Virginia 2025-HB2094

• Authority: Virginia
• Parent authority: State governments
• Jurisdiction: United States
• Collections: Editors' Picks;U.S. state and local documents
• Most recent activity: Defunct
• Most recent activity date: 2025-03-24

Risk subdomain coverage

Good coverage — Comprehensive governance measures or mitigations with clear procedures relating to the risk subdomain are explicitly described.

• Unfair discrimination and misrepresentation
• Lack of capability or robustness
• Lack of transparency or interpretability

Minimal coverage — Brief mention but no specific mitigations, recommendations or governance measures relating to the risk subdomain are described.

• Unequal performance across groups
• Compromise of privacy
• AI system security vulnerabilities
• False or misleading information
• Fraud, scams, and targeted manipulation
• Loss of human agency and autonomy

All other risk subdomains had no coverage in this document.

Risk Coverage Summary

The document has good coverage of approximately 6-7 subdomains, with strong focus on unfair discrimination (1.1), privacy compromise (2.1), security vulnerabilities (2.2), false information (3.1), lack of transparency (7.4), and lack of robustness (7.3). Coverage is concentrated in discrimination/toxicity, privacy/security, and AI system safety domains.

Sector coverage

Good coverage — Comprehensive governance measures or mitigations with clear procedures relating to the sector are explicitly described.

• Finance & Insurance
• Health Care & Social Assistance
• Public Administration (excl. National Security)

Minimal coverage — Brief mention but no specific mitigations, recommendations or governance measures relating to the sector are described.

• Information
• Real Estate, Rental & Leasing
• Professional & Technical Services
• Scientific Research & Development Services
• Educational Services
• National Security

All other sectors had no coverage in this document.

Sectors Summary

The document governs AI use across multiple sectors through its definition of 'consequential decisions' which explicitly covers employment, education, financial services, healthcare, housing, insurance, and legal services. The law applies broadly to any sector where high-risk AI systems make decisions affecting consumers in these areas.

Legislative Status

Hard Law

Legislative Status Summary

This is a binding legislative act with mandatory requirements, civil penalties for non-compliance, and enforcement by the Attorney General. The document uses mandatory language throughout ('shall') and establishes specific legal obligations for developers and deployers of high-risk AI systems.

Actors

Proposer

• Entity Types: AI_Governance_Actor
• Summary: The document is a bill enacted by the General Assembly of Virginia to amend the Code of Virginia, establishing this legislative body as the proposer of the governance instrument.

Target

• Entity Types: AI_Developer, AI_Deployer
• Summary: The document explicitly targets two categories of entities: developers who create or substantially modify high-risk AI systems, and deployers who use such systems to make consequential decisions affecting Virginia consumers.

Enforcer

• Entity Types: AI_Governance_Actor
• Summary: The document grants exclusive enforcement authority to the Attorney General of Virginia, who has powers to issue civil investigative demands, bring injunctive actions, and impose civil penalties.

Monitor

• Entity Types: AI_Governance_Actor
• Summary: The Attorney General has monitoring authority through civil investigative demands and the power to require disclosure of risk management policies, impact assessments, and other documentation relevant to investigations.

AI Lifecycle Stages

Lifecycle stages covered by the documents, as defined in the OECD Framework for the Classification of AI Systems

• Plan and Design
• Collect and Process Data
• Build and Use Model
• Verify and Validate
• Deploy
• Operate and Monitor

AI Lifecycle Summary

The document covers multiple lifecycle stages with primary focus on deployment and operational monitoring. It addresses design through risk management requirements, validation through impact assessments, deployment through disclosure requirements, and ongoing monitoring through post-deployment oversight obligations.

Technical Scope

Terms relating to technical scope that are mentioned or implicitly referenced in the document

• AI Models
• AI Systems
• General Purpose AI
• Generative AI

Technical Scope Summary

The document explicitly defines and covers AI systems and AI models, with specific focus on high-risk AI systems. It addresses general-purpose AI models and generative AI systems. There is no explicit mention of frontier AI, task-specific AI, foundation models, predictive AI, open-weight models, or specific compute thresholds.