Virginia HB 2094

Overview

Virginia HB 2094 is Virginia's legislation governing the use of automated decision systems (ADS) in high-stakes decisions affecting Virginia residents. The law imposes transparency, impact assessment, and opt-out obligations on organizations that deploy AI in consequential contexts such as employment, credit, healthcare, and housing.

The law reflects a growing trend in US state AI regulation — following Colorado's SB 24-205 and mirroring many principles of the EU AI Act — with a focus on protecting consumers from the risks of opaque algorithmic decision-making.

Virginia HB 2094 takes effect July 1, 2026.

---

Scope

Virginia HB 2094 applies to any entity that:

• Deploys an automated decision system that makes or is a substantial factor in making a consequential decision affecting a Virginia resident, or
• Develops an automated decision system and makes it available to others for deployment in Virginia

What Is a Consequential Decision?

A consequential decision is one with a significant effect on an individual in any of the following areas:

• Employment — hiring, promotion, compensation, or termination
• Credit & Finance — loan approvals, credit scoring, insurance underwriting
• Education — admissions, financial aid, or academic advancement
• Healthcare — diagnosis, treatment recommendations, or coverage decisions
• Housing — rental, mortgage, or real estate eligibility
• Insurance — eligibility or pricing decisions

What Is an Automated Decision System?

An ADS is any computational tool, software, algorithm, or AI-based model that processes personal data to generate a decision, recommendation, or classification that affects an individual. The law covers both fully automated decisions and AI systems that substantially influence a human decision-maker.

Out-of-State Organizations

There is no residency or headquarters requirement. If your AI system makes consequential decisions affecting Virginia residents — whether they are employees, consumers, applicants, or patients — you are in scope.

---

Key Requirements

1. Impact Assessment

Before deploying an automated decision system that makes consequential decisions, covered organizations must conduct an impact assessment that:

• Identifies the purpose and intended use of the ADS
• Documents known risks of inaccuracy, bias, or discriminatory outcomes
• Describes the data used and any known limitations
• Evaluates the potential impact on Virginia consumers
• Documents the steps taken to mitigate identified risks

Impact assessments must be updated annually or whenever significant changes are made to the ADS.

2. Consumer Notification

When an ADS makes or substantially influences a consequential decision affecting a Virginia resident, the organization must:

• Notify the consumer that an automated decision system was used
• Explain the type of decision made and the data used as inputs
• Provide contact information for the deploying organization

3. Opt-Out Rights

Virginia residents have the right to opt out of solely automated decision-making in certain consequential contexts. Organizations must:

• Provide a clear and accessible mechanism for consumers to request that a human review the decision
• Process opt-out requests in a timely manner
• Not penalize consumers who exercise their opt-out rights

4. Transparency Documentation (Developers)

Organizations that develop covered automated decision systems must provide deployers with documentation covering:

• The intended use cases and known high-risk applications
• Known limitations, failure modes, and risks of discrimination
• A summary of training data and performance metrics
• Guidance on appropriate deployment contexts

---

Penalties & Enforcement

The Virginia Attorney General has enforcement authority over HB 2094. There is no private right of action — only the AG may bring enforcement proceedings.

• Civil penalties: Up to $7,500 per violation
• Cure period: A reasonable cure period is provided before penalties attach for first-time violations where the organization acts in good faith
• Injunctive relief: Courts may order organizations to cease non-compliant practices

Penalty Calculation

Penalties are assessed per violation — meaning each affected Virginia consumer, each non-compliant deployment, or each failure to provide a required notice could constitute a separate violation. For organizations with large consumer-facing deployments, aggregate exposure can be substantial.

---

Compliance Timeline

| Date | Milestone | |------|-----------| | 2026 | HB 2094 enacted by Virginia General Assembly | | July 1, 2026 | Law takes effect — compliance required | | Ongoing | Annual impact assessment renewal required |

---

How to Prepare

Follow this checklist to be ready by July 1, 2026:

1. Inventory your AI systems. Identify all automated decision systems used in employment, credit, healthcare, education, housing, or insurance decisions affecting Virginia residents.

2. Determine scope. For each system, assess whether it makes or substantially influences consequential decisions. If yes, it is covered under HB 2094.

3. Conduct impact assessments. Document the purpose, data inputs, known risks, and mitigation steps for each covered ADS. Store these records and plan for annual renewals.

4. Build consumer notification workflows. Add disclosures to decision points where AI is used, informing affected consumers that an ADS was involved and providing required contact information.

5. Implement opt-out mechanisms. Create a clear, accessible process for Virginia consumers to request human review of ADS-driven decisions.

6. Review vendor contracts. If you use third-party AI tools (e.g., hiring software, credit scoring engines), ensure your vendor provides the developer-level documentation required by the law.

7. Update privacy notices and terms. Your privacy policy and terms of service should reflect your use of automated decision systems and consumer rights under HB 2094.

8. Train your compliance team. Ensure staff responsible for AI governance understand HB 2094's requirements and the processes for consumer requests and incident reporting.

---

Frequently Asked Questions

When does Virginia HB 2094 take effect? July 1, 2026.

Does HB 2094 apply to our out-of-state company? Yes, if you deploy automated decision systems that affect Virginia residents in a covered consequential decision context, you must comply regardless of where you are headquartered.

We use a third-party AI tool for hiring. Are we responsible? Yes — as the deployer, you bear compliance responsibility even if you didn't build the AI. You should obtain required documentation from your vendor and ensure the tool is covered by your impact assessment.

What is the difference between HB 2094 and the Colorado AI Act? Both laws impose impact assessments and consumer rights requirements on high-risk AI deployments, and both cover similar consequential decision categories. Virginia HB 2094 includes an explicit opt-out right that mirrors aspects of the EU AI Act, while Colorado's law places more emphasis on the reasonable care standard and incident reporting to the AG.

Is there a minimum company size threshold? No. Virginia HB 2094 does not include a revenue or employee-count exemption. Any organization deploying covered ADS affecting Virginia residents must comply.