S. 3312Senate118th Congress (2023-2025)In Committee

Artificial Intelligence Research, Innovation, and Accountability Act of 2024

AI-Generated Summary

Updated January 20, 2026 at 1:09 PM UTC

The Artificial Intelligence Research, Innovation, and Accountability Act of 2024 creates a comprehensive framework for advancing AI research while ensuring transparency, safety, and accountability. It defines key AI terms, updates open‑data rules, and funds research on content provenance and detection of AI‑generated media. The bill imposes disclosure and reporting requirements on online platforms, high‑impact AI deployers, and critical‑impact AI organizations, establishes federal oversight guidelines, certification standards, and enforcement mechanisms, and launches a consumer‑education effort.

Key Provisions

Adds definitions for “artificial intelligence system,” “data model,” and related terms, and amends the federal open‑data policy to include AI‑generated data.
Directs the Under Secretary of Commerce for Standards and Technology to research and develop standards for digital content provenance, authenticity, and labeling of AI‑generated media, and to run a pilot program on these methods.
Amends NIST’s authority to require best‑practice standards for detecting AI‑generated outputs and anomalous AI behavior.
Orders the Comptroller General to study legal, regulatory and policy barriers to AI use in government and to recommend best practices.
Requires online platforms that use generative AI to give clear, conspicuous notice to users before they see AI‑generated content, with enforcement authority for the Secretary of Commerce.
Mandates that deployers of high‑impact AI systems submit annual transparency reports detailing system purpose, data, risk management, and safeguards; developers must provide supporting information.
Creates federal agency guidelines for oversight of high‑impact AI and obligates each covered agency to develop sector‑specific oversight plans.
Requires critical‑impact AI organizations to perform biennial risk‑management assessments, report findings to the Secretary, and certify compliance with TEVV (testing, evaluation, validation, verification) standards.
Establishes an AI Certification Advisory Committee and a three‑year plan for TEVV standards, with public comment and exemption processes.
Empowers the Secretary to impose civil penalties (up to $300,000 or twice the system’s value) and prohibitions for non‑compliance, and allows civil actions by the Attorney General.

Legislative Activity

Stay on top of the latest movement without scrolling through every action

4 earlier actions

SenateCalendars Latest Action

Placed on Senate Legislative Calendar under General Orders. Calendar No. 723.

December 18, 2024

View full timeline

SenateIntro Referral

Introduced in Senate

November 15, 2023

SenateIntro Referral

Read twice and referred to the Committee on Commerce, Science, and Transportation. (text: CR S5543-5549)

Commerce, Science, and Transportation Committee

November 15, 2023

SenateCommittee

Committee on Commerce, Science, and Transportation. Ordered to be reported with an amendment in the nature of a substitute favorably.

Commerce, Science, and Transportation Committee

July 31, 2024

SenateCommittee

Committee on Commerce, Science, and Transportation. Reported by Senator Cantwell with an amendment in the nature of a substitute. Without written report.

Commerce, Science, and Transportation Committee

December 18, 2024

SenateCalendars

Placed on Senate Legislative Calendar under General Orders. Calendar No. 723.

December 18, 2024

Floor Debate

3 members

What members said about S. 3312 on the floor

2 Republicans1 Democrat

Sen. Susan M. CollinsR-ME · Nov 15, 2023

Madam President, I rise to introduce the Supporting Seniors with Opioid Use Disorder Act with my colleague from Maryland, Senator Cardin. I very much appreciate his leadership on this issue. The…

Madam President, I rise to introduce the Supporting Seniors with Opioid Use Disorder Act with my colleague from Maryland, Senator Cardin. I very much appreciate his leadership on this issue. The United States is experiencing an opioid overdose and addiction crisis with devastating effects on communities across the country. The opioid epidemic is claiming the lives of far too many people, with a record 716 Mainers and nearly 110,000 Americans lost in 2022. While many perceive the face of opioid addiction as young, the epidemic harms older adults as well. In Maine, approximately 12 percent of drug overdose deaths last year were among residents age 60 and older.

Each and every opioid death is preventable, and more can be done to ensure that the unique needs of older Americans struggling with addiction are not forgotten. In December 2021, the Department of Health and Human Services Office of the Inspector General, OIG, identified an urgent need to increase the number of Medicare beneficiaries receiving treatment for opioid use disorder. The legislation we are introducing today would help improve seniors' awareness of, and access to, opioid use disorder, OUD, treatment covered by the Medicare Program.

The challenges of the pandemic, combined with the increased prevalence of fentanyl entering our country, have aggravated this national crisis. Even before COVID-19, however, the number of people age 55 or older treated in emergency rooms for nonfatal opioid overdoses was increasing, with a shocking 32 percent jump in ER visits from 2016 to 2017. In 2018, when I served as chairman of the Senate Special Committee on Aging, I chaired a hearing on this topic to shed light on the unique challenges faced by this often-overlooked population. One expert witness told the Aging Committee, ``Medicare beneficiaries are the fastest growing population of diagnosed opioid use disorders.'' Dr. Charles Pattavina, an emergency medicine physician in Bangor, ME, also explained how increased incidences of acute illnesses and injuries among older Americans make them more susceptible to opioid misuse.

In 2021, the Office of the Inspector General investigated the extent to which Medicare beneficiaries diagnosed with opioid use disorder received medication and behavioral therapy through Medicare. The report found that more than 1 million Medicare beneficiaries were diagnosed with OUD in 2020, yet fewer than 16 percent of those patients received medication to treat their OUD. The report also concluded that older beneficiaries were three times less likely to receive medication to treat their OUD than younger beneficiaries. Even fewer beneficiaries received both medication and behavioral therapy. The conclusion was clear: Medicare beneficiaries are not receiving the OUD treatment they need.

A followup OIG report from September 2022 revealed that the situation has largely failed to improve over time. About 50,400 Part D beneficiaries experienced an opioid overdose--from prescription opioids, illicit opioids, or both--during 2021. While the overall proportion of beneficiaries with opioid use disorder receiving medication increased slightly from 16 percent in 2020 to 18 percent in 2021, still fewer than one in five Medicare beneficiaries received the medication they need. This report echoed the call to implement the 2021 OIG recommendations.

The Supporting Seniors with Opioid Use Disorder Act would put into law the recommendations made by the HHS OIG regarding how to improve beneficiaries' awareness of Medicare coverage for OUD treatment and how to identify gaps and opportunities to better meet the needs of this unique population. Specifically, our legislation would require CMS to conduct additional outreach to beneficiaries to increase awareness about Medicare coverage for the treatment of OUD, such as by revising enrollment materials, making State and national contact information for healthcare providers publicly available and easily accessible, and developing or improving continuing education programs about opioid medications and substance use disorder treatment programs. Our bill would also improve data sharing within Agencies at HHS with the goal of obtaining a better understanding of current treatment gaps.

Finally, the bill would require HHS to convene a stakeholder meeting to share best practices on the use of behavioral therapy among beneficiaries receiving medication to treat opioid use disorder. Emerging research points to evidence that patients receiving medication to treat opioid use disorder may also benefit from behavioral therapy, so this opportunity for collaboration on strategies to support better treatment engagement and continuity could be beneficial to both patients and healthcare professionals.

The drug crisis continues to ravage our country, and it is critical that people who are suffering from opioid use disorder have access to the treatment they need to survive and thrive--including our seniors. Challenges in treatment and recovery will persist, but we can begin by better supporting older Americans' access to opioid use disorder services and by strengthening our understanding of potential disparities in treatment. I urge my colleagues to support this important legislation.

Sen. John ThuneR-SD · Nov 15, 2023

Madam President, I ask unanimous consent that the text of the bill be printed in the Record.

Sen. Richard J. DurbinD-IL · Nov 15, 2023

Madam President, I ask unanimous consent that the text of the bill be printed in the Record.

Sen. John ThuneR-SD · Nov 15, 2023

Madam President, I ask unanimous consent that the text of the bill be printed in the Record.

Bill Text

2 versions available

Reading Mode

Raw Text PDF XML

Reported to SenateIssued December 18, 2024

Calendar No. 723

118th CONGRESS

2d Session

S. 3312

IN THE SENATE OF THE UNITED STATES

November 15, 2023

Mr. Thune (for himself, Ms. Klobuchar, Mr. Wicker, Mr. Hickenlooper, Mr. Luján, Mrs. Capito, Ms. Baldwin, and Ms. Lummis) introduced the following bill; which was read twice and referred to the Committee on Commerce, Science, and Transportation

December 18 (legislative day, December 16), 2024

Reported by Ms. Cantwell, with an amendment

Strike out all after the enacting clause and insert the part printed in italic

A BILL

To provide a framework for artificial intelligence innovation and accountability, and for other purposes.

Short title

This Act may be cited as the Artificial Intelligence Research, Innovation, and Accountability Act of 2023.

Table of contents

The table of contents for this Act is as follows:

Sec. 1. Short title.

Sec. 2. Table of contents.

TITLE I—Artificial intelligence research and innovation

Sec. 101. Open data policy amendments.

Sec. 102. Online content authenticity and provenance standards research and development.

Sec. 103. Standards for detection of emergent and anomalous behavior and AI-generated media.

Sec. 104. Comptroller General study on barriers and best practices to usage of AI in government.

TITLE II—Artificial intelligence accountability

Sec. 201. Definitions.

Sec. 202. Generative artificial intelligence transparency.

Sec. 203. Transparency reports for high-impact artificial intelligence systems.

Sec. 204. Recommendations to Federal agencies for risk management of high-impact artificial intelligence systems.

Sec. 205. Office of Management and Budget oversight of recommendations to agencies.

Sec. 206. Risk management assessment for critical-impact artificial intelligence systems.

Sec. 207. Certification of critical-impact artificial intelligence systems.

Sec. 208. Enforcement.

Sec. 209. Artificial intelligence consumer education.

Artificial intelligence research and innovation

101.

Open data policy amendments

Section 3502 of title 44, United States Code, is amended—

(1)

in paragraph (22)—

(A)

by inserting or data model after a data asset; and

(B)

by striking and at the end;

(2)

in paragraph (23), by striking the period at the end and inserting a semicolon; and

(3)

by adding at the end the following:

(24)

the term data model means a mathematical, economic, or statistical representation of a system or process used to assist in making calculations and predictions, including through the use of algorithms, computer programs, or artificial intelligence systems; and

(25)

the term artificial intelligence system means an engineered system that—

(A)

generates outputs, such as content, predictions, recommendations, or decisions for a given set of objectives; and

(B)

is designed to operate with varying levels of adaptability and autonomy using machine and human-based inputs.

102.

Online content authenticity and provenance standards research and development

(a)

Research

(1)

In general

Not later than 180 days after the date of the enactment of this Act, the Under Secretary of Commerce for Standards and Technology shall carry out research to facilitate the development and standardization of means to provide authenticity and provenance information for content generated by human authors and artificial intelligence systems.

(2)

Elements

The research carried out pursuant to paragraph (1) shall cover the following:

(A)

Secure and binding methods for human authors of content to append statements of provenance through the use of unique credentials, watermarking, or other data or metadata-based approaches.

(B)

Methods for the verification of statements of content provenance to ensure authenticity such as watermarking or classifiers, which are trained models that distinguish artificial intelligence-generated media.

(C)

Methods for displaying clear and conspicuous statements of content provenance to the end user.

(D)

Technologies or applications needed to facilitate the creation and verification of content provenance information.

(E)

Mechanisms to ensure that any technologies and methods developed under this section are minimally burdensome on content producers.

(F)

Such other related processes, technologies, or applications as the Under Secretary considers appropriate.

(G)

Use of provenance technology to enable attribution for content creators.

(3)

Implementation

The Under Secretary shall carry out the research required by paragraph (1) as part of the research directives pursuant to section 22A(b)(1) of the National Institute of Standards and Technology Act (15 U.S.C. 278h–1(b)(1)).

(b)

Development of standards

(1)

In general

For methodologies and applications related to content provenance and authenticity deemed by the Under Secretary to be at a readiness level sufficient for standardization, the Under Secretary shall provide technical review and assistance to such other Federal agencies and nongovernmental standards organizations as the Under Secretary considers appropriate.

(2)

Considerations

In providing any technical review and assistance related to the development of content provenance and authenticity standards under this subsection, the Under Secretary may—

(A)

consider whether a proposed standard is reasonable, practicable, and appropriate for the particular type of media and media environment for which the standard is proposed;

(B)

consult with relevant stakeholders; and

(C)

review industry standards issued by nongovernmental standards organizations.

(c)

Pilot program

(1)

In general

The Under Secretary shall carry out a pilot program to assess the feasibility and advisability of using available technologies and creating open standards to facilitate the creation and verification of content governance information for digital content.

(2)

Locations

The pilot program required by paragraph (1) shall be carried out at not more than 2 Federal agencies the Under Secretary shall select for purposes of the pilot program required by paragraph (1).

(3)

Requirements

In carrying out the pilot program required by paragraph (1), the Under Secretary shall—

(A)

apply and evaluate methods for authenticating the origin of and modifications to government-produced digital content using technology and open standards described in paragraph (1); and

(B)

make available to the public digital content embedded with provenance or other authentication provided by the heads of the Federal agencies selected pursuant to paragraph (2) for the purposes of the pilot program.

(4)

Briefing required

Not later than 1 year after the date of the enactment of this Act, and annually thereafter until the date described in paragraph (5), the Under Secretary shall brief the Committee on Commerce, Science, and Transportation of the Senate and the Committee on Science, Space, and Technology of the House of Representatives on the findings of the Under Secretary with respect to the pilot program carried out under this subsection.

(5)

Termination

The pilot program shall terminate on the date that is 10 years after the date of the enactment of this Act.

(d)

Report to Congress

Not later than 1 year after the date of the enactment of this Act, the Under Secretary shall submit to the Committee on Commerce, Science, and Transportation of the Senate and the Committee on Science, Space, and Technology of the House of Representatives a report outlining the progress of standardization initiatives relating to requirements under this section, as well as recommendations for legislative or administrative action to encourage or require the widespread adoption of such initiatives in the United States.

103.

Standards for detection of emergent and anomalous behavior and AI-generated media

Section 22A(b)(1) of the National Institute of Standards and Technology Act (15 U.S.C. 278h–1(b)(1)) is amended—

(1)

by redesignating subparagraph (I) as subparagraph (K);

(2)

in subparagraph (H), by striking ; and and inserting a semicolon; and

(3)

by inserting after subparagraph (H) the following:

(I)

best practices for detecting outputs generated by artificial intelligence systems, including content such as text, audio, images, and videos;

(J)

methods to detect and understand anomalous behavior of artificial intelligence systems and safeguards to mitigate potentially adversarial or compromising anomalous behavior; and

104.

Comptroller General study on barriers and best practices to usage of AI in government

(a)

In general

Not later than 1 year after the date of enactment of this Act, the Comptroller General of the United States shall—

(1)

conduct a review of statutory, regulatory, and other policy barriers to the use of artificial intelligence systems to improve the functionality of the Federal Government; and

(2)

identify best practices for the adoption and use of artificial intelligence systems by the Federal Government, including—

(A)

ensuring that an artificial intelligence system is proportional to the need of the Federal Government;

(B)

restrictions on access to and use of an artificial intelligence system based on the capabilities and risks of the artificial intelligence system; and

(C)

safety measures that ensure that an artificial intelligence system is appropriately limited to necessary data and compartmentalized from other assets of the Federal Government.

(b)

Report

Not later than 2 years after the date of enactment of this Act, the Comptroller General of the United States shall submit to the Committee on Commerce, Science, and Transportation of the Senate and the Committee on Science, Space, and Technology of the House of Representatives a report that—

(1)

summarizes the results of the review conducted under subsection (a)(1) and the best practices identified under subsection (a)(2), including recommendations, as the Comptroller General of the United States considers appropriate;

(2)

describes any laws, regulations, guidance documents, or other policies that may prevent the adoption of artificial intelligence systems by the Federal Government to improve certain functions of the Federal Government, including—

(A)

data analysis and processing;

(B)

paperwork reduction;

(C)

contracting and procurement practices; and

(D)

other Federal Government services; and

(3)

includes, as the Comptroller General of the United States considers appropriate, recommendations to modify or eliminate barriers to the use of artificial intelligence systems by the Federal Government.

Artificial intelligence accountability

201.

Definitions

In this title:

(1)

Appropriate congressional committees

The term appropriate congressional committees means—

(A)

the Committee on Energy and Natural Resources and the Committee on Commerce, Science, and Transportation of the Senate;

(B)

the Committee on Energy and Commerce of the House of Representatives; and

(C)

each congressional committee with jurisdiction over an applicable covered agency.

(2)

Artificial intelligence system

The term artificial intelligence system means an engineered system that—

(A)

generates outputs, such as content, predictions, recommendations, or decisions for a given set of human-defined objectives; and

(B)

is designed to operate with varying levels of adaptability and autonomy using machine and human-based inputs.

(3)

Covered agency

the term covered agency means an agency for which the Under Secretary develops an NIST recommendation.

(4)

Covered internet platform

(A)

In general

The term covered internet platform—

(i)

means any public-facing website, consumer-facing internet application, or mobile application available to consumers in the United States; and

(ii)

includes a social network site, video sharing service, search engine, and content aggregation service.

(B)

Exclusions

The term covered internet platform does not include a platform that—

(i)

is wholly owned, controlled, and operated by a person that—

(I)

during the most recent 180-day period, did not employ more than 500 employees;

(II)

during the most recent 3-year period, averaged less than $50,000,000 in annual gross receipts; and

(III)

on an annual basis, collects or processes the personal data of less than 1,000,000 individuals; or

(ii)

is operated for the sole purpose of conducting research that is not directly or indirectly made for profit.

(5)

Critical-impact AI organization

The term critical-impact AI organization means a non-government organization that serves as the deployer of a critical-impact artificial intelligence system.

(6)

Critical-impact artificial intelligence system

The term critical-impact artificial intelligence system means an artificial intelligence system that—

(A)

is deployed for a purpose other than solely for use by the Department of Defense or an intelligence agency (as defined in section 3094(e) of the National Security Act of 1947 (50 U.S.C. 3094(3))); and

(B)

is used or intended to be used—

(i)

to make decisions that have a legal or similarly significant effect on—

(I)

the real-time or ex post facto collection of biometric data of natural persons by biometric identification systems without their consent;

(II)

the direct management and operation of critical infrastructure (as defined in section 1016(e) of the USA PATRIOT Act (42 U.S.C. 5195c(e))) and space-based infrastructure; or

(III)

criminal justice (as defined in section 901 of title I of the Omnibus Crime Control and Safe Streets Act of 1968 (34 U.S.C. 10251)); and

(ii)

in a manner that poses a significant risk to rights afforded under the Constitution of the United States or safety.

(7)

Deployer

The term deployer—

(A)

means an entity that uses or operates an artificial intelligence system for internal use or for use by third parties; and

(B)

does not include an entity that is solely an end user of a system.

(8)

Developer

The term developer means an entity that—

(A)

designs, codes, produces, or owns an artificial intelligence system for internal use or for use by a third party as a baseline model; and

(B)

does not act as a deployer of the artificial intelligence system described in subparagraph (A).

(9)

Generative artificial intelligence system

The term generative artificial intelligence system means an artificial intelligence system that generates novel data or content in a written, audio, or visual format.

(10)

High-impact artificial intelligence system

The term high-impact artificial intelligence system means an artificial intelligence system—

(A)

deployed for a purpose other than solely for use by the Department of Defense or an intelligence agency (as defined in section 3094(e) of the National Security Act of 1947 (50 U.S.C. 3094(3))); and

(B)

that is specifically developed with the intended purpose of making decisions that have a legal or similarly significant effect on the access of an individual to housing, employment, credit, education, healthcare, or insurance in a manner that poses a significant risk to rights afforded under the Constitution of the United States or safety.

(11)

NIST recommendation

The term NIST recommendation means a sector-specific recommendation developed under section 22B(b)(1) of the National Institute of Standards and Technology Act, as added by section 204 of this Act.

(12)

Secretary

The term Secretary means the Secretary of Commerce.

(13)

Significant risk

The term significant risk means a combination of severe, high-intensity, high-probability, and long-duration risk of harm to individuals.

(14)

TEVV

The term TEVV means the testing, evaluation, validation, and verification of any artificial intelligence system that includes—

(A)

open, transparent, testable, and verifiable specifications that characterize realistic operational performance, such as precision and accuracy for relevant tasks;

(B)

testing methodologies and metrics that enable the evaluation of system trustworthiness, including robustness and resilience;

(C)

data quality standards for training and testing datasets;

(D)

requirements for system validation and integration into production environments, automated testing, and compliance with existing legal and regulatory specifications;

(E)

methods and tools for—

(i)

the monitoring of system behavior;

(ii)

the tracking of incidents or errors reported and their management; and

(iii)

the detection of emergent properties and related impacts; and

(F)

and processes for redress and response.

(15)

Under Secretary

The term Under Secretary means the Director of the National Institute of Standards and Technology.

202.

Generative artificial intelligence transparency

(a)

Prohibition

(1)

In general

Subject to paragraph (2), it shall be unlawful for a person to operate a covered internet platform that uses a generative artificial intelligence system.

(2)

Disclosure of use of generative artificial intelligence systems

(A)

In general

A person may operate a covered internet platform that uses a generative artificial intelligence system if the person provides notice to each user of the covered internet platform that the covered internet platform uses a generative artificial intelligence system to generate content the user sees.

(B)

Requirements

A person providing the notice described in subparagraph (A) to a user—

(i)

subject to clause (ii), shall provide the notice in a clear and conspicuous manner on the covered internet platform before the user interacts with content produced by a generative artificial intelligence system; and

(ii)

may provide an option for the user to choose to see the notice described in clause (i) only upon the first interaction of the user with content produced by a generative artificial intelligence system.

(b)

Enforcement action

Upon learning that a covered internet platform does not comply with the requirements under this section, the Secretary—

(1)

shall immediately—

(A)

notify the covered internet platform of the finding; and

(B)

order the covered internet platform to take remedial action to address the noncompliance of the generative artificial intelligence system operated by the covered internet platform; and

(2)

may, as determined appropriate or necessary by the Secretary, take enforcement action under section 208 if the covered internet platform does not take sufficient action to remedy the noncompliance within 15 days of the notification under paragraph (1)(A).

(c)

Effective date

This section shall take effect on the date that is 180 days after the date of enactment of this Act.

203.

Transparency reports for high-impact artificial intelligence systems

(a)

Transparency reporting

(1)

In general

Each deployer of a high-impact artificial intelligence system shall—

(A)

before deploying the high-impact artificial intelligence system, and annually thereafter, submit to the Secretary a report describing the design and safety plans for the artificial intelligence system; and

(B)

submit to the Secretary an updated report on the high-impact artificial intelligence system if the deployer makes a material change to—

(i)

the purpose for which the high-impact artificial intelligence system is used; or

(ii)

the type of data the high-impact artificial intelligence system processes or uses for training purposes.

(2)

Contents

Each transparency report submitted under paragraph (1) shall include, with respect to the high-impact artificial intelligence system—

(A)

the purpose;

(B)

the intended use cases;

(C)

deployment context;

(D)

benefits;

(E)

a description of data that the high-impact artificial intelligence system, once deployed, processes as inputs;

(F)

if available—

(i)

a list of data categories and formats the deployer used to retrain or continue training the high-impact artificial intelligence system;

(ii)

metrics for evaluating the high-impact artificial intelligence system performance and known limitations; and

(iii)

transparency measures, including information identifying to individuals when a high-impact artificial intelligence system is in use;

(G)

processes and testing performed before each deployment to ensure the high-impact artificial intelligence system is safe, reliable, and effective;

(H)

if applicable, an identification of any third-party artificial intelligence systems or datasets the deployer relies on to train or operate the high-impact artificial intelligence system; and

(I)

post-deployment monitoring and user safeguards, including a description of the oversight process in place to address issues as issues arise.

(b)

Developer obligations

The developer of a high-impact artificial intelligence system shall be subject to the same obligations as a developer of a critical impact artificial intelligence system under section 206(c).

(c)

Considerations

In carrying out subsections (a) and (b), a deployer or developer of a high-impact artificial intelligence system shall consider the best practices outlined in the most recent version of the risk management framework developed pursuant to section 22A(c) of the National Institute of Standards and Technology Act (15 U.S.C. 278h–1(c)).

(d)

Noncompliance and enforcement action

Upon learning that a deployer of a high-impact artificial intelligence system is not in compliance with the requirements under this section with respect to a high-impact artificial intelligence system, the Secretary—

(1)

shall immediately—

(A)

notify the deployer of the finding; and

(B)

order the deployer to immediately submit to the Secretary the report required under subsection (a)(1); and

(2)

if the deployer fails to submit the report by the date that is 15 days after the date of the notification under paragraph (1)(A), may take enforcement action under section 208.

(e)

Avoidance of duplication

(1)

In general

Pursuant to the deconfliction of duplicative requirements under paragraph (2), the Secretary shall ensure that the requirements under this section are not unnecessarily burdensome or duplicative of requirements made or oversight conducted by a covered agency regarding the non-Federal use of high-impact artificial intelligence systems.

(2)

Deconfliction of duplicative requirements

Not later than 90 days after the date of the enactment of this Act, and annually thereafter, the Secretary, in coordination with the head of any relevant covered agency, shall complete the deconfliction of duplicative requirements relating to the submission of a transparency report for a high-impact artificial intelligence system under this section.

(f)

Rule of construction

Nothing in this section shall be construed to require a deployer of a high-impact artificial intelligence system to disclose any information, including data or algorithms—

(1)

relating to a trade secret or other protected intellectual property right;

(2)

that is confidential business information; or

(3)

that is privileged.

204.

Recommendations to Federal agencies for risk management of high-impact artificial intelligence systems

The National Institute of Standards and Technology Act (15 U.S.C. 278h–1) is amended by inserting after section 22A the following:

22B.

Recommendations to Federal agencies for sector-specific oversight of artificial intelligence

(a)

Definition of high-Impact artificial intelligence system

In this section, the term high-impact artificial intelligence system means an artificial intelligence system—

(1)

deployed for purposes other than those solely for use by the Department of Defense or an element of the intelligence community (as defined in section 3 of the National Security Act of 1947 (50 U.S.C. 3003)); and

(2)

that is specifically developed with the intended purpose of making decisions that have a legal or similarly significant effect on the access of an individual to housing, employment, credit, education, health care, or insurance in a manner that poses a significant risk to rights afforded under the Constitution of the United States or to safety.

(b)

Sector-Specific recommendations

Not later than 1 year after the date of the enactment of the Artificial Intelligence Research, Innovation, and Accountability Act of 2023, the Director shall—

(1)

develop sector-specific recommendations for individual Federal agencies to conduct oversight of the non-Federal, and, as appropriate, Federal use of high-impact artificial intelligence systems to improve the safe and responsible use of such systems; and

(2)

not less frequently than biennially, update the sector-specific recommendations to account for changes in technological capabilities or artificial intelligence use cases.

(c)

Requirements

In developing recommendations under subsection (b), the Director shall use the voluntary risk management framework required by section 22A(c) to identify and provide recommendations to a Federal agency—

(1)

to establish regulations, standards, guidelines, best practices, methodologies, procedures, or processes to facilitate oversight of non-Federal use of high-impact artificial intelligence systems; and

(2)

to mitigate risks from such high-impact artificial intelligence systems.

(d)

Recommendations

In developing recommendations under subsection (b), the Director may include the following:

(1)

Key design choices made during high-impact artificial intelligence model development, including rationale and assumptions made.

(2)

Intended use and users, other possible use cases, including any anticipated undesirable or potentially harmful use cases, and what good faith efforts model developers can take to mitigate the use of the system in harmful ways.

(3)

Methods for evaluating the safety of high-impact artificial intelligence systems and approaches for responsible use.

(4)

Sector-specific differences in what constitutes acceptable high-impact artificial intelligence model functionality and trustworthiness, metrics used to determine high-impact artificial intelligence model performance, and any test results reflecting application of these metrics to evaluate high-impact artificial intelligence model performance across different sectors.

(5)

Recommendations to support iterative development of subsequent recommendations under subsection (b).

(e)

Consultation

In developing recommendations under subsection (b), the Director shall, as the Director considers applicable and practicable, consult with relevant covered agencies and stakeholders representing perspectives from civil society, academia, technologists, engineers, and creators.

205.

Office of Management and Budget oversight of recommendations to agencies

(a)

Recommendations

(1)

In general

Not later than 1 year after the date of enactment of this Act, the Under Secretary shall submit to the Director, the head of each covered agency, and the appropriate congressional committees each NIST recommendation.

(2)

Agency responses to recommendations

Not later than 90 days after the date on which the Under Secretary submits a NIST recommendation to the head of a covered agency under paragraph (1), the head of the covered agency shall transmit to the Director a formal written response to the NIST recommendation that—

(A)

indicates whether the head of the covered agency intends to—

(i)

carry out procedures to adopt the complete NIST recommendation;

(ii)

carry out procedures to adopt a part of the NIST recommendation; or

(iii)

refuse to carry out procedures to adopt the NIST recommendation; and

(B)

includes—

(i)

with respect to a formal written response described in clause (i) or (ii) of subparagraph (A), a copy of a proposed timetable for completing the procedures described in that clause;

(ii)

with respect to a formal written response described in subparagraph (A)(ii), the reasons for the refusal to carry out procedures with respect to the remainder of the NIST recommendation described in that subparagraph; and

(iii)

with respect to a formal written response described in subparagraph (A)(iii), the reasons for the refusal to carry out procedures.

(b)

Public availability

The Director shall make a copy of each NIST recommendation and each written formal response of a covered agency required under subsection (a)(2) available to the public at reasonable cost.

(c)

Reporting requirements

(1)

Annual secretarial regulatory status reports

(A)

In general

On the first February 1 occurring after the date of enactment of this Act, and annually thereafter until the date described in subparagraph (B), the head of each covered agency shall submit to the Director a report containing the regulatory status of each NIST recommendation.

(B)

Continued reporting

The date described in this subparagraph is the date on which the head of a covered agency—

(i)

takes final regulatory action with respect to a NIST recommendation; and

(ii)

determines and states in a report required under subparagraph (A) that no regulatory action should be taken with respect to a NIST recommendation.

(2)

Compliance report to Congress

On April 1 of each year, the Director shall—

(A)

review the reports received under paragraph (1)(A); and

(B)

transmit comments on the reports to the heads of covered agencies and the appropriate congressional committees.

(3)

Failure to report

If, on March 1 of each year, the Director has not received a report required under paragraph (1)(A) from the head of a covered agency, the Director shall notify the appropriate congressional committees of the failure.

(d)

Technical assistance in carrying out recommendations

The Under Secretary shall provide assistance to the heads of covered agencies relating to the implementation of the NIST recommendations the heads of covered agencies intend to carry out.

(e)

Regulation review and improvement

The Administrator of the Office of Information and Regulatory Affairs of the Office of Management and Budget, in consultation with the Under Secretary, shall develop and periodically revise performance indicators and measures for sector-specific regulation of artificial intelligence.

206.

Risk management assessment for critical-impact artificial intelligence systems

(a)

Requirement

(1)

In general

Each critical-impact AI organization shall perform a risk management assessment in accordance with this section.

(2)

Assessment

Each critical-impact AI organization shall—

(A)

not later than 30 days before the date on which a critical-impact artificial intelligence system is made publicly available by the critical-impact AI organization, perform a risk management assessment; and

(B)

not less frequently than biennially during the period beginning on the date of enactment of this Act and ending on the date on which the applicable critical-impact artificial intelligence system is no longer being made publicly available by the critical-impact AI organization, as applicable, conduct an updated risk management assessment that—

(i)

may find that no significant changes were made to the critical-impact artificial intelligence system; and

(ii)

provides, to the extent practicable, aggregate results of any significant deviation from expected performance detailed in the assessment performed under subparagraph (A) or the most recent assessment performed under this subparagraph.

(3)

Review

(A)

In general

Not later than 90 days after the date of completion of a risk management assessment by a critical-impact AI organization under this section, the critical-impact AI organization shall submit to the Secretary a report—

(i)

outlining the assessment performed under this section; and

(ii)

that is in a consistent format, as determined by the Secretary.

(B)

Additional information

Subject to subsection (d), the Secretary may request that a critical-impact AI organization submit to the Secretary any related additional or clarifying information with respect to a risk management assessment performed under this section.

(4)

Limitation

The Secretary may not prohibit a critical-impact AI organization from making a critical-impact artificial intelligence system available to the public based on the review by the Secretary of a report submitted under paragraph (3)(A) or additional or clarifying information submitted under paragraph (3)(B).

(b)

Assessment subject areas

Each assessment performed by a critical-impact AI organization under subsection (a) shall describe the means by which the critical-impact AI organization is addressing, through a documented TEVV process, the following categories:

(1)

Policies, processes, procedures, and practices across the organization relating to transparent and effective mapping, measuring, and managing of artificial intelligence risks, including—

(A)

how the organization understands, manages, and documents legal and regulatory requirements involving artificial intelligence;

(B)

how the organization integrates characteristics of trustworthy artificial intelligence, which include valid, reliable, safe, secure, resilient, accountable, transparent, globally and locally explainable, interpretable, privacy-enhanced, and fair with harmful bias managed, into organizational policies, processes, procedures, and practices;

(C)

a methodology to determine the needed level of risk management activities based on the organization’s risk tolerance; and

(D)

how the organization establishes risk management processes and outcomes through transparent policies, procedures, and other controls based on organizational risk priorities.

(2)

The structure, context, and capabilities of the critical-impact artificial intelligence system or critical-impact foundation model, including—

(A)

how the context was established and understood;

(B)

capabilities, targeted uses, goals, and expected costs and benefits; and

(C)

how risks and benefits are mapped for each system component.

(3)

A description of how the organization employs quantitative, qualitative, or mixed-method tools, techniques, and methodologies to analyze, assess, benchmark, and monitor artificial intelligence risk, including—

(A)

identification of appropriate methods and metrics;

(B)

how artificial intelligence systems are evaluated for trustworthy characteristics;

(C)

mechanisms for tracking artificial intelligence system risks over time; and

(D)

processes for gathering and assessing feedback relating to the efficacy of measurement.

(4)

A description of allocation of risk resources to map and measure risks on a regular basis as described in paragraph (1), including—

(A)

how artificial intelligence risks based on assessments and other analytical outputs described in paragraphs (2) and (3) are prioritized, responded to, and managed;

(B)

how strategies to maximize artificial intelligence benefits and minimize negative impacts were planned, prepared, implemented, documented, and informed by input from relevant artificial intelligence deployers;

(C)

management of artificial intelligence system risks and benefits; and

(D)

regular monitoring of risk treatments, including response and recovery, and communication plans for the identified and measured artificial intelligence risks, as applicable.

(c)

Developer obligations

The developer of a critical-impact artificial intelligence system that agrees through a contract or license to provide technology or services to a deployer of the critical-impact artificial intelligence system shall provide to the deployer of the critical-impact artificial intelligence system the information reasonably necessary for the deployer to comply with the requirements under subsection (a), including—

(1)

an overview of the data used in training the baseline artificial intelligence system provided by the developer, including—

(A)

data size;

(B)

data sources;

(C)

copyrighted data; and

(D)

personal identifiable information;

(2)

documentation outlining the structure and context of the baseline artificial intelligence system of the developer, including—

(A)

input modality;

(B)

output modality;

(C)

model size; and

(D)

model architecture;

(3)

known capabilities, limitations, and risks of the baseline artificial intelligence system of the developer at the time of the development of the artificial intelligence system; and

(4)

documentation for downstream use, including—

(A)

a statement of intended purpose;

(B)

guidelines for the intended use of the artificial intelligence system, including a list of permitted, restricted, and prohibited uses and users; and

(C)

a statement of the potential for deviation from the intended purpose of the baseline artificial intelligence system.

(d)

Termination of obligation To disclose information

(1)

In general

The obligation of a critical-impact AI organization to provide information, upon request of the Secretary, relating to a specific assessment category under subsection (b) shall end on the date of issuance of a relevant standard applicable to the same category of a critical-impact artificial intelligence system by—

(A)

the Secretary under section 207(c) with respect to a critical-impact artificial intelligence system;

(B)

another department or agency of the Federal Government, as determined applicable by the Secretary; or

(C)

a non-governmental standards organization, as determined appropriate by the Secretary.

(2)

Effect of new standard

In adopting any standard applicable to critical-impact artificial intelligence systems under section 207(c), the Secretary shall—

(A)

identify the category under subsection (b) to which the standard relates, if any; and

(B)

specify the information that is no longer required to be included in a report required under subsection (a) as a result of the new standard.

(e)

Rule of construction

Nothing in this section shall be construed to require a critical-impact AI organization, or permit the Secretary, to disclose any information, including data or algorithms—

(1)

relating to a trade secret or other protected intellectual property right;

(2)

that is confidential business information; or

(3)

that is privileged.

207.

Certification of critical-impact artificial intelligence systems

(a)

Establishment of Artificial Intelligence Certification Advisory Committee

(1)

In general

Not later than 180 days after the date of enactment of this Act, the Secretary shall establish an advisory committee to provide advice and recommendations on TEVV standards and the certification of critical-impact artificial intelligence systems.

(2)

Duties

The advisory committee established under this section shall advise the Secretary on matters relating to the testing and certification of critical-impact artificial intelligence systems, including by—

(A)

providing recommendations to the Secretary on proposed TEVV standards to ensure such standards—

(i)

maximize alignment and interoperability with standards issued by nongovernmental standards organizations and international standards bodies;

(ii)

are performance-based and impact-based; and

(iii)

are applicable or necessary to facilitate the deployment of critical-impact artificial intelligence systems in a transparent, secure, and safe manner;

(B)

reviewing prospective TEVV standards submitted by the Secretary to ensure such standards align with recommendations under subparagraph (A);

(C)

upon completion of the review under subparagraph (B), providing consensus recommendations to the Secretary on—

(i)

whether a TEVV standard should be issued, modified, revoked, or added; and

(ii)

if such a standard should be issued, how best to align the standard with the considerations described in subsection (c)(2) and recommendations described in subparagraph (A); and

(D)

reviewing and providing advice and recommendations on the plan and subsequent updates to the plan submitted under subsection (b).

(3)

Composition

The advisory committee established under this subsection shall be composed of not more than 15 members with a balanced composition of representatives of the private sector, institutions of higher education, and non-profit organizations, including—

(A)

representatives of—

(i)

institutions of higher education;

(ii)

companies developing or operating artificial intelligence systems;

(iii)

consumers or consumer advocacy groups; and

(iv)

enabling technology companies; and

(B)

any other members the Secretary considers to be appropriate.

(b)

Artificial intelligence certification plan

(1)

In general

Not later than 1 year after the date of enactment of this Act, the Secretary shall establish a 3-year implementation plan for the certification of critical-impact artificial intelligence systems.

(2)

Periodic update

The Secretary shall periodically update the plan established under paragraph (1).

(3)

Contents

The plan established under paragraph (1) shall include—

(A)

a methodology for gathering and using relevant, objective, and available information relating to TEVV;

(B)

a process for considering whether prescribing certain TEVV standards under subsection (c) for critical-impact artificial intelligence systems is appropriate, necessary, or duplicative of existing international standards;

(C)

if TEVV standards are considered appropriate, a process for prescribing such standards for critical-impact artificial intelligence systems; and

(D)

an outline of standards proposed to be issued, including an estimation of the timeline and sequencing of such standards.

(4)

Consultation

In developing the plan required under paragraph (1), the Secretary shall consult the following:

(A)

The National Artificial Intelligence Initiative Office.

(B)

The interagency committee established under section 5103 of the National Artificial Intelligence Initiative Act of 2020 (15 U.S.C. 9413).

(C)

The National Artificial Intelligence Advisory Committee.

(D)

Industry consensus standards issued by non-governmental standards organizations.

(E)

Other departments, agencies, and instrumentalities of the Federal Government, as considered appropriate by the Secretary.

(5)

Submission to certification advisory committee

Upon completing the initial plan required under this subsection and upon completing periodic updates to the plan under paragraph (2), the Secretary shall submit the plan to the advisory committee established under subsection (a) for review.

(6)

Submission to committees of congress

Upon completing the plan required under this subsection, the Secretary shall submit to the relevant committees of Congress a report containing the plan.

(7)

Limitation

The Secretary may not issue TEVV standards under subsection (c) until the date of the submission of the plan under paragraphs (5) and (6).

(c)

Standards

(1)

Standards

(A)

In general

The Secretary shall issue TEVV standards for critical-impact artificial intelligence systems.

(B)

Requirements

Each standard issued under this subsection shall—

(i)

be practicable;

(ii)

meet the need for safe, secure, and transparent operations of critical-impact artificial intelligence systems;

(iii)

with respect to a relevant standard issued by a non-governmental standards organization that is already in place, align with and be interoperable with that standard;

(iv)

provide for a mechanism to, not less frequently than once every 2 years, solicit public comment and update the standard to reflect advancements in technology and system architecture; and

(v)

be stated in objective terms.

(2)

Considerations

In issuing TEVV standards for critical-impact artificial intelligence systems under this subsection, the Secretary shall—

(A)

consider relevant available information concerning critical-impact artificial intelligence systems, including—

(i)

transparency reports submitted under section 203(a);

(ii)

risk management assessments conducted under section 206(a); and

(iii)

any additional information provided to the Secretary pursuant to section 203(a)(1)(B);

(B)

consider whether a proposed standard is reasonable, practicable, and appropriate for the particular type of critical-impact artificial intelligence system for which the standard is proposed;

(C)

consult with relevant artificial intelligence stakeholders and review industry standards issued by nongovernmental standards organizations;

(D)

pursuant to paragraph (1)(B)(iii), consider whether adoption of a relevant standard issued by a nongovernmental standards organization as a TEVV standard is the most appropriate action; and

(E)

consider whether the standard takes into account—

(i)

transparent, replicable, and objective assessments of critical-impact artificial intelligence system risk, structure, capabilities, and design;

(ii)

the risk posed to the public by an applicable critical-impact artificial intelligence system; and

(iii)

the diversity of methodologies and innovative technologies and approaches available to meet the objectives of the standard.

(3)

Consultation

Before finalizing a TEVV standard issued under this subsection, the Secretary shall submit the TEVV standard to the advisory committee established under subsection (a) for review.

(4)

Public comment

Before issuing any TEVV standard under this subsection, the Secretary shall provide an opportunity for public comment.

(5)

Cooperation

In developing a TEVV standard under this subsection, the Secretary may, as determined appropriate, advise, assist, and cooperate with departments, agencies, and instrumentalities of the Federal Government, States, and other public and private agencies.

(6)

Effective date of standards

(A)

In general

The Secretary shall specify the effective date of a TEVV standard issued under this subsection in the order issuing the standard.

(B)

Limitation

Subject to subparagraph (C), a TEVV standard issued under this subsection may not become effective—

(i)

during the 180-day period following the date on which the TEVV standard is issued; and

(ii)

more than 1 year after the date on which the TEVV standard is issued.

(C)

Exception

Subparagraph (B) shall not apply to the effective date of a TEVV standard issued under this section if the Secretary—

(i)

finds, for good cause shown, that a different effective date is in the public interest; and

(ii)

publishes the reasons for the finding under clause (i).

(7)

Rule of construction

Nothing in this subsection shall be construed to authorize the Secretary to impose any requirements on or take any enforcement actions under this section or section 208 relating to a critical-impact AI organization before a TEVV standard relating to those requirements is prescribed.

(d)

Exemptions

(1)

Authority to exempt and procedures

(A)

In general

The Secretary may exempt, on a temporary basis, a critical-impact artificial intelligence system from a TEVV standard issued under subsection (c) on terms the Secretary considers appropriate.

(B)

Renewal

An exemption under subparagraph (A)—

(i)

may be renewed only on reapplication; and

(ii)

shall conform to the requirements of this paragraph.

(C)

Proceedings

(i)

In general

The Secretary may begin a proceeding to grant an exemption to a critical-impact artificial intelligence system under this paragraph if the critical-impact AI organization that deployed the critical-impact artificial intelligence systems applies for an exemption or a renewal of an exemption.

(ii)

Notice and comment

The Secretary shall publish notice of the application under clause (i) and provide an opportunity to comment.

(iii)

Filing

An application for an exemption or for a renewal of an exemption under this paragraph shall be filed at such time and in such manner and contain such information as the Secretary may require.

(D)

Actions

The Secretary may grant an exemption under this paragraph upon finding that—

(i)

the exemption is consistent with the public interest and this section; and

(ii)

the exemption would facilitate the development or evaluation of a feature or characteristic of a critical-impact artificial intelligence system providing a safety and security level that is not less than the TEVV standard level.

(2)

Disclosure

Not later than 30 days after the date on which an application is filed under this subsection, the Secretary may make public information contained in the application or relevant to the application, unless the information concerns or is related to a trade secret or other confidential information not relevant to the application.

(3)

Notice of decision

The Secretary shall publish in the Federal Register a notice of each decision granting or denying an exemption under this subsection and the reasons for granting or denying that exemption, including a justification with supporting information for the selected approach.

(e)

Self-Certification of compliance

(1)

In general

Subject to paragraph (2), with respect to each critical-impact artificial intelligence system of a critical-impact AI organization, the critical-impact AI organization shall certify to the Secretary that the critical-impact artificial intelligence system complies with applicable TEVV standards issued under this section.

(2)

Exception

A critical-impact AI organization may not issue a certificate under paragraph (1) if, in exercising reasonable care, the critical-impact AI organization has constructive knowledge that the certificate is false or misleading in a material respect.

(f)

Noncompliance findings and enforcement action

(1)

Finding of noncompliance by secretary

Upon learning that a critical-impact artificial intelligence system deployed by a critical-impact AI organization does not comply with the requirements under this section, the Secretary shall—

(A)

immediately—

(i)

notify the critical-impact AI organization of the finding; and

(ii)

order the critical-impact AI organization to take remedial action to address the noncompliance of the artificial intelligence system; and

(B)

may, as determined appropriate or necessary by the Secretary, and if the Secretary determines that actions taken by a critical-impact AI organization are insufficient to remedy the noncompliance of the critical-impact AI organization with this section, take enforcement action under section 208.

(2)

Actions by critical-impact AI organization

If a critical-impact AI organization finds that a critical-impact artificial intelligence system deployed by the critical-impact AI organization is noncompliant with an applicable TEVV standard issued under this section or the critical-impact AI organization is notified of noncompliance by the Secretary under paragraph (1)(A)(i), the critical-impact AI organization shall—

(A)

without undue delay, notify the Secretary by certified mail or electronic mail of the noncompliance or receipt of the notification of noncompliance;

(B)

take remedial action to address the noncompliance; and

(C)

not later than 10 days after the date of the notification or receipt under subparagraph (A), submit to the Secretary a report containing information on—

(i)

the nature and discovery of the noncompliant aspect of the critical-impact artificial intelligence system;

(ii)

measures taken to remedy such noncompliance; and

(iii)

actions taken by the critical-impact AI organization to address stakeholders affected by such noncompliance.

208.

Enforcement

(a)

In general

Upon discovering noncompliance with a provision of this Act by a deployer of a high-impact artificial intelligence system or a critical-impact AI organization if the Secretary determines that actions taken by the critical-impact AI organization are insufficient to remedy the noncompliance, the Secretary shall take an action described in this section.

(b)

Civil penalties

(1)

In general

The Secretary may impose a penalty described in paragraph (2) on deployer of a high-impact artificial intelligence system or a critical-impact AI organization for each violation by that entity of this Act or any regulation or order issued under this Act.

(2)

Penalty described

The penalty described in this paragraph is the greater of—

(A)

an amount not to exceed $300,000; or

(B)

an amount that is twice the value of the transaction that is the basis of the violation with respect to which the penalty is imposed.

(c)

Violation with intent

(1)

In general

If the Secretary determines that a deployer of a high-impact artificial intelligence system or a critical-impact AI organization intentionally violates this Act or any regulation or order issued under this Act, the Secretary may prohibit the critical-impact AI organization from deploying a critical-impact artificial intelligence system.

(2)

In addition

A prohibition imposed under paragraph (1) shall be in addition to any other civil penalties provided under this Act.

(d)

Factors

The Secretary may by regulation provide standards for establishing levels of civil penalty under this section based upon factors such as the seriousness of the violation, the culpability of the violator, and such mitigating factors as the violator’s record of cooperation with the Secretary in disclosing the violation.

(e)

Civil action

(1)

In general

Upon referral by the Secretary, the Attorney General may bring a civil action in a United States district court to—

(A)

enjoin a violation of section 207; or

(B)

collect a civil penalty upon a finding of noncompliance with this Act.

(2)

Venue

A civil action may be brought under paragraph (1) in the judicial district in which the violation occurred or the defendant is found, resides, or does business.

(3)

Process

Process in a civil action under paragraph (1) may be served in any judicial district in which the defendant resides or is found.

(f)

Rule of construction

Nothing in this section shall be construed to require a developer of a critical-impact artificial intelligence system to disclose any information, including data or algorithms—

(1)

relating to a trade secret or other protected intellectual property right;

(2)

that is confidential business information; or

(3)

that is privileged.

209.

Artificial intelligence consumer education

(a)

Establishment

Not later than 180 days after the date of enactment of this Act, the Secretary shall establish a working group relating to responsible education efforts for artificial intelligence systems.

(b)

Membership

(1)

In general

The Secretary shall appoint to serve as members of the working group established under this section not more than 15 individuals with expertise relating to artificial intelligence systems, including—

(A)

representatives of—

(i)

institutions of higher education;

(ii)

companies developing or operating artificial intelligence systems;

(iii)

consumers or consumer advocacy groups;

(iv)

public health organizations;

(v)

marketing professionals;

(vi)

entities with national experience relating to consumer education, including technology education;

(vii)

public safety organizations;

(viii)

rural workforce development advocates;

(ix)

enabling technology companies; and

(x)

nonprofit technology industry trade associations; and

(B)

any other members the Secretary considers to be appropriate.

(2)

Compensation

A member of the working group established under this section shall serve without compensation.

(c)

Duties

(1)

In general

The working group established under this section shall—

(A)

identify recommended education and programs that may be voluntarily employed by industry to inform—

(i)

consumers and other stakeholders with respect to artificial intelligence systems as those systems—

(I)

become available; or

(II)

are soon to be made widely available for public use or consumption; and

(B)

submit to Congress, and make available to the public, a report containing the findings and recommendations under subparagraph (A).

(2)

Factors for consideration

The working group established under this section shall take into consideration topics relating to—

(A)

the intent, capabilities, and limitations of artificial intelligence systems;

(B)

use cases of artificial intelligence applications that improve lives of the people of the United States, such as improving government efficiency, filling critical roles, and reducing mundane work tasks;

(C)

artificial intelligence research breakthroughs;

(D)

engagement and interaction methods, including how to adequately inform consumers of interaction with an artificial intelligence system;

(E)

human-machine interfaces;

(F)

emergency fallback scenarios;

(G)

operational boundary responsibilities;

(H)

potential mechanisms that could change function behavior in service; and

(I)

consistent nomenclature and taxonomy for safety features and systems.

(3)

Consultation

The Secretary shall consult with the Chair of the Federal Trade Commission with respect to the recommendations of the working group established under this section, as appropriate.

(d)

Termination

The working group established under this section shall terminate on the date that is 2 years after the date of enactment of this Act.

Short title

This Act may be cited as the Artificial Intelligence Research, Innovation, and Accountability Act of 2024.

Table of contents

The table of contents for this Act is as follows:

Sec. 1. Short title.

Sec. 2. Table of contents.

TITLE I—Artificial intelligence research and innovation

Sec. 101. Open data policy amendments.

Sec. 102. Online content authenticity and provenance standards research and development.

Sec. 103. Standards for detection of anomalous behavior and artificial intelligence-generated media.

Sec. 104. Comptroller general study on barriers and best practices to usage of AI in government.

TITLE II—Artificial intelligence accountability

Sec. 201. Definitions.

Sec. 202. Generative artificial intelligence transparency.

Sec. 203. Transparency reports for high-impact artificial intelligence systems.

Sec. 204. Guidelines for Federal agencies and plans for oversight of high-impact artificial intelligence systems.

Sec. 205. Office of Management and Budget Oversight guidelines and agency oversight plans.

Sec. 206. Risk management assessment for critical-impact artificial intelligence systems.

Sec. 207. Certification of critical-impact artificial intelligence systems.

Sec. 208. Enforcement.

Sec. 209. Developer and deployer overlap.

Sec. 210. Artificial intelligence consumer education.

Sec. 211. Severability.

Artificial intelligence research and innovation

101.

Open data policy amendments

Section 3502 of title 44, United States Code, is amended—

(1)

in paragraph (22)—

(A)

by inserting or data model after a data asset; and

(B)

by striking and at the end;

(2)

in paragraph (23), by striking the period at the end and inserting a semicolon; and

(3)

by adding at the end the following:

(24)

(25)

the term artificial intelligence system means a machine-based system that, for explicit or implicit objectives, infers from the input the system receives how to generate outputs, such as predictions, content, recommendations, or decisions that can influence physical or virtual environments.

102.

Online content authenticity and provenance standards research and development

(a)

Research

(1)

In general

Not later than 180 days after the date of the enactment of this Act, the Under Secretary of Commerce for Standards and Technology shall carry out research to facilitate the development and promote the standardization of means to provide authenticity and provenance information for digital content generated by human authors and artificial intelligence systems.

(2)

Elements

The research carried out pursuant to paragraph (1) shall cover the following:

(A)

Secure and mandatory methods for human content to append statements of provenance information through the use of unique credentials, watermarking, or other data or metadata-based approaches.

(B)

Methods for the verification of statements of digital content provenance to ensure authenticity such as watermarking or classifiers, which are trained models that distinguish artificial intelligence-generated content.

(C)

Methods for displaying clear and conspicuous labels of digital content provenance to users.

(D)

Technologies, applications, or infrastructure needed to facilitate the creation and verification of digital content provenance information.

(E)

Mechanisms to ensure that any technologies and methods developed under this subsection are minimally burdensome on content producers to implement.

(F)

Use of digital content transparency technologies to enable attribution for human-created content.

(G)

Such other related processes, technologies, or applications as the Under Secretary considers appropriate.

(3)

Implementation

(b)

Technical assistance on the development of standards

(1)

In general

(2)

Considerations

In providing any technical review and assistance related to the development of digital content provenance and authenticity standards under this subsection, the Under Secretary may—

(A)

consider whether a proposed standard is reasonable, practicable, and appropriate for the particular type of media and media environment for which the standard is proposed;

(B)

consult with relevant stakeholders; and

(C)

review industry standards issued by nongovernmental standards organizations.

(c)

Pilot program

(1)

In general

The Under Secretary shall carry out a pilot program to assess the feasibility and advisability of using available technologies and creating guidelines to facilitate the creation and verification of digital content provenance information.

(2)

Locations

The pilot program required by paragraph (1) shall be carried out at not more than 2 Federal agencies the Under Secretary shall select for purposes of the pilot program required by paragraph (1).

(3)

Requirements

In carrying out the pilot program required by paragraph (1), the Under Secretary shall—

(A)

apply and evaluate methods for authenticating the origin of and modifications to government-produced digital content, either by Federal Government employees or a private entity under the terms of a government contract, using technology and guidelines described in paragraph (1); and

(B)

make available to the public digital content embedded with provenance data or other authentication provided by the heads of the Federal agencies selected pursuant to paragraph (2) for the purposes of the pilot program.

(4)

Briefing required

(5)

Termination

The pilot program shall terminate on the date that is 10 years after the date of the enactment of this Act.

(d)

Report to congress

103.

Standards for detection of anomalous behavior and artificial intelligence-generated media

Section 22A(b)(1) of the National Institute of Standards and Technology Act (15 U.S.C. 278h–1(b)(1)) is amended—

(1)

by redesignating subparagraph (I) as subparagraph (K);

(2)

in subparagraph (H), by striking ; and and inserting a semicolon; and

(3)

by inserting after subparagraph (H) the following:

(I)

best practices for detecting outputs generated by artificial intelligence systems, including content such as text, audio, images, and videos;

(J)

methods to detect and mitigate anomalous behavior of artificial intelligence systems and safeguards to mitigate potentially adversarial or compromising anomalous behavior; and

104.

Comptroller general study on barriers and best practices to usage of AI in government

(a)

In general

Not later than 1 year after the date of enactment of this Act, the Comptroller General of the United States shall—

(1)

conduct a review of statutory, regulatory, and other policy barriers to the use of artificial intelligence systems to improve the functionality of the Federal Government; and

(2)

identify best practices for the adoption and responsible use of artificial intelligence systems by the Federal Government, including—

(A)

ensuring that an artificial intelligence system is proportional to the need of the Federal Government;

(B)

restrictions on access to and use of an artificial intelligence system based on the capabilities and risks of the artificial intelligence system; and

(C)

safety measures that ensure that an artificial intelligence system is appropriately limited to necessary data and compartmentalized from other assets of the Federal Government.

(b)

Report

(1)

(2)

(A)

data analysis and processing;

(B)

paperwork reduction;

(C)

contracting and procurement practices; and

(D)

other Federal Government services; and

(3)

Artificial intelligence accountability

201.

Definitions

In this title:

(1)

Appropriate congressional committees

The term appropriate congressional committees means—

(A)

the Committee on Energy and Natural Resources and the Committee on Commerce, Science, and Transportation of the Senate;

(B)

the Committee on Energy and Commerce of the House of Representatives; and

(C)

each congressional committee with jurisdiction over an applicable covered agency.

(2)

Artificial intelligence system

The term artificial intelligence system means a machine-based system that, for explicit and implicit objectives, infers from the input the system receives how to generate outputs such as predictions, content, recommendations, or decisions that can influence physical or virtual environments.

(3)

Covered agency

The term covered agency means an agency for which a guideline is developed under section 22B(b)(1) of the National Institute of Standards and Technology Act, as added by section 204 of this Act, including—

(A)

the Department of Commerce;

(B)

the Department of State;

(C)

the Department of Homeland Security;

(D)

the Department of Health and Human Services;

(E)

the Department of Agriculture;

(F)

the Department of Housing and Urban Development;

(G)

the Department of the Interior;

(H)

the Department of Education;

(I)

the Department of Energy;

(J)

the Department of Labor;

(K)

the Department of Transportation;

(L)

the Department of Justice;

(M)

the Department of the Treasury;

(N)

the Department of Veterans Affairs; and

(O)

any other agency the Secretary determines appropriate.

(4)

Critical-impact ai organization

The term critical-impact AI organization means a nongovernmental organization that serves as the deployer of a critical-impact artificial intelligence system.

(5)

Critical-impact artificial intelligence system

The term critical-impact artificial intelligence system means an artificial intelligence system that—

(A)

is deployed for a purpose other than solely for use by the Department of Defense or an intelligence agency (as defined in section 504(e) of the National Security Act of 1947 (50 U.S.C. 3094(3))); and

(B)

is used or intended to be used—

(i)

to make a decision or substantially replace or facilitate the discretionary human decisionmaking process regarding—

(I)

the real-time or ex post facto collection or analysis of biometric data of a natural person by biometric identification systems without the consent of the natural person;

(II)

an operational component involved in the direct management of infrastructure determined by the Secretary of Homeland Security to be critical infrastructure (as defined in section 1016(e) of the USA PATRIOT Act (42 U.S.C. 5195c(e))) that is—

(aa)

transportation infrastructure;

(bb)

energy infrastructure;

(cc)

electrical infrastructure;

(dd)

communications infrastructure;

(ee)

manufacturing infrastructure; or

(ff)

infrastructure used in the supply and production of water and hazardous materials; or

(III)

a government or government contractor’s actions pertaining to criminal justice (as defined in section 901 of title I of the Omnibus Crime Control and Safe Streets Act of 1968 (34 U.S.C. 10251)); and

(ii)

in a manner that poses a significant risk to safety or violates rights afforded under the Constitution of the United States.

(6)

Deployer

The term deployer—

(A)

means an entity that—

(i)

uses or operates an artificial intelligence system for internal use or for use by a third party;

(ii)

substantially modifies an artificial intelligence system, or trains an artificial intelligence system using new data, for internal use or for use by a third party; or

(iii)

performs the functions described in clauses (i) and (ii); and

(B)

does not include an entity that is solely an end user of a system.

(7)

Developer

The term developer means an entity that—

(A)

initially designs, codes, produces, or owns an artificial intelligence system for internal use or for use by a third party as a baseline model; and

(B)

is not a deployer of the artificial intelligence system described in subparagraph (A).

(8)

End user

The term end user means an entity that, with respect to an artificial intelligence system procured from a deployer for which the deployer submits a transparency report under section 203 or a risk management assessment under section 206—

(A)

uses or operates the artificial intelligence system; and

(B)

does not substantially edit or modify the artificial intelligence system.

(9)

Generative artificial intelligence system

The term generative artificial intelligence system means an artificial intelligence system that generates output, such as data or content in a written, audio, or visual format.

(10)

High-impact artificial intelligence system

The term high-impact artificial intelligence system means an artificial intelligence system—

(A)

deployed for a purpose other than solely for use by the Department of Defense or an intelligence agency (as defined in section 3094(e) of the National Security Act of 1947 (50 U.S.C. 3094(3))); and

(B)

that is specifically deployed to make a decision or substantially replace the discretionary human decisionmaking process regarding the access of an individual to housing, employment, credit, education, healthcare, government services, or insurance in a manner that poses a significant risk to safety or violates rights afforded under the Constitution of the United States or Federal law.

(11)

Online platform

The term online platform means any public-facing website, online service, online application, or mobile application that predominantly provides a community forum for user-generated content, such as sharing videos, images, games, audio files, or other content, including a social media service, social network, or virtual reality environment.

(12)

Secretary

The term Secretary means the Secretary of Commerce.

(13)

Significant risk

The term significant risk means the risk of—

(A)

high-impact, severe, high-intensity, or long-duration harm to individuals; or

(B)

a high probability of substantial harm to individuals.

(14)

TEVV

The term TEVV means the testing, evaluation, validation, and verification of any artificial intelligence system that includes—

(A)

open, transparent, testable, and verifiable specifications that characterize realistic operational performance, such as validity and reliability for relevant tasks;

(B)

testing methodologies and metrics that enable the evaluation of system trustworthiness, including robustness and resilience;

(C)

data quality standards for training and testing datasets;

(D)

requirements for system validation and integration into production environments, automated testing, and compliance with existing legal and regulatory specifications;

(E)

methods and tools for—

(i)

the monitoring of system behavior;

(ii)

the tracking of incidents or errors reported and their management; and

(iii)

the detection of emergent properties and related impacts; and

(F)

processes for redress and response.

(15)

Under secretary

The term Under Secretary means the Director of the National Institute of Standards and Technology.

202.

Generative artificial intelligence transparency

(a)

Prohibition

(1)

Disclosure of use of generative artificial intelligence systems

(A)

In general

A person operating an online platform that uses a generative artificial intelligence system shall provide notice to each user of the online platform that the online platform uses a generative artificial intelligence system to generate content the user sees.

(B)

Requirements

A person providing the notice described in subparagraph (A) to a user—

(i)

subject to clause (ii), shall provide the notice in a clear and conspicuous manner on the online platform before the user interacts with content produced by a generative artificial intelligence system used by the online platform; and

(ii)

(b)

Enforcement action

Upon learning that a person operating an online platform violates this section after receiving a report of noncompliance or pursuant to an investigation conducted under section 208(f), the Secretary—

(1)

shall immediately—

(A)

notify the person operating the online platform of the finding; and

(B)

order the person operating the online platform to take remedial action to address the noncompliance of the generative artificial intelligence system operated by the online platform; and

(2)

may, as determined appropriate or necessary by the Secretary, take enforcement action under section 208 if the person operating the online platform does not take sufficient action to remedy the noncompliance by the date that is 15 days after the notification issued under paragraph (1)(A).

(c)

Effective date

This section shall take effect on the date that is 180 days after the date of enactment of this Act.

203.

Transparency reports for high-impact artificial intelligence systems

(a)

Transparency reporting

(1)

In general

Each deployer of a high-impact artificial intelligence system shall—

(A)

before deploying the high-impact artificial intelligence system, and annually thereafter, submit to the Secretary a transparency report for the high-impact artificial intelligence system; and

(B)

submit to the Secretary an updated transparency report on the high-impact artificial intelligence system if the deployer makes a material change to—

(i)

the purpose for which the high-impact artificial intelligence system is used; or

(ii)

the type of data or content the high-impact artificial intelligence system processes or uses for training purposes.

(2)

Contents

Each transparency report submitted under paragraph (1) by a deployer of a high-impact artificial intelligence system shall include—

(A)

with respect to the organization of the deployer—

(i)

policies, processes, procedures, and practices across the organization relating to transparent and effective mapping, measuring, and managing of artificial intelligence risks, including—

(I)

how the organization understands, manages, and documents legal and regulatory requirements involving artificial intelligence;

(II)

how the organization integrates characteristics of trustworthy artificial intelligence, which include valid, reliable, safe, secure, resilient, accountable, transparent, globally and locally explainable, interpretable, privacy-enhanced, and protecting of rights under the Constitution of the United States, and compliant with all relevant Federal laws, into organizational policies, processes, procedures, and practices;

(III)

a methodology to determine the needed level of risk management activities based on the risk tolerance of the organization; and

(IV)

how the organization establishes risk management processes and outcomes through transparent policies, procedures, and other controls based on organizational risk priorities;

(B)

the structure, context, and capabilities of the high-impact artificial intelligence system, including—

(i)

how the context was established and understood;

(ii)

capabilities, targeted uses, goals, and expected costs and benefits; and

(iii)

how risks and benefits are mapped for each system component;

(C)

a description of how the organization of the deployer employs quantitative, qualitative, or mixed-method tools, techniques, and methodologies to analyze, assess, benchmark, and monitor artificial intelligence risk, including—

(i)

identification of appropriate methods and metrics;

(ii)

how artificial intelligence systems are evaluated for characteristics of trustworthy artificial intelligence;

(iii)

mechanisms for tracking artificial intelligence system risks over time; and

(iv)

processes for gathering and assessing feedback relating to the efficacy of measurement; and

(D)

a description of allocation of risk resources to map and measure risks on a regular basis, including—

(i)

how artificial intelligence risks based on assessments and other analytical outputs are prioritized, responded to, and managed;

(ii)

(iii)

management of artificial intelligence system risks and benefits; and

(iv)

regular monitoring of risk treatments, including response and recovery, and communication plans for the identified and measured artificial intelligence risks, as applicable.

(3)

Developer obligations

The developer of a high-impact artificial intelligence system that agrees to provide technologies or services to a deployer of the high-impact artificial intelligence system shall provide to the deployer of the high-impact artificial intelligence system the information reasonably necessary for compliance with paragraph (1), including—

(A)

an overview of the data used in training the baseline artificial intelligence system provided by the developer, including—

(i)

size of datasets used;

(ii)

content and data sources and types of data used;

(iii)

content and data that may be subject to copyright protection and any steps taken to remove such content and data prior to training or other uses; and

(iv)

whether and to what extent personal identifiable information makes up a portion of the training dataset, and what risk mitigation measures have been taken to prevent the disclosure of that personal identifiable information;

(B)

documentation outlining the structure and context of the baseline artificial intelligence system of the developer, including—

(i)

input modality;

(ii)

system output and modality;

(iii)

model size; and

(iv)

model architecture;

(C)

known or reasonably foreseeable capabilities, limitations, and risks of the baseline artificial intelligence system at the time of the development of the artificial intelligence system; and

(D)

documentation for downstream use, including—

(i)

a statement of intended purpose;

(ii)

guidelines for the intended use of the artificial intelligence system, including a list of permitted, restricted, and prohibited uses and users; and

(iii)

a description of the potential for and risk of deviation from the intended purpose of the baseline artificial intelligence system, including recommended safeguards to mitigate and prevent risks to safety or to rights afforded under the Constitution of the United States or Federal law.

(4)

Considerations

In carrying out this subsection, a deployer or developer of a high-impact artificial intelligence system shall consider the best practices outlined in the most recent version of the risk management framework developed pursuant to section 22A(c) of the National Institute of Standards and Technology Act (15 U.S.C. 278h–1(c)).

(b)

Noncompliance and enforcement action

Upon learning that a deployer of a high-impact artificial intelligence system violates this section with respect to a high-impact artificial intelligence system after receiving a report of noncompliance or pursuant to an investigation conducted under section 208(f), the Secretary—

(1)

shall immediately—

(A)

notify the deployer of the finding; and

(B)

order the deployer to immediately submit to the Secretary the report required under subsection (a)(1); and

(2)

if the deployer fails to submit the report by the date that is 15 days after the date of the notification under paragraph (1)(A), may take enforcement action under section 208.

(c)

Avoidance of duplication

With respect to a developer or deployer of a high-impact artificial intelligence system that maintains policies and procedures for risk management in accordance with any applicable rules, regulations, or supervisory guidance promulgated by a relevant Federal agency, the Secretary shall deem the developer or deployer to be in compliance with this section.

(d)

Rule of construction

Nothing in this section shall be construed to require a deployer of a high-impact artificial intelligence system to disclose any information, including data, content, or algorithms—

(1)

constituting a trade secret or other intellectual property right; or

(2)

that is confidential business information.

(e)

Consolidation

With respect to an instance in which multiple deployers participate in the deployment of a high-impact artificial intelligence system, the Secretary may establish through regulation a process under which the deployers may submit a single transparency report under subsection (a).

204.

Guidelines for Federal agencies and plans for oversight of high-impact artificial intelligence systems

(a)

Guidelines for federal agencies for oversight of artificial intelligence

The National Institute of Standards and Technology Act (15 U.S.C. 271 et seq.) is amended by inserting after section 22A (15 U.S.C. 278h–1) the following:

22B.

Guidelines for Federal agencies for oversight of artificial intelligence

(a)

Definition of high-impact artificial intelligence system

In this section, the term high-impact artificial intelligence system means an artificial intelligence system—

(1)

(2)

that is specifically deployed to make a decision or substantially replace the discretionary human decisionmaking process regarding the access of an individual to housing, employment, credit, education, health care, government services, or insurance in a manner that poses a significant risk to safety or violates rights afforded under the Constitution of the United States.

(b)

Guidelines for oversight of high-impact artificial intelligence systems

Not later than 1 year after the date of the enactment of the Artificial Intelligence Research, Innovation, and Accountability Act of 2024, the Director shall—

(1)

develop guidelines for Federal agencies to conduct oversight of the non-Federal and, as may be appropriate, Federal use of high-impact artificial intelligence systems to improve the safe and responsible use of such systems; and

(2)

not less frequently than biennially, update the guidelines to account for changes in technological capabilities or artificial intelligence use cases.

(c)

Use of voluntary risk management framework

In developing guidelines under subsection (b), the Director shall use the voluntary risk management framework required by section 22A(c) to identify and provide guidelines for Federal agencies on establishing regulations, standards, guidelines, best practices, methodologies, procedures, or processes—

(1)

to facilitate oversight of non-Federal use of high-impact artificial intelligence systems; and

(2)

to mitigate risks from such high-impact artificial intelligence systems.

(d)

Authorized elements

In developing guidelines under subsection (b), the Director may include the following:

(1)

Key design choices made during high-impact artificial intelligence model development, including rationale and assumptions made.

(2)

(3)

Methods for evaluating the safety of high-impact artificial intelligence systems and approaches for responsible use.

(e)

Consultation

In developing guidelines under subsection (b), the Director may consult with such stakeholders representing perspectives from civil society, academia, technologists, engineers, and creators as the Director considers applicable, practicable, and relevant.

(b)

Agency-specific plans for oversight of high-impact artificial intelligence systems

(1)

Plans required

Not later than 2 years after the date of the enactment of this Act, the head of each covered agency shall—

(A)

develop sector-specific plans for the covered agency to conduct oversight of the non-Federal and, as may be appropriate, Federal use of high-impact artificial intelligence systems to improve the safe and responsible use of such systems; and

(B)

not less frequently than biennially, update the sector-specific recommendations to account for changes in technological capabilities or artificial intelligence use cases.

(2)

Requirements

In developing plans under paragraph (1), the head of each covered agency shall follow the guidelines established under section 22B(b) of the National Institute of Standards and Technology Act, as added by subsection (a), to develop plans to mitigate risks from such high-impact artificial intelligence systems.

(3)

Authorized elements

In developing plans under paragraph (1), the head of a covered agency may include the following:

(A)

(B)

Methods for evaluating the safety of high-impact artificial intelligence systems and approaches for responsible use.

(C)

(D)

Recommendations to support iterative development of subsequent recommendations under paragraph (1).

(4)

Consultation

In developing plans under paragraph (1), the head of each covered agency shall consult with—

(A)

the Under Secretary; and

(B)

such stakeholders representing perspectives from civil society, academia, technologists, engineers, and creators as the head of the agency considers applicable, practicable, and relevant.

205.

Office of Management and Budget Oversight guidelines and agency oversight plans

(a)

Agency oversight plan

In this section, the term agency oversight plan means a guideline developed under section 22B(b)(1) of the National Institute of Standards and Technology Act, as added by section 204 of this Act.

(b)

Recommendations

Not later than 2 years after the date of enactment of this Act, the Under Secretary and the head of each covered agency shall submit to the Director of the Office of Management and Budget and the appropriate congressional committees each agency oversight plan.

(c)

Reporting requirements

(1)

Annual agency oversight status reports

(A)

In general

On the first February 1 occurring after the date that is 2 years after the date of enactment of this Act, and annually thereafter until the date described in subparagraph (B), the head of each covered agency shall submit to the Director of the Office of Management and Budget a report containing the implementation status of each agency oversight plan.

(B)

Continued reporting

The date described in this subparagraph is the date on which the head of a covered agency—

(i)

takes final implementation action with respect to an agency oversight plan; and

(ii)

determines and states in a report required under subparagraph (A) that no further implementation action should be taken with respect to an agency oversight plan.

(2)

Compliance report to congress

On April 1 of each year occurring after the date that is 2 years after the date of enactment of this Act, the Director of the Office of Management and Budget shall transmit comments on the reports required under paragraph (1) to the heads of covered agencies and the appropriate congressional committees.

(3)

Failure to report

If, on March 1 of each year occurring after the date that is 2 years after the date of enactment of this Act, the Director of the Office of Management and Budget has not received a report required from the head of a covered agency under paragraph (1), the Director shall notify the appropriate congressional committees of the failure.

(d)

Technical assistance in carrying out agency oversight plans

The Under Secretary shall provide assistance to the heads of covered agencies relating to the implementation of the agency oversight plan the heads of covered agencies intend to carry out.

(e)

Regulation review and improvement

206.

Risk management assessment for critical-impact artificial intelligence systems

(a)

Requirement

(1)

In general

Each critical-impact AI organization shall perform a risk management assessment in accordance with this section.

(2)

Assessment

Each critical-impact AI organization shall—

(A)

not later than 30 days before the date on which a critical-impact artificial intelligence system is deployed or made publicly available by the critical-impact AI organization, perform a risk management assessment; and

(B)

not less frequently than biennially during the period beginning on the date of enactment of this Act and ending on the date on which the applicable critical-impact artificial intelligence system is no longer being deployed or made publicly available by the critical-impact AI organization, as applicable, conduct an updated risk management assessment that—

(i)

if no significant changes were made to the critical-impact artificial intelligence system, may find that no significant changes were made to the critical-impact artificial intelligence system; and

(ii)

(3)

Review

(A)

In general

(i)

outlining the assessment performed under this section; and

(ii)

that is in a consistent format, as determined by the Secretary.

(B)

Additional information

(4)

Limitation

(b)

Assessment subject areas

(1)

Policies, processes, procedures, and practices across the organization relating to transparent and effective mapping, measuring, and managing of artificial intelligence risks, including—

(A)

how the organization understands, manages, and documents legal and regulatory requirements involving critical-impact artificial intelligence systems;

(B)

how the organization integrates the characteristics of trustworthy artificial intelligence, which include valid, reliable, safe, secure, resilient, accountable, transparent, globally and locally explainable, interpretable, privacy-enhanced, protecting of rights under the Constitution of the United States, and compliant with all relevant Federal laws, into organizational policies, processes, procedures, and practices for deploying critical-impact artificial intelligence systems;

(C)

a methodology to determine the needed level of risk management activities for critical-impact artificial intelligence systems based on the organization’s risk tolerance; and

(D)

how the organization establishes risk management processes and outcomes through transparent policies, procedures, and other controls based on organizational risk priorities.

(2)

The structure, context, and capabilities of the critical-impact artificial intelligence system, including—

(A)

how the context was established and understood;

(B)

capabilities, targeted uses, goals, and expected costs and benefits; and

(C)

how risks and benefits are mapped for each system component.

(3)

(A)

identification of appropriate methods and metrics;

(B)

how artificial intelligence systems are evaluated for characteristics of trustworthy artificial intelligence;

(C)

mechanisms for tracking artificial intelligence system risks over time; and

(D)

processes for gathering and assessing feedback relating to the efficacy of measurement.

(4)

A description of allocation of risk resources to map and measure risks on a regular basis as described in paragraph (1), including—

(A)

how artificial intelligence risks based on assessments and other analytical outputs described in paragraphs (2) and (3) are prioritized, responded to, and managed;

(B)

(C)

management of artificial intelligence system risks and benefits; and

(D)

regular monitoring of risk treatments, including response and recovery, and communication plans for the identified and measured artificial intelligence risks, as applicable.

(c)

Developer obligations

The developer of a critical-impact artificial intelligence system that agrees to provide technologies or services to a deployer of the critical-impact artificial intelligence system shall provide to the deployer of the critical-impact artificial intelligence system the information reasonably necessary for the deployer to comply with the requirements under subsection (a), including—

(1)

an overview of the data used in training the baseline artificial intelligence system provided by the developer, including—

(A)

content and size of datasets used;

(B)

content and types of data used;

(C)

content and data that may be subject to copyright protection, and any steps taken to remove such content and data prior to training; and

(D)

(2)

documentation outlining the structure and context of the baseline artificial intelligence system of the developer, including—

(A)

input modality;

(B)

system output and modality;

(C)

model size; and

(D)

model architecture;

(3)

known or reasonably foreseeable capabilities, limitations, and risks of the baseline artificial intelligence system at the time of the development of the artificial intelligence system; and

(4)

documentation for downstream use, including—

(A)

a statement of intended purpose;

(B)

guidelines for the intended use of the artificial intelligence system, including a list of permitted, restricted, and prohibited uses and users; and

(C)

(d)

Termination of obligation to disclose information

(1)

In general

The obligation of a critical-impact AI organization to provide information, upon a request of the Secretary, relating to a specific assessment category under subsection (b) shall end on the date of issuance of a relevant standard applicable to the same category of a critical -impact artificial intelligence system by—

(A)

the Secretary under section 207(c) with respect to a critical-impact artificial intelligence system;

(B)

another department or agency of the Federal Government, as determined applicable by the Secretary; or

(C)

a nongovernmental standards organization, as determined appropriate by the Secretary.

(2)

Effect of new standard

In adopting any standard applicable to critical-impact artificial intelligence systems under section 207(c), the Secretary shall—

(A)

identify the category under subsection (b) to which the standard relates, if any; and

(B)

specify the information that is no longer required to be included in a report required under subsection (a) as a result of the new standard.

(e)

Rule of construction

Nothing in this section shall be construed to require a critical-impact AI organization or permit the Secretary to disclose any information, including data or algorithms—

(1)

constituting a trade secret or other intellectual property right; or

(2)

that is confidential business information.

(f)

Consolidation

With respect to an instance in which multiple critical-impact AI organizations participate in the deployment of a high-impact artificial intelligence system, the Secretary may establish through regulation a process under which the critical-impact AI organizations may submit a single risk management assessment under subsection (a).

207.

Certification of critical-impact artificial intelligence systems

(a)

Establishment of artificial intelligence certification advisory committee

(1)

In general

(2)

Duties

(A)

providing recommendations to the Secretary on proposed TEVV standards to ensure such standards—

(i)

maximize alignment and interoperability with standards issued by nongovernmental standards organizations and international standards bodies; and

(ii)

are performance-based, impact-based, and risk-based;

(B)

reviewing prospective TEVV standards submitted by the Secretary to ensure such standards align with recommendations under subparagraph (A);

(C)

upon completion of the review under subparagraph (B), providing consensus recommendations to the Secretary on—

(i)

whether a TEVV standard should be issued, modified, revoked, or added; and

(ii)

if such a standard should be issued, how best to align the standard with the considerations described in subsection (c)(2) and recommendations described in subparagraph (A); and

(D)

reviewing and providing advice and recommendations on the plan and subsequent updates to the plan submitted under subsection (b).

(3)

Composition

The advisory committee established under this subsection shall be appointed by the Secretary and composed of not more than 15 members with a balanced composition of representatives of the private sector, institutions of higher education, and nonprofit organizations, including—

(A)

representatives of—

(i)

institutions of higher education;

(ii)

companies developing or operating artificial intelligence systems;

(iii)

consumers or consumer advocacy groups;

(iv)

enabling technology companies; and

(v)

labor organizations representing the technology sector; and

(B)

any other members the Secretary considers to be appropriate.

(b)

Artificial intelligence certification plan

(1)

In general

Not later than 1 year after the date of enactment of this Act, the Secretary shall establish a 3-year implementation plan for the certification of critical-impact artificial intelligence systems.

(2)

Periodic update

As the Secretary determines appropriate, the Secretary shall update the plan established under paragraph (1).

(3)

Contents

The plan established under paragraph (1) shall include—

(A)

a methodology for gathering and using relevant, objective, and available information relating to TEVV;

(B)

(C)

if TEVV standards are considered appropriate, a process for prescribing such standards for critical-impact artificial intelligence systems;

(D)

a mechanism for determining compliance with TEVV standards; and

(E)

an outline of standards proposed to be issued, including an estimation of the timeline and sequencing of such standards.

(4)

Consultation

In developing the plan required under paragraph (1), the Secretary shall consult the following:

(A)

The National Artificial Intelligence Initiative Office.

(B)

The interagency committee established under section 5103 of the National Artificial Intelligence Initiative Act of 2020 (15 U.S.C. 9413).

(C)

The National Artificial Intelligence Advisory Committee.

(D)

Consensus standards issued by nongovernmental standards organizations.

(E)

The Cybersecurity and Infrastructure Security Agency.

(F)

Other departments, agencies, and instrumentalities of the Federal Government, as considered appropriate by the Secretary.

(5)

Submission to certification advisory committee

(6)

Submission to committees of congress

Upon completing the plan required under this subsection, the Secretary shall submit to the appropriate congressional committees a report containing the plan.

(7)

Limitation

The Secretary may not issue TEVV standards under subsection (c) until the date of the submission of the plan under paragraphs (5) and (6).

(c)

Standards

(1)

Standards

(A)

In general

The Secretary shall issue TEVV standards for critical-impact artificial intelligence systems.

(B)

Requirements

Each standard issued under this subsection shall—

(i)

be practicable;

(ii)

meet the need for safe, secure, and transparent operations of critical-impact artificial intelligence systems;

(iii)

with respect to a relevant standard issued by a nongovernmental standards organization that is already in place, not unintentionally contradict that standard;

(iv)

provide for a mechanism to, not less frequently than once every 2 years, solicit public comment and update the standard to reflect evidence about the utility of risk mitigation approaches and advancements in technology and system architecture; and

(v)

be stated in objective terms.

(2)

Considerations

In issuing TEVV standards for critical-impact artificial intelligence systems under this subsection, the Secretary shall—

(A)

consider relevant available information concerning critical-impact artificial intelligence systems, including—

(i)

transparency reports submitted under section 203(a);

(ii)

risk management assessments conducted under section 206(a); and

(iii)

any additional information provided to the Secretary pursuant to section 203(a)(1)(B);

(B)

consider whether a proposed standard is reasonable, practicable, and appropriate for the particular type of critical-impact artificial intelligence system for which the standard is proposed;

(C)

consult with stakeholders with expertise in addressing risks and design of artificial intelligence systems and review standards issued by nongovernmental standards organizations;

(D)

pursuant to paragraph (1)(B)(iii), consider whether adoption of a relevant standard issued by a nongovernmental standards organization as a TEVV standard is the most appropriate action; and

(E)

consider whether the standard takes into account—

(i)

transparent, replicable, and objective assessments of critical-impact artificial intelligence system risk, structure, capabilities, and design;

(ii)

the risk posed to the public by an applicable critical-impact artificial intelligence system; and

(iii)

the diversity of methodologies and innovative technologies and approaches available to meet the objectives of the standard.

(3)

Consultation

Before finalizing a TEVV standard issued under this subsection, the Secretary shall submit the TEVV standard to the advisory committee established under subsection (a) for review.

(4)

Public comment

Before issuing any TEVV standard under this subsection, the Secretary shall—

(A)

publish a notice describing the TEVV standard; and

(B)

provide an opportunity for public comment pursuant to section 553 of title 5, United States Code.

(5)

Cooperation

(6)

Effective date of standards

(A)

In general

The Secretary shall specify the effective date of a TEVV standard issued under this subsection in the order issuing the standard.

(B)

Limitation

Subject to subparagraph (C), a TEVV standard issued under this subsection may not become effective—

(i)

during the 180-day period following the date on which the TEVV standard is issued; and

(ii)

more than 1 year after the date on which the TEVV standard is issued.

(C)

Exception

Subparagraph (B) shall not apply to the effective date of a TEVV standard issued under this section if the Secretary—

(i)

finds, for good cause shown, that a different effective date is in the public interest; and

(ii)

publishes the reasons for the finding under clause (i).

(7)

Rule of construction

(d)

Exemptions

(1)

Authority to exempt and procedures

(A)

In general

The Secretary may exempt, on a temporary basis, a critical-impact artificial intelligence system from a TEVV standard issued under subsection (c) on terms the Secretary considers appropriate.

(B)

Renewal

An exemption under subparagraph (A)—

(i)

may be renewed only on reapplication; and

(ii)

shall conform to the requirements of this paragraph.

(C)

Proceedings

(i)

In general

The Secretary may begin a proceeding to grant an exemption to a critical-impact artificial intelligence system under this paragraph if the critical-impact AI organization that deployed the critical-impact artificial intelligence system applies for an exemption or a renewal of an exemption.

(ii)

Notice and comment

The Secretary shall publish notice of the application under clause (i) and provide an opportunity for public comment under section 553 of title 5, United States Code.

(iii)

Filing

An application for an exemption or for a renewal of an exemption under this paragraph shall be filed at such time and in such manner and contain such information as the Secretary may require.

(D)

Actions

The Secretary may grant an exemption under this paragraph upon finding that—

(i)

the exemption is consistent with the public interest and this section; and

(ii)

(2)

Disclosure

Not later than 30 days after the date on which an application is filed under this subsection, the Secretary may make public information contained in the application or relevant to the application, unless the information concerns or constitutes a trade secret or other confidential information not relevant to the application.

(3)

Notice of decision

(e)

Certification of compliance

(1)

In general

(2)

Exception

A critical-impact AI organization may not issue a certification under paragraph (1) if, in exercising reasonable care, the critical-impact AI organization has constructive knowledge that the certification is false or misleading in a material respect.

(3)

Developer obligations

The developer of a critical-impact artificial intelligence system that enters into a contractual or licensing agreement with a critical impact AI organization shall be subject to the same disclosure obligations as a developer of a critical impact artificial intelligence system under section 206(c).

(f)

Noncompliance findings and enforcement action

(1)

Finding of noncompliance by secretary

Upon learning that a critical-impact artificial intelligence system deployed by a critical-impact AI organization violates this section upon receiving a report of noncompliance pursuant to an investigation conducted under section 208(f) or through other means established through TEVV standards pursuant to this section, the Secretary shall—

(A)

immediately—

(i)

notify the critical-impact AI organization of the finding; and

(ii)

order the critical-impact AI organization to take remedial action to address the noncompliance of the artificial intelligence system; and

(B)

(2)

Actions by critical-impact ai organization

(A)

without undue delay, notify the Secretary by certified mail or electronic mail of the noncompliance or receipt of the notification of noncompliance;

(B)

take remedial action to address the noncompliance; and

(C)

not later than 10 days after the date of the notification or receipt under subparagraph (A), submit to the Secretary a report containing information on—

(i)

the nature and discovery of the noncompliant aspect of the critical-impact artificial intelligence system;

(ii)

measures taken to remedy such noncompliance; and

(iii)

actions taken by the critical-impact AI organization to address stakeholders affected by such noncompliance.

208.

Enforcement

(a)

In general

The Secretary shall take an action described in this section—

(1)

upon discovering noncompliance with a provision of this Act by a deployer of a high-impact artificial intelligence system, a critical-impact AI organization, or a developer of a critical-impact artificial intelligence system; and

(2)

if the Secretary determines that actions taken by the deployer of a high-impact artificial intelligence system, a critical-impact AI organization, or the developer of a critical-impact artificial intelligence system are insufficient to remedy the noncompliance.

(b)

Civil penalties

(1)

In general

The Secretary may impose a penalty described in paragraph (2) on a deployer of a high-impact artificial intelligence system or a critical-impact AI organization for each violation by that entity of this Act or any regulation or order issued under this Act.

(2)

Penalty described

The penalty described in this paragraph is the greater of—

(A)

an amount not to exceed $300,000; or

(B)

an amount that is twice the value of the artificial intelligence system product deployed that is the basis of the violation with respect to which the penalty is imposed.

(c)

Violation with intent

(1)

In general

If the Secretary determines that a deployer of a high-impact artificial intelligence system or a critical-impact AI organization intentionally violates this Act or any regulation or order issued under this Act, the Secretary may prohibit the critical-impact AI organization or deployer, as applicable, from deploying a critical-impact artificial intelligence system or a high-impact artificial intelligence system.

(2)

In addition

A prohibition imposed under paragraph (1) shall be in addition to any other civil penalties provided under this Act.

(d)

Factors

The Secretary may by regulation provide standards for establishing levels of civil penalty under this section based upon factors, such as the seriousness of the violation, the culpability of the violator, and such mitigating factors as the violator’s record of cooperation with the Secretary in disclosing the violation.

(e)

Civil action

(1)

In general

Upon referral by the Secretary, the Attorney General may bring a civil action in a United States district court to—

(A)

enjoin a violation of section 207; or

(B)

collect a civil penalty upon a finding of noncompliance with this Act.

(2)

Venue

A civil action may be brought under paragraph (1) in the judicial district in which the violation occurred or the defendant is found, resides, or does business.

(3)

Process

Process in a civil action under paragraph (1) may be served in any judicial district in which the defendant resides or is found.

(f)

Authority to investigate

The Secretary may conduct an investigation—

(1)

that may be necessary to enforce this Act or a TEVV standard or regulation prescribed pursuant to this Act; or

(2)

related to a report of noncompliance with this Act from a third party, a deployer or developer of an artificial intelligence system subject to the requirements of this Act, or discovered by the Secretary.

(g)

Rule of construction

Nothing in this section shall be construed to require a deployer of a critical-impact artificial intelligence system to disclose any information, including data or algorithms—

(1)

constituting a trade secret or other protected intellectual property right; or

(2)

that is confidential business information.

209.

Developer and deployer overlap

With respect to an entity that is a deployer and a developer, the entity shall be subject to the requirements of deployers and developers under this Act.

210.

Artificial intelligence consumer education

(a)

Establishment

Not later than 180 days after the date of enactment of this Act, the Secretary shall establish a working group relating to responsible education efforts for artificial intelligence systems.

(b)

Membership

(1)

In general

(A)

representatives of—

(i)

institutions of higher education;

(ii)

companies developing or operating artificial intelligence systems;

(iii)

consumers or consumer advocacy groups;

(iv)

public health organizations;

(v)

marketing professionals;

(vi)

entities with national experience relating to consumer education, including technology education;

(vii)

public safety organizations;

(viii)

rural workforce development advocates;

(ix)

enabling technology companies; and

(x)

nonprofit technology industry trade associations; and

(B)

any other members the Secretary considers to be appropriate.

(2)

Compensation

A member of the working group established under this section shall serve without compensation.

(c)

Duties

(1)

In general

The working group established under this section shall—

(A)

identify recommended education and programs that may be voluntarily employed by industry to inform—

(i)

consumers and other stakeholders with respect to artificial intelligence systems as those systems—

(I)

become available; or

(II)

are soon to be made widely available for public use or consumption; and

(B)

submit to Congress, and make available to the public, a report containing the findings and recommendations under subparagraph (A).

(2)

Factors for consideration

The working group established under this section shall take into consideration topics relating to—

(A)

the intent, capabilities, and limitations of artificial intelligence systems;

(B)

(C)

artificial intelligence research breakthroughs;

(D)

engagement and interaction methods, including how to adequately inform consumers of interaction with an artificial intelligence system;

(E)

human-machine interfaces;

(F)

emergency fallback scenarios;

(G)

operational boundary responsibilities;

(H)

potential mechanisms that could change function behavior in service;

(I)

consistent nomenclature and taxonomy for safety features and systems; and

(J)

digital literacy.

(3)

Consultation

The Secretary shall consult with the Chair of the Federal Trade Commission with respect to the recommendations of the working group established under this section, as appropriate.

(d)

Termination

The working group established under this section shall terminate on the date that is 2 years after the date of enactment of this Act.

211.

Severability

If any provision of this title, or an amendment made by this title, or the application of such provision to any person or circumstance is held to be unconstitutional, the remainder of this title, or an amendment made by this title, and the application of the provisions of such to all other persons or circumstances shall not be affected thereby.

December 18 (legislative day, December 16), 2024

Reported with an amendment