Welcome to My Academic Portfolio and Knowledge Repository.

Issue 28 – Cybersecurity and Information Security Newsletter

Table of Contents


Virginia bill ensuring that criminal decisions must be made by a human decision-maker becomes law; Virginia Governor vetoes the “High-Risk Artificial Intelligence Developer and Deployer Act.”

The Virginia legislature considered two AI-related bills during the 2025 Regular Session of the Virginia General Assembly. First, House Bill 1642 (HB 1642), “Artificial intelligence-based tool; definition, use of tool,” was enacted on April 2, 2025. Second, House Bill 2094 (HB 2094), “High-Risk Artificial Intelligence Developer and Deployer Act,” was vetoed by Governor Glenn Youngkin on March 24. The bills’ summaries and legislative actions are outlined below.

HB 1642 – “Artificial intelligence-based tool; definition, use of tool”

First, HB 1642 offered by Delegate C.E. Cliff Hayes, aimed to ensure that a human decision-maker shall be the proper judicial or other lawful authority adjudicating in certain criminal procedure matters.1 The bill emphasizes that all decisions related to “the pretrial detention or release, prosecution, adjudication, sentencing, probation, parole, correctional supervision, or rehabilitation of criminal offenders” must be made with “the involvement of a human decision-maker.”2

The purpose of HB 1642 is to define clearly the roles of artificial intelligence-based tools in certain criminal proceedings. The bill defines artificial intelligence-based tools as “any machine-based system[s] or algorithm[s], including machine learning models, predictive analytics, and decision support systems, that analyze data and generate recommendations or predictions.” HB 1642 also states that the “use of any recommendation or prediction from an artificial intelligence-based tool shall be subject to any challenge or objection permitted by law.” Note that the new law doesn’t prohibit use of technological tools.3

The bill passed both houses of the General Assembly and was sent to the Governor on March 5, 2025.  On March 24, Governor Youngkin sent his recommended modification of the bill to the House of Delegates, making minor text adjustments.4 On April 2, both the House of Delegates and the Senate unanimously voted to adopt the Governor’s recommendation, and HB 1642 was enacted with the effective date of July 1, 2025.

HB 2094 – “High-Risk Artificial Intelligence Developer and Deployer Act”

The second AI-related bill considered by the General Assembly was HB 2094 that was offered by Delegate Michelle Lopes Maldonado.5 This bill focused on protecting Virginia consumers from the risks of algorithmic discrimination arising from the use of artificial intelligence systems by creating operating standards for both developers and deployers of “high-risk artificial intelligence systems.”

Under HB 2094, a high-risk artificial intelligence system refers to “any artificial intelligence system that is specifically intended to autonomously make, or be a substantial factor in making, a consequential decision.”6 A consequential decision is “any decision that has a material legal, or similarly significant, effect on the provision or denial to any consumer of (i) parole, probation, a pardon, or any other release from incarceration or court supervision; (ii) education enrollment or an education opportunity; (iii) access to employment; (iv) a financial or lending service; (v) access to health care services; (vi) housing; (vii) insurance; (viii) marital status; or (ix) a legal service.”

In general, HB 2094 would have required the developer of a high-risk artificial intelligence system to “use reasonable duty of care to protect consumers from any known or reasonably foreseeable risks of algorithmic discrimination arising from the intended and contracted uses” of the technology. The bill offered a set of operating standards for developers that, if followed, would have provided a rebuttable presumption that developers complied with this legislation. Similarly, it would have obligated the deployer of a high-risk artificial intelligence system to “use . . . reasonable care to protect consumers from any known or reasonably foreseeable risks of algorithmic discrimination.” HB 2094 also included a set of operating standards for deployers that, if followed, would have provided a rebuttable presumption that deployers complied with regulatory requirements.

Some of HB 2094 unique regulatory requirements included referring to external nationally or internationally recognized artificial intelligence risk management standards—such as the National Institute of Standards and Technology’s Artificial Intelligence Risk Management Framework7 or the International Organization for Standardization’s Standard ISO/IEC 42001 “Information technology — Artificial intelligence — Management system”8—as an acceptable guidance or standard to conform high-risk artificial intelligence systems under this bill.

Also, the bill would have required certain developers (who share their high-risk artificial intelligence systems with others) or deployers (who use high-risk artificial intelligence systems to make a consequential decision) to complete an impact assessment of using the system in its intended use.

On February 19, 2025, the Senate voted for the bill (21-Y 19-N) and the House followed the next day (52-Y 46-N). On March 24, Governor Youngkin vetoed HB 2094, explaining in part that the regulatory framework of the bill would undermine the ongoing process of economic growth of the Commonwealth, “stifling the AI industry as it is taking off.”9 Specifically, the Governor’s veto message notes that “[t]here are many laws currently in place that protect consumers and place responsibilities on companies relating to discriminatory practices, privacy, data use, libel, and more.” It was his belief that HB 2094’s regulatory requirements may especially burden smaller AI firms and startups that lack large legal compliance departments.

As of the publication of this newsletter, HB 2094 has not been considered for a subsequent vote in the current legislative session.

Analysis

Virginia General Assembly’s consideration of both HB 1642 and HB 2094 demonstrates the proactive posture of state legislators to anticipate and attempt to mitigate foreseeable issues raised by artificial intelligence technologies.

HB 1642, which affirmed the role of a human decision-maker as the sole decision-maker in certain criminal proceedings, recognizes the emerging threat of predictive artificial intelligence systems that might overly dominate the decision-making processes in the administration of criminal justice. It is worth emphasizing that HB 1642 does not prohibit the use of artificial intelligence tools to assist the human decision-maker, but rather that they are one of many factors that a decision-maker may consider in a criminal proceeding.

Unlike HB 1642, which had a narrow legislative focus, HB 2094 had a broader purpose of creating certain consumer protection-oriented regulations targeting artificial intelligence developers and deployers. The bill would have committed the Commonwealth to a proactive approach to thoughtfully regulating certain unsafe and foreseeable impacts of artificial intelligence systems on Virginia consumers.

HB 2094’s approach closely mirrors the Colorado AI Act (also known as Colorado’s Senate Bill 24-205).10 Although the Colorado AI Act was passed by the Colorado legislature and signed by Colorado Governor Jared Polis on May 17, 2024, the Governor raised concerns about “the impact this law may have on an industry that is fueling critical technological advancements across [Colorado] for consumers and enterprises alike.”11 While signing the Colorado AI Act, the Governor encouraged “the General Assembly to work closely with stakeholders to craft future legislation for [his] signature that will amend this bill to conform with evidence based findings and recommendations for the regulation of this industry.” (emphasis added)

Colorado Governor Polis’s concerns are similar to Virginia Governor Youngkin’s veto message to the General Assembly. Both Governors favor artificial intelligence regulatory and governance approaches involving industry and other business leaders to reach an appropriate pathway for developing safeguards that do not inadvertently negatively impact growth in the technology sector.

If the Virginia General Assembly seeks to consider another consumer protection artificial intelligence regulation bill, broad engagement with industry, academia, and civil society may bring broader consensus to set forth regulatory efforts that may be the leading approach for other state governments to follow.


  1. Division of Legislative Automated Systems, “HB1642 Artificial intelligence-based tool; definition, use of tool.”, https://lis.virginia.gov/bill-details/20251/HB1642. ↩︎
  2. Virginia General Assembly, Chaptered HB 1642, https://lis.blob.core.windows.net/files/1079123.PDF. ↩︎
  3. See, e.g., State v. Loomis, 371 Wis.2d 235 (2016), https://www.courtlistener.com/opinion/4237997/state-v-eric-l-loomis/. ↩︎
  4. Governor Glenn Youngkin, “(HB1642) Governor’s Recommendation”, https://lis.virginia.gov/bill-details/20251/HB1642/text/HB1642AG. ↩︎
  5. Division of Legislative Automated Systems, “HB2094 High-risk artificial intelligence; definitions, development, deployment, and use, civil penalties.”, https://lis.virginia.gov/bill-details/20251/HB2094. ↩︎
  6. Virginia General Assembly, Enrolled HB 2094, https://lis.blob.core.windows.net/files/1066933.PDF. ↩︎
  7. National Institute of Standards and Technology, “AI Risk Management Framework”, https://www.nist.gov/itl/ai-risk-management-framework. ↩︎
  8. International Organization for Standardization, “ISO/IEC 42001:2023 Information technology — Artificial intelligence — Management system”, https://www.iso.org/standard/81230.html. ↩︎
  9. Governor Glenn Youngkin, “(HB2094) Governor’s Veto”, https://lis.virginia.gov/bill-details/20251/HB2094/text/HB2094VG. ↩︎
  10. Colorado General Assembly, “SB24-205 Consumer Protections for Artificial Intelligence”, https://leg.colorado.gov/bills/sb24-205. ↩︎
  11. Governor Jared Polis, Letter to The Honorable Colorado General Assembly (May 17, 2024), https://danielshin.net/wp-content/uploads/2025/06/Governor-Polis-Signing-Statement-SB24-205.pdf. ↩︎