* § 404. Submission to the governor and legislature. 1. Each impact
assessment conducted pursuant to this article shall be submitted to the
governor, the temporary president of the senate, and the speaker of the
assembly at least thirty days prior to the implementation of the
automated decision-making system that is the subject of such assessment.

2. (a) The impact assessment of an automated decision-making system
shall be published on the website of the relevant state agency.

(b) If the state agency makes a determination that the disclosure of
any information required in the impact assessment would result in a
substantial negative impact on health or safety of the public, infringe
upon the privacy rights of individuals, or significantly impair the
state agency's ability to protect its information technology or
operational assets, such state agency may redact such information,
provided that an explanatory statement on the process by which the state
agency made such determination is published along with the redacted
impact assessment.

(c) If the impact assessment covers any automated decision-making
system that includes technology that is used to prevent, detect, protect
against or respond to security incidents, identity theft, fraud,
harassment, malicious or deceptive activities or other illegal activity,
preserve the integrity or security of systems, or to investigate, report
or prosecute those responsible for any such malicious or deceptive
action, such state agency may redact such information for the purposes
of this subdivision, provided that an explanatory statement on the
process by which the state agency made such determination is published
along with the redacted impact assessment.

* NB Effective December 21, 2025