HF4544

Purpose

• Establish a licensing framework for independent verification organizations (IVOs) that assess AI models and applications for safety and risk mitigation.
• Create an AI Advisory Council within the Department of Commerce to oversee licensing, auditing, and related activities.
• Allow rulemaking and reporting to implement these changes in Minnesota law (Minnesota Statutes chapter 325M).

Key concepts and entities

• IVO (Independent Verification Organization): a licensed entity that verifies AI models or AI applications meet defined safety and risk-mitigation standards.
• AI model vs. AI application: a model is the underlying system; an application is the software that uses AI to perform tasks.
• Deployer: person or entity that implements or makes an AI model/application operational in Minnesota.
• Developer: person who develops an AI model/application deployed in Minnesota.
• Commissioner of Commerce: state official responsible for licensing IVOS and enforcing the provisions.
• Security vendor: third party that tests the safety or security of an AI model or application.
• Risk mitigation: actions and measures to reduce the chance or impact of potential harms from AI.

How the licensing system works (main provisions)

• License required for an IVO (325M.51):
  • Applications must include an IVO plan detailing risks to mitigate, definitions of acceptable risk, measurable metrics, target levels, data sources, and methods to measure and verify outcomes.
  • The plan must cover technical, operational, and governance requirements for developers or deployers, including predevelopment and postdevelopment steps to ensure risk is kept at acceptable levels.
  • Plans must describe ongoing monitoring, evaluation methods, disclosure of detected risks, incident reporting, and how corrective actions will be implemented.
  • The plan should address governance, whistleblower protections, training, and cooperation with regulators.
  • The commissioner considers plans for risk-specific verification, and how the IVO will coordinate with state and federal authorities.
• License determination (325M.51 Subd.3):
  • The commissioner may grant a license if the applicant shows independence from the AI industry and that the plan adequately mitigates risks.
  • If only certain risks can be adequately mitigated, the license may specify verification of only those risks and specify the markets the license covers.
• License revocation (325M.51 Subd.4):
  • Licenses can be revoked for misleading plans, failure to follow the plan, loss of independence, obsolescence due to technology changes, or if verification causes material harm.
• Cure opportunity (325M.51 Subd.5):
  • The commissioner can allow a chance to fix issues before ending the license.
• Fees (325M.51 Subd.6):
  • Reasonable application and renewal fees will be set to cover administrative costs.
• No automatic verification requirement (325M.51 Subd.7):
  • An AI model or application does not have to seek IVO verification.
• Rulemaking (325M.51 Subd.8):
  • The commissioner can adopt rules to implement these provisions.

What IVOS must do (requirements and ongoing duties)

• Implementation of approved plan (325M.52 Subd.1).
• Maintain verification: revoke verification if a developer/deployer misses mitigation requirements, stops monitoring, violates governance, or fails to implement corrective actions (325M.52 Subd.2).
• Plan updates allowed (325M.52 Subd.3):
  • IVOs may update technical/operational requirements, evaluation benchmarks, audit methodologies, governance plans, and verification activities to reflect better technology.
  • Must report material changes to the commissioner with rationale; changes take effect on notification; the commissioner can request more info or reject changes.
• Annual reporting (325M.52 Subd.4):
  • IVOs must report to the commissioner and legislative leadership about capabilities, societal risks/benefits, adequacy of resources, verification results, remediation compliance, significant observed risks, list of verified AI models/apps, evaluation methods, and any changes affecting independence.
  • Trade secrets and sensitive data may be redacted; documents must be kept for 10 years; redacted reports released on the Department of Commerce website.

Advisory Council

• Establishment (325M.53):
  • A AI Advisory Council is established within the Department of Commerce; the commissioner sets its size and appoints members.
  • At least one civil society representative must be included (e.g., NGOs, educational/research institutions, policy institutes, consumer/business advocacy groups).
• Duties (325M.53 Subd.2):
  • The council’s powers include licensing and auditing decisions delegated by the commissioner.
  • Members must avoid conflicts of interest, remain independent, avoid ownership interests in significant AI companies, and observe a one-year postemployment restriction from AI firms or IVOs.
  • Members must be qualified to assess IVO plans.
• Administration (325M.53 Subd.3):
  • Terms, expenses, possible salaries, removal for misfeasance, and quorum rules.
• Record-keeping (325M.53 Subd.4):
  • The council must keep records of proceedings related to IVO licensing decisions.

Liability framework

• Limited liability rebuttable presumption (325M.54):
  • In civil cases for personal injury or property damage caused by an AI model or AI application, there is a rebuttable presumption against liability if:
  • The AI model/application was verified by a licensed IVO at the time of injury, and
  • The injury arose from a risk the IVO was licensed to verify, and
  • The AI model/application is within the market segment the IVO was licensed to verify.

Significant changes to existing law

• Creates a new, state-wide licensing regime for independent verification organizations (IVOs) to assess AI safety and risk mitigation.
• Establishes a formal process for risk-focused verification, including definitions of acceptable risk, measurable metrics, and ongoing monitoring.
• Introduces an AI Advisory Council with conflict-of-interest protections and civil-society representation.
• Adds a liability presumption that can shield AI developers/deployers if a verified IVO was responsible for validating the applicable risk.
• Expands reporting, governance, and transparency requirements for IVOS, including annual public-facing reporting with redaction options.
• Enables rulemaking to implement the new framework and related procedures.

Relevant terms - IVO, independent verification organization - license, licensure - commissioner of commerce - artificial intelligence model - artificial intelligence application - deployer - developer - risk mitigation - acceptable levels of risk - metrics, target levels, data sources, evaluation protocol - ongoing monitoring, mitigation efficacy - governance plan, governance policies - corrective action - revocation of verification - plan modification - predevelopment, postdevelopment - finetuning - security vendor - advisory council, civil society representative - licensing and auditing - annual report - independence, conflicts of interest - one-year postemployment restriction - market segment - limited liability rebuttable presumption - safe/harm prevention in AI - rulemaking - Minnesota Statutes chapter 325M