A computer told you no.
Not a person — a scoring model. You applied for the apartment, the auto loan, the job, the insurance policy, and a system evaluated you and produced an answer. The person on the phone cannot tell you what it weighed, because the person on the phone does not know.
In Minnesota you can make them find out. That has been law since July 31, 2025, and I have yet to meet a Minnesotan outside the compliance trade who knows it exists.
Minnesota already wrote the hardest sentence
A Minnesota AI standard does not start on a blank page. It starts in the Minnesota Consumer Data Privacy Act, at Minn. Stat. § 325M.14.
If an automated system profiles you in a decision carrying legal or similarly significant effects, you may question the result. You may be told the reason the profiling produced that decision — that decision, not a brochure about the model in general. Where feasible, you may be told what you might have done differently. You may see the data the system used on you. And if the decision rested on inaccurate data, you may have the data corrected and the decision run again on the corrected version. The company gets 45 days, extendable once by 45 more with notice.
The statute names the decisions it covers: lending, housing, insurance, education, criminal justice, employment, health care, and essential goods or services. It defines profiling by what the thing does, not by what a vendor calls it — any automated processing used to evaluate or predict a person's finances, health, reliability, behavior, or location. A spreadsheet with weights in it qualifies. Nobody has to say the words "artificial intelligence."
Per-decision explanation, a counterfactual, and a do-over. The industry has spent a decade calling those three things hard.
The grace period is gone too. The paragraph requiring the Attorney General to send a warning letter and wait 30 days before suing carried its own expiration date and expired on schedule on January 31, 2026. Since then the state sues with no letter, at up to $7,500 per violation plus its litigation expenses.
A right is not a standard
The Act reaches only large data operations — an entity handling personal data of 100,000 consumers in a year, or 25,000 while making more than a quarter of its revenue selling data. The clinic, the school district, and the forty-employee manufacturer that just bought a résumé screener sit outside it, and so does government. And the right fires backward, after you have already been turned down. A standard is a different instrument: what the builder meets before the system scores anybody, and a mark that says so.
What Colorado and Europe actually do
Colorado has been the other American laboratory, and a rough one. Its 2024 AI Act — high-risk systems, algorithmic discrimination, a duty of reasonable care — was delayed, challenged in court, then repealed and reenacted in May 2026 as a statute about automated decision-making technology in consequential decisions, effective January 1, 2027 and reaching only decisions made on or after that day. Colorado's version: notice before the system is used on you, a plain-language explanation within thirty days of an adverse outcome, a route to correct your data, and human review to the extent commercially reasonable. Colorado does not require anyone to correct opinions, predictions, or scores, and gives businesses a 60-day cure period running to 2030. So Colorado regulates the developer and the deployer, which we do not — and on what one person can demand about one decision, our law today is stronger than what Colorado's will deliver in 2027.
Europe tiered by risk, then moved its own deadline. In July 2026 the Parliament and Council amended the EU AI Act and pushed the high-risk duties for employment, credit, education, and essential services out to December 2, 2027, conceding in the recitals that the standards came late and the burden ran heavier than expected. What binds now, since August 2, 2026, is transparency — tell people when they are dealing with a machine, mark synthetic content so it is machine-detectable, disclose deep fakes — and it reaches a Minnesota company with no European office, because the trigger is that the output gets used in the Union.
The bill that had the right idea and one fatal word
Our Legislature got closer than almost anyone noticed. On March 23, 2026, House File 4544 was introduced by Representatives Koegel, Rymer, Norris, and Bahner — three DFLers and a Republican — and referred to House Commerce Finance and Policy. A Senate companion, Senate File 4636, from Senators Frentz and Lucero, went to Senate Commerce and Consumer Protection the same day.
The design was better than its obscurity suggests. The commissioner of commerce would license private independent verification organizations — only on a finding that the applicant was independent of the AI community, and only against a filed plan: the risks it verifies, what an acceptable level of each looks like, measurable metrics and targets, audit methods, monitoring after deployment, and when a verification gets pulled. Reports would be published in redacted form, documentation kept ten years, and an advisory council with a civil-society seat would oversee it under conflict rules barring members from holding an interest in AI companies or taking an industry job for a year.
Then the payoff. If a licensed verifier had verified a system against the very risk that later injured someone, the company got a rebuttable presumption against liability in a suit for personal injury or property damage. Verification bought a defense.
Then the sentence that emptied it, from proposed section 325M.51, subdivision 7: "Nothing in this section requires an artificial intelligence model or artificial intelligence application to seek IVO verification."
Neither bill moved again. No committee action appears on either status page after the day it was referred, and the regular session could not meet past May 18 — our constitution closes it on the first Monday following the third Saturday in May.
A standard nobody has to meet is a standard nobody meets, unless what it shields you from costs more than compliance does. Minnesota's arithmetic does not work yet: the privacy act whose chapter this bill would have joined has no private right of action, and suits over injury caused by a model are still a thin category. The carrot was real. The plate under it was empty.
What the standard would say
Five requirements, and four of them are already written down somewhere in Minnesota law.
Per-decision explanation, for everyone, not only the giants. The Legislature already decided what the answer looks like when a machine turns a Minnesotan down. What keeps that answer from most people is the headcount threshold, not the principle. Keep the principle, drop the threshold.
A written risk assessment before deployment, disparate impact included. Minnesota already makes covered businesses write and keep an assessment when profiling carries a reasonably foreseeable risk of unfair or deceptive treatment, disparate impact, or financial, physical, or reputational injury. The standard makes that document a condition of the mark instead of a filing nobody reads.
A named human who owns it. The privacy act already contemplates a person — a chief privacy officer or another individual with primary responsibility. Not a committee, not a shared mailbox. Put the name on the certificate.
Independent verification, not optional for anyone claiming the mark. Take House File 4544's machinery whole and attach it to weight: no automated decision system sold to the State of Minnesota, and no product advertised as built to the Minnesota standard, without a current verification. Nobody is compelled to be verified. Everybody who wants the state's business, or the state's name on the box, is.
Synthetic-output disclosure, harmonized rather than reinvented. Europe's transparency duties already bind Minnesota exporters. Match them. A second, slightly different rule buys Minnesotans nothing and costs Minnesota companies twice.
The part I cannot promise
A standard is a constraint and constraints carry a price. Some companies will read this and go build somewhere looser, and I would rather put that on the page myself than have it read back to me later. Minnesota is one state in a national market; we cannot set that market's rules, and if Congress preempts the field, part of this becomes history.
The bet is that buyers pay for trust. Hospitals, banks, insurers, school districts, and the state itself are the customers for these systems, and every one of them is buying today on a vendor's word. A mark that means something — issued by someone with no stake in the sale, revocable, evidence retained, reports published — is worth money to a buyer who is otherwise guessing.
That is a bet, and I am calling it one. What makes me willing to place it is that we are not starting from zero.
What we can do
Tell people the right exists. A Minnesotan turned down by an automated system in a covered category should learn about this from the denial, not from a law firm's blog. The Legislature can require that notice in a short bill.
Write the standard into what the state buys. Procurement needs no new agency. Minnesota purchases systems that touch benefits, licensing, and hiring. Put the standard in the contract terms and every vendor who wants our business meets it.
Bring House File 4544 back with the voluntariness fixed. Keep the licensing, the independence test, the published reports, the ten-year retention. Tie the mark to state purchasing and to the right to claim Minnesota verification in marketing, and keep the liability presumption as the carrot for everyone else.
Extend the profiling right below the threshold for the decisions that decide a life. Housing, credit, employment, health care. A Minnesotan denied an apartment by an algorithm should get the same answer whether the landlord's software vendor has a hundred thousand customers or nine hundred.
Put citizens on the body that writes it. House File 4544 reserved one seat for civil society. One seat is a courtesy. A standard drafted only by engineers, lobbyists, and lawyers is one Minnesotans would be right not to trust — and a standard nobody trusts is worth nothing in the market it was built to win.
We keep waiting for somebody to write the rules for this. Minnesota wrote the hardest one two years ago and left it in a drawer.
First the facts. Then the fix.
Sources
The Minnesota provisions were read as raw statutory text pulled from the Office of the Revisor of Statutes with a browser user agent, not through a summarizer. Minn. Stat. § 325M.14, subdivision 1, paragraph (g) is the profiling right described here — to question the result, to be informed of the reason the profiling resulted in the decision, to be informed if feasible of what the consumer might have done differently, to review the personal data used, and to have inaccurate data corrected and the decision reevaluated on the corrected data; the 45-day clock and its single 45-day extension are in subdivision 4 of the same section. The covered decisions and the functional definition of profiling are in § 325M.11. The 100,000-consumer threshold, the 25,000-plus-25-percent-of-revenue threshold, and the exclusion of government entities are in § 325M.12. The mandatory documented assessment for profiling that presents a reasonably foreseeable risk of unfair or deceptive treatment, disparate impact, or financial, physical, or reputational injury, and the requirement to name an individual with primary responsibility, are in § 325M.18. The warning-letter-and-30-day-cure paragraph that expired on its own terms on January 31, 2026, the $7,500-per-violation penalty, the state's litigation expenses, and the absence of any private right of action are in § 325M.20. The Act was enacted in Laws 2024, chapter 121, article 5, and took effect July 31, 2025.
House File 4544 and Senate File 4636 were read from the Revisor's bill text and status pages. The introduced text supplies the licensure scheme, the required contents of a verification plan, the independence finding, the annual reports published by the Department of Commerce, the ten-year retention, the advisory council and its conflict rules, the rebuttable presumption against liability in proposed section 325M.54, and the sentence quoted in full from proposed section 325M.51, subdivision 7. The status pages show House File 4544 authored by Koegel, Rymer, Norris, and Bahner, introduced and referred to Commerce Finance and Policy on March 23, 2026, with no later action, and Senate File 4636 authored by Frentz and Lucero, introduced and referred to Commerce and Consumer Protection the same day, also with no later action. Party affiliations of the House authors come from the Minnesota House member roster. The session limit is Minnesota Constitution, article IV, section 12, which bars the Legislature from meeting in regular session after the first Monday following the third Saturday in May — May 18 in 2026.
Colorado is in my own words and not quoted, because the signed act's text layer breaks words apart and I will not put a repaired extraction inside quotation marks. The sequence is Senate Bill 24-205 (approved May 17, 2024), Senate Bill 25B-004 (approved August 28, 2025, delaying the duties), and Senate Bill 26-189 (approved May 14, 2026), which repealed and reenacted part 17 of article 1 of title 6 of the Colorado Revised Statutes as an automated decision-making-technology framework effective January 1, 2027, applying to consequential decisions made on or after that date, with the notice, thirty-day adverse-outcome explanation, correction route, commercially-reasonable human review, the carve-out for opinions, predictions, and scores, and the 60-day cure period that repeals January 1, 2030. The European material is Regulation (EU) 2024/1689 as amended by Regulation (EU) 2026/1744 of 8 July 2026, read in the EUR-Lex consolidated text: article 113 as amended, moving the Annex III high-risk obligations to 2 December 2027 against a general application date of 2 August 2026; article 50, the transparency duties in force since that date; article 2(1)(c), applying the regulation where the output produced by the AI system is used in the Union; and recital (2) of the amending regulation on late standards and heavier-than-expected burden.
The federal challenge to Colorado's earlier statute is noted only as filed; I have read no order in it and nothing here characterizes one. Whether any Minnesota business has yet been sued under the privacy act is not asserted — no enforcement action has been located in the public record, and warning letters are not necessarily public. This describes law and proposes policy; it is not legal advice, and no client matter appears in it. Corrections: campaign@madgettformn.com.