New Virginia State Law Regulates AI in Customer Support
The state of Virginia is on the verge of implementing a significant law that aims to regulate the use of high-risk artificial intelligence (AI) systems in customer support. This legislation, known as the High-Risk Artificial Intelligence Developer and Deployer Act, introduces compliance requirements for businesses that utilize AI systems impacting consumers in Virginia.
Passed by the Virginia state senate, the law is pending the governor’s signature and is set to take effect on July 1, 2026. Organizations that fail to comply with its provisions risk incurring substantial fines, potentially reaching $10,000 per affected customer.
Definition of High-Risk AI
The act specifically targets AI systems that either autonomously make or significantly influence key consumer decisions. Notable applications of such high-risk AI include:
- Automating decisions regarding customer eligibility for products or services.
- Generating personalized financial offers and recommendations.
- Determining access to premium services or customer tiers.
- Resolving disputes and processing customer claims automatically.
- Influencing credit approvals and financing options.
This law aims to enhance accountability and transparency in AI deployment within customer interactions.
Compliance Requirements for Developers and Deployers
Under this legislation, entities involved in the development or deployment of AI-driven customer experience systems are categorized as developers and deployers, respectively. Each classification comes with a set of responsibilities:
- Developers must take reasonable steps to prevent discrimination, disclose the system’s purpose and limitations, provide documentation for bias monitoring, and update disclosures within 90 days of major changes.
- Deployers must establish a risk management policy for AI tools, conduct impact assessments prior to deployment, and inform customers when AI is involved in decision-making processes. They are also required to explain adverse decisions and maintain documentation for a minimum of three years.
Generative AI Regulations
The law also includes specific guidelines for the use of generative AI (GenAI). It mandates the implementation of detectable markers or identification methods for AI-generated synthetic content, including audio, video, and images in customer experience applications. This regulation applies to:
- AI-generated product demonstrations.
- Virtual try-ons.
- AI-voiced customer service interactions.
- Personalized marketing efforts.
However, exceptions are made for creative works and artistic expressions, allowing their use in marketing and branded content.
Exemptions and Penalties
The legislation outlines several scenarios in which AI use may be exempt from the regulations, including:
- Anti-fraud technologies (excluding those utilizing facial recognition).
- Cybersecurity tools for customer data protection.
- Healthcare scenarios involving HIPAA-covered entities.
- Financial institutions adhering to equivalent federal standards.
For non-exempt entities that violate the law, non-willful violations may incur fines of up to $1,000 per instance, while willful violations can result in fines of up to $10,000 per instance. Each affected customer counts as a separate violation, meaning that the potential financial penalties could be considerable.
A Broader Context of AI Regulation
Virginia is not alone in its pursuit of AI regulations. Colorado was the first state in the U.S. to enact comprehensive consumer protection regulations focused on fair AI use. Other states, including California, Illinois, Minnesota, and Utah, are also working on similar legislation to govern AI applications.
Internationally, the European Union has introduced an AI Act, which may evolve to include rights such as the right to talk with a human in customer service interactions within the next few years.
Conclusion
As AI technology continues to evolve, the regulatory landscape surrounding its use will become increasingly complex. Customer service and experience professionals must stay informed about the latest laws and regulations to maximize the potential of their AI systems while avoiding legal and financial repercussions.
