New Hampshire H1688 (AI Use By State Agencies)

Summary

Define "artificial intelligence," "generative AI," "deepfake," and "state agency" in relation to AI governance.

Apply provisions to all state agency computer systems, with exceptions for research and personal use systems.

Prohibit uses by state agencies for classifying individuals leading to discrimination, surveillance in public spaces without a warrant, and malicious use of deepfakes.

Allow AI use with human oversight on irreversible decisions, disclosure of AI-generated content, and informing users of AI interactions.

Require state agencies to review AI use, modify inconsistent procedures, and document compliance within nine months, reporting to the department of information technology.

Mandate annual reporting and updates on AI system compliance and procurement to key government officials and public posting on the department website.

Sever provisions to ensure remaining regulations remain in effect if parts are invalidated.

Enact the chapter on July 1, 2024.

Defines key terms including artificial intelligence, generative AI, deepfake, and state agency for regulatory purposes.

CHAPTER 5-D

USE OF ARTIFICIAL INTELLIGENCE BY STATE AGENCIES

5-D:1 Definitions. In this chapter:

I. "Artificial intelligence" or "AI" is the ability of a machine to display human-like capabilities for cognitive tasks such as reasoning, learning, planning, and creativity. AI systems may adapt their behavior to a certain degree by analyzing the effects of previous actions and operating under varying and unpredictable circumstances without significant human oversight.

II. "Generative AI" is AI that can generate text, images, or other media in response to prompts.

III. "Deepfake" means a video, audio, or any other media of a person in which his or her face, body, or voice has been digitally altered so that he or she appears to be someone else, he or she appears to be saying something that he or she has never said, or he or she appears to be doing something that he or she has never done.

IV. "State agency" means any department, commission, board, institution, bureau, office, law enforcement, or other entity, by whatever name called, including the legislative and judicial branches of state government, established in the state constitution, statutes, session laws or executive orders.

Applies the chapter to state agency computer systems, excluding certain educational and personal-use consumer systems. Prohibits AI use in unlawful discrimination, surveillance without a warrant, and malicious deepfakes.

5-D:2 Applicability. This chapter shall apply to all computer systems operated by any state agency as defined in RSA 5-D:1, IV. Excepted are systems used in research by state-funded institutions of higher learning. Also excepted are installed consumer systems in common personal use, including, but not limited to facial recognition used to unlock a smartphone.

5-D:3 Prohibition. The following uses of AI by state agencies shall be prohibited:

I. Classifying persons based on behavior, socio-economic status, or personal characteristics resulting in unlawful discrimination against any individual person or group of persons.

II. Real-time and remote biometric identification systems used for surveillance in public spaces, such as facial recognition, except by law enforcement with a warrant.

III. Deepfakes when used for any deceptive or malicious purpose.

Requires human review of irreversible AI decisions, disclosure of AI-generated material, and user AI interaction notification.

5-D:4 Permitted Uses and Restrictions. Use of AI by state agencies shall be allowed under the following circumstances and with the following restrictions:

I. If an AI system produces a recommendation or a decision, and this recommendation or decision once implemented or executed cannot be reversed, then the recommendation or decision must be reviewed by a human who is in an appropriate responsible position and is aware of the limitations of the AI system before the recommendation or decision takes effect.

II. Such recommendations and decisions pertain to, but are not limited to, the following:

(a) Situations in which limitations on rights and freedoms of an individual person or group of persons are determined.

(b) Biometric identification to verify the identity of an individual person.

(c) Management and operation of critical infrastructure.

(d) Actions taken by law enforcement at the state and local levels.

(e) Interpreting and applying the laws of the state, including sentencing.

III. Any material produced by generative AI and that has not been reviewed, and possibly edited by a human in an appropriate responsible position, must be accompanied by disclosure that the content was generated by AI.

IV. In all other circumstances in which a human user is interacting with an AI system, either directly or indirectly, the user must be informed that they are interacting with an AI system.

Requires state agencies to review and align AI use with ethical codes; mandates annual reporting to officials.

5-D:5 Compliance.

I. All state agencies shall take the following actions no later than 9 months after the effective date of this chapter and report their compliance with the department of information technology:

(a) Review the use of AI in their computer systems to verify, to the best of their knowledge, that they comply with the provisions of this chapter and the department of information technology code of ethics for AI systems. Any AI system that is prohibited shall be removed.

(b) Modify all procedures relative to any use of AI that are inconsistent with this chapter so that these procedures are consistent with the requirements in this chapter.

II. Any AI systems newly deployed by a state agency after the effective date of this chapter shall comply with the provisions of this chapter and the department of information technology code of ethics for AI systems. All newly implemented procedures relative to any use of AI that are implemented by a state agency after the effective date of this chapter shall be consistent with the requirements in this chapter.

III. One year after the effective date of this chapter, the department of information technology shall provide to the governor, the speaker of the house of representatives, and the president of the senate a report summarizing AI systems identified by state agencies recording which of those systems were prohibited and removed in compliance with this chapter, which systems are allowed according to this chapter, and what procedures have been implemented to ensure that the procurement and use of these systems will be in compliance with this chapter. This report shall be updated annually to include new systems that state agencies have purchased. All such reports shall also be posted on the department of information technology’s website.

Declares provisions severable so invalidity of one doesn't affect others; effective July 1, 2024.

5-D:6 Severability.

The provisions of this chapter are severable. If any provision of this chapter or its application is held invalid, that invalidity shall not affect other provisions or applications that can be given effect without the invalid provision or application.

2 Effective Date. This act shall take effect July 1, 2024.