AI Laws in Hawaii (HI)

What HB 1607 requires

Hawaii has enacted HB 1607 — AI Accountability. Proposed requirements for AI impact assessments in employment and public services. This page explains what the law requires in plain language, who is in scope, the penalty for non-compliance, and what your business needs to do before the January 1, 2027 deadline.

Who is in scope

The law covers any business in Hawaii that uses algorithmic tools to screen job applications, score interviews, rank candidates, evaluate employee performance, or make promotion and termination decisions; developers who build AI systems classified as high-risk — typically systems that influence consequential decisions in credit, employment, healthcare, education, housing, or government services — and the companies that deploy them; and Hawaii state agencies that deploy AI for benefits determination, licensing, law enforcement, or public-service delivery; private-sector operators serving state contracts are also in scope. Company size does not determine whether you are in scope — a startup with ten employees using an off-the-shelf AI hiring tool has the same disclosure obligations as an enterprise running a custom-built model. What matters is whether the AI system makes or substantially informs a decision that affects a Hawaii resident in a consequential way. Notably, the obligation extends to vendors: if your company deploys an AI tool built by a third party, you — as the deployer — are responsible for ensuring it meets Hawaii's requirements, even if you did not build it.

Key compliance requirements

Hawaii's employment AI rules create concrete pre-deployment and ongoing obligations. Before any AI tool enters the hiring or performance-management pipeline, employers must be able to document what data the system uses, how it reaches a decision, and what steps have been taken to detect and mitigate bias. Affected candidates and employees are entitled to notice that AI is involved — that notice must be provided before the AI evaluation takes place, not after an adverse decision has already been issued. Many employment AI statutes also require that a human reviewer be available to consider any appeal of an AI-assisted adverse action, preventing a loop where an algorithm's decision becomes final with no meaningful override path.

Hawaii's risk-assessment framework requires that developers and deployers of high-impact AI systems conduct formal impact assessments before deployment and re-evaluate them when the system changes materially. An impact assessment must document the intended purpose of the system, the data it uses, the populations it affects, known accuracy limitations, and what bias-testing was performed. Deployers must also publish a summary of the assessment that is accessible to consumers and regulators — internal documentation alone is insufficient. Critically, the assessment is not a one-time exercise: Hawaii's law contemplates ongoing monitoring, with a duty to update documentation when performance data or demographic outputs shift.

Hawaii's AI law for public-sector systems requires state agencies to create and maintain an inventory of every AI tool used in government operations. Each entry in the inventory must describe the system's purpose, the decisions it informs, the data inputs, and the vendor or developer responsible for it. Agencies must also establish an appeals process so that individuals affected by an AI-assisted decision can request human review. For private-sector companies that provide AI tools to the state, contract language must address these transparency and accountability obligations — vendors who cannot demonstrate compliance may be excluded from procurement.

Penalties for non-compliance

The financial consequences of non-compliance under HB 1607 are real and enforceable now. Hawaii sets a maximum civil penalty of Civil penalties. Penalties accumulate per violation — meaning a company that has deployed an AI tool to thousands of consumers without required disclosures faces compounding exposure, not a single capped fine. Employment AI violations often trigger parallel exposure: an employer who fails to provide required notice faces state penalties AND increased litigation risk under federal equal-employment law, because documented failure to audit for bias can be used as evidence of disparate-impact intent in private lawsuits.

What to do now

Build your AI inventory first. You cannot comply with Hawaii's requirements if you do not know which systems are in scope. Map every AI or automated decision system your company uses that touches Hawaii residents — including third-party vendor tools integrated into your product.

Audit hiring tools before the deadline. Commission or conduct a bias audit on any resume screener, interview scorer, or performance-management AI. Document the methodology, the demographic breakdown of outcomes, and the steps taken to mitigate any identified disparities.

Implement candidate and employee notice. Update job postings, onboarding materials, and performance-review workflows to include required disclosures. Verify that the notice is delivered before the AI evaluation occurs.

Draft accurate disclosure language. Work with legal counsel to produce disclosure statements that accurately describe what your AI does, what data it uses, and what the consumer can do if they want human review. Vague or boilerplate disclosures will not satisfy Hawaii's requirements.

Build the opt-out pathway. Implement a functioning process for consumers to request human review or opt out of AI-assisted processing. Test it before the deadline — regulators will look for live, working mechanisms, not documented promises.

Complete impact assessments for high-risk systems. Follow the framework in HB 1607 to produce a written assessment covering intended use, training data, affected populations, accuracy benchmarks, and bias mitigation. Retain the documentation for at least the period specified in the law's record-keeping provisions.

Review government contracts. If your company provides AI tools to Hawaii state agencies, review pending and existing contracts to ensure they address the inventory, transparency, and appeals requirements that now flow through to vendors.

Assign a compliance owner. Designate someone — legal counsel, a privacy officer, or a dedicated AI governance lead — to track regulatory developments, own the audit documentation, and respond if an enforcement inquiry arrives. The compliance deadline is January 1, 2027. Don't wait until the deadline to start.

Hawaii AI law in the broader regulatory landscape

Hawaii's law does not exist in isolation. The trend across the United States is toward more regulation, not less: at least 20 states enacted or proposed AI-specific legislation in 2025 alone, and federal enforcement agencies — the FTC, EEOC, CFPB, and HHS — have all issued guidance making clear that existing laws apply to AI systems even where no AI-specific statute exists. Companies doing business across state lines must track each state's requirements independently — there is no federal preemption that would allow a company to satisfy Hawaii's law and automatically comply with requirements in Illinois, Colorado, or New York.