or federal law or information that would create a security risk to the developer.

Such disclosure, notice or submission shall be exempt from disclosure pursuant to the Inspection of Public Records Act.

[NEW MATERIAL] DEPLOYER RISK-MANAGEMENT POLICY REQUIRED.-- e t 17 A.

A deployer shall use reasonable care to protect w l n d 18 consumers from known or reasonably foreseeable risks of = = 19 algorithmic discrimination.

a l i a e r 20 B.

A deployer shall implement a risk management a t m m 21 policy and program to govern the deployer's deployment of a d r e 22 high-risk artificial intelligence system.

The risk management c e s k 23 policy and program shall:

e a n b 24 (1) specify and incorporate the principles, u [ processes and personnel that the deployer uses to identify, .230826.6 - 13 - HJC/HB 60 document and mitigate known or reasonably foreseeable risks of algorithmic discrimination;

and (2) be an iterative process planned, implemented and regularly and systematically updated over the e t 17 life cycle of a high-risk artificial intelligence system and w l n d 18 include regular systematic review and updates.

= = 19 a l C.

A risk management policy shall meet standards i a e r 20 established by the state department of justice by rule.

a t m m 21 SECTION 6.

[NEW MATERIAL] DEPLOYER IMPACT ASSESSMENTS.-- d r e 22 A.

Except as provided in Subsections D, E and H of c e s k 23 this section, a deployer shall conduct an impact assessment for e a n b 24 any high-risk artificial intelligence system deployed by the u [ deployer:

.228797.3 - 13 - (1) annually;

e t 17 B.

An impact assessment of a high-risk artificial w l n d 18 intelligence system completed pursuant to this section shall = = 19 include, to the extent reasonably known by or available to the a l i a e r 20 deployer:

a t m m 21 (1) a statement of the intended uses, d r e 22 deployment contexts and benefits of the system;

c e s k 23 (2) an analysis of any known or reasonably e a n b 24 foreseeable risks of algorithmic discrimination posed by the system,u and[ whensystem a risk exists, the nature of the algorithmic discrimination and thewhen: steps that have been taken to mitigate the risk;

(3).230826.6 a- description14 of- theHJC/HB categories60 of(a) dataa risk exists, the systemnature processesof asthe inputsalgorithmic discrimination and the outputssteps thethat systemhave ebeen ttaken 17to produces;mitigate the risk;

w(b) lthe nimpact dassessment 18is (4)dependent aon summarydeveloper ofinformation categoriesoutside of anythe datadeployer's usedcontrol, =include = 19 a lstatement todetailing customizethat thedependence; system;

iand a(c) ethe rdeployer 20has (5)cause theto metricsbelieve usedalgorithmic todiscrimination evaluateexists, the adeployer tshall muse mreasonable 21efforts performanceto andmitigate knownthe limitationsimpacts of thesuch system,discrimination; including:

d(3) ra edescription 22of (a)the whethercategories theof evaluationdata wasthe carriedsystem cprocesses eas sinputs kand 23the outoutputs usingthe testsystem data;produces;

e(4) a nsummary bof 24categories (b)of whetherany the test data setsused wereto ucustomize [the collectedsystem; solely in New Mexico, solely in other states or in .228797.3 - 14 - New Mexico in combination with other states;

(c)(5) the demographicmetrics groupsused representedto inevaluate the teste datat sets17 performance and theknown proportionlimitations of eachthe age,system, ethnic,including: gender or racial group in each data set;

andw (d)l anyn independentd studies18 carried(a) outwhether to evaluate the systemevaluation forwas performancecarried and= risk= of19 discriminationout andusing whethertest thedata; studies are publicly available or peer-reviewed;

a l i a e r 20 (b) whether the test data sets were a t m m 21 collected solely in New Mexico, solely in other states or in d r e 22 New Mexico in combination with other states;

c e s k 23 (c) the demographic groups represented e a n b 24 in the test data sets and the proportion of each age, ethnic, u [ gender or racial group in each data set;

and .230826.6 - 15 - HJC/HB 60 (d) any independent studies carried out to evaluate the system for performance and risk of discrimination and whether the studies are publicly available or peer-reviewed;

e t 17 C.

An impact assessment conducted duefollowing to an w l n d 18 intentional and substantial modification of a high-risk = = 19 a l artificial intelligence system shall include a disclosure of i a e r 20 the extent to which the system was used in a manner consistent ae t m17 m 21 with, or that varied from, the developer's intended uses of the dw rl en 22d 18 system.

c= e= s19 k 23 D.

A deployer may use a single impact assessment to ea l i a ne br 2420 address a set of comparable high-risk artificial intelligence ua [t m m 21 systems.

.228797.3d -r 15e -22 E.

An impact assessment conducted for the purpose c e s k 23 of complying with another applicable law or rule shall satisfy e a n b 24 the requirement of this section when the assessment:

u [ (1) meets the requirements of this section;

.230826.6 - 16 - HJC/HB 60 and (2) is reasonably similar in scope and effect to an assessment that would otherwise be conducted pursuant to this section.

OnOne orhundred beforetwenty Marchdays 1,after 2027,the department has promulgated rules pursuant to Section 14 of the Artificial Intelligence Act, a deployer shall review each high-risk artificial intelligence system that the e t 17 deployer has deployed to ensure that the system is not causing w l n d 18 algorithmic discrimination.

=e =t 1917 a l H.

iw al en rd 2018 (1) a deployer using a high-risk artificial a= t= m19 m 21 intelligence system:

da rl i a e 22r 20 (a) employsimpacts fewer than fifty full-timeconsumers; c e s k 23 employees;

e a nt bm 24m 21 (b) does not use the deployer's own data ud [r e 22 to train the system;

.228797.3c -e 16s -k 23 (c) uses the system solely for the e a n b 24 system's intended uses as disclosed by a developer pursuant to u [ the Artificial Intelligence Act;

and .230826.6 - 17 - HJC/HB 60 (d) makes any impact assessment of the system that has been provided by the developer pursuant to the Artificial Intelligence Act available to consumers;

I.

A deployer may supply documentation provided by a developer to complete the requirements for an item pursuant to Subsection B of this section;

provided that the deployer has not modified the item.

(1) a summary of the types of high-risk artificial intelligence systems that the deployer currently deploys and how known or reasonably foreseeable risks of e t 17 algorithmic discrimination from the deployment of each system ew tl 17n d 18 are managed;

and w= l= n19 d 18 (2) a detailed explanation of the nature, =a =l 19i a le r 20 source and extent of the information collected and used by the i a et rm 20m 21 deployer.

ad tr me m22 21 B.

At a minimum, a deployer shall update the dc r e 22s k 23 information posted on its website pursuant to this section c e sa kn 23b 24 annually and when the deployer deploys a new high-risk eu a[ n b 24 artificial intelligence system.

u.230826.6 [- 18 - HJC/HB 60 SECTION 8.

[NEW MATERIAL] USE OF ARTIFICIAL INTELLIGENCE .228797.3 - 17 - SYSTEMS WHEN MAKING CONSEQUENTIAL DECISIONS--DIRECT NOTICE TO AFFECTED CONSUMERS--ADVERSE DECISIONS--OPPORTUNITY FOR APPEAL.-- A.

(b) the purpose of the system and the e t 17 nature of the consequential decision being made;

and ew tl 17n d 18 (c) the deployer's contact information.

w= l= n19 d 18 B.

Except as provided in Subsection E of this =a =l 19i a le r 20 section, when a high-risk artificial intelligence system has i a et rm 20m 21 been used to make or has been a substantial factor in making a ad tr me m22 21 consequential decision concerning a consumer that is adverse to dc r e 22s k 23 the consumer, the deployer shall provide directly to the c e sa kn 23b 24 consumer:

eu a[ n b 24 (1) a statement explaining:

u.230826.6 [- 19 - HJC/HB 60 (a) the principal reason or reasons for .228797.3 - 18 - the decision;

and (3) an opportunity to appeal the adverse decision except in instances where an appeal is not in the best interest of the consumer, such as creating a delay that may pose a risk of life or safety to the consumer.

w l n d 18 (1) in plain language and in all languages in = = 19 a l which the deployer in the ordinary course of business provides a l i a e r 20 contracts, disclaimers, sale announcements and other a t m m 21 information to consumers;

When a deployer is unable to provide u [ information, notice or a statement required pursuant to this .228797.3.230826.6 - 1920 - HJC/HB 60 section directly to a consumer, the deployer shall make such information, notices or statements available in a manner that is reasonably calculated to ensure that the consumer receives the information, notice or statement.

[NEW MATERIAL] USE OF HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEM--NOTICE AND DISCLOSURE TO THE STATEDEPARTMENT--INSPECTION DEPARTMENT OF JUSTICE--INSPECTION OF PUBLIC RECORDS ACT EXEMPTION.-- A.

When a deployer discovers that a high-risk artificial intelligence system that has been used has caused algorithmic discrimination, the deployer shall as expeditiously as possible but at a maximum within ninety days notify the state department of justice of the discovery.

Upon request by the statedepartment, department of justice, a deployer shall within ninety days submit to the state e t 17 department of justice any risk management policy, impact w l n d 18 assessment or records conducted, implemented, maintainede ort =17 =maintained 19or a l received pursuant to the Artificial Intelligence w l n d 18 Act.

The i a e r 20 submission shall be in a form and manner prescribed by= the= a19 tby mthe m 21 department.

da rl i a e 22r 20 C.

The state department of justice may evaluate crisk emanagement sa kt 23m riskm management21 policies, impact assessments or records esubmitted apursuant nto bd 24r submittede pursuant22 to this section for compliance with the u [ Artificial Intelligence c e s k 23 Act.

.228797.3e -a 20n -b 24 D.

AAs riskpart managementof policy,a impactdisclosure, assessmentnotice or recordsubmission submittedu [ pursuant to the stateArtificial departmentIntelligence ofAct, justicea pursuantdeployer shall .230826.6 - 21 - HJC/HB 60 not be required to thisdisclose sectiona istrade exemptsecret, information protected from disclosure pursuantby tostate theor Inspectionfederal oflaw Publicor Recordsinformation Act.that would create a security risk to the deployer.

Such a disclosure, notice or submission shall be exempt from disclosure pursuant to the Inspection of Public Records Act.

InWithin aninety submissiondays pursuantof to this section, a deployerrequest mayby designate a portion of the submissiondepartment, as including proprietary information or a tradedeveloper secretshall andsubmit to the extentdepartment that a submissioncopy containsof informationthe subjectsummary toand attorney-documentation clientthe privilegedeveloper orhas work-productmade protection,available theto submissionrecipients doespursuant notto constituteSection a3 waiver of the privilegeArtificial orIntelligence protection.Act.

A developer may designate the summary or documentation as including a trade secret.

To the extent that information contained in the summary or documentation includes information subject to attorney-client privilege or work-product protection, compliance with this section does not constitute a waiver of the privilege or protection.

[NEW MATERIAL] INTERACTION OF ARTIFICIAL e t 17 INTELLIGENCE SYSTEM WITH CONSUMERS--REQUIRED DISCLOSURE.--ADISCLOSURE.-- developerw thatl offersn ord makes18 availableA. an artificial intelligence system intended to interact with consumers shall ensure that a consumer is informed that the consumer is interacting with an artificial intelligence system.

ThisA edeveloper tor 17a sectiondeployer doesthat notoffers applyor whenmakes it= would= be19 obviousavailable an artificial intelligence system intended to a reasonablel wi la ne dr 1820 personinteract with consumers shall ensure that a consumer is a t m m 21 informed that the consumer is interacting with an artificial =d =r 19e a22 l intelligence system.

ic a e rs 20k SECTION23 11.B.

[NEWPrior MATERIAL]to EXEMPTIONdeploying FROMa DISCLOSURE--high-risk artificial e a tn mb m24 21intelligence TRADEsystem SECRETSto ANDmake, OTHERor INFORMATIONbe PROTECTEDa BYsubstantial LAW--NOTICEfactor TOin du r[ emaking, a consequential decision concerning a consumer, a .230826.6 - 22 CONSUMER.--- cHJC/HB e60 sdeployer kshall 23notify A.the consumer that the high-risk artificial intelligence system is being deployed and of the system's role in making the consequential decision.

NothingSECTION in11. the Artificial Intelligence Act shall e a n b 24 require a deployer or developer to disclose a trade secret or u [ other information protected from disclosure by state or federal .228797.3 - 21 - law.

[NEW MATERIAL] EXEMPTION FROM DISCLOSURE-- TRADE SECRETS AND OTHER INFORMATION PROTECTED BY LAW--NOTICE TO CONSUMER.-- A.

Nothing in the Artificial Intelligence Act shall require a deployer or developer to disclose a trade secret or other information protected from disclosure by state or federal law.

To the extent that a deployer or developer withholds information pursuant to this section that would otherwise be part of a disclosure pursuant to the Artificial Intelligence Act, the deployer or developer shall notify aall consumeraffected andconsumers, provide a basis for the withholding.withholding and include all information not protected as a trade secret e t 17 pursuant to the Uniform Trade Secrets Act or other state or w l n d 18 federal law.

= = 19 SECTION 12.

[NEW MATERIAL] APPLICABILITY EXEMPTIONS-- a l i a e r 20 OTHER LAW--SECURITY AND TESTING--FEDERAL USE--INSURANCE a t m m 21 PROVIDERS.-- d r e 22 A.

No provision of the Artificial Intelligence Act c e s k 23 shall be construed to restrict a person's ability to:

e a n b 24 (1) comply with federal, state or municipal u [ laws or regulations;

.230826.6 - 23 - HJC/HB 60 (2) comply with a civil, criminal or regulatory inquiry, investigation, subpoena or summons by a governmental authority;

e t 17 (3) cooperate with a law enforcement agency w l n d 18 concerning activity that the person reasonably and in good = = 19 a l faith believes may violate other laws or regulations;

i a e r 20 (4) defend, exercise or investigate legal a t m m 21 claims;

d r e 22 (5) act to protect an interest that is c e s k 23 essential for the life or physical safety of a person;

e a n b 24 (6) by meansany othermeans: than the use of facial u [ recognition technology:

.228797.3 - 22 - (a) detect, prevent, protect against or respond to deceptive, illegal or malicious activity, fraud, identity theft, harassment or security incidents;

or (b) investigate, prosecute or report persons responsible for the actions listed in Subparagraph (a) e t 17 of this paragraph;

w l n d 18 (7) preserve the integrity or security of = = 19 artificial intelligence, computer, electronic or internet a l i a e r 20 connection systems;

a t m m 21 (8) engage in public or peer-reviewed d r e 22 scientific or statistical researchresearch, including clinical trials, c e s k 23 that adheres to and is conducted in accordance with applicable e a n b 24 federal and state law;

u [ (9) engage in pre-market testing other than .230826.6 - 24 - HJC/HB 60 testing conducted under real-world conditions, including development, research and testing of artificial intelligence systems;

or e t 17 (10) assist another person with compliance w l n d 18 with the Artificial Intelligence Use Act.

= = 19 a l B.

No provision of the Artificial Intelligence Act i a e r 20 shall be construed to restrict:

a t m m 21 (1) a product recall;

or d r e 22 (2) identification or repair of technical c e s k 23 errors that impair the functionality of anthe artificial e a n b 24 intelligence system.

u [ C.

The Artificial Intelligence Act shalldoes not apply .228797.3 - 23 - in circumstances wherein which compliance would violate an evidentiary privilege pursuant to law.

No provision of the Artificial Intelligence Act shall be construed so as to limit the rights of a person'sperson, e t 17 including the rights to free speech or freedom of the press w l n d 18 pursuant to the first amendment to the United States = = 19 constitution or Article 2, Section 17 of the constitution of a l i a e r 20 New Mexico.

a t m m 21 E.

The Artificial Intelligence Act shalldoes not apply d r e 22 to a developer, deployer or other person who:

c e s k 23 (1) uses or intentionally and substantially e a n b 24 modifies a high-risk artificial intelligence system that:

u [ (a) has been authorized by a federal .230826.6 - 25 - HJC/HB 60 agency in accordance with federal law;

and (b) is in compliance with standards established by a federal agency in accordance with federal law when such standards are substantially equivalent or more e t 17 stringent than the requirements of the Artificial Intelligence w l n d 18 Act;

= = 19 a l (2) conducts research to support an i a e r 20 application for approval, certification or review by a federal agency a t m m 21 pursuant to federal law;

dor r e 22 (3) performs work under or in connection with c e s k 23 a contract with a federal agency, unless the work is on a high- e a n b 24 risk artificial intelligence system used to make or as a u [ substantial factor in making a decision concerning employment .228797.3 - 24 - or housing;housing.

or (4) is a covered entity pursuant to federal health insurance law and is providing health care recommendations:

(a) generated by an artificial intelligence system;

(b) that require a health care provider to take action to implement the recommendations;

and (c) that are not considered to be high risk.

The Artificial Intelligence Act shalldoes not apply to an artificial intelligence system acquiredto the extent the system e t 17 is used by the federal government, except for a high-risk w l n d 18 artificial intelligence system used to make or as a substantial = = 19 factor in making a decision concerning employment or housing.

a l i a e r 20 G.

A financial institutioninstitution, oran affiliate or ea a t 17m m 21 subsidiary of a financial institution thator isa subjectservice toprovider wd lr ne d22 18that is subject to prudential regulation by another state or by thec federale =s =k 1923 athe lfederal government pursuant to laws that apply to the use ofe high-riska in ab e24 rof 20high-risk artificial intelligence systems shall be deemed to u [ be in a t m m 21 compliance with the Artificial Intelligence Act when the d.230826.6 r- e26 22- HJC/HB 60 applicable laws:

c e s k 23 (1) impose requirements that are substantially e a n b 24 equivalent to or more stringent than the requirements imposed u [ by the Artificial Intelligence Act;

and .228797.3 - 25 - (2) at a minimum, require the financial institutioninstitution, affiliate or service provider to:

(a) regularlynotify auditconsumers thesubject institution'sto usethe of high-risk artificial intelligence systemssystem forof compliancethe withsystem's stateuse and federalits antidiscriminationrole laws;in consequential decisions;

and (b) mitigateregularly anyaudit algorithmic discrimination caused by the institution's use of a high-risk artificial intelligence system.systems for compliance with state and federal antidiscrimination laws;

and (c) mitigate any algorithmic discrimination caused by the use of a high-risk artificial intelligence system.

AsA useddeveloper, indeployer thisor section,other "financialperson institution"who meanse t 17 engages in an insuredaction statepursuant orto nationalan bank,exemption aset stateforth orin federalthis savingsw andl loann associationd or18 savingssection bank,shall abear statethe orburden federalof creditdemonstrating unionthat orthe authorizedaction branches= of= each19 ofqualifies for the foregoing.exemption.

a l i a e r 20 I.

AAs developer,used deployerin orthis othersection, person"financial whoinstitution" engagesa int anm actionm pursuant21 tomeans an exemptioninsured setstate forthor innational thisbank, sectiona shallstate bearor thefederal burdend ofr demonstratinge that22 thesavings actionand loan association or savings bank, a state or c e ts 17k qualifies23 forfederal credit union or authorized branches of each of the exemption.e a n b 24 foregoing.

wu l[ n d 18 SECTION 13.

[NEW MATERIAL] ENFORCEMENT--STATEENFORCEMENT--DEPARTMENT-- DEPARTMENT.230826.6 =- =27 19- aHJC/HB l60 OFOPPORTUNITY JUSTICE--CONSUMERTO CURE--CONSUMER CIVIL ACTIONS.-- i a e r 20 A.

Upon the promulgation of rules pursuant to a t m m 21 Section 14 of the Artificial Intelligence Act:

d r e 22 (1) the state department of justice shall have c e s k 23 authority to enforce that act;

and e a n b 24 (2) a consumer may bring a civil action in u [ district court against a developer or deployer for declaratory .228797.3 - 26 - or injunctive relief and attorney fees for a violation of that act.

InPrior anto actionthe promulgation of rules by the state department ofpursuant justice to enforceSection 14 of the Artificial Intelligence Act, itthe isdepartment shall issue a notice to a prospective defendant prior to initiating an affirmativeaction defensefor when:violation of the act.

(1)The thenotice developer,shall deployerinclude ora otherdetailed persondescription discoversof andthe curesalleged a violation ofand the Artificialactions Intelligencerequired Actto ascure athe resultviolation. of:

(a)The feedbackprospective thatdefendant theshall developer,have deployere ort other17 personninety encouragesdays from the deployerreceipt orof usersthe notice to provide;submit evidence w l n d 18 satisfactory to the department that the violation has been = = 19 cured.

orNinety-one (b)days adversarialafter testing,the redprospective teamingdefendant orhas a l i a e r 20 received the notice, if the department has not received a t m m 21 satisfactory evidence that the violation has been cured, the d r e 22 department may file an internalaction reviewin process;district court for the c e s k 23 violation.

ande (2) the developer, deployer or other person is in compliance with a riskn managementb framework24 forC. artificial intelligence systems designated by the state department of e t 17 justice by rule.

wFor lone ncalendar dyear 18from C.the date the u [ department promulgates rules pursuant to Section 14 of the .230826.6 - 28 - HJC/HB 60 Artificial Intelligence Act, it shall be an affirmative defense in an action brought by the department to enforce the Artificial Intelligence Act when:

In(1) an action by the state department of justice = = 19 a l to enforce the Artificial Intelligence Act, the developer, i a e r 20 deployer or other person whodiscovers isa theviolation subject of the enforcementArtificial aIntelligence tAct mas ma 21result shall bear the burden of demonstratingadversarial thattesting, thered requirementsteaming dor r e 22 for an affirmativeinternal defensereview pursuantprocess; to this section have been c e s k 23 met.

e(2) athe ndeveloper, bdeployer 24or D.other person reports the violation to the department and cures the violation within seven days of the violation;

Nothing(3) within the Artificialdeveloper, Intelligencedeployer Act,or uother [person includingis thein enforcementcompliance authoritywith granteda torisk themanagement stateframework .228797.3for -artificial 27intelligence -systems departmentdesignated ofby justicethe pursuantdepartment toby thisrule; section, preempts or otherwise affects any right, claim, remedy, presumption or defense available in law or equity.

(4) the deployer is dependent on documentation from the developer to cure or otherwise resolve a violation and the deployer complies with the requirements in Paragraph (2) of e t 17 Subsection B of Section 6 of the Artificial Intelligence Act;

w l n d 18 and = = 19 (5) the developer, deployer or other person a l i a e r 20 demonstrates that the violation was inadvertent, affected fewer a t m m 21 than one hundred consumers and could not have been discovered d r e 22 through reasonable diligence.

c e s k 23 D.

After one calendar year from the date the e a n b 24 department promulgates rules pursuant to Section 14 of the u [ Artificial Intelligence Act, a deployer, developer or other .230826.6 - 29 - HJC/HB 60 person subject to enforcement for a violation of that act shall have no right to cure the violation or an affirmative defense pursuant to this section.

AnIn affirmativean defenseaction orby rebuttablethe presumptiondepartment establishedto byenforce the Artificial Intelligence ActAct, appliesthe onlydeveloper, todeployer anor enforcementother actionperson bywho is the statesubject department of justicethe andenforcement doesshall notbear applythe toburden anyof right,demonstrating claim,that remedy,the presumptionrequirements orfor an affirmative defense availablepursuant into lawthis orsection equity.have been met.

ANothing violationin of the Artificial Intelligence ActAct, isincluding anthe unfairenforcement practiceauthority andgranted mayto bethe enforceddepartment pursuant to thethis Unfairsection, Practicespreempts Act.or otherwise affects any right, claim, remedy, presumption or defense available in law or equity.

An affirmative defense presumption established by the Artificial Intelligence Act applies only to an enforcement action by the department and does not apply to any e t 17 right, claim, remedy, presumption or defense available in law w l n d 18 or equity.

= = 19 H.

A violation of the Artificial Intelligence Act a l i a e r 20 is an unfair practice and may be enforced pursuant to the a t m m 21 Unfair Practices Act.

d r e 22 I.

c e s k 23 (1) "adversarial testing" means to proactively e a n b 24 try to break an application by providing it with data most u [ likely to elicit problematic output, or as defined by the state.230826.6 department- of30 justice- HJC/HB 60 department by rule;

and e t 17 (2) "red teaming" means the practice of w l n d 18 simulating attack scenarios on an artificial intelligence = = 19 a l application to pinpoint weaknesses and plan preventive measures i a e r 20 or as defined by the state department of justice by rule.

a t m m 21 SECTION 14.

[NEW MATERIAL] RULEMAKING.--OnRULEMAKING.-- orA. before d r e 22 January 1, 2027, the state department of justice shall c e s k 23 promulgate rules to implement the Artificial Intelligence Act e a n b 24 and shall post them prominently on the state department of u [ justice's website.

.228797.3On -or 28before -January SECTION1, 15.2027, the department shall promulgate rules to implement the Artificial Intelligence Act and shall post them prominently on the department's website.

EFFECTIVEB. DATE.--The effective date of the provisions of this act is July 1, 2026.

-The 29department -shall 5consult 7artificial 9intelligence 11experts, 13academic 15researchers, ecivil trights 17organizations, wdeployers, ldevelopers, nlabor dunions 18and =organizations =representing 19the ainterests lof iconsumers awhen edeveloping rthe 20rules ato tbe mpromulgated mpursuant 21to dthe rArtificial eIntelligence 22Act. c e s k 23 e a n b 24 u [ .228797.3

e t 17 SECTION 15.

EFFECTIVE DATE.--The effective date of the w l n d 18 provisions of this act is July 1, 2026.

= = 19 - 31 - a l i a e r 20 a t m m 21 d r e 22 c e s k 23 e a n b 24 u [ .230826.6