Go-to-Guide:
Virginia’s HB 2094 is applied to high-risk AI system developers and deployers, focusing on consumer protection.
The bill covers AI systems that make consequential decisions autonomously or have significant impacts without meaningful human oversight.
Developers need to document system limitations, be transparent and manage risks, while deployers need to disclose their use of AI and conduct impact assessments.
With limited exceptions, the generated AI output must be identifiable.
The Attorney General will oversee the enforcement and oversee the fine of up to $10,000 for each violation and a discretionary 45-day treatment period.
HB 2094 is the Colorado AI Act (CAIA, CAIA law with clearer transparency obligations and trade secret protection, unlike the EU AI Act, which imposes stricter risk-based compliance rules.
On February 20, 2024, the Virginia Legislature passed the High-Risk Artificial Intelligence (AI) Developers and Deployment Act (HB 2094). If signed by Gov. Glenn Youngkin, Virginia will be the second US to implement a broad framework that regulates AI use, particularly in high-risk applications.
This GT alert covers who the bill applies to, important definitions, important differences with CAIA, and potential future implications.
Who does HB 2094 apply to?
HB 2094 applies to people doing business in Virginia who develop or deploy high-risk AI systems. “Developer” refers to an organization that provides, sells, leases, offers or otherwise provides high-risk AI systems deployed in Virginia. The requirements imposed by HB 2094 on developers also apply to those who intentionally and effectively modify existing high-risk AI systems. “Deployer” refers to an organization that deploys or uses high-risk AI systems to make consequential decisions about Virginians.
How does HB 2094 work?
Important definitions
HB 2094 aims to protect Virginia residents who act in their individual capabilities. It does not apply to Virginia residents acting in a commercial or employment context. Additionally, HB 2094 defines a “generic artificial intelligence system” as an AI system that incorporates generation AI. This includes the ability to “use to produce synthetic content such as audio, images, text, and videos.”
The definition of “high-risk AI” in HB 2094 applies only to machine learning-based systems that act as the primary basis for consequential decisions. This means it operates without human supervision.
High-risk applications include parole, probation, pardon, other forms of release from incarceration or court supervision, and decisions related to marriage status situations. As the bill does not apply to government agencies, it is not yet clear which private sector decisions fall within the scope of these high-risk applications.
Requirements
HB 2094 places an obligation on AI developers and deployers to mitigate and ensure transparency in the risks associated with algorithm identification. Establish care, disclosure and risk management requirements for high-risk AI system developers, establishing consumer disclosure obligations and deployer impact assessments. Developers should document known or reasonably known limitations in AI systems. Synthetic content generated or substantially modified from the Generated AI’s high-risk system should be made identifiable and detectable using industry standard tools, complying with applicable accessibility requirements when feasible, and ensuring that the synthetic content is identified at the time of generation. The bill established AI risk frameworks such as the NIST AI RMF and ISO/IEC 42001.
Exemption
Certain exclusions include the use of AI on demand by consumers, or the provision of services or products requested under contract, under HB 2094. Additionally, there are limited exceptions to financial services, with wider exemptions in the health and insurance sector.
Execution
The bill grants the Attorney General an enforcement body and establishes penalties for violations. Violations can result in a fine of up to $1,000 per incident, changing attorneys’ fees, but intentional violations can carry the fine up to $10,000 per case. Each violation will be considered individually for penalty assessment. The Attorney General must issue a demand for citizen investigations before initiating enforcement action, and a discretionary 45-day right to treat the duration of treatment is available to deal with violations. Under HB 2094, there is no right to private conduct.
Important differences with CAIA
The HB 2094 modeles CAIA intimately, but makes a noticeable difference. HB 2094 limits the definition of consumers to individual and household contexts, and explicitly excludes commercial and employment contexts. It defines “high-risk AI” narrowly, focusing only on systems that operate without meaningful human supervision and serve as the primary basis for the resulting decision, and adding several new use cases to the “high-risk” range of use. It also provides clearer guidelines on when developers will be deployed, impose more specific documentation and transparency obligations, and enhanced protection of trade secrets. Unlike CAIA, HB 2094 does not need to report algorithmic discrimination to the Attorney General, allowing a discretionary 45-day right to cure the violation. Additionally, we will expand our high-risk use list to include decisions related to parole, probation, pardon, and marriage status status status.
HB 2094 is consistent with aspects of CAIA but unlike the broader and more stringent EU AI law, which imposes risk-based AI classifications, stricter compliance obligations, and serious penalties for violations. HB 2094 also does not include direct incident reporting requirements, public disclosure requirements, or small business exceptions. Finally, HB 2094 supports a higher threshold than CAIA for consumer rights when high-risk AI makes negative decisions related to consumers and requires that AI systems be processed beyond what consumers provide directly.
Conclusion
If signed into law, HB 2094 will become the second US in Virginia to implement comprehensive AI regulations, setting guidelines for high-risk AI systems while trying to address concerns about transparency and algorithmic discrimination. With enforcement likely to begin in 2026, companies developing or deploying AI in Virginia must actively assess their compliance obligations and prepare their organizations for new regulatory frameworks that are subject to their CAIA obligations.
