Vermont Artificial Intelligence and Consumer Data Act (AICDA)

Per Vermont AICDA: AI system inventory + risk assessment + consequential decision classification.

• VT AICDA evidence for VERMONTAICDA-1

• bias testing + DPIA partial

Per AICDA: bias testing + algorithmic discrimination prevention + transparency.

• VT AICDA evidence for VERMONTAICDA-3

• bias testing + DPIA partial

Per AICDA: Vermont AG enforcement + cure period + civil penalties.

• VT AICDA evidence for VERMONTAICDA-4

• bias testing + DPIA partial

Per AICDA: consumer rights including Access + Correction + Deletion + Opt Out + Data Portability + automated decision opt-out.

• VT AICDA evidence for VERMONTAICDA-2

• bias testing + DPIA partial

Maintain an inventory of AI and automated decision systems used by the entity, classify by risk and consequence category, and assign owners.

• AI system register
• Risk classification rubric
• Owner attestation log
• Shadow AI detection scan results

• Inventory lacks vendor-supplied AI features
• Classification not reviewed annually
• Shadow AI not actively scanned

Log inputs, outputs, model version, and decision rationale for consequential automated decisions for a defined retention period sufficient to support consumer rights and audits.

• Logging architecture diagram
• Sample log records
• Retention configuration
• Log integrity verification report

• Inputs hashed beyond reconstruction
• Retention shorter than appeal window
• No write-once or tamper-evident storage

Document training data sources, collection methods, representativeness assessments, and lawful basis for use of personal data in training AI models.

• Training data datasheet
• Representativeness analysis
• Lawful basis register
• Licensing or consent records

• Scraped data lacks lawful basis
• No representativeness analysis for protected classes
• Datasheet missing for fine-tuned models

Developers of high-risk AI systems must provide deployers with documentation sufficient to complete impact assessments, including intended use, known limitations, and discrimination risks.

• Model card or system card
• Intended use statement
• DPA addendum on AI disclosure
• Limitation register

• Model card lacks demographic performance breakdown
• Intended use too broad to be operational
• Vendor refuses to share training data summary

Conduct and document data protection assessments for processing activities that present heightened risk to consumers, including targeted advertising, profiling, sensitive data, and sale.

• Completed DPA template
• Risk register
• Mitigation tracker
• Retention schedule for DPAs

• DPA template lacks consumer harm analysis
• Mitigations not retested
• DPAs not refreshed when processing changes

Conduct and document risk assessments for high-risk AI systems that evaluate the potential for algorithmic discrimination against protected classes under Vermont and federal law.

• Algorithmic impact assessment report
• Disparate impact test results
• Protected class taxonomy
• Mitigation plan with owners and dates

• Bias testing limited to race and gender only
• No retesting after model retraining
• Mitigation actions tracked outside ticketing system

Complete and retain pre-deployment impact assessments for high-risk AI systems addressing purpose, data inputs, training data, performance metrics, and risks to consumers.

• Completed impact assessment templates
• Data lineage diagrams
• Performance benchmark report
• Executive approval sign-off

• Assessment completed after deployment
• Training data sources not documented
• No retention schedule defined

Perform an annual audit of deployed high-risk AI systems to detect algorithmic discrimination, document findings, and implement remediation.

• Annual audit report
• Findings and CAP register
• Remediation evidence pack
• Audit scope document

• Audit scope excludes vendor models
• Findings not retested after remediation
• No independent reviewer involved

Provide Vermont consumers with the right to access, correct, delete, and obtain a portable copy of their personal data, with response within the statutory window.

• DSAR intake portal
• Identity verification procedure
• DSAR response tracker with SLA
• Portability output sample

• No SLA dashboard
• Identity verification overly intrusive
• Deletion does not propagate to vendors

Recognise and honour browser-based or device-based universal opt-out signals for sale of personal data and targeted advertising.

• GPC handling configuration
• Tag manager rules
• Test report showing opt-out honoured
• Vendor-side propagation evidence

• GPC honoured only at first visit, not on return
• Server-side calls bypass opt-out
• No quarterly verification

Provide clear, plain-language notice to consumers when a consequential decision (employment, housing, credit, healthcare, education, essential services) is made or materially assisted by an automated system.

• Notice template
• Screenshots of consumer-facing disclosure
• Decision log with notice timestamp
• Plain-language readability score

• Notice buried in privacy policy
• No record that consumer actually viewed notice
• Notice missing for partial automation cases

Provide consumers with a meaningful explanation of the principal factors and logic involved in an adverse consequential decision generated or materially assisted by an automated system.

• Sample explanation outputs
• Adverse decision register
• Explanation quality rubric
• Customer-facing explanation portal logs

• Explanations are generic and not consumer-specific
• Top factor counts inconsistent across decisions
• No QA sampling of explanation accuracy

Allow consumers to request human review of adverse consequential automated decisions and to appeal the outcome through a documented, timely process.

• Appeal request log
• Reviewer training records
• SLA tracking report
• Sample reversed decisions with rationale

• No clock on appeal response time
• Reviewers see the model output before independent review
• Appeal outcomes not analysed for systemic issues

Provide consumers a clear mechanism to opt out of solely automated consequential decision-making and to request a non-automated alternative where feasible.

• Opt-out request portal
• Workflow diagram for alternative path
• Opt-out completion log
• Feasibility analysis for non-feasible cases

• Opt-out limited to marketing despite consequential scope
• No documented fallback workflow
• Feasibility refusals not justified in writing

Determine whether the entity meets thresholds for AICDA coverage based on Vermont resident data processing volume, revenue, or use of consequential automated decision systems affecting Vermonters.

• Applicability memo
• Vermont resident count log
• Annual revenue attestation
• Consequential decision system inventory

• No formal threshold recalculation cadence
• Missing inventory of automated decision systems
• Vermont-resident identification relies on billing address only

Maintain an inventory of personal data of Vermont consumers processed by the entity, including categories, sources, purposes, and recipients.

• Personal data inventory spreadsheet or tool export
• Data flow diagrams
• Refresh evidence log
• Owner attestations

• Inventory not refreshed in past year
• Vendor-side processing missing
• No mapping from inventory to retention rules

Obtain affirmative opt-in consent before processing sensitive personal data of Vermont consumers and apply enhanced safeguards to such data.

• Consent receipt log
• Sensitive data classification scheme
• Access control matrix for sensitive data
• Encryption configuration evidence

• Consent inferred from continued use of service
• Sensitive tags missing on inferred attributes
• Same access controls applied as for non-sensitive data

Apply heightened protections, including verifiable parental consent where required, when processing personal data of Vermont consumers known to be under 18, and prohibit targeted advertising and profiling to minors.

• Age verification configuration
• Parental consent records
• Audience exclusion rules for minors in ad platforms
• Profiling exemption logic documentation

• Age self-declaration only
• No suppression list for minors in marketing tools
• Profiling exclusion not tested

Establish written contracts with processors and AI vendors specifying processing instructions, confidentiality, security, subprocessor flow-down, and audit rights.

• Executed DPAs
• Subprocessor register
• Audit right clause inventory
• Vendor risk assessments

• Legacy vendor contracts not updated
• Subprocessor list not refreshed
• Audit rights never exercised

Operate a process to receive, investigate, and remediate consumer complaints of algorithmic discrimination or privacy violations and escalate as required.

• Complaint register
• Investigation playbook
• Remediation evidence
• Escalation matrix

• Complaints handled by support without bias-pathway escalation
• No root cause analysis
• Remediation not validated

Publish a public-facing transparency report or AI use disclosure summarising the categories of consequential AI systems in use, purposes, and consumer rights.

• Published transparency report
• Annual update changelog
• Legal review attestation
• Internal accuracy reconciliation to AI inventory

• Report not refreshed after new deployments
• Vendor AI features omitted
• No mapping to internal AI inventory

Retain impact assessments, audit reports, decision logs, consumer rights records, and related compliance evidence for inspection by the Vermont Attorney General.

• Document retention schedule
• Evidence index
• Mock inspection report
• Legal hold register

• Records scattered across teams
• No index linking evidence to obligations
• Retention shorter than statute of limitations