HB5322 103RD GENERAL ASSEMBLY

LRB103 37070 JRC 67188 b

103RD GENERAL ASSEMBLY
State of Illinois
2023 and 2024
HB5322

Introduced 2/9/2024, by Rep. Abdelnasser Rashid

SYNOPSIS AS INTRODUCED:

New Act

Creates the Illinois Commercial Algorithmic Impact Assessments Act. Defines "algorithmic discrimination", "artificial intelligence", "consequential decision", "deployer", "developer" and other terms. Requires that by January 1, 2026 and annually thereafter, a deployer of an automated decision tool must complete and document an assessment that summarizes the nature and extent of that tool, how it is used, and assessment of its risks among other things. Requires on or after January 1, 2026 and annually thereafter, developers of an automated decision tool must complete and document a similar assessment. Provides that upon the request of the Attorney General, a developer or deployer must provide that Office any impact assessment performed that is exempt from the Freedom of Information Act. Requires that a developer must provide a deployer with a statement regarding the intended uses of the automated decision tool and documentation regarding all of the following: (i) the known limitations of the automated decision tool, including any reasonably foreseeable risks of algorithmic discrimination arising from its intended use; (ii) a description of the types of data used to program or train the automated decision tool; and (iii) a description of how the automated decision tool was evaluated for validity and the ability to be explained before sale or licensing. Exempts a deployer with fewer than 50 employees unless, as of the end of the prior calendar year, the deployer deployed an automated decision tool that affected more than 999 people per year.

A BILL FOR

AN ACT concerning business.

Be it enacted by the People of the State of Illinois, represented in the General Assembly:

Section 1. Short title. This Act may be cited as the Illinois Commercial Algorithmic Impact Assessments Act.

Section 5. Definitions. As used in this Act:

"Algorithmic discrimination" means the condition in which an automated decision tool contributes to unjustified differential treatment or impacts disfavoring people on the basis of race, color, national origin, citizen or immigration status, families with children, creed, religious belief or affiliation, sex, marital status, the presence of any sensory, mental, or physical disability, age, honorably discharged veteran or military status, sexual orientation, gender expression or gender identity, or any other protected class under Illinois statute.

"Artificial intelligence" means a machine-based system that can, for a given set of human-defined objectives, make predictions, recommendations, or decisions influencing a real or virtual environment.

"Automated decision tool" means a system or service that uses artificial intelligence and has been specifically developed and marketed to, or specifically modified to, make, or be a controlling factor in making, consequential decisions.

"Consequential decision" means a decision or judgment that has a legal, material, or similarly significant effect on an individual's life relating to the impact of, access to, or the cost, terms, or availability of, any of the following:

(1) Employment, workers management, or self-employment, including, but not limited to:

(A) Pay or promotion;

(B) Hiring or termination; and

(C) Automated task allocation that automatically limits, segregates, or classifies employees based on individual behavior or performance for the purpose of assigning or determining material terms or conditions of employment.

(2) Education and vocational training, including, but not limited to:

(A) Assessment, including, but not limited to, detecting student cheating or plagiarism;

(B) Accreditation;

(C) Certification;

(D) Admissions; and

(E) Financial aid or scholarships.

(3) Housing or lodging, including rental or short-term housing or lodging;

(4) Essential utilities, including electricity, heat, water, internet or telecommunications access, or transportation;

(5) Family planning, including adoption services or reproductive services, as well as assessments related to child protective services;

(6) Health care or health insurance, including mental health care, dental, or vision;

(7) Financial services, including a financial service provided by a mortgage company, mortgage broker, or creditor;

(8) The criminal justice system, including, but not limited to, risk assessments for pretrial hearings, sentencing, and parole;

(9) Legal services, including private arbitration or mediation;

(10) Voting; and

(11) Access to benefits or services or assignment of penalties.

"Deployer" means a person, partnership, State or local government agency, or corporation that uses or modifies an automated decision tool to make a consequential decision.

"Developer" means a person, partnership, State or local government agency, or corporation that designs, codes, or produces an automated decision tool, or substantially modifies an artificial intelligence system or service for the known intended purpose of making, or being a controlling factor in making, consequential decisions, whether for its own use or for use by the deployer.

"Ethical artificial intelligence" means automated decision tools that are developed and deployed with reasonable efforts by the developer and the deployer to:

(1) Minimize unlawful discriminatory or biased outputs or applications;

(2) Ensure that automated decision tools are being operated reliably, safely, and consistently;

(3) Protect the data of natural persons by incorporating robust privacy and data security measures;

(4) Prioritize transparency so that the behavior and functional components of automated decision tools can be understood in order to enable the identification of performance issues, safety and privacy concerns, biases, exclusionary practices, and unintended outcomes; and

(5) Promote individual rights and minimize reasonably foreseeable harm to individuals resulting from use of the automated decision tool.

"Impact assessment" means a documented risk-based evaluation of an automated decision tool that meets the criteria of this Act.

"Sex" includes pregnancy, childbirth, and related conditions, gender identity, intersex status, and sexual orientation.

"Significant update" means a new version, new release, or other update to an automated decision tool that materially changes its principal use, principal intended use, or expected outcome.

Section 10. Assessment required.

(a) By January 1, 2026, and annually thereafter, a deployer of an automated decision tool must complete and document an impact assessment for any automated decision tool the deployer uses that includes all of the following:

(1) A statement of the purpose of the automated decision tool and its intended benefits, uses, and deployment contexts;

(2) A description of the automated decision tool's outputs and how they are used to make, or be a controlling factor in making, a consequential decision;

(3) A summary of the types of data collected from natural persons and processed by the automated decision tool when it is used to make, or be a controlling factor in making, a consequential decision;

(4) A statement of the extent to which the deployer's use of the automated decision tool is consistent with or varies from the statement required of the developer by Section 15 of this Act;

(5) An assessment of the reasonably foreseeable risks of algorithmic discrimination arising from the use of the automated decision tool known to the deployer at the time of the impact assessment;

(6) A description of the safeguards implemented, or that will be implemented, by the deployer to align use of the automated decision tool with principles of ethical artificial intelligence and to address any reasonably foreseeable risks of algorithmic discrimination arising from the use of the automated decision tool;

(7) A description of how the automated decision tool will be used by a natural person, or monitored when it is used, to make, or be a controlling factor in making, a consequential decision; and

(8) A description of how the automated decision tool has been or will be evaluated for validity or relevance.

(b) By January 1, 2026, and annually thereafter, a developer of an automated decision tool must complete and document an impact assessment of any automated decision tool that it designs, codes, or produces that includes all of the following:

(1) A statement of the purpose of the automated decision tool and its intended benefits, uses, and deployment contexts;

(2) A description of the automated decision tool's outputs and how they are used, as intended, to make, or be a controlling factor in making, a consequential decision;

(3) A summary of the types of data collected from natural persons and processed by the automated decision tool when it is used to make, or be a controlling factor in making, a consequential decision;

(4) An assessment of the reasonably foreseeable risks of algorithmic discrimination arising from the intended use or foreseeable misuse of the automated decision tool;

(5) A description of the measures taken by the developer to incorporate principles of ethical artificial intelligence and to mitigate the risk known to the developer of algorithmic discrimination arising from the use of the automated decision tool; and

(6) A description of how the automated decision tool is intended to be used by a natural person, or monitored when it is used, to make, or be a controlling factor in making, a consequential decision.

(c) A deployer or developer must, in addition to the impact assessment required by subsections (1) and (2) of this Section, perform, as soon as feasible, an impact assessment with respect to any significant update.

(d) Upon the request of the Office of the Attorney General, a developer or deployer must provide any impact assessment that it performed pursuant to this Section to the Office of the Attorney General. If a developer or deployer fails or refuses to provide an impact assessment requested by the Attorney General, the Attorney General may seek injunctive relief, actual damages caused by failure or refusal, and attorney's fees.

(e) Impact assessments provided pursuant to subsection (d) of this Section are confidential and exempt from disclosure under the Freedom of Information Act.

Section 15. Statements provided to deployers. A developer must provide a deployer with a statement regarding the intended uses of the automated decision tool and documentation regarding all of the following:

(a) The known limitations of the automated decision tool, including any reasonably foreseeable risks of algorithmic discrimination arising from its intended use;

(b) A description of the types of data used to program or train the automated decision tool; and

(c) A description of how the automated decision tool was evaluated for validity and the ability to be explained before sale or licensing.

Section 20. Developer policies. A developer must make publicly available, in a readily accessible manner, a clear policy that provides a summary of both of the following:

(a) The types of automated decision tools currently made available to others by the developer; and

(b) How the developer manages the reasonably foreseeable risks of algorithmic discrimination that may arise from the use of the automated decision tools it currently makes available to others.

Section 25. Exempt deployers. This Act does not apply to a deployer with fewer than 50 employees unless, as of the end of the prior calendar year, the deployer deployed an automated decision tool that affected more than 999 people per year.