,,ii #aahth ,,congress #ast ,session ,s4 #cbje ,,in ,,the ,,senate ,,of ,,the ,,united ,,states ,november #b1 #bjbc,mr4 ,moran 7for himself and ,mr4 ,warner7 introduced the following bill2 which was read twice and referred to the ,committee on ,homeland ,security and ,governmental ,affairs ,a ,,bill ,to require ,federal agencies to use the ,artificial ,intelligence ,risk ,management ,framework developed by the ,national ,institute of ,standards and ,technology with respect to the use of artificial intelligence4 #a4 ,short title ,this ,act may be cited as the ,federal ,artificial ,intelligence ,risk ,management ,act of #bjbc4 #b4 ,agency use of artificial intelligence 7a7 ,definitions ,in this section3 7#a7 ,administrator ,the term ,administrator means the ,administrator of ,federal ,procurement ,policy4 7#b7 ,agency ,the term agency means any department1 independent establishment1 ,government corporation1 or other agency of the executive branch of the ,federal ,government4 7#c7 ,artificial intelligence ,the term artificial intelligence has the meaning given the term in section #ejjb of the ,national ,artificial ,intelligence ,initiative ,act of #bjbj 7#ae ,u4,s4,c4 #idja74 7#d7 ,director ,the term ,director means the ,director of the ,national ,institute of ,standards and ,technology4 7#e7 ,framework ,the term framework means document number ,,nist ,,ai #ajj-a of the ,national ,institute of ,standards and ,technology entitled ,artificial ,intelligence ,risk ,management ,framework1 or any successor document4 7#f7 ,playbook ,the term playbook means the ,,ai ,,rmf ,playbook developed by the ,national ,institute of ,standards and ,technology4 7#g7 ,profile ,the term profile means an implementation of the artificial intelligence risk management functions1 categories1 and subcategories for a specific setting or application based on the requirements1 risk tolerance1 and resources of the framework user4 7b7 ,requirements for agency use of artificial intelligence 7#a7 ,,omb ,guidance ,not later than #ahj days after the date on which the ,director of the ,national ,institute of ,standards and ,technology issues guidelines under paragraph 7#b71 the ,director of the ,office of ,management and ,budget shall issue guidance requiring agencies to incorporate the framework and the guidelines into their artificial intelligence risk management efforts1 consistent with such guidelines4 7#b7 ,,nist ,guidelines ,not later than #a year after the date of the enactment of this ,act1 the ,director of the ,national ,institute of ,standards and ,technology shall1 in consultation with the ,administrator1 issue guidance for agencies to incorporate the framework into the artificial intelligence risk management efforts of the agency1 which shall-- 7,a7 provide standards1 practices1 and tools consistent with the framework and how they can leverage the framework to reduce risks to people and the planet for agency implementation in the development1 procurement1 and use of artificial intelligence2 7,b7 specify appropriate cybersecurity strategies and the installation of effective cybersecurity tools to improve security of artificial intelligence systems2 7,c7 provide standards-- 7i7 that are consistent with the framework and ,circular ,a-#aai of the ,office of ,management and ,budget2 7ii7 that are tailored to risks that could endanger people and the planet2 and 7iii7 which a supplier of artificial intelligence for the agency must attest to meet before the head of an agency may procure artificial intelligence from that supplier2 7,d7 recommend training on the framework and the guidelines for each agency responsible for procuring artificial intelligence2 7,e7 set minimum requirements for developing profiles for agency use of artificial intelligence consistent with the framework2 and 7,f7 develop profiles for framework use for an entity that is a small business concern 7as defined in section #c of the ,small ,business ,act 7#ae ,u4,s4,c4 #fcb774 7#c7 ,additional requirements 7,a7 ,draft contract language ,the ,administrator shall1 in consultation with the ,director1 provide draft contract language for each agency to use in procurement that requires a supplier of artificial intelligence-- 7i7 to adhere to certain actions that are consistent with the framework2 and 7ii7 to provide appropriate access to data1 models1 and parameters1 as defined by the ,director1 to enable sufficient test and evaluation1 verification1 and validation4 7,b7 ,templates ,the ,director of the ,office of ,management and ,budget shall1 in consultation with the ,director1 provide a template for agency use on the guidance issued under paragraph 7#a7 that includes recommended procedures for implementation4 7#d7 ,conforming requirement ,the head of each agency shall conform any policy1 principle1 practice1 procedure1 or guideline governing the design1 development1 implementation1 deployment1 use1 or evaluation of an artificial intelligence system by the agency to the framework and to the guidance issued under paragraph 7#a74 7#e7 ,supporting material ,in carrying out paragraph 7#d71 the head of each agency may use the supporting materials of the framework1 including the playbook4 7#f7 ,study ,not later than #a year after the date of enactment of this ,act1 the ,comptroller ,general of the ,united ,states shall conduct a study on the impact of the application of the framework on agency use of artificial intelligence4 7#g7 ,reporting requirement ,not later than #a year after the date of the enactment of this ,act1 and not less frequently than once every #c years thereafter1 the ,director of the ,office of ,management and ,budget shall submit to ,congress a report on agency implementation of and conformity to the framework4 7#h7 ,exception for national security systems ,nothing in this subsection shall apply to a national security system 7as defined in section #ceeb of title #dd1 ,united ,states ,code74 7c7 ,requirements for agency procurement of artificial intelligence ,not later than #a year after the issuance of guidance pursuant to subsection 7b77#a71 the ,federal ,acquisition ,regulatory ,council shall promulgate regulations that provide for-- 7#a7 the requirements for the acquisition of artificial intelligence products1 services1 tools1 and systems1 to include risk-based compliance with the framework2 and 7#b7 solicitation provisions and contract clauses that include references to the requirements described in paragraph 7#a7 and the framework for use in artificial intelligence acquisitions4 7d7 ,artificial intelligence workforce 7#a7 ,in general ,not later than #ahj days after the date of the enactment of this ,act1 the ,director of the ,office of ,management and ,budget shall1 in consultation with the ,administrator of the ,general ,services ,administration1 establish an initiative to provide to agencies expertise on artificial intelligence pursuant to requests for such expertise by the heads of such agencies4 7#b7 ,elements ,the initiative established pursuant to paragraph 7#a7 shall include the following3 7,a7 ,the recruitment and hiring of interdisciplinary experts who can assist agencies in the development1 procurement1 use1 and assessment of artificial intelligence tools4 7,b7 ,a process for establishing development and deployment guidelines and tools for managing artificial intelligence risks under which the initiative can assist agencies4 7,c7 ,consultation with existing initiatives1 including ,united ,states ,digital ,service and the technology transformation services of the ,general ,services ,administration1 to incorporate best practices for assisting agencies in the development1 procurement1 use1 and assessment of artificial intelligence tools4 7e7 ,testing and evaluation of artificial intelligence 7#a7 ,study ,not later than #ij days after the date of the enactment of this ,act1 the ,director of the ,national ,institute of ,standards and ,technology shall complete a study to review the existing and forthcoming voluntary consensus standards for the test1 evaluation1 verification1 and validation of artificial intelligence acquisitions4 7#b7 ,development of voluntary consensus standards ,not later than #ij days after the date of the completion of the study required by paragraph 7#a71 the ,director shall-- 7,a7 convene relevant stakeholders to develop voluntary consensus standards for the test1 evaluation1 verification1 and validation of artificial intelligence acquisitions2 7,b7 upon completion of the standards described in subparagraph 7,a7 or within #a year1 whichever is sooner-- 7i7 develop methods and principles1 based on the standards described in subparagraph 7,a71 for the conduct of test1 evaluation1 verification1 and validation of artificial intelligence acquisitions2 7ii7 establish the resources for the conduct of test1 evaluation1 verification1 and validation of artificial intelligence acquisitions2 7iii7 monitor and review all test1 evaluation1 verification1 and validation of artificial intelligence acquisitions2 and 7iv7 review and make recommendations to the head of each agency of risks to people and the plant on relevant artificial intelligence acquisitions2 and 7,c7 continuously update the methods and principles described in subparagraph 7,b77i7 based on evolving voluntary consensus standards4