§ 503 — Impact assessments

* § 503. Impact assessments. 1. Government agencies seeking to utilize\nor apply an automated decision-making tool permitted under section five\nhundred two of this article with continued and operational meaningful\nhuman review shall conduct or have conducted an impact assessment\nsubstantially completed and bearing the signature of one or more\nindividuals responsible for meaningful human review for the lawful\napplication and use of such automated decision-making tool. Following\nthe first impact assessment, an impact assessment shall be conducted in\naccordance with this section at least once every two years. An impact\nassessment shall be conducted prior to any material change to the\nautomated decision-making tool that may change the outcome or effect of\nsuch tool. Such impact assessments shall include:\n (a) a description of the objectives of the automated decision-making\ntool;\n (b) an evaluation of the ability of the automated decision-making tool\nto achieve its stated objectives;\n (c) a description and evaluation of the objectives and development of\nthe automated decision-making including:\n (i) a summary of the underlying algorithms, computational modes, and\nartificial intelligence tools that are used within the automated\ndecision-making tool; and\n (ii) the design and training data used to develop the automated\ndecision-making tool process;\n (d) testing for:\n (i) accuracy, fairness, bias and discrimination, and an assessment of\nwhether the use of the automated decision-making tool produces\ndiscriminatory results on the basis of a consumer's or a class of\nconsumers' actual or perceived race, color, ethnicity, religion,\nnational origin, sex, gender, gender identity, sexual orientation,\nfamilial status, biometric information, lawful source of income, or\ndisability and outlines mitigations for any identified performance\ndifferences in outcomes across relevant groups impacted by such use;\n (ii) any cybersecurity vulnerabilities and privacy risks resulting\nfrom the deployment and use of the automated decision-making tool, and\nthe development or existence of safeguards to mitigate the risks;\n (iii) any public health or safety risks resulting from the deployment\nand use of the automated decision-making tool;\n (iv) any reasonably foreseeable misuse of the automated\ndecision-making tool and the development or existence of safeguards\nagainst such misuse;\n (e) the extent to which the deployment and use of the automated\ndecision-making tool requires input of sensitive and personal data, how\nthat data is used and stored, and any control users may have over their\ndata; and\n (f) the notification mechanism or procedure, if any, by which\nindividuals impacted by the utilization of the automated decision-making\ntool may be notified of the use of such automated decision-making tool\nand of the individual's personal data, and informed of their rights and\noptions relating to such use.\n 2. Notwithstanding the provisions of this article or any other law, if\nan impact assessment finds that the automated decision-making tool\nproduces discriminatory or biased outcomes, the government agency shall\ncease any utilization, application, or function of such automated\ndecision-making tool, and of any information produced using such tool.\n * NB Effective December 19, 2026\n