A computer told you no.
Not a person — a scoring model. You applied for the apartment, the auto loan, the job, the insurance policy, and a system evaluated you and produced an answer. The person on the phone cannot tell you what it weighed, because the person on the phone does not know.
Minnesota wrote you a right to make them find out. It has been law since July 31, 2025, and I have yet to meet a Minnesotan outside the compliance trade who knows it exists. Then the same statute exempted the bank, the insurer, and the employment file. Three of those four doors are shut before you knock.
Minnesota already wrote the hardest sentence
A Minnesota AI standard does not start on a blank page. It starts in the Minnesota Consumer Data Privacy Act, at Minn. Stat. § 325M.14.
If an automated system profiles you in a decision carrying legal or similarly significant effects, you may question the result. You may be told the reason the profiling produced that decision — that decision, not a brochure about the model in general. Where feasible, you may be told what you might have done differently. You may see the data it used on you. And if the decision rested on inaccurate data, you may have the data corrected and the decision run again on the corrected version. The company gets 45 days, extendable once with notice.
It defines profiling by what the thing does, not by what a vendor calls it — any automated processing used to evaluate or predict a person's finances, health, reliability, behavior, or location. A spreadsheet with weights in it qualifies. Nobody has to say the words "artificial intelligence."
Per-decision explanation, a counterfactual, and a do-over. The industry has spent a decade calling those three things hard.
The grace period is gone too. The paragraph that made the Attorney General send a warning letter and wait 30 days before suing expired on schedule on January 31, 2026. Since then the state sues with no letter, at up to $7,500 per violation plus its litigation expenses.
A right is not a standard
Start with size, the limit people know about. The Act reaches only large data operations — 100,000 consumers in a year, or 25,000 while making more than a quarter of revenue selling data — and a company small enough to qualify as a small business under the federal size standards is carved out of nearly all of it.
Then read the exclusion list, which is the part nobody quotes. Chartered banks and credit unions are excluded outright, as entities, and so are insurance companies, producers, and third-party administrators of self-insurance. Data collected while someone acts as a job applicant or an employee is excluded where it is used only in that role. Gramm-Leach-Bliley data is out where it is handled in compliance with that Act, and credit-report activity by a reporting agency, a furnisher, or a user of a report is out to the extent the Fair Credit Reporting Act already governs it. Health records, protected health information, FERPA student records, and government: out.
Now set that beside the decisions the right was written for, which the statute lists: lending, housing, insurance, education, criminal justice, employment, health care, and access to essential goods or services. Minnesota wrote a right to ask an automated system why it said no, then exempted most of the industries that say no. What comes through whole is the last category — the utility, the telecom, the big retailer — plus a landlord large enough to clear the thresholds and scoring you on something other than a credit report.
That is not mainly a threshold problem. Extending the Act to every small business in the state would open the apartment door and leave the other three shut, because size is not what closed them. The right also fires backward, after you have already been turned down. A standard is a different instrument: what the builder meets before the system scores anybody, and a mark that says so.
What Colorado and Europe actually do
Colorado has been the other American laboratory, and a rough one: its 2024 AI Act was delayed, challenged in court, then repealed and reenacted in May 2026 as a statute about automated decision-making technology in consequential decisions, effective January 1, 2027. It requires notice before the system is used on you, an explanation within thirty days of an adverse outcome, a route to correct your data, and human review to the extent commercially reasonable, with no duty to correct opinions, predictions, or scores. It reaches the company that builds the system and not only the one that uses it, which is more than we do — though on what one person can demand about one decision, our law is stronger, where it applies at all.
Europe tiered by risk, then moved its own deadline: in July 2026 the Parliament and Council pushed the EU AI Act's high-risk duties for employment, credit, education, and essential services out to December 2, 2027, conceding in the recitals that the standards came late and the burden ran heavier than expected. What binds now, since August 2, 2026, is transparency — say when a machine is talking, mark synthetic content so it is machine-detectable, disclose deep fakes — and it reaches a Minnesota company with no European office, because the trigger is that the output gets used in the Union.
The bill that had the right idea and one fatal word
Our Legislature got closer than almost anyone noticed. On March 23, 2026, House File 4544 was introduced by Representatives Koegel, Rymer, Norris, and Bahner — three DFLers and a Republican — and referred to House Commerce Finance and Policy. A Senate companion, Senate File 4636, from Senators Frentz and Lucero, went to Senate Commerce and Consumer Protection the same day.
The design was better than its obscurity suggests. The commissioner of commerce would license private verification organizations — only on a finding that the applicant was independent of the AI industry, and only against a filed plan naming the risks it verifies, what an acceptable level of each looks like, measurable metrics and targets, and when a verification gets pulled. Their reports would be published in redacted form, their files kept ten years, under an advisory council with a seat reserved for civil society.
Then the payoff. If a licensed verifier had verified a system against the very risk that later injured someone, the company got a rebuttable presumption against liability in a suit for personal injury or property damage. Verification bought a defense.
Then the sentence that emptied it, from proposed section 325M.51, subdivision 7: "Nothing in this section requires an artificial intelligence model or artificial intelligence application to seek IVO verification."
Neither bill moved again. No committee action appears on either status page after the day it was referred, and the constitution closes the regular session on the first Monday following the third Saturday in May — May 18 this year.
A standard nobody has to meet is a standard nobody meets, unless what it shields you from costs more than compliance. Minnesota's does not: the privacy act whose chapter this bill would have joined has no private right of action, and suits over injury caused by a model are still thin. The carrot was real. The plate under it was empty.
What the standard would say
Five requirements, and four of them are already written down somewhere in law.
Per-decision explanation, tied to the decision and not to the industry. The Legislature already decided what the answer looks like when a machine turns a Minnesotan down, then exempted the bank, the insurer, and the employment file. A mark worth having covers the decision — credit, housing, insurance, employment, health care — whichever regulator already holds a piece of the company making it. Federal law occupies some of that ground and a state cannot legislate it away, but it can require anyone claiming the Minnesota mark to answer anyway.
A written risk assessment before deployment, disparate impact included. Minnesota already makes covered businesses write and keep an assessment when profiling carries a reasonably foreseeable risk of unfair or deceptive treatment, disparate impact, or financial or reputational injury. The standard makes that document a condition of the mark instead of a filing nobody reads.
A named human who owns it. The privacy act already contemplates a person — a chief privacy officer or another individual with primary responsibility. Not a committee, not a shared mailbox. Put the name on the certificate.
Independent verification, not optional for anyone claiming the mark. Take House File 4544's machinery whole and attach it to weight: no automated decision system sold to the State of Minnesota, and no product advertised as built to the Minnesota standard, without a current verification. Nobody is compelled to be verified. Everybody who wants the state's name on the box is.
Synthetic-output disclosure, matched to Europe's. Those duties already bind Minnesota exporters. A second, slightly different Minnesota rule buys Minnesotans nothing and costs Minnesota companies twice.
The part I cannot promise
A standard is a constraint, and constraints carry a price. Some companies will read this and go build somewhere looser, and I would rather put that on the page myself than have it read back to me later. Minnesota is one state in a national market; we cannot set that market's rules, and if Congress preempts the field, part of this becomes history.
The bet is that buyers pay for trust. Hospitals, banks, insurers, school districts, and the state itself are the customers for these systems, and every one of them buys today on a vendor's word. A mark that means something — issued by someone with no stake in the sale, revocable, evidence retained, reports published — is worth money to a buyer who is otherwise guessing.
That is a bet, and I am calling it one.
What we can do
Write the standard into what the state buys. Procurement needs no new agency. Minnesota buys systems that touch benefits, licensing, and hiring; put the standard in the contract terms and every vendor who wants our business meets it.
Bring House File 4544 back with the voluntariness fixed. Same machinery, tied to state purchasing and to the right to claim Minnesota verification, with the liability presumption kept as the carrot.
Close the exemptions before anyone argues about the threshold. Reach what a state can reach, say where federal law occupies the field, and make the denial itself say the right exists.
Put citizens on the body that writes it. House File 4544 reserved one seat for civil society. One seat is a courtesy. A standard drafted only by engineers, lobbyists, and lawyers is one Minnesotans would be right not to trust, and a standard nobody trusts is worth nothing in the market it was built to win.
We keep waiting for somebody to write the rules for this. Minnesota wrote the hardest one two years ago, then wrote most of the industries it was aimed at out of it.
First the facts. Then the fix.
Sources
The Minnesota provisions were read as raw statutory text pulled from the Office of the Revisor of Statutes with a browser user agent, not through a summarizer. Minn. Stat. § 325M.14, subdivision 1, paragraph (g) is the profiling right described here — to question the result, to be informed of the reason the profiling resulted in the decision, to be informed if feasible of what the consumer might have done differently, to review the personal data used, and to have inaccurate data corrected and the decision reevaluated on the corrected data; the 45-day clock and its single 45-day extension are in subdivision 4 of the same section. The covered decisions and the functional definition of profiling are in § 325M.11. The 100,000-consumer and 25,000-plus-25-percent-of-revenue thresholds are in § 325M.12, subdivision 1, and the exclusions described here are all in subdivision 2, paragraph (a) of the same section, read clause by clause: government entities at clause (1); health records, protected health information, and provider-held information at clauses (3) through (6); credit-report activity by a consumer reporting agency, a furnisher, or a user of a report at clause (8), which excludes it only to the extent the Fair Credit Reporting Act governs the activity; Gramm-Leach-Bliley data at clause (9), only where handled in compliance with that Act; FERPA-regulated student data at clause (11); job-applicant and employee data at clause (13), only where collected and used solely within that role; state and federally chartered banks and credit unions at clause (16); insurance companies, producers, and third-party administrators of self-insurance at clause (18), which itself carves back in a person who establishes a self-insurance program and does not otherwise write policies; and SBA-defined small businesses at clause (19), which remain subject to § 325M.17. Clause (18)'s carve-back, and clauses (2), (10), (12), (14), (15), (17), (20), and (21), are not described in the body of this article. The mandatory documented assessment for profiling that presents a reasonably foreseeable risk of unfair or deceptive treatment, disparate impact, or financial, physical, or reputational injury, and the requirement to name an individual with primary responsibility, are in § 325M.18. The warning-letter-and-30-day-cure paragraph that expired on its own terms on January 31, 2026, the $7,500-per-violation penalty, the state's litigation expenses, and the absence of any private right of action are in § 325M.20. The Act was enacted in Laws 2024, chapter 121, article 5, and took effect July 31, 2025.
House File 4544 and Senate File 4636 were read from the Revisor's bill text and status pages. The introduced text supplies the licensure scheme, the required contents of a verification plan, the independence finding, the annual reports published by the Department of Commerce, the ten-year retention, the advisory council and its conflict rules, the rebuttable presumption against liability in proposed section 325M.54, and the sentence quoted in full from proposed section 325M.51, subdivision 7. The status pages show House File 4544 authored by Koegel, Rymer, Norris, and Bahner, introduced and referred to Commerce Finance and Policy on March 23, 2026, with no later action, and Senate File 4636 authored by Frentz and Lucero, introduced and referred to Commerce and Consumer Protection the same day, also with no later action. Party affiliations of the House authors come from the Minnesota House member roster. The session limit is Minnesota Constitution, article IV, section 12, which bars the Legislature from meeting in regular session after the first Monday following the third Saturday in May — May 18 in 2026.
Colorado is in my own words and not quoted, because the signed act's text layer breaks words apart and I will not put a repaired extraction inside quotation marks. The sequence is Senate Bill 24-205 (approved May 17, 2024), Senate Bill 25B-004 (approved August 28, 2025, delaying the duties), and Senate Bill 26-189 (approved May 14, 2026), which repealed and reenacted part 17 of article 1 of title 6 of the Colorado Revised Statutes as an automated decision-making-technology framework effective January 1, 2027, applying to consequential decisions made on or after that date, with the notice, thirty-day adverse-outcome explanation, correction route, commercially-reasonable human review, the carve-out for opinions, predictions, and scores, and the 60-day cure period that repeals January 1, 2030. The European material is Regulation (EU) 2024/1689 as amended by Regulation (EU) 2026/1744 of 8 July 2026, read in the EUR-Lex consolidated text: article 113 as amended, moving the Annex III high-risk obligations to 2 December 2027 against a general application date of 2 August 2026; article 50, the transparency duties in force since that date; article 2(1)(c), applying the regulation where the output produced by the AI system is used in the Union; and recital (2) of the amending regulation on late standards and heavier-than-expected burden.
The federal challenge to Colorado's earlier statute is noted only as filed; I have read no order in it and nothing here characterizes one. Whether any Minnesota business has yet been sued under the privacy act is not asserted — no enforcement action has been located in the public record, and warning letters are not necessarily public. This describes law and proposes policy; it is not legal advice, and no client matter appears in it. Corrections: campaign@madgettformn.com.