S.Amdt. 694

SA 694. Mr. MORAN submitted an amendment intended to be proposed by
him to the bill S. 2226, to authorize appropriations for fiscal year
2024 for military activities of the Department of Defense, for military
construction, and for defense activities of the Department of Energy,
to prescribe military personnel strengths for such fiscal year, and for
other purposes; which was ordered to lie on the table; as follows:

At the appropriate place, insert the following:

SEC. ___. AGENCY USE OF ARTIFICIAL INTELLIGENCE.

(a) Definitions.--In this section:
(1) Administrator.--The term ``Administrator'' means the
Administrator of Federal Procurement Policy.
(2) Agency.--The term ``agency'' means any department,
independent establishment, Government corporation, or other
agency of the executive branch of the Federal Government.
(3) Artificial intelligence.--The term ``artificial
intelligence'' has the meaning given the term in section 5002
of the National Artificial Intelligence Initiative Act of
2020 (15 U.S.C. 9401).
(4) Director.--The term ``Director'' means the Director of
the National Institute of Standards and Technology.
(5) Framework.--The term ``framework'' means document
number NIST AI 100-1 of the National Institute of Standards
and Technology entitled ``Artificial Intelligence Risk
Management Framework'', or any successor document.
(6) Playbook.--The term ``playbook'' means the AI RMF
Playbook developed by the National Institute of Standards and
Technology.
(7) Profile.--The term ``profile'' means an implementation
of the artificial intelligence risk management functions,
categories, and subcategories for a specific setting or
application based on the requirements, risk tolerance, and
resources of the framework user.
(b) Requirements for Agency Use of Artificial
Intelligence.--
(1) In general.--Not later than 180 days after the date of
enactment of this Act, the Director, in consultation with the
Administrator, shall issue guidance for each agency to
incorporate the framework into the artificial intelligence
risk management efforts of the agency, which shall--
(A) recommend requirements consistent with the framework
and tailored to risks that could endanger human life, health,
property, or the environment for agency implementation in the
development, procurement, and use of artificial intelligence;
(B) specify appropriate cybersecurity strategies and the
installation of effective cybersecurity tools;
(C) recommend minimum standards--
(i) that are consistent with the framework and Circular A-
119 of the Office of Management and Budget;
(ii) that are tailored to risks that could endanger human
life, health, property, or the environment; and
(iii) which a supplier of artificial intelligence for the
agency must attest to meet before the head of an agency may
procure artificial intelligence from that supplier;
(D) provide draft contract language for each agency to use
in procurement that requires a supplier of artificial
intelligence to adhere to certain actions that are consistent
with the framework;
(E) provide a template for agency use on the guidance that
includes recommended procedures for implementation;
(F) provide specific recommendations, including exceptions,
consistent with the framework for an entity that is a small
business concern (as defined in section 3 of the Small
Business Act (15 U.S.C. 632));
(G) recommend training on the framework and the guidance
for each agency responsible for procuring artificial
intelligence; and
(H) develop profiles for agency use of artificial
intelligence consistent with the framework.
(2) Conforming requirement.--The head of each agency shall
conform any policy, principle, practice, procedure, or
guideline governing the design, development, implementation,
deployment, use, or evaluation of an artificial intelligence
system by the agency to the guidance issued under paragraph
(1).
(3) Supporting material.--In carrying out paragraph (2),
the head of each agency may use the supporting materials of
the framework, including the playbook.

[[Page S2800]]

(4) Study.--Not later than 1 year after the date of
enactment of this Act, the Comptroller General of the United
States shall conduct a study on the impact of the application
of the framework on agency use of artificial intelligence.
(5) Reporting requirement.--Not later than 1 year after the
date of the enactment of this Act, and not less frequently
than once every 3 years thereafter, the Director of the
Office of Management and Budget shall submit to Congress a
report on agency implementation of and conformity to the
framework.
(c) REQUIREMENTS FOR AGENCY PROCUREMENT OF ARTIFICIAL
INTELLIGENCE.--Not later than 180 days after the issuance of
guidance pursuant to subsection (b)(1), the Federal
Acquisition Regulatory Council shall promulgate regulations
that provide for--
(1) the requirements for the acquisition of artificial
intelligence products, services, tools, and systems, to
include risk-based compliance with the framework; and
(2) solicitation provisions and contract clauses that
include references to the requirements described in paragraph
(1) and the framework for use in artificial intelligence
acquisitions.
______