You must conduct annual risk assessments for each AI system used in consequential decisions. These assessments document the system’s intended use, identify potential harms, evaluate fairness across demographic groups, and assess bias mitigation measures. Documentation must be retained for audit purposes and updated whenever the system changes.

Establish documented risk management procedures aligned with NIST’s AI Risk Management Framework. Your program should cover: mapping of AI systems in your organization, risk governance structure, assessment methodologies, mitigation strategies, and ongoing monitoring. This is not a checkbox -it’s a living operational framework.

When AI is used in a consequential decision affecting a consumer (hiring, lending, housing, etc.), you must disclose that AI was used and provide an opportunity for the affected person to request human review. Notice must be clear and provided at the time of decision or before the decision takes effect, where feasible.

Conduct testing to identify and mitigate discriminatory impacts. You must evaluate whether your AI systems produce disparate outcomes based on protected characteristics (race, color, religion, sex, national origin, age, disability, sexual orientation, etc.). If discrimination is found, you must implement mitigation measures and document the process.

Establish clear governance structures that define roles, responsibilities, and oversight mechanisms for AI systems. Create and maintain written policies covering: system development, deployment, monitoring, human review processes, and incident response. Governance must be documented, communicated internally, and updated as needed.

Provide training to employees involved in AI deployment, monitoring, and decision-making. Training should cover: your organization’s AI governance policies, SB 205 requirements, how to identify and report potential issues, and the importance of human oversight in high-stakes decisions. Annual refresher training is recommended.