HB2500

SECTION 1. The Hawaii Revised Statutes is amended by adding a new chapter to be appropriately designated and to read as follows:

"Chapter

artificial intelligence

§ -1 Definitions. As used in this chapter:

"Algorithmic decision system" means any machine-based system or computational process that uses statistical modeling, data analytics, artificial intelligence, or machine learning to generate a simplified output, including scores, classifications, or recommendations, or is capable, for a given set of human-defined objectives, of making predictions or recommendations and is used to assist, inform, or replace human decision-making. "Algorithmic decision system" does not include the following:

(1) Databases, spreadsheets, or other tools that merely organize data already in the possession of the human user of the system;

(2) Junk email filters;

(3) Firewalls;

(4) Anti-virus software;

(5) Calculators;

(6) Spell-checking;

(7) Anti-malware;

(8) Artificial-intelligence-enabled video games;

(9) Cybersecurity;

(10) Data storage;

(11) Internet domain registration;

(12) Internet website loading;

(13) Networking;

(14) Spam call and robocall filtering;

(15) Web caching;

(16) Web hosting or similar technology; or

(17) Technologies that are solely used to order office supplies, schedule meetings, automate inventory tracking, or perform, assist, or administer similar ministerial administrative support functions.

"Biometric identifier" means data generated by the technological processing, measurement, or analysis of an individual's biological, physical, or behavioral characteristics, which data can be processed for the purpose of uniquely identifying the individual. "Biometric identifier" includes:

(1) A fingerprint;

(2) A voiceprint;

(3) A scan or record of an eye retina or iris;

(4) A facial map, facial geometry, or facial template; or

(5) Other unique biological, physical, or behavioral patterns or characteristics.

"Deploy" means to use an algorithmic decision system.

"Deployer" means a person doing business in the State that deploys an algorithmic decision system.

"Develop" means to design, build, or train an algorithmic decision system or to knowingly and materially modify, adapt, or combine an existing machine-based system or computational process for use as an algorithmic decision system.

"Developer" means a person or the person's agent doing business in the State that:

(1) Develops an algorithmic decision system; or

(2) Sells, leases, distributes, or otherwise makes available an algorithmic decision system to a deployer.

"Generative artificial intelligence system" means an artificial intelligence system that:

(1) Is trained on data;

(2) Interacts with an individual using text, audio, or visual communication; and

(3) Generates unscripted outputs similar to outputs created by a human, with limited or no human oversight.

"Personal characteristics" include:

(1) Personal data;

(2) Genetic information;

(3) Biometric identifiers;

(4) An individual's economic situation, health, personal preferences, affiliations, interests, reliability, behavior, location, or movements; and

(5) Inferences associated with a group, band, class, or tier of individuals to which the individual belongs.

"Plain language" means communication that is:

(1) Clear, concise, and easy to understand for the intended audience, including people with disabilities, people with limited education, and English language learners; and

(2) Available in English and any other relevant languages required by the attorney general by rule.

§ -2 Disclosure requirements for developers of algorithmic decision systems. Beginning January 1, 2027, a developer shall, consistent with any form and manner prescribed by the attorney general, provide to each deployer of the developer's algorithmic decision system:

(1) An analysis of whether and how any intended uses, or reasonably foreseeable uses or misuses, of the algorithmic decision system pose a known or reasonably foreseeable risk of violating this chapter and any applicable state or federal law;

(2) A description of any steps taken by the developer to mitigate any identified risks of violations of this chapter and any applicable state or federal law;

(3) A statement describing the intended uses and reasonably foreseeable uses and misuses of the algorithmic decision system; and

(4) All other information necessary to allow the deployer to comply with the deployer's obligations under this chapter.

§ -3 Disclosure requirements for deployers of algorithmic decision systems. (a) Beginning January 1, 2027, a deployer shall, either directly or through a developer or other third party, provide the disclosures required by subsection (b) directly to an individual who is or will be affected by a decision made, informed, or influenced by an algorithmic decision system, which decision has a material legal or similarly significant effect on the provision or denial to the individual of, or the cost or terms of:

(1) Education enrollment or an education opportunity;

(2) Employment or an employment opportunity;

(3) A financial or lending service;

(4) An essential government service;

(5) A health care service;

(6) Housing;

(7) Insurance; or

(8) A legal service.

(b) Before a deployer deploys an algorithmic decision system to make, inform, or influence a decision affecting an individual pursuant to subsection (a), the deployer shall provide the individual with a notice, in plain language and consistent with any form and manner prescribed by the attorney general, that the deployer will be using an algorithmic decision system to make, inform, or influence a decision concerning the individual; provided that the notice shall include:

(1) The name of the developer or developers of the algorithmic decision system;

(2) The trade name and version number of the algorithmic decision system;

(3) The nature of the decision and the stage in the decision-making process during which the algorithmic decision system will be used; and

(4) The contact information for the deployer.

(c) As soon as practicable, and no later than thirty days after the deployment of an algorithmic decision system to make, inform, or influence a decision pursuant to subsection (a), a deployer shall provide an affected individual, in plain language and consistent with any form and manner prescribed by the attorney general, with:

(1) A list of the types, categories, and sources of personal characteristics associated with the individual that were analyzed, predicted, input into, inferred, or collected by the algorithmic decision system;

(2) A list of the twenty personal characteristics of the individual that most substantially influenced the output of the algorithmic decision system or, if the algorithmic decision system's output was influenced by fewer than twenty personal characteristics, a list of all personal characteristics that influenced the output; and

(3) Information on how the individual can exercise rights pursuant to section -4.

§ -4 Individual right to access and correct data used by an algorithmic decision system; procedures. (a) An individual affected by a decision made, informed, or influenced by an algorithmic decision system, as described in section -3(a), has a right to:

(1) Access any personal characteristics of the individual that were analyzed by, predicted by, input into, inferred by, or collected by an algorithmic decision system; and

(2) Challenge and correct any inaccurate data.

(b) A deployer or developer that has access to an individual's data shall create reasonable, accessible, and concise procedures in plain language to allow the individual to exercise the individual's right pursuant to subsection (a).

§ -5 Disclosure requirements for generative artificial intelligence systems. Pursuant to any requirements established by the attorney general, a person that deploys, offers, sells, leases, licenses, gives, or otherwise makes available a generative artificial intelligence system that is intended to interact with an individual shall disclose to each individual who interacts with the generative artificial intelligence system the fact that the individual is interacting with a generative artificial intelligence system.

§ -6 Joint and several liability for a developer and deployer of an algorithmic decision system. (a) Notwithstanding any other law to the contrary, beginning January 1, 2027, the developer and deployer of an algorithmic decision system shall be jointly and severally liable for a violation of any law facilitated by the deployer's use of the algorithmic decision system; provided that a developer shall not be jointly and severally liable if the developer can demonstrate that the violation of law resulted from a misuse of the algorithmic decision system by the deployer, the developer took all reasonable steps available, contractual or otherwise, to prevent the misuse, and the developer:

(1) Did not intend and could not have reasonably foreseen the misuse; or

(2) Specifically disallowed the misuse in disclosures pursuant to section -2.

(b) Nothing in this section shall limit, displace, or otherwise affect any liability that a developer may have in the developer's own right, separate and apart from liability under this section, for a violation of state or federal law. Compliance with this chapter shall not be a defense to, and shall not otherwise excuse, noncompliance with any applicable law.

§ -7 Enforcement. (a) A violation of this chapter shall constitute an unfair or deceptive act or practice in the conduct of trade or commerce within the meaning of section 480-2.

(b) No private right of action at law shall arise under this chapter.

(c) Nothing in this chapter shall preempt or otherwise affect any other right, claim, remedy, presumption, or defense available at law or in equity, including any right available pursuant to laws governing anti-discrimination, competition, privacy, or unfair and deceptive acts and practices.

§ -8 Rules. The attorney general shall adopt rules as necessary pursuant to chapter 91 to implement and enforce this chapter."

SECTION 2. This Act does not affect rights and duties that matured, penalties that were incurred, and proceedings that were begun before its effective date.

SECTION 3. If any provision of this Act, or the application thereof to any person or circumstance, is held invalid, the invalidity does not affect other provisions or applications of the Act that can be given effect without the invalid provision or application, and to this end the provisions of this Act are severable.

SECTION 4. This Act shall take effect upon its approval.

INTRODUCED BY:	_____________________________

HOUSE OF REPRESENTATIVES	H.B. NO.	2500
THIRTY-THIRD LEGISLATURE, 2026
STATE OF HAWAII