New Jersey — AI, Data Privacy, Insurance AI & Algorithmic Discrimination: AI Compliance Requirements

Do not produce or distribute AI-generated audio or visual media ("deepfakes") that: (1) Depicts a real person without their consent. (2) Is used to further any criminal activity (fraud, threats, child exploitation, harassment, hazing, etc.). Review all AI content generation workflows to ensure no unauthorized deepfakes are created.

Every insurer authorized to do business in New Jersey is expected to develop, implement and maintain a written program (an "AIS Program") for the responsible use of AI Systems that make or support decisions related to regulated insurance practices, designed to mitigate the risk of Adverse Consumer Outcomes. The AIS Program must address governance, risk management controls and internal audit functions, and must vest responsibility for its development, implementation, monitoring and oversight — and for setting the insurer's AI strategy — in senior management accountable to the board or an appropriate board committee. It must be tailored and proportionate to the insurer's actual use of and reliance on AI, and it must cover the whole insurance life cycle (product development and design, marketing, use, underwriting, rating and pricing, case management, claim administration and payment, and fraud detection) and every phase of an AI System's own life cycle (design, development, validation, implementation, use, ongoing monitoring, updating and retirement). It must cover AI Systems used for regulated insurance practices whether the insurer built them or bought them from a third-party vendor. The Program may sit inside or alongside the insurer's existing Enterprise Risk Management program and may adopt or rely on a third-party standard such as the NIST AI Risk Management Framework, Version 1.0.

Document the insurer's risk identification, mitigation and management framework and internal controls for AI Systems, generally and at each stage of the AI System life cycle. This must address: the oversight and approval process for developing, adopting or acquiring AI Systems; data practices and accountability procedures covering data currency, lineage, quality, integrity, bias analysis and minimisation, and suitability; management and oversight of Predictive Models including inventories and descriptions, detailed development and use documentation, and assessments of interpretability, repeatability, robustness, regular tuning, reproducibility, traceability, Model Drift and the auditability of those measurements; validating, testing and retesting as necessary to assess the generalisation of AI System outputs upon implementation, including whether the training data was suitable and comparing model performance on unseen data against post-implementation performance; protection of non-public consumer information including unauthorised access to the Predictive Models themselves; and data and record retention. Governance must also cover the insurer's processes for detecting and addressing errors, performance issues, outliers or unfair discrimination in insurance practices resulting from a Predictive Model.

The LAD applies to discrimination arising from automated decision-making tools exactly as it applies to any other discriminatory conduct — it "draws no distinctions based on the mechanism of discrimination". A covered entity (employer, housing provider, place of public accommodation, credit provider, contractor, or any other party subject to the LAD) can violate the LAD through an automated decision-making tool in two ways. DISPARATE TREATMENT: designing or using a tool to treat members of a protected class differently, selectively applying a tool only to members of a protected class, or using a tool that makes recommendations on a close proxy for a protected characteristic. DISPARATE IMPACT: using a tool whose recommendations or decisions disproportionately harm members of a protected class — prohibited unless the use is necessary to achieve a substantial, legitimate, nondiscriminatory interest AND there is no less discriminatory alternative that would achieve the same interest. Two facts drive the compliance posture: liability does NOT require intent to discriminate, and liability is NOT avoided because a third party built the tool or because the entity does not understand the tool's inner workings. Protected characteristics include actual or perceived race, religion, colour, national origin, sexual orientation, pregnancy, breastfeeding, sex, gender identity, gender expression and disability, among others.

Provide New Jersey consumers with the right to opt out of the processing of their personal data for purposes of profiling in furtherance of decisions that produce legal or similarly significant effects concerning the consumer — alongside the parallel rights to opt out of targeted advertising and of the sale of personal data. Do not discriminate against a consumer for exercising any of these opt-outs. A consumer may exercise the right personally or through a designated authorized agent, and a controller must comply with an opt-out received from an authorized agent where it can verify, with commercially reasonable effort, both the consumer's identity and the agent's authority to act. This right is the operative AI hook in the NJDPA: an automated decision that materially affects a consumer is reachable through the profiling opt-out even though New Jersey has no standalone automated-decision statute.

A controller that processes personal data for purposes of targeted advertising or the sale of personal data must allow consumers to exercise the opt-out right through a user-selected universal opt-out mechanism — in practice, an opt-out preference signal such as Global Privacy Control. The statute frames this as an additional channel, not a substitute: the controller must still offer its own opt-out route. SCOPE PRECISION: as enacted, the universal-opt-out duty is written to cover targeted advertising and the sale of personal data. It is NOT written to extend to profiling; the separate authorized-agent provision reaches profiling only "when such technology exists". Secondary summaries frequently blur this and describe a universal opt-out covering profiling — do not repeat that framing to customers.

New Jersey inverts the sequencing most incident-response templates assume. Any business or public entity required to disclose a breach of security of a customer's personal information must, IN ADVANCE of the disclosure to the customer, report the breach and any information pertaining to it to the Division of State Police in the Department of Law and Public Safety, for investigation or handling — which may include dissemination or referral to other appropriate law enforcement entities. Only then may customer notification proceed, which must be made in the most expedient time possible and without unreasonable delay, consistent with the legitimate needs of law enforcement. Build the State Police report into the incident-response runbook as a blocking step ahead of customer notice; notifying customers first is itself the violation, independent of whether the customer notice was timely. This matters directly for AI deployments: models, training corpora and vector stores holding New Jersey customers' personal information are in scope like any other system.

Implement a written policy for any AI-generated content involving real individuals' likenesses, voices, or images. Obtain and document explicit consent before generating or distributing AI content depicting identifiable people. Maintain records of all authorizations.

The AIS Program must address the insurer's process for acquiring, using or relying on (i) third-party data used to develop AI Systems and (ii) AI Systems developed by a third party. This includes due diligence and the methods used to assess the third party and its data or AI Systems, so as to ensure that decisions made or supported by those systems which could lead to Adverse Consumer Outcomes will meet the legal standards imposed on the insurer itself. Where appropriate and available, contracts with third parties should include terms that provide audit rights and/or entitle the insurer to receive audit reports from qualified auditing entities, and that require the third party to cooperate with the insurer on regulatory inquiries and investigations relating to the insurer's use of the third party's product or services. The insurer should also exercise those contractual audit rights to confirm the third party's compliance with contractual and, where applicable, regulatory requirements.

The AIS Program must include processes and procedures providing notice to impacted consumers that AI Systems are in use, and providing access to appropriate levels of information based on the phase of the insurance life cycle in which the AI Systems are being used. This is a distinct, affirmative consumer-facing duty in the bulletin — it is not satisfied by internal governance documentation alone. It pairs with the bulletin's expectation that the transparency and explainability of outcomes to the impacted consumer is one of the factors determining how extensive the insurer's controls must be.

Regardless of whether the insurer has a written AIS Program at all, in an investigation or market conduct action the insurer can expect to be asked about the development, deployment and use of its AI Systems, about any specific Predictive Model or AI System and its outcomes (including Adverse Consumer Outcomes), and for any other information the Department deems relevant. Maintain retrievable evidence covering: the written AIS Program and documentation evidencing its adoption; the Program's scope, including which AI Systems and technologies are NOT covered by it; how the Program is proportionate to the insurer's AI use and the Degree of Potential Harm to Consumers; policies, procedures, guidance and training materials; documentation of the formation and ongoing operation of the insurer's AI coordinating bodies; data practices and accountability procedures; inventories and descriptions of Predictive Models and AI Systems used to make or support decisions that can result in Adverse Consumer Outcomes; for any model under examination, documentation of compliance with the insurer's own AI policies plus information on data source, provenance, lineage, quality, integrity, bias analysis and minimisation, suitability and currency, and the techniques, measurements and thresholds used; and documentation of validation, testing and auditing including evaluation of Model Drift.

Algorithmic discrimination can violate the LAD where an automated decision-making tool precludes or impedes the provision of reasonable accommodations, or of modifications to policies, procedures or physical structures needed for accessibility, on the basis of disability, religion, pregnancy or breastfeeding status. Three failure modes are identified in the guidance. (1) The tool itself is inaccessible to individuals with disabilities or others with a protected characteristic — for example a typing-speed assessment that cannot measure typing from a non-traditional keyboard. (2) The tool was not trained on data including individuals who use an accommodation, so it fails to recognise that an accommodation is possible or penalises candidates who need one — a covered entity that acts on such a recommendation may engage in disparate impact discrimination. (3) The tool fails to account for an accommodation the entity has already granted — for example productivity-monitoring software that flags atypical or unsanctioned breaks without being programmed to allow for breaks granted to accommodate a disability or milk expression; an employer that accepts the tool's recommendation to discipline those employees may violate the LAD. The LAD requires a covered entity to make reasonable accommodations based on protected-class membership where the entity knew or should have known of the need and the accommodation would not cause undue hardship.

Conduct and document a data protection assessment for each processing activity that presents a heightened risk of harm to a consumer. The Act reaches, at minimum: processing personal data for purposes of targeted advertising; the sale of personal data; the processing of sensitive data; and profiling where the profiling presents a reasonably foreseeable risk of (i) unfair or deceptive treatment of, or unlawful disparate impact on, consumers, (ii) financial or physical injury to consumers, or (iii) a physical or other intrusion upon the solitude or seclusion, or the private affairs or concerns, of consumers where that intrusion would be offensive to a reasonable person. For AI deployments the profiling limb is the operative trigger — the disparate-impact language means an automated tool that materially affects New Jersey consumers is assessable under the NJDPA and, separately, under the NJLAD (see nj_lad_algorithmic_discrimination). Retain the assessment: it is the artefact the Attorney General will ask for.

Do not process a consumer's sensitive data without first obtaining the consumer's consent. Consent under the Act must be an affirmative, freely given, specific, informed and unambiguous choice — it cannot be inferred from silence, pre-ticked boxes, or continued use of a service. For AI systems this bites at the training and feature-engineering stage as much as at inference: ingesting sensitive attributes into a model without consent is processing. Note that New Jersey's definition of sensitive data is broader than several peer states — it expressly reaches financial information alongside the more common categories, and the Act separately restricts processing the personal data of consumers the controller knows or wilfully disregards to be children aged 13 through 16 for targeted advertising, sale, or profiling without consent.