The Next Wave of AI Regulation: What Employers Should Know About State-Level Activity

Transcript

Eric Felsberg
Principal, Long Island

Welcome to the We Get AI podcast. My name is Eric Felsberg, and I'm joined by my colleague Joe Lazzarotti. Joe and I are the leaders of the AI group at Jackson Lewis. We're happy to be with you as we try to demystify a lot of the AI developments that we're all experiencing; this is a rapidly moving area.

The goal of this podcast is to ensure that we take some of those developments and break them down into easy-to-understand segments. If it goes well, offer you some practical tips on how to navigate this evolving area.

Joe Lazzarotti
Principal, Tampa

Hey, good to be with you, Eric. Today we want to try to touch on some recent developments. There was a significant change in Colorado. They had come out with a comprehensive, expansive AI law that required developers and deployers to take several steps, and it looks like that's been pretty scaled back, although there are still some things that have to be done.

Connecticut more recently passed its own law that touched on a whole range of areas, obviously including employment, but also companion bots, chat bots, AI with children, issues with children, and a whole range of other issues. A good place to start is to touch on the Connecticut law and tell us what the key issues are and what businesses should be thinking about.

Felsberg

Those have been the two most recent developments. It's helpful to provide some context to the landscape of AI laws that are now joined by this updated Colorado law, as you mentioned, of course, Connecticut. We have seen laws pop up pretty consistently over the last year or so in different jurisdictions. We have New York City, of course, Illinois, Colorado, you mentioned, Joe, and you're going to cover. Colorado has this take two, if you will. California and Connecticut – these states are all popping up. In the case of New York, New York City as a local jurisdiction is coming up with its own methods for enforcing AI. It's challenging for employers because each of these jurisdictions is getting at the same themes. They're just going about it a little bit differently. 

The other thing that I find interesting is New York City, at least with respect to regulating use of AI in the employment context, has been seen as the leader here. You may recall New York City has a bias audit requirement. There's a publication requirement of the bias, or of course there's a notice piece. For a while, in places like Colorado, there seemed to be an emphasis on analyzing the output from some of these tools that we use in the employment context for evidence of bias. That seemed to be the emphasis early on.

As we're going to see in a few minutes, with some of the most recent laws, that emphasis has shifted away from prioritizing bias analyses, and now it's putting more of the weight on transparency and the issuance of notices. You see that most dramatically in Colorado, but even in places like Connecticut. 

Connecticut has a new law, and as your comments echo or allude to, it's pretty far-reaching. It's not just limited to the employment context. It touches upon deployers and developers. It talks about chatbots and, of course, has a big section of it dealing with automated employment-related decision technology. Again, in Connecticut law, there are some staged effective dates in this particular law, but it starts to go into effect later this year in the fall. What Connecticut is getting at from an employment perspective is that, and I'm paraphrasing here, if you're using any tools that are playing a substantial factor in your employment process, think of this like those processes that are resulting in an employment decision. If it's ranking or scoring or somehow categorizing candidates, let's say for hire, although it's not limited to hiring, but for ease of discussion for hiring, it triggers a notice obligation in the state of Connecticut. It falls primarily on the shoulders of the deployers. That's going to be our employers out there that are using this technology. It also puts some of the onus on the developers, in fact, leaning on those developers to provide some of the information to the deployers, again, which are going to be our employers here, that have to issue the notice. The law in this regard is fairly forgiving in a sense that if you don't get this right at first pass, there is a cure period that's afforded before there's any stricter enforcement; that's a way to characterize it. 

The content of the notice has six features to it. The first one is that if you're using an automated employment-related decision technology, and again, you know, there's an acronym there for that, AEDT. It seems like every state has its own acronym, but they're all fairly similar. You have to notify them that if you're the deployer and you're using one of these tools to put folks, if it's an applicant situation, applicants that are going to be reviewed vis-a-vis this tool, and put them on notice that we are using this technology. We also need to touch on what the purpose of it is and what the nature of the employment-related decision is that is at least in part being handled by the technology. Interestingly, you also have to provide the trade name. What's the actual name of the technology you're using?

Joe, our listeners know from some of our past episodes that you have a very deep background in the privacy area. This next item touches on your area, which is categories of personal data that the tool is considering when making or engaging in this decision-making technology. I'll ask you in a moment here to perhaps comment on that, but that's certainly a feature of the notice and the sources of that personal data that's being used. 

Finally, number six is providing contact information. Again, if you look at the provisions of the notice in Connecticut, it's really saying to these employers, be transparent. You're not going to see anything in here about any analytics as you see in New York City, which is highly stressed in that jurisdiction. It's more about notifying folks whose information may be processed by one of these technologies to say, this is out there, this is what we're doing, here's the name of it, and this is how it's being used. Again, it then puts the decision with the applicant; if it's an applicant situation, the job seekers decide whether this is something they're going to continue on with or not.  

It's interesting because, to reference back to what I said earlier, there is a very heavy emphasis on notice, less so on measuring, if you will, for discrimination. Again, Connecticut, it's a pretty lengthy bill, a lot of different features. We probably could do maybe a one- or two-hour episode solely just on this law. We won't. That's an overview from the employment perspective with respect to Connecticut. 

Lazzarotti

To your point about the privacy angle, it's funny how AI and privacy have joined forces in a way. Both the Connecticut and the Colorado laws are tied in some ways to the existing comprehensive privacy statutes in both cases. The definition of an AI that might be an automated employment decision tool is that technology must process personal information and use computation to generate output. It's noting that if you're going to have used an AI tool, it has to have personal data being used in the process. It makes sense that part of the notice, at least in Connecticut, would require that you describe those elements. 

Another interesting point about that is, just staying on Connecticut for a minute, there's an interesting distinction; maybe you can expand on this in Connecticut: there are some exclusions to what that is. One of the excluded technologies is these performance management platforms, like these measuring platforms that track employee productivity.

As I understand it, that by itself is not covered, but if you focus on what decision is being made, for example. if you're deciding on whether to promote someone and performance is a part of that decision, then that would be a decision. Can you talk about that a little bit?

Felsberg

On its face, just looking at the tool for what it's doing, if it is something along the lines of what you're describing, Connecticut says, this law doesn't apply to that situation. It's somewhat of a fine line or a slippery slope, however you'd like to think of it, because all right, well now I have values that are coming out of that platform, if it is used to look at things like productivity or what have you. What if I now use those outputs to make employment decisions? Am I now back in the law? I'm not sure I have an answer for that. 

It's going to be interesting to see, from a pure discrimination perspective, if somebody were to make an allegation to say, you've made decisions that either disparately treated or impacted either me or the demographic that I identify as, could they point to that output as a piece of the decision-making process and therefore potentially actionable? For me, it's a little bit of a gray area, but I agree with you that there are exclusions here.

We have to wait. This law in particular is not even in effect yet. We must see how this unfolds. I would say more broadly, a lot of these state laws, even if they are local laws- again, New York City, for example- even if they have been in effect, candidly we just haven't seen a lot of enforcement activity. Until those times come when we do see more enforcement, some of these questions will be answered, but it is an interesting point.

Joe Lazzarotti

You mentioned the shift, maybe to some degree, to transparency and notice. Certainly, Connecticut has a notice provision, Colorado has a notice provision, although it's a little different in the sense that you have a pre-interaction notice, then you have a notice requirement if you make some adverse outcome.

A few months ago, we reported that in the Illinois statute they had said that there would need to be a notice, and then the Illinois Department of Human Rights started issuing some draft guidelines which earlier this month were pulled back. I'm not sure if they're just trying to rethink it a little bit more and put it back in the oven, let it cook a little bit more. 

There is a big focus on how to provide that notice, and you must describe what the tool is that you're using. You really need to think about that and know which tools you must be able to describe in the notice. Also, if you're a multi-state organization, how are you tracking that? A lot of times companies want to streamline these processes and come up with one way to do this across all their locations, and that may become a little bit more challenging.

Just looking at California with the CCPA. You have Illinois when they get around to the end notice requirement. You're going to have Colorado with a pre-interaction or post-adverse notice. You're going to have Connecticut, which it looks like is just that initial notice, and who knows what other states are going to come about. You have the New York City notice, the website posting. It's really going to require a fair amount of coordination, some inventory, and some tracking of those requirements to be able to know what to say and when you have to say it. New York City has some requirements about how you must deliver the notice, which is going to be a big challenge for a lot of organizations.

Do you see that as well?

Felsberg

I am. Joe, you're right. We work with employers across state borders with clients that have operations all over the United States, and they would love to know if we have a notice for them that would cover them everywhere. In theory, we can create one, but then you start to get concerned about, well, am I extending the post-action notice or provision in Colorado? Should that be baked into the same notice where it's going to be given to employees or candidates in other states where that is not a provision of that particular law? These notices are going to start to, and they already have to some degree morphed into a very large document that says, if you're in New York City, here are the provisions that apply to you. If you're in Connecticut, here are the provisions, and so on and so forth.

The other thing I have found, just from speaking with different employers, is that in our day and age, it seems like everybody works remotely. If I’m sitting in a state other than Colorado, let's say I'm sitting in Oklahoma. I am applying for a job with an employer in Colorado, but that job can, in theory, be performed anywhere in the country. It doesn't have to be in Colorado, Oklahoma, New York City or any of these places. It is getting cumbersome to figure out how to do it for each candidate. Before you know it, you're talking about issues that extend far beyond the world of AI. Perhaps you're getting into other issues about, for example, who has standing or anything like that. This is becoming a huge area of concern for employers. Again, without any enforcement that we can reflect on, it makes the job for people like you and me and other practitioners to give advice to say, this is firmly what you can expect because we're all in the same position where we're not reading the regulations and so forth, but also reading tea leaves. Sometimes that could not be the most comfortable place to be, but just the landscape now.

Joe Lazzarotti

One other thing about Colorado, and generally it must be looked at as if we're still at the beginning. I mean, even under that new version of the law, which quickly replaced the original version, and now that it calls for the attorney general to adopt rules to clarify those notice requirements, at least in the post-adverse situation. That's going to be before the end of this year. The way that they crafted that was that the AG may decide to come up with different rules for different covered domains. It's the term that they use to refer to employment, financial services, health services and education. Depending on what industry your organization is in, you may have a different set of rules to communicate adverse decisions, whether you're dealing with a customer/patient/student or whatever versus your own employees. Just keeping that straight as well, internally, you may have some inconsistencies or just things you must address or attend to. You can't just say, they must have done this already for our customers, so we can take those notices and use them for our employees, and that may not work either. Those kinds of issues involve managing the governance around this, and building some kind of a cheat sheet for you is going to be helpful, perhaps. Unless maybe AI can come up with a super notice or something like you were talking about. It just seems like it's going to get pretty crazy quick.

Just a couple of other things on this. There's a three-year record retention requirement. I don't know if one exists in Connecticut, but I know that Colorado has something like that. Companies need to think about, in terms of whether they're going to deploy some type of automated decision-making technology, what do they have to do with that? 

The last thing I wanted to mention in Colorado is that there are some pretty interesting provisions around allocation of liability with developers, and a lot of clients are using third parties to leverage their tools and thinking, hey, we could negotiate indemnity. You really must look at those provisions because the statute places some significant limitations on whether and under what circumstances you can shift liability for your own actions to the vendor. That's going to be pretty important. 

The other thing is that the developers have some protection for uses that are outside of what they've advertised their products to perform. If they, in their agreements, say, our tool is intended to do this, to do X, Y, and Z, and you do A, B, and C, you may not have the protection that you think you have. You really have to understand the terms of use and your master services agreement and what you're buying, because how you use the tool may not be on all fours with what it's advertised as.

Felsberg

Several of the issues that you're bringing up, as well as some of the requirements for employers under these notice provisions in these different jurisdictions, force their hand to have a robust governance structure. When I speak to employers, they are usually not thinking in those terms. They're thinking, what does the law require and what do I have to do? In certain jurisdictions, for example, you may have opt-out provisions where somebody may opt out of the use of AI. Who in the organization is going to manage that? How do we keep track of these different requirements? The underbelly to all of this, which we've talked about on prior episodes, is the importance of having a very robust governance structure, and it's even more so now. 

Listen, we're not going to solve all these issues in a 20-minute podcast episode. I'm sure we're going to revisit these topics on future episodes. Joe, great conversation as always, and to our listeners, thank you very much for tuning in.

If you have any questions about anything that we discuss on this podcast or you would like to see a topic that you haven't seen or heard about yet, let us know. You could reach out to us at ai@jacksonlewis.com.