New Hampshire State Agency AI Law

Overview

New Hampshire enacted HB 1688-FN as Chapter 209 of the 2024 session laws. Section 209:1 inserts RSA Chapter 5-D, titled Use of Artificial Intelligence by State Agencies, after RSA Chapter 5-C. The act establishes binding restrictions on government AI use rather than a voluntary strategy or a general licensing regime for private AI developers. Its principal protections address discriminatory classifications, biometric surveillance, deceptive deepfakes, irreversible recommendations and decisions, and undisclosed AI interactions. The chaptered final version records approval on July 12, 2024, with an effective date specified as July 1, 2024.

The chapter applies to computer systems operated by broadly defined state agencies, subject to two express exclusions. It combines prohibited uses with strict conditions under which other AI uses are allowed. Agencies bear full responsibility for examining their systems and procedures, removing prohibited systems, and reporting compliance to the Department of Information Technology. The department consolidates information into formal reports for executive and legislative leaders and publishes those reports online. The law does not establish a new AI commission, specify monetary penalties, or require pre-approval of every AI system before deployment. Its operative model centers on direct agency compliance supported by centralized reporting, human oversight, and mandatory transparency obligations.

Definitions

RSA 5-D:1 defines artificial intelligence, or AI, as the ability of a machine to display human-like capabilities for cognitive tasks such as reasoning, learning, planning, and creativity. It explains that AI systems may adapt their behavior to a certain degree by analyzing the effects of previous actions and operating under varying and unpredictable circumstances without significant human oversight. Generative AI is defined as AI that can generate text, images, or other media in response to prompts. A deepfake is defined as video, audio, or other media of a person whose face, body, or voice has been digitally altered to make that person appear to be someone else, say something never said, or do something never done.

The definition of state agency covers any department, commission, board, institution, bureau, office, law enforcement, or other entity established in the state constitution, statutes, session laws, or executive orders. It expressly includes the legislative and judicial branches. RSA 5-D:2 excludes systems used in research by state-funded institutions of higher learning and installed consumer systems in common personal use, such as facial recognition used to unlock a smartphone. These are system-use exclusions rather than blanket exemptions for every activity of an institution. The chapter does not separately define biometric identification, critical infrastructure, an appropriate responsible position, or irreversibility within its text.

Governance and Institutional Framework

Each covered agency has direct compliance responsibilities under RSA 5-D:5. Agencies must review AI use in their computer systems to verify compliance with both Chapter 5-D and the Department of Information Technology code of ethics for AI systems. They must remove prohibited systems and modify procedures inconsistent with the chapter. These actions must be completed no later than nine months after the effective date, with compliance reported to the department. Because the agency definition includes all three branches of state government, the institutional reach extends broadly across state governance. The act does not name a mandatory agency AI officer or prescribe a rigid internal reporting hierarchy.

The Department of Information Technology functions as the central reporting institution. One year after the effective date, it must provide a detailed report to the governor, the speaker of the House of Representatives, and the president of the Senate. The report must summarize AI systems identified by agencies, distinguish prohibited and removed systems from allowed systems, and describe procedures implemented to ensure compliant procurement and use. Annual updates must include new systems purchased by agencies, and all reports must appear publicly on the department’s website. This creates a recurring oversight channel, although the chapter does not confer fining powers or establish an independent administrative tribunal.

Key Focus Areas

RSA 5-D:3 prohibits three categories of AI use. First, agencies may not classify persons by behavior, socio-economic status, or personal characteristics when this results in unlawful discrimination against an individual or group. Second, real-time and remote biometric identification systems used for surveillance in public spaces, such as facial recognition, are prohibited except when used by law enforcement acting under a warrant. Third, deepfakes may not be used for any deceptive or malicious purpose. Human review or an AI disclosure does not make a prohibited use permissible under the law.

RSA 5-D:4 establishes oversight and transparency conditions for permitted uses. An AI recommendation or decision that cannot be reversed once implemented or executed must receive human review before taking effect. The reviewer must occupy an appropriate responsible position and understand the system’s limitations. Specified illustrative settings include restrictions on rights and freedoms, identity verification, critical infrastructure, state and local law-enforcement actions, and application of state law, including sentencing. Generative AI material not reviewed and edited by an appropriately responsible human must disclose that it was generated by AI. Users interacting directly or indirectly with AI must be informed of that interaction in all other governed circumstances.

Implementation Framework

Implementation begins with determining whether a system falls within the agency and applicability provisions. Agencies must examine existing AI uses against the prohibited-use rules, the human-review and disclosure conditions, and the department’s AI code of ethics. RSA 5-D:5 requires the removal of prohibited systems and correction of inconsistent procedures within the nine-month compliance period. An inventory, use-case classification, and identification of responsible reviewers serve as practical methods of carrying out those duties. The statutory review standard is verification to the best of the agency’s knowledge, rather than a formal third-party conformity assessment.

New systems and procedures receive specific operational treatment relative to existing operations. Under RSA 5-D:5, II, AI systems newly deployed after the effective date must comply with the chapter and the department’s AI code of ethics upon deployment. Newly implemented AI-related procedures must likewise align with the statutory framework. The initial nine-month deadline functions as a transition window for existing systems rather than an exemption for new deployments. Procurement controls are expected to support the department’s reporting requirements regarding compliant procurement and use.

Monitoring and Evaluation

The monitoring structure links agency self-assessment with continuing public reporting. Agencies identify AI systems, evaluate their legality, remove prohibited systems, modify non-compliant procedures, and report their compliance status to the Department of Information Technology. The department’s first report is due one year after the chapter’s effective date. It must record which identified systems were prohibited and removed, which systems are allowed, and what procedures ensure that procurement and use satisfy statutory standards. These required categories enable institutional scrutiny of the government system landscape.

Annual updates must detail new AI systems purchased by agencies, and every report must be posted on the department’s public website. This recurring obligation continues beyond the initial compliance window. The act does not specify technical model-performance metrics, bias-testing intervals, incident-reporting deadlines, external audit requirements, or a public complaint portal. Agencies may utilize internal testing, documentation, and periodic reviews to verify ongoing compliance within their operational frameworks.

Penalties, Liability, and Appeals

Chapter 5-D contains binding statutory prohibitions and mandatory agency duties but does not establish a schedule of civil fines, criminal penalties, damages, or personal liabilities for state officials. It does not expressly create a private right of action, a dedicated administrative complaint procedure, or a specialized appeal pathway for AI-related decisions. The required remedy for a prohibited AI system is statutory removal, while inconsistent procedures must be modified. Reporting compliance to the Department of Information Technology is mandatory for all covered agencies.

The chapter does not alter or replace general legal remedies available under state law for discriminatory acts or constitutional violations. RSA 5-D:6 provides standard severability: if a provision or its application is held invalid, that invalidity does not affect other provisions or applications capable of operating without the invalid term. This clause protects the broader statutory framework from automatic invalidation while leaving court enforcement to existing judicial structures.

Relationship to Other Instruments

Section 209:1 creates a new chapter of the New Hampshire Revised Statutes Annotated, codified as RSA Chapter 5-D. The statute explicitly links agency system compliance to the Department of Information Technology code of ethics for AI systems. Both existing system reviews and new deployments must address that ethical framework alongside the statutory requirements. The act does not reproduce the text of the ethics code or set a fixed version date for it.

The prohibition on classifications resulting in unlawful discrimination operates in conjunction with anti-discrimination statutes in state law. The warrant exception for law-enforcement biometric surveillance relies upon standard judicial search warrant procedures under criminal procedure laws. Human oversight requirements for AI used in interpreting state law, including sentencing, establish an added statutory check without replacing underlying administrative or judicial procedure rules. The act does not regulate private-sector commercial AI developers directly.

National/Federal Alignment

HB 1688-FN is a state law governing computer systems operated by New Hampshire state agencies. It does not establish duties for federal agencies or create a national regulatory framework for commercial AI providers. Chapter 5-D does not incorporate federal AI statutes, executive orders, or federal technical standards, and it contains no federal certification requirements. Its legal mechanism operates strictly through state-level agency compliance and centralized reporting to New Hampshire executive and legislative authorities.

The act addresses governance concerns that align with broader state and national policy discussions, including anti-discrimination, surveillance limits, deepfake mitigation, and human control over automated decision-making. However, the statute does not reference federal preemption, define interactions with federal grant funding, or create mutual recognition mechanisms for external AI compliance standards. Covered agencies must evaluate their Chapter 5-D duties independently under state authority.

Implementation Timeline

Sources and References