Virginia’s High-Risk AI Act: What Developers and Deployers Must Know

Virginia came closer than any state other than Colorado to enacting a comprehensive algorithmic discrimination law. On February 20, 2025, the Virginia General Assembly passed House Bill 2094 — the High-Risk Artificial Intelligence Developer and Deployer Act — along narrow party-line votes in both chambers. The bill would have taken effect July 1, 2026. It would have made Virginia the second state, after Colorado, to impose statutory duties on developers and deployers of high-risk AI systems to protect consumers from algorithmic discrimination.

Then Governor Glenn Youngkin vetoed it.

Understanding what HB 2094 would have required, why it was vetoed, what Virginia has done since, and where the state is likely to go next is essential context for any AI developer, technology company, or business deploying AI in consequential contexts. Virginia is a large, economically important state — it is home to more data centers than any other state in the country, hosts major federal contractors, and attracts technology investment at scale. Its legislative choices on AI carry national significance. This post covers the full picture: what the law said, why it failed, what replaced it, and what businesses should be preparing for.

What HB 2094 Would Have Required

The Core Framework: Reasonable Care Against Algorithmic Discrimination

HB 2094 was built around a single organizing principle: that developers and deployers of high-risk AI systems owe a duty of reasonable care to consumers to protect them from algorithmic discrimination. “Algorithmic discrimination” was defined as differential treatment or impact on any individual or group of individuals based on actual or perceived race, color, ethnicity, sex, religion, age, national origin, limited English proficiency, disability, veteran status, genetic information, reproductive health, or other protected classifications under Virginia law — except where that differential treatment is expressly permitted by law.

The duty of reasonable care is familiar to lawyers and executives alike. It does not require perfection. It requires that developers and deployers take steps that a reasonably prudent company in their position would take to prevent foreseeable harm. What makes HB 2094 significant is that it imposed this duty by statute — making algorithmic discrimination a specific, enforceable legal standard, not merely a potential claim under existing civil rights law.

Who Was Covered: The “High-Risk” Definition

HB 2094’s scope was cabined to “high-risk artificial intelligence systems” — a defined term that limited the law’s application to AI systems with the most significant potential for harm.

A high-risk AI system was defined as any AI system that is specifically intended to:
– Autonomously make a consequential decision, or
– Be a substantial factor in making a consequential decision.

The “substantial factor” language was important: the law did not cover only fully autonomous AI decisions. If a human decision-maker relied heavily on an AI system’s output — even if the human technically made the final call — the AI system could qualify as a substantial factor and the entire interaction would be within scope.

Consequential Decisions: The Covered Decision Domains

Not all decisions count. A “consequential decision” under HB 2094 was one that had a material legal or similarly significant effect on the provision or denial of:

• Employment: hiring, firing, promotion, compensation, work assignments.
• Financial services: loan approvals, credit decisions, credit terms.
• Housing: rental approval, mortgage approval, housing terms.
• Insurance: coverage approvals, pricing, denials.
• Education: enrollment decisions, academic progression.
• Healthcare services: treatment recommendations, coverage authorizations, clinical triage.
• Legal services: advice and representation access.
• Criminal justice: parole, probation, pardons, and release from incarceration.

This list covered the core areas where documented algorithmic discrimination is most consequential and most studied. The inclusion of criminal justice decisions was notable — it brought AI systems used in pretrial risk assessments, sentencing recommendations, and parole decision tools directly within scope.

Developer Obligations

Developers of high-risk AI systems would have faced the following requirements:

Disclosure of limitations and discrimination risks: No developer could offer, sell, lease, or otherwise provide a high-risk AI system to a deployer unless the developer made available to the deployer a disclosure of:
– Known or reasonably knowable limitations of the system.
– All known or reasonably foreseeable risks of algorithmic discrimination arising from the system’s intended uses.
– Documentation sufficient to allow the deployer to conduct their own risk management.

The practical effect of this requirement is significant: AI system vendors cannot simply sell a product and let customers figure out the risks. The vendor must actively characterize the system’s limitations and known discrimination risks before sale or deployment.

Documentation package: Developers were required to maintain documentation describing the system’s intended purpose, the training data used, the outputs produced, measures taken to mitigate discrimination risks, and instructions to assist deployers in monitoring performance. This documentation had to be made available to deployers and, under specified circumstances, to the Attorney General.

Update obligations: When developers became aware of material changes to the system — including new limitations or newly identified discrimination risks — they were required to notify deployers promptly.

Deployer Obligations

Deployers — businesses that deploy high-risk AI systems to make or influence consequential decisions about Virginia consumers — carried the most demanding compliance obligations:

Risk management policy and program: No deployer could deploy a high-risk AI system to make consequential decisions without first implementing a risk management policy and program for that system. The program had to be calibrated to the size and complexity of the deployer’s organization and the nature of the AI system.

Public disclosure: Deployers were required to make publicly available a statement summarizing how they manage reasonably foreseeable risks of algorithmic discrimination arising from the use of each high-risk AI system. This is not a detailed audit report — it is a summary accessible to consumers, regulators, and the public.

Impact assessments: Deployers were required to complete an impact assessment for each high-risk AI system before deployment and annually thereafter. The impact assessment had to include:
– A description of the AI system, its purpose, and its outputs.
– A description of the categories of data used and an analysis of their potential for introducing algorithmic discrimination.
– An evaluation of the benefits and risks of the system.
– A description of the risk mitigation measures in place.

Consumer rights on adverse decisions: When a high-risk AI system produced an adverse consequential decision — denying a loan, rejecting a job application, or denying insurance — the deployer had to:
– Disclose the principal reasons for the adverse decision, including whether the AI system was a determining factor.
– Inform the consumer of any reasonably available process to correct inaccurate data used in the decision.
– Provide an opportunity to appeal the decision.

These consumer rights align with the emerging national standard: transparency about AI’s role in adverse decisions, data correction, and appeal. Colorado’s CADMA adopted a similar framework; so did Connecticut’s SB 5 for AEDT decisions.

How HB 2094 Compared to Colorado’s CAIA

Virginia’s bill was drafted largely in parallel with Colorado’s original AI Act (CAIA), with each state watching the other’s progress. The comparison is instructive:

Virginia’s bill was actually somewhat more conservative than CAIA’s initial version because it relied entirely on AG enforcement with no private right of action. Colorado’s law ultimately went through multiple rounds of amendment and was eventually repealed and replaced by the narrower CADMA. Virginia’s trajectory went in a different direction: a flat veto.

Enforcement: AG-Only with Civil Penalties

HB 2094 provided that violations would be enforced exclusively by the Virginia Attorney General, with no private right of action for consumers. The AG could seek civil penalties — though the specific penalty amounts were left to be determined in implementing regulations.

The AG-only enforcement model was a deliberate choice designed to address business concerns about class action exposure. Developers and deployers would face government enforcement rather than individual or class-action lawsuits, which the law’s drafters hoped would make the compliance burden more predictable.

The Veto: Governor Youngkin’s Rationale

On March 24, 2025, Governor Youngkin vetoed HB 2094. His veto message argued on two main grounds:

The law stifled innovation: The Governor stated that the regulatory framework “fail[ed] to account for the rapidly evolving and fast-moving nature of the AI industry” and would “harm the creation of new jobs, the attraction of new business investment, and the availability of innovative technology” in Virginia.

It placed onerous burdens on small businesses: Governor Youngkin argued that the annual impact assessment requirements and ongoing compliance obligations imposed “an especially onerous burden on smaller firms and startups” — businesses that develop or use AI but that do not have dedicated compliance teams capable of managing the required program.

The veto was politically consistent with the Youngkin administration’s general preference for a light regulatory touch on technology and its alignment with the Trump administration’s stated federal AI policy — which favored voluntary frameworks over mandatory state compliance regimes.

The veto was not overridden. HB 2094 is dead.

What Virginia Has Done Instead

Virginia did not walk away from AI governance entirely after the HB 2094 veto. Two developments are worth tracking.

The Independent Verification Organization Framework (2026)

On April 13, 2026, Virginia’s new governor signed SB 384 and HB 797 — bills that passed with strong bipartisan margins (84-14 in the House, 40-0 in the Senate) and that take a fundamentally different approach to AI governance than HB 2094.

Rather than imposing substantive compliance duties on developers and deployers, these bills direct Virginia’s Joint Commission on Technology and Science (JCOTS) to evaluate the feasibility of an Independent Verification Organization (IVO) framework. IVOs would be independent expert bodies that verify whether AI systems meet defined safety standards — analogous to how underwriters’ laboratories certify consumer products, or how financial auditors independently certify financial statements.

JCOTS is directed to submit a report with recommendations by November 1, 2026. That report will form the foundation of any operational IVO legislation introduced in the 2027 session.

The IVO framework reflects a different theory of AI governance: rather than imposing compliance requirements on every developer and deployer, create an ecosystem of independent verifiers who can certify AI systems, and then build regulatory requirements around certification. This approach is more market-compatible, imposes lower direct compliance costs on individual companies, and aligns with the Trump administration’s preference for industry-led governance over government mandates.

The 2026 Session: Mostly Tabled

In the 2026 General Assembly session, state legislators introduced various AI-related bills — focusing on children’s safety online, AI guidance for K-12 schools, and sector-specific AI rules. Most of the substantive bills did not clear the Communications, Technology and Innovation Committee in the House of Delegates. The legislature largely tabled comprehensive AI regulation until at least 2027, pending the JCOTS report and a clearer national picture.

Why HB 2094 Still Matters — Even Though It Was Vetoed

A vetoed bill is not law. But HB 2094 remains important for several reasons.

It is the template for future legislation. The algorithmic discrimination framework, the developer/deployer dual-obligation structure, the impact assessment requirement, the consumer rights provisions — all of this is likely to reappear in a future Virginia AI bill. New governors bring different priorities, and AI regulation is popular with bipartisan majorities in the legislature. Companies that understand HB 2094’s requirements are better positioned for whatever comes next.

It shapes how Virginia courts interpret existing law. Even without a statute, HB 2094’s legislative history — the findings, the defined terms, the policy rationale — may inform how Virginia courts apply common law negligence, civil rights statutes, and consumer protection law to AI-related claims. Legislative history is not binding, but courts look at it when interpreting related statutes and evaluating novel claims.

It mirrors active laws in other states. Colorado’s CADMA is in effect in January 2027. Connecticut’s SB 5 AEDT framework is in effect in October 2027. Illinois has its own AI employment decision rules. New York City’s Local Law 144 has been enforcing AEDT bias audit requirements since 2023. If your organization is complying with these other state laws, you are already building toward HB 2094 compliance should Virginia try again.

Federal law may arrive before a new Virginia bill does. Congress has been working on various AI governance frameworks, and if a federal high-risk AI law passes — drawing on the same developer/deployer structure that HB 2094 used — Virginia businesses will face those requirements regardless of state law. Compliance infrastructure built for HB 2094 would directly serve federal law compliance.

What Developers and Deployers Should Do Now

Even with HB 2094 vetoed and no replacement enacted, Virginia-operating businesses should be taking the following steps:

Step 1: Understand Your Current Exposure Under Existing Law

Virginia law does not currently impose specific AI duties on developers and deployers. But existing civil rights statutes, consumer protection laws, and common law negligence principles still apply. An AI system that produces discriminatory outcomes in employment, housing, or financial services can generate legal liability under the Virginia Human Rights Act, the Virginia Fair Housing Law, the Consumer Protection Act, and federal civil rights statutes. The absence of HB 2094 does not mean the absence of legal risk.

Step 2: Build for the Multi-State Reality

If your business operates in Colorado (CADMA effective January 1, 2027), Connecticut (AEDT provisions effective October 2027), or other states with active AI laws, you are already building compliance infrastructure that overlaps substantially with what HB 2094 would have required. Extend that infrastructure to cover your Virginia operations. The investment is not wasted — it positions you for Virginia’s next legislative attempt and for potential federal requirements.

Step 3: Document Your High-Risk AI Systems

Regardless of what any statute requires, organizations that have maintained documentation of their AI systems’ purposes, training data, limitations, and known discrimination risks are better positioned to defend against government investigations and civil claims. Build that documentation now.

Step 4: Implement Human Review for Consequential Decisions

Consumer access to human review of adverse AI-driven decisions — on loans, hiring, insurance, housing — is the convergent standard across all active state AI laws and the strongest consumer protection you can offer. Build meaningful human review into your consequential decision workflows. This is good risk management independent of any specific statutory requirement.

Step 5: Monitor the JCOTS Report and the 2027 Session

The November 2026 JCOTS report on the IVO framework will signal whether Virginia is heading toward a certification-based model, a regulatory mandate, or continued deference to federal developments. Businesses with significant Virginia AI operations should track the JCOTS process, engage in the public comment process, and be prepared for 2027 session activity.

Step 6: Watch Federal Developments

The federal landscape is shifting. The Trump administration’s Executive Order on AI prioritizes voluntary frameworks and national security applications, but Congress has continued introducing bipartisan AI governance bills. A federal AI law that adopts the developer/deployer structure would supersede state inaction. Organizations that wait passively for federal law may have significantly less lead time to comply than those building infrastructure proactively.

The Broader Lesson: Vetoed Does Not Mean Irrelevant

HB 2094’s veto is a data point in the national conversation about AI regulation — evidence that even thoughtfully drafted, narrow high-risk AI laws face significant political headwinds when they impose process obligations on businesses. But the veto does not resolve the underlying policy question: AI systems are making consequential decisions about real people’s access to jobs, housing, credit, healthcare, and liberty, and those decisions carry discriminatory risks that existing civil rights law is not fully equipped to address.

Virginia will revisit this question. The IVO framework may provide a path. Federal action may pre-empt state-level debate. But the companies that use the current window to build governance programs, document their systems, and implement meaningful human oversight are the ones that will be ready — regardless of which path the law eventually takes.

This post is for general informational purposes only and does not constitute legal advice. Reading this post does not create an attorney-client relationship. If you have questions about your specific situation, consult a qualified attorney.