,,ii #aahth ,,congress #ast ,session ,s4 #ccab ,,in ,,the ,,senate ,,of ,,the ,,united ,,states ,november #ae1 #bjbc,mr4 ,thune 7for himself1 ,ms4 ,klobuchar1 ,mr4 ,wicker1 ,mr4 ,hickenlooper1 ,mr4 ,lujn1 and ,mrs4 ,capito7 introduced the following bill2 which was read twice and referred to the ,committee on ,commerce1 ,science1 and ,transportation ,a ,,bill ,to provide a framework for artificial intelligence innovation and accountability1 and for other purposes4 #a4 ,short title ,this ,act may be cited as the ,artificial ,intelligence ,research1 ,innovation1 and ,accountability ,act of #bjbc4 #b4 ,table of contents ,the table of contents for this ,act is as follows3 ,sec4 #a4 ,short title4,sec4 #b4 ,table of contents4,,title ,i--,artificial intelligence research and innovation,sec4 #aja4 ,open data policy amendments4,sec4 #ajb4 ,online content authenticity and provenance standards research and development4,sec4 #ajc4 ,standards for detection of emergent and anomalous behavior and ,,ai-generated media4,sec4 #ajd4 ,comptroller ,general study on barriers and best practices to usage of ,,ai in government4,,title ,,ii--,artificial intelligence accountability,sec4 #bja4 ,definitions4,sec4 #bjb4 ,generative artificial intelligence transparency4,sec4 #bjc4 ,transparency reports for high-impact artificial intelligence systems4,sec4 #bjd4 ,recommendations to ,federal agencies for risk management of high-impact artificial intelligence systems4,sec4 #bje4 ,office of ,management and ,budget oversight of recommendations to agencies4,sec4 #bjf4 ,risk management assessment for critical-impact artificial intelligence systems4,sec4 #bjg4 ,certification of critical-impact artificial intelligence systems4,sec4 #bjh4 ,enforcement4,sec4 #bji4 ,artificial intelligence consumer education4 ,i ,artificial intelligence research and innovation #aja4 ,open data policy amendments ,section #cejb of title #dd1 ,united ,states ,code1 is amended-- 7#a7 in paragraph 7#bb7-- 7,a7 by inserting or data model after a data asset2 and 7,b7 by striking and at the end2 7#b7 in paragraph 7#bc71 by striking the period at the end and inserting a semicolon2 and 7#c7 by adding at the end the following3 7#bd7 the term data model means a mathematical1 economic1 or statistical representation of a system or process used to assist in making calculations and predictions1 including through the use of algorithms1 computer programs1 or artificial intelligence systems2 and 7#be7 the term artificial intelligence system means an engineered system that-- 7,a7 generates outputs1 such as content1 predictions1 recommendations1 or decisions for a given set of objectives2 and 7,b7 is designed to operate with varying levels of adaptability and autonomy using machine and human-based inputs4 4 #ajb4 ,online content authenticity and provenance standards research and development 7a7 ,research 7#a7 ,in general ,not later than #ahj days after the date of the enactment of this ,act1 the ,under ,secretary of ,commerce for ,standards and ,technology shall carry out research to facilitate the development and standardization of means to provide authenticity and provenance information for content generated by human authors and artificial intelligence systems4 7#b7 ,elements ,the research carried out pursuant to paragraph 7#a7 shall cover the following3 7,a7 ,secure and binding methods for human authors of content to append statements of provenance through the use of unique credentials1 watermarking1 or other data or metadata-based approaches4 7,b7 ,methods for the verification of statements of content provenance to ensure authenticity such as watermarking or classifiers1 which are trained models that distinguish artificial intelligence-generated media4 7,c7 ,methods for displaying clear and conspicuous statements of content provenance to the end user4 7,d7 ,technologies or applications needed to facilitate the creation and verification of content provenance information4 7,e7 ,mechanisms to ensure that any technologies and methods developed under this section are minimally burdensome on content producers4 7,f7 ,such other related processes1 technologies1 or applications as the ,under ,secretary considers appropriate4 7,g7 ,use of provenance technology to enable attribution for content creators4 7#c7 ,implementation ,the ,under ,secretary shall carry out the research required by paragraph 7#a7 as part of the research directives pursuant to section #bb;,a7b77#a7 of the ,national ,institute of ,standards and ,technology ,act 7#ae ,u4,s4,c4 #bgh;h-#a7;b77#a774 7b7 ,development of standards 7#a7 ,in general ,for methodologies and applications related to content provenance and authenticity deemed by the ,under ,secretary to be at a readiness level sufficient for standardization1 the ,under ,secretary shall provide technical review and assistance to such other ,federal agencies and nongovernmental standards organizations as the ,under ,secretary considers appropriate4 7#b7 ,considerations ,in providing any technical review and assistance related to the development of content provenance and authenticity standards under this subsection1 the ,under ,secretary may-- 7,a7 consider whether a proposed standard is reasonable1 practicable1 and appropriate for the particular type of media and media environment for which the standard is proposed2 7,b7 consult with relevant stakeholders2 and 7,c7 review industry standards issued by nongovernmental standards organizations4 7c7 ,pilot program 7#a7 ,in general ,the ,under ,secretary shall carry out a pilot program to assess the feasibility and advisability of using available technologies and creating open standards to facilitate the creation and verification of content governance information for digital content4 7#b7 ,locations ,the pilot program required by paragraph 7#a7 shall be carried out at not more than #b ,federal agencies the ,under ,secretary shall select for purposes of the pilot program required by paragraph 7#a74 7#c7 ,requirements ,in carrying out the pilot program required by paragraph 7#a71 the ,under ,secretary shall-- 7,a7 apply and evaluate methods for authenticating the origin of and modifications to government-produced digital content using technology and open standards described in paragraph 7#a72 and 7,b7 make available to the public digital content embedded with provenance or other authentication provided by the heads of the ,federal agencies selected pursuant to paragraph 7#b7 for the purposes of the pilot program4 7#d7 ,briefing required ,not later than #a year after the date of the enactment of this ,act1 and annually thereafter until the date described in paragraph 7#e71 the ,under ,secretary shall brief the ,committee on ,commerce1 ,science1 and ,transportation of the ,senate and the ,committee on ,science1 ,space1 and ,technology of the ,house of ,representatives on the findings of the ,under ,secretary with respect to the pilot program carried out under this subsection4 7#e7 ,termination ,the pilot program shall terminate on the date that is #aj years after the date of the enactment of this ,act4 7d7 ,report to ,congress ,not later than #a year after the date of the enactment of this ,act1 the ,under ,secretary shall submit to the ,committee on ,commerce1 ,science1 and ,transportation of the ,senate and the ,committee on ,science1 ,space1 and ,technology of the ,house of ,representatives a report outlining the progress of standardization initiatives relating to requirements under this section1 as well as recommendations for legislative or administrative action to encourage or require the widespread adoption of such initiatives in the ,united ,states4 #ajc4 ,standards for detection of emergent and anomalous behavior and ,,ai-generated media ,section #bb;,a7b77#a7 of the ,national ,institute of ,standards and ,technology ,act 7#ae ,u4,s4,c4 #bgh;h-#a7;b77#a77 is amended-- 7#a7 by redesignating subparagraph 7,i7 as subparagraph 7,k72 7#b7 in subparagraph 7,h71 by striking 2 and and inserting a semicolon2 and 7#c7 by inserting after subparagraph 7,h7 the following3 7,i7 best practices for detecting outputs generated by artificial intelligence systems1 including content such as text1 audio1 images1 and videos2 7,j7 methods to detect and understand anomalous behavior of artificial intelligence systems and safeguards to mitigate potentially adversarial or compromising anomalous behavior2 and 4 #ajd4 ,comptroller ,general study on barriers and best practices to usage of ,,ai in government 7a7 ,in general ,not later than #a year after the date of enactment of this ,act1 the ,comptroller ,general of the ,united ,states shall-- 7#a7 conduct a review of statutory1 regulatory1 and other policy barriers to the use of artificial intelligence systems to improve the functionality of the ,federal ,government2 and 7#b7 identify best practices for the adoption and use of artificial intelligence systems by the ,federal ,government1 including-- 7,a7 ensuring that an artificial intelligence system is proportional to the need of the ,federal ,government2 7,b7 restrictions on access to and use of an artificial intelligence system based on the capabilities and risks of the artificial intelligence system2 and 7,c7 safety measures that ensure that an artificial intelligence system is appropriately limited to necessary data and compartmentalized from other assets of the ,federal ,government4 7b7 ,report ,not later than #b years after the date of enactment of this ,act1 the ,comptroller ,general of the ,united ,states shall submit to the ,committee on ,commerce1 ,science1 and ,transportation of the ,senate and the ,committee on ,science1 ,space1 and ,technology of the ,house of ,representatives a report that-- 7#a7 summarizes the results of the review conducted under subsection 7a77#a7 and the best practices identified under subsection 7a77#b71 including recommendations1 as the ,comptroller ,general of the ,united ,states considers appropriate2 7#b7 describes any laws1 regulations1 guidance documents1 or other policies that may prevent the adoption of artificial intelligence systems by the ,federal ,government to improve certain functions of the ,federal ,government1 including-- 7,a7 data analysis and processing2 7,b7 paperwork reduction2 7,c7 contracting and procurement practices2 and 7,d7 other ,federal ,government services2 and 7#c7 includes1 as the ,comptroller ,general of the ,united ,states considers appropriate1 recommendations to modify or eliminate barriers to the use of artificial intelligence systems by the ,federal ,government4 ,,ii ,artificial intelligence accountability #bja4 ,definitions ,in this title3 7#a7 ,appropriate congressional committees ,the term appropriate congressional committees means-- 7,a7 the ,committee on ,energy and ,natural ,resources and the ,committee on ,commerce1 ,science1 and ,transportation of the ,senate2 7,b7 the ,committee on ,energy and ,commerce of the ,house of ,representatives2 and 7,c7 each congressional committee with jurisdiction over an applicable covered agency4 7#b7 ,artificial intelligence system ,the term artificial intelligence system means an engineered system that-- 7,a7 generates outputs1 such as content1 predictions1 recommendations1 or decisions for a given set of human-defined objectives2 and 7,b7 is designed to operate with varying levels of adaptability and autonomy using machine and human-based inputs4 7#c7 ,covered agency the term covered agency means an agency for which the ,under ,secretary develops an ,,nist recommendation4 7#d7 ,covered internet platform 7,a7 ,in general ,the term covered internet platform-- 7i7 means any public-facing website1 consumer-facing internet application1 or mobile application available to consumers in the ,united ,states2 and 7ii7 includes a social network site1 video sharing service1 search engine1 and content aggregation service4 7,b7 ,exclusions ,the term covered internet platform does not include a platform that-- 7i7 is wholly owned1 controlled1 and operated by a person that-- 7,i7 during the most recent #ahj-;day period1 did not employ more than #ejj employees2 7,,ii7 during the most recent #c-year period1 averaged less than #ej1jjj1jjj in annual gross receipts2 and 7,,iii7 on an annual basis1 collects or processes the personal data of less than #a1jjj1jjj individuals2 or 7ii7 is operated for the sole purpose of conducting research that is not directly or indirectly made for profit4 7#e7 ,critical-impact ,,ai organization ,the term critical-impact ,,ai organization means a non-government organization that serves as the deployer of a critical-impact artificial intelligence system4 7#f7 ,critical-impact artificial intelligence system ,the term critical-impact artificial intelligence system means an artificial intelligence system that-- 7,a7 is deployed for a purpose other than solely for use by the ,department of ,defense or an intelligence agency 7as defined in section #cjid7;e7 of the ,national ,security ,act of #aidg 7#ej ,u4,s4,c4 #cjid7c7772 and 7,b7 is used or intended to be used-- 7i7 to make decisions that have a legal or similarly significant effect on-- 7,i7 the real-time or ex post facto collection of biometric data of natural persons by biometric identification systems without their consent2 7,,ii7 the direct management and operation of critical infrastructure 7as defined in section #ajaf7;e7 of the ,,usa ,,patriot ,act 7#db ,u4,s4,c4 #eaie;c7e777 and space-based infrastructure2 or 7,,iii7 criminal justice 7as defined in section #ija of title ,i of the ,omnibus ,crime ,control and ,safe ,streets ,act of #aifh 7#cd ,u4,s4,c4 #ajbea772 and 7ii7 in a manner that poses a significant risk to rights afforded under the ,constitution of the ,united ,states or safety4 7#g7 ,deployer ,the term deployer-- 7,a7 means an entity that uses or operates an artificial intelligence system for internal use or for use by third parties2 and 7,b7 does not include an entity that is solely an end user of a system4 7#h7 ,developer ,the term developer means an entity that-- 7,a7 designs1 codes1 produces1 or owns an artificial intelligence system for internal use or for use by a third party as a baseline model2 and 7,b7 does not act as a deployer of the artificial intelligence system described in subparagraph 7,a74 7#i7 ,generative artificial intelligence system ,the term generative artificial intelligence system means an artificial intelligence system that generates novel data or content in a written1 audio1 or visual format4 7#aj7 ,high-impact artificial intelligence system ,the term high-impact artificial intelligence system means an artificial intelligence system-- 7,a7 deployed for a purpose other than solely for use by the ,department of ,defense or an intelligence agency 7as defined in section #cjid7;e7 of the ,national ,security ,act of #aidg 7#ej ,u4,s4,c4 #cjid7c7772 and 7,b7 that is specifically developed with the intended purpose of making decisions that have a legal or similarly significant effect on the access of an individual to housing1 employment1 credit1 education1 healthcare1 or insurance in a manner that poses a significant risk to rights afforded under the ,constitution of the ,united ,states or safety4 7#aa7 ,,nist recommendation ,the term ,,nist recommendation means a sector-specific recommendation developed under section #bb;,b7b77#a7 of the ,national ,institute of ,standards and ,technology ,act1 as added by section #bjd of this ,act4 7#ab7 ,secretary ,the term ,secretary means the ,secretary of ,commerce4 7#ac7 ,significant risk ,the term significant risk means a combination of severe1 high-intensity1 high-probability1 and long-duration risk of harm to individuals4 7#ad7 ,,tevv ,the term ,,tevv means the testing1 evaluation1 validation1 and verification of any artificial intelligence system that includes-- 7,a7 open1 transparent1 testable1 and verifiable specifications that characterize realistic operational performance1 such as precision and accuracy for relevant tasks2 7,b7 testing methodologies and metrics that enable the evaluation of system trustworthiness1 including robustness and resilience2 7,c7 data quality standards for training and testing datasets2 7,d7 requirements for system validation and integration into production environments1 automated testing1 and compliance with existing legal and regulatory specifications2 7,e7 methods and tools for-- 7i7 the monitoring of system behavior2 7ii7 the tracking of incidents or errors reported and their management2 and 7iii7 the detection of emergent properties and related impacts2 and 7,f7 and processes for redress and response4 7#ae7 ,under ,secretary ,the term ,under ,secretary means the ,director of the ,national ,institute of ,standards and ,technology4 #bjb4 ,generative artificial intelligence transparency 7a7 ,prohibition 7#a7 ,in general ,subject to paragraph 7#b71 it shall be unlawful for a person to operate a covered internet platform that uses a generative artificial intelligence system4 7#b7 ,disclosure of use of generative artificial intelligence systems 7,a7 ,in general ,a person may operate a covered internet platform that uses a generative artificial intelligence system if the person provides notice to each user of the covered internet platform that the covered internet platform uses a generative artificial intelligence system to generate content the user sees4 7,b7 ,requirements ,a person providing the notice described in subparagraph 7,a7 to a user-- 7i7 subject to clause 7ii71 shall provide the notice in a clear and conspicuous manner on the covered internet platform before the user interacts with content produced by a generative artificial intelligence system2 and 7ii7 may provide an option for the user to choose to see the notice described in clause 7i7 only upon the first interaction of the user with content produced by a generative artificial intelligence system4 7b7 ,enforcement action ,upon learning that a covered internet platform does not comply with the requirements under this section1 the ,secretary-- 7#a7 shall immediately-- 7,a7 notify the covered internet platform of the finding2 and 7,b7 order the covered internet platform to take remedial action to address the noncompliance of the generative artificial intelligence system operated by the covered internet platform2 and 7#b7 may1 as determined appropriate or necessary by the ,secretary1 take enforcement action under section #bjh if the covered internet platform does not take sufficient action to remedy the noncompliance within #ae days of the notification under paragraph 7#a77;,a74 7c7 ,effective date ,this section shall take effect on the date that is #ahj days after the date of enactment of this ,act4 #bjc4 ,transparency reports for high-impact artificial intelligence systems 7a7 ,transparency reporting 7#a7 ,in general ,each deployer of a high-impact artificial intelligence system shall-- 7,a7 before deploying the high-impact artificial intelligence system1 and annually thereafter1 submit to the ,secretary a report describing the design and safety plans for the artificial intelligence system2 and 7,b7 submit to the ,secretary an updated report on the high-impact artificial intelligence system if the deployer makes a material change to-- 7i7 the purpose for which the high-impact artificial intelligence system is used2 or 7ii7 the type of data the high-impact artificial intelligence system processes or uses for training purposes4 7#b7 ,contents ,each transparency report submitted under paragraph 7#a7 shall include1 with respect to the high-impact artificial intelligence system-- 7,a7 the purpose2 7,b7 the intended use cases2 7,c7 deployment context2 7,d7 benefits2 7,e7 a description of data that the high-impact artificial intelligence system1 once deployed1 processes as inputs2 7,f7 if available-- 7i7 a list of data categories and formats the deployer used to retrain or continue training the high-impact artificial intelligence system2 7ii7 metrics for evaluating the high-impact artificial intelligence system performance and known limitations2 and 7iii7 transparency measures1 including information identifying to individuals when a high-impact artificial intelligence system is in use2 7,g7 processes and testing performed before each deployment to ensure the high-impact artificial intelligence system is safe1 reliable1 and effective2 7,h7 if applicable1 an identification of any third-party artificial intelligence systems or datasets the deployer relies on to train or operate the high-impact artificial intelligence system2 and 7,i7 post-deployment monitoring and user safeguards1 including a description of the oversight process in place to address issues as issues arise4 7b7 ,developer obligations ,the developer of a high-impact artificial intelligence system shall be subject to the same obligations as a developer of a critical impact artificial intelligence system under section #bjf7;c74 7c7 ,considerations ,in carrying out subsections 7a7 and 7b71 a deployer or developer of a high-impact artificial intelligence system shall consider the best practices outlined in the most recent version of the risk management framework developed pursuant to section #bb;,a7c7 of the ,national ,institute of ,standards and ,technology ,act 7#ae ,u4,s4,c4 #bgh;h-#a7;c774 7d7 ,noncompliance and enforcement action ,upon learning that a deployer of a high-impact artificial intelligence system is not in compliance with the requirements under this section with respect to a high-impact artificial intelligence system1 the ,secretary-- 7#a7 shall immediately-- 7,a7 notify the deployer of the finding2 and 7,b7 order the deployer to immediately submit to the ,secretary the report required under subsection 7a77#a72 and 7#b7 if the deployer fails to submit the report by the date that is #ae days after the date of the notification under paragraph 7#a77;,a71 may take enforcement action under section #bjh4 7e7 ,avoidance of duplication 7#a7 ,in general ,pursuant to the deconfliction of duplicative requirements under paragraph 7#b71 the ,secretary shall ensure that the requirements under this section are not unnecessarily burdensome or duplicative of requirements made or oversight conducted by a covered agency regarding the non-,federal use of high-impact artificial intelligence systems4 7#b7 ,deconfliction of duplicative requirements ,not later than #ij days after the date of the enactment of this ,act1 and annually thereafter1 the ,secretary1 in coordination with the head of any relevant covered agency1 shall complete the deconfliction of duplicative requirements relating to the submission of a transparency report for a high-impact artificial intelligence system under this section4 7f7 ,rule of construction ,nothing in this section shall be construed to require a deployer of a high-impact artificial intelligence system to disclose any information1 including data or algorithms-- 7#a7 relating to a trade secret or other protected intellectual property right2 7#b7 that is confidential business information2 or 7#c7 that is privileged4 #bjd4 ,recommendations to ,federal agencies for risk management of high-impact artificial intelligence systems ,the ,national ,institute of ,standards and ,technology ,act 7#ae ,u4,s4,c4 #bgh;h-#a7 is amended by inserting after section #bb;,a the following3 #bb;,b4 ,recommendations to ,federal agencies for sector-specific oversight of artificial intelligence 7a7 ,definition of high-,impact artificial intelligence system ,in this section1 the term high-impact artificial intelligence system means an artificial intelligence system-- 7#a7 deployed for purposes other than those solely for use by the ,department of ,defense or an element of the intelligence community 7as defined in section #c of the ,national ,security ,act of #aidg 7#ej ,u4,s4,c4 #cjjc772 and 7#b7 that is specifically developed with the intended purpose of making decisions that have a legal or similarly significant effect on the access of an individual to housing1 employment1 credit1 education1 health care1 or insurance in a manner that poses a significant risk to rights afforded under the ,constitution of the ,united ,states or to safety4 7b7 ,sector-,specific recommendations ,not later than #a year after the date of the enactment of the ,artificial ,intelligence ,research1 ,innovation1 and ,accountability ,act of #bjbc1 the ,director shall-- 7#a7 develop sector-specific recommendations for individual ,federal agencies to conduct oversight of the non-,federal1 and1 as appropriate1 ,federal use of high-impact artificial intelligence systems to improve the safe and responsible use of such systems2 and 7#b7 not less frequently than biennially1 update the sector-specific recommendations to account for changes in technological capabilities or artificial intelligence use cases4 7c7 ,requirements ,in developing recommendations under subsection 7b71 the ,director shall use the voluntary risk management framework required by section #bb;,a7c7 to identify and provide recommendations to a ,federal agency-- 7#a7 to establish regulations1 standards1 guidelines1 best practices1 methodologies1 procedures1 or processes to facilitate oversight of non-,federal use of high-impact artificial intelligence systems2 and 7#b7 to mitigate risks from such high-impact artificial intelligence systems4 7d7 ,recommendations ,in developing recommendations under subsection 7b71 the ,director may include the following3 7#a7 ,key design choices made during high-impact artificial intelligence model development1 including rationale and assumptions made4 7#b7 ,intended use and users1 other possible use cases1 including any anticipated undesirable or potentially harmful use cases1 and what good faith efforts model developers can take to mitigate the use of the system in harmful ways4 7#c7 ,methods for evaluating the safety of high-impact artificial intelligence systems and approaches for responsible use4 7#d7 ,sector-specific differences in what constitutes acceptable high-impact artificial intelligence model functionality and trustworthiness1 metrics used to determine high-impact artificial intelligence model performance1 and any test results reflecting application of these metrics to evaluate high-impact artificial intelligence model performance across different sectors4 7#e7 ,recommendations to support iterative development of subsequent recommendations under subsection 7b74 7e7 ,consultation ,in developing recommendations under subsection 7b71 the ,director shall1 as the ,director considers applicable and practicable1 consult with relevant covered agencies and stakeholders representing perspectives from civil society1 academia1 technologists1 engineers1 and creators4 4 #bje4 ,office of ,management and ,budget oversight of recommendations to agencies 7a7 ,recommendations 7#a7 ,in general ,not later than #a year after the date of enactment of this ,act1 the ,under ,secretary shall submit to the ,director1 the head of each covered agency1 and the appropriate congressional committees each ,,nist recommendation4 7#b7 ,agency responses to recommendations ,not later than #ij days after the date on which the ,under ,secretary submits a ,,nist recommendation to the head of a covered agency under paragraph 7#a71 the head of the covered agency shall transmit to the ,director a formal written response to the ,,nist recommendation that-- 7,a7 indicates whether the head of the covered agency intends to-- 7i7 carry out procedures to adopt the complete ,,nist recommendation2 7ii7 carry out procedures to adopt a part of the ,,nist recommendation2 or 7iii7 refuse to carry out procedures to adopt the ,,nist recommendation2 and 7,b7 includes-- 7i7 with respect to a formal written response described in clause 7i7 or 7ii7 of subparagraph 7,a71 a copy of a proposed timetable for completing the procedures described in that clause2 7ii7 with respect to a formal written response described in subparagraph 7,a77ii71 the reasons for the refusal to carry out procedures with respect to the remainder of the ,,nist recommendation described in that subparagraph2 and 7iii7 with respect to a formal written response described in subparagraph 7,a77iii71 the reasons for the refusal to carry out procedures4 7b7 ,public availability ,the ,director shall make a copy of each ,,nist recommendation and each written formal response of a covered agency required under subsection 7a77#b7 available to the public at reasonable cost4 7c7 ,reporting requirements 7#a7 ,annual secretarial regulatory status reports 7,a7 ,in general ,on the first ,february #a occurring after the date of enactment of this ,act1 and annually thereafter until the date described in subparagraph 7,b71 the head of each covered agency shall submit to the ,director a report containing the regulatory status of each ,,nist recommendation4 7,b7 ,continued reporting ,the date described in this subparagraph is the date on which the head of a covered agency-- 7i7 takes final regulatory action with respect to a ,,nist recommendation2 and 7ii7 determines and states in a report required under subparagraph 7,a7 that no regulatory action should be taken with respect to a ,,nist recommendation4 7#b7 ,compliance report to ,congress ,on ,april #a of each year1 the ,director shall-- 7,a7 review the reports received under paragraph 7#a77;,a72 and 7,b7 transmit comments on the reports to the heads of covered agencies and the appropriate congressional committees4 7#c7 ,failure to report ,if1 on ,march #a of each year1 the ,director has not received a report required under paragraph 7#a77;,a7 from the head of a covered agency1 the ,director shall notify the appropriate congressional committees of the failure4 7d7 ,technical assistance in carrying out recommendations ,the ,under ,secretary shall provide assistance to the heads of covered agencies relating to the implementation of the ,,nist recommendations the heads of covered agencies intend to carry out4 7e7 ,regulation review and improvement ,the ,administrator of the ,office of ,information and ,regulatory ,affairs of the ,office of ,management and ,budget1 in consultation with the ,under ,secretary1 shall develop and periodically revise performance indicators and measures for sector-specific regulation of artificial intelligence4 #bjf4 ,risk management assessment for critical-impact artificial intelligence systems 7a7 ,requirement 7#a7 ,in general ,each critical-impact ,,ai organization shall perform a risk management assessment in accordance with this section4 7#b7 ,assessment ,each critical-impact ,,ai organization shall-- 7,a7 not later than #cj days before the date on which a critical-impact artificial intelligence system is made publicly available by the critical-impact ,,ai organization1 perform a risk management assessment2 and 7,b7 not less frequently than biennially during the period beginning on the date of enactment of this ,act and ending on the date on which the applicable critical-impact artificial intelligence system is no longer being made publicly available by the critical-impact ,,ai organization1 as applicable1 conduct an updated risk management assessment that-- 7i7 may find that no significant changes were made to the critical-impact artificial intelligence system2 and 7ii7 provides1 to the extent practicable1 aggregate results of any significant deviation from expected performance detailed in the assessment performed under subparagraph 7,a7 or the most recent assessment performed under this subparagraph4 7#c7 ,review 7,a7 ,in general ,not later than #ij days after the date of completion of a risk management assessment by a critical-impact ,,ai organization under this section1 the critical-impact ,,ai organization shall submit to the ,secretary a report-- 7i7 outlining the assessment performed under this section2 and 7ii7 that is in a consistent format1 as determined by the ,secretary4 7,b7 ,additional information ,subject to subsection 7d71 the ,secretary may request that a critical-impact ,,ai organization submit to the ,secretary any related additional or clarifying information with respect to a risk management assessment performed under this section4 7#d7 ,limitation ,the ,secretary may not prohibit a critical-impact ,,ai organization from making a critical-impact artificial intelligence system available to the public based on the review by the ,secretary of a report submitted under paragraph 7#c77;,a7 or additional or clarifying information submitted under paragraph 7#c77;,b74 7b7 ,assessment subject areas ,each assessment performed by a critical-impact ,,ai organization under subsection 7a7 shall describe the means by which the critical-impact ,,ai organization is addressing1 through a documented ,,tevv process1 the following categories3 7#a7 ,policies1 processes1 procedures1 and practices across the organization relating to transparent and effective mapping1 measuring1 and managing of artificial intelligence risks1 including-- 7,a7 how the organization understands1 manages1 and documents legal and regulatory requirements involving artificial intelligence2 7,b7 how the organization integrates characteristics of trustworthy artificial intelligence1 which include valid1 reliable1 safe1 secure1 resilient1 accountable1 transparent1 globally and locally explainable1 interpretable1 privacy-enhanced1 and fair with harmful bias managed1 into organizational policies1 processes1 procedures1 and practices2 7,c7 a methodology to determine the needed level of risk management activities based on the organization's risk tolerance2 and 7,d7 how the organization establishes risk management processes and outcomes through transparent policies1 procedures1 and other controls based on organizational risk priorities4 7#b7 ,the structure1 context1 and capabilities of the critical-impact artificial intelligence system or critical-impact foundation model1 including-- 7,a7 how the context was established and understood2 7,b7 capabilities1 targeted uses1 goals1 and expected costs and benefits2 and 7,c7 how risks and benefits are mapped for each system component4 7#c7 ,a description of how the organization employs quantitative1 qualitative1 or mixed-method tools1 techniques1 and methodologies to analyze1 assess1 benchmark1 and monitor artificial intelligence risk1 including-- 7,a7 identification of appropriate methods and metrics2 7,b7 how artificial intelligence systems are evaluated for trustworthy characteristics2 7,c7 mechanisms for tracking artificial intelligence system risks over time2 and 7,d7 processes for gathering and assessing feedback relating to the efficacy of measurement4 7#d7 ,a description of allocation of risk resources to map and measure risks on a regular basis as described in paragraph 7#a71 including-- 7,a7 how artificial intelligence risks based on assessments and other analytical outputs described in paragraphs 7#b7 and 7#c7 are prioritized1 responded to1 and managed2 7,b7 how strategies to maximize artificial intelligence benefits and minimize negative impacts were planned1 prepared1 implemented1 documented1 and informed by input from relevant artificial intelligence deployers2 7,c7 management of artificial intelligence system risks and benefits2 and 7,d7 regular monitoring of risk treatments1 including response and recovery1 and communication plans for the identified and measured artificial intelligence risks1 as applicable4 7c7 ,developer obligations ,the developer of a critical-impact artificial intelligence system that agrees through a contract or license to provide technology or services to a deployer of the critical-impact artificial intelligence system shall provide to the deployer of the critical-impact artificial intelligence system the information reasonably necessary for the deployer to comply with the requirements under subsection 7a71 including-- 7#a7 an overview of the data used in training the baseline artificial intelligence system provided by the developer1 including-- 7,a7 data size2 7,b7 data sources2 7,c7 copyrighted data2 and 7,d7 personal identifiable information2 7#b7 documentation outlining the structure and context of the baseline artificial intelligence system of the developer1 including-- 7,a7 input modality2 7,b7 output modality2 7,c7 model size2 and 7,d7 model architecture2 7#c7 known capabilities1 limitations1 and risks of the baseline artificial intelligence system of the developer at the time of the development of the artificial intelligence system2 and 7#d7 documentation for downstream use1 including-- 7,a7 a statement of intended purpose2 7,b7 guidelines for the intended use of the artificial intelligence system1 including a list of permitted1 restricted1 and prohibited uses and users2 and 7,c7 a statement of the potential for deviation from the intended purpose of the baseline artificial intelligence system4 7d7 ,termination of obligation ,to disclose information 7#a7 ,in general ,the obligation of a critical-impact ,,ai organization to provide information1 upon request of the ,secretary1 relating to a specific assessment category under subsection 7b7 shall end on the date of issuance of a relevant standard applicable to the same category of a critical-impact artificial intelligence system by-- 7,a7 the ,secretary under section #bjg7;c7 with respect to a critical-impact artificial intelligence system2 7,b7 another department or agency of the ,federal ,government1 as determined applicable by the ,secretary2 or 7,c7 a non-governmental standards organization1 as determined appropriate by the ,secretary4 7#b7 ,effect of new standard ,in adopting any standard applicable to critical-impact artificial intelligence systems under section #bjg7;c71 the ,secretary shall-- 7,a7 identify the category under subsection 7b7 to which the standard relates1 if any2 and 7,b7 specify the information that is no longer required to be included in a report required under subsection 7a7 as a result of the new standard4 7e7 ,rule of construction ,nothing in this section shall be construed to require a critical-impact ,,ai organization1 or permit the ,secretary1 to disclose any information1 including data or algorithms-- 7#a7 relating to a trade secret or other protected intellectual property right2 7#b7 that is confidential business information2 or 7#c7 that is privileged4 #bjg4 ,certification of critical-impact artificial intelligence systems 7a7 ,establishment of ,artificial ,intelligence ,certification ,advisory ,committee 7#a7 ,in general ,not later than #ahj days after the date of enactment of this ,act1 the ,secretary shall establish an advisory committee to provide advice and recommendations on ,,tevv standards and the certification of critical-impact artificial intelligence systems4 7#b7 ,duties ,the advisory committee established under this section shall advise the ,secretary on matters relating to the testing and certification of critical-impact artificial intelligence systems1 including by-- 7,a7 providing recommendations to the ,secretary on proposed ,,tevv standards to ensure such standards-- 7i7 maximize alignment and interoperability with standards issued by nongovernmental standards organizations and international standards bodies2 7ii7 are performance-based and impact-based2 and 7iii7 are applicable or necessary to facilitate the deployment of critical-impact artificial intelligence systems in a transparent1 secure1 and safe manner2 7,b7 reviewing prospective ,,tevv standards submitted by the ,secretary to ensure such standards align with recommendations under subparagraph 7,a72 7,c7 upon completion of the review under subparagraph 7,b71 providing consensus recommendations to the ,secretary on-- 7i7 whether a ,,tevv standard should be issued1 modified1 revoked1 or added2 and 7ii7 if such a standard should be issued1 how best to align the standard with the considerations described in subsection 7c77#b7 and recommendations described in subparagraph 7,a72 and 7,d7 reviewing and providing advice and recommendations on the plan and subsequent updates to the plan submitted under subsection 7b74 7#c7 ,composition ,the advisory committee established under this subsection shall be composed of not more than #ae members with a balanced composition of representatives of the private sector1 institutions of higher education1 and non-profit organizations1 including-- 7,a7 representatives of-- 7i7 institutions of higher education2 7ii7 companies developing or operating artificial intelligence systems2 7iii7 consumers or consumer advocacy groups2 and 7iv7 enabling technology companies2 and 7,b7 any other members the ,secretary considers to be appropriate4 7b7 ,artificial intelligence certification plan 7#a7 ,in general ,not later than #a year after the date of enactment of this ,act1 the ,secretary shall establish a #c-year implementation plan for the certification of critical-impact artificial intelligence systems4 7#b7 ,periodic update ,the ,secretary shall periodically update the plan established under paragraph 7#a74 7#c7 ,contents ,the plan established under paragraph 7#a7 shall include-- 7,a7 a methodology for gathering and using relevant1 objective1 and available information relating to ,,tevv2 7,b7 a process for considering whether prescribing certain ,,tevv standards under subsection 7c7 for critical-impact artificial intelligence systems is appropriate1 necessary1 or duplicative of existing international standards2 7,c7 if ,,tevv standards are considered appropriate1 a process for prescribing such standards for critical-impact artificial intelligence systems2 and 7,d7 an outline of standards proposed to be issued1 including an estimation of the timeline and sequencing of such standards4 7#d7 ,consultation ,in developing the plan required under paragraph 7#a71 the ,secretary shall consult the following3 7,a7 ,the ,national ,artificial ,intelligence ,initiative ,office4 7,b7 ,the interagency committee established under section #eajc of the ,national ,artificial ,intelligence ,initiative ,act of #bjbj 7#ae ,u4,s4,c4 #idac74 7,c7 ,the ,national ,artificial ,intelligence ,advisory ,committee4 7,d7 ,industry consensus standards issued by non-governmental standards organizations4 7,e7 ,other departments1 agencies1 and instrumentalities of the ,federal ,government1 as considered appropriate by the ,secretary4 7#e7 ,submission to certification advisory committee ,upon completing the initial plan required under this subsection and upon completing periodic updates to the plan under paragraph 7#b71 the ,secretary shall submit the plan to the advisory committee established under subsection 7a7 for review4 7#f7 ,submission to committees of congress ,upon completing the plan required under this subsection1 the ,secretary shall submit to the relevant committees of ,congress a report containing the plan4 7#g7 ,limitation ,the ,secretary may not issue ,,tevv standards under subsection 7c7 until the date of the submission of the plan under paragraphs 7#e7 and 7#f74 7c7 ,standards 7#a7 ,standards 7,a7 ,in general ,the ,secretary shall issue ,,tevv standards for critical-impact artificial intelligence systems4 7,b7 ,requirements ,each standard issued under this subsection shall-- 7i7 be practicable2 7ii7 meet the need for safe1 secure1 and transparent operations of critical-impact artificial intelligence systems2 7iii7 with respect to a relevant standard issued by a non-governmental standards organization that is already in place1 align with and be interoperable with that standard2 7iv7 provide for a mechanism to1 not less frequently than once every #b years1 solicit public comment and update the standard to reflect advancements in technology and system architecture2 and 7v7 be stated in objective terms4 7#b7 ,considerations ,in issuing ,,tevv standards for critical-impact artificial intelligence systems under this subsection1 the ,secretary shall-- 7,a7 consider relevant available information concerning critical-impact artificial intelligence systems1 including-- 7i7 transparency reports submitted under section #bjc7;a72 7ii7 risk management assessments conducted under section #bjf7;a72 and 7iii7 any additional information provided to the ,secretary pursuant to section #bjc7;a77#a77;,b72 7,b7 consider whether a proposed standard is reasonable1 practicable1 and appropriate for the particular type of critical-impact artificial intelligence system for which the standard is proposed2 7,c7 consult with relevant artificial intelligence stakeholders and review industry standards issued by nongovernmental standards organizations2 7,d7 pursuant to paragraph 7#a77;,b77iii71 consider whether adoption of a relevant standard issued by a nongovernmental standards organization as a ,,tevv standard is the most appropriate action2 and 7,e7 consider whether the standard takes into account-- 7i7 transparent1 replicable1 and objective assessments of critical-impact artificial intelligence system risk1 structure1 capabilities1 and design2 7ii7 the risk posed to the public by an applicable critical-impact artificial intelligence system2 and 7iii7 the diversity of methodologies and innovative technologies and approaches available to meet the objectives of the standard4 7#c7 ,consultation ,before finalizing a ,,tevv standard issued under this subsection1 the ,secretary shall submit the ,,tevv standard to the advisory committee established under subsection 7a7 for review4 7#d7 ,public comment ,before issuing any ,,tevv standard under this subsection1 the ,secretary shall provide an opportunity for public comment4 7#e7 ,cooperation ,in developing a ,,tevv standard under this subsection1 the ,secretary may1 as determined appropriate1 advise1 assist1 and cooperate with departments1 agencies1 and instrumentalities of the ,federal ,government1 ,states1 and other public and private agencies4 7#f7 ,effective date of standards 7,a7 ,in general ,the ,secretary shall specify the effective date of a ,,tevv standard issued under this subsection in the order issuing the standard4 7,b7 ,limitation ,subject to subparagraph 7,c71 a ,,tevv standard issued under this subsection may not become effective-- 7i7 during the #ahj-;day period following the date on which the ,,tevv standard is issued2 and 7ii7 more than #a year after the date on which the ,,tevv standard is issued4 7,c7 ,exception ,subparagraph 7,b7 shall not apply to the effective date of a ,,tevv standard issued under this section if the ,secretary-- 7i7 finds1 for good cause shown1 that a different effective date is in the public interest2 and 7ii7 publishes the reasons for the finding under clause 7i74 7#g7 ,rule of construction ,nothing in this subsection shall be construed to authorize the ,secretary to impose any requirements on or take any enforcement actions under this section or section #bjh relating to a critical-impact ,,ai organization before a ,,tevv standard relating to those requirements is prescribed4 7d7 ,exemptions 7#a7 ,authority to exempt and procedures 7,a7 ,in general ,the ,secretary may exempt1 on a temporary basis1 a critical-impact artificial intelligence system from a ,,tevv standard issued under subsection 7c7 on terms the ,secretary considers appropriate4 7,b7 ,renewal ,an exemption under subparagraph 7,a7-- 7i7 may be renewed only on reapplication2 and 7ii7 shall conform to the requirements of this paragraph4 7,c7 ,proceedings 7i7 ,in general ,the ,secretary may begin a proceeding to grant an exemption to a critical-impact artificial intelligence system under this paragraph if the critical-impact ,,ai organization that deployed the critical-impact artificial intelligence systems applies for an exemption or a renewal of an exemption4 7ii7 ,notice and comment ,the ,secretary shall publish notice of the application under clause 7i7 and provide an opportunity to comment4 7iii7 ,filing ,an application for an exemption or for a renewal of an exemption under this paragraph shall be filed at such time and in such manner and contain such information as the ,secretary may require4 7,d7 ,actions ,the ,secretary may grant an exemption under this paragraph upon finding that-- 7i7 the exemption is consistent with the public interest and this section2 and 7ii7 the exemption would facilitate the development or evaluation of a feature or characteristic of a critical-impact artificial intelligence system providing a safety and security level that is not less than the ,,tevv standard level4 7#b7 ,disclosure ,not later than #cj days after the date on which an application is filed under this subsection1 the ,secretary may make public information contained in the application or relevant to the application1 unless the information concerns or is related to a trade secret or other confidential information not relevant to the application4 7#c7 ,notice of decision ,the ,secretary shall publish in the ,federal ,register a notice of each decision granting or denying an exemption under this subsection and the reasons for granting or denying that exemption1 including a justification with supporting information for the selected approach4 7e7 ,self-,certification of compliance 7#a7 ,in general ,subject to paragraph 7#b71 with respect to each critical-impact artificial intelligence system of a critical-impact ,,ai organization1 the critical-impact ,,ai organization shall certify to the ,secretary that the critical-impact artificial intelligence system complies with applicable ,,tevv standards issued under this section4 7#b7 ,exception ,a critical-impact ,,ai organization may not issue a certificate under paragraph 7#a7 if1 in exercising reasonable care1 the critical-impact ,,ai organization has constructive knowledge that the certificate is false or misleading in a material respect4 7f7 ,noncompliance findings and enforcement action 7#a7 ,finding of noncompliance by secretary ,upon learning that a critical-impact artificial intelligence system deployed by a critical-impact ,,ai organization does not comply with the requirements under this section1 the ,secretary shall-- 7,a7 immediately-- 7i7 notify the critical-impact ,,ai organization of the finding2 and 7ii7 order the critical-impact ,,ai organization to take remedial action to address the noncompliance of the artificial intelligence system2 and 7,b7 may1 as determined appropriate or necessary by the ,secretary1 and if the ,secretary determines that actions taken by a critical-impact ,,ai organization are insufficient to remedy the noncompliance of the critical-impact ,,ai organization with this section1 take enforcement action under section #bjh4 7#b7 ,actions by critical-impact ,,ai organization ,if a critical-impact ,,ai organization finds that a critical-impact artificial intelligence system deployed by the critical-impact ,,ai organization is noncompliant with an applicable ,,tevv standard issued under this section or the critical-impact ,,ai organization is notified of noncompliance by the ,secretary under paragraph 7#a77;,a77i71 the critical-impact ,,ai organization shall-- 7,a7 without undue delay1 notify the ,secretary by certified mail or electronic mail of the noncompliance or receipt of the notification of noncompliance2 7,b7 take remedial action to address the noncompliance2 and 7,c7 not later than #aj days after the date of the notification or receipt under subparagraph 7,a71 submit to the ,secretary a report containing information on-- 7i7 the nature and discovery of the noncompliant aspect of the critical-impact artificial intelligence system2 7ii7 measures taken to remedy such noncompliance2 and 7iii7 actions taken by the critical-impact ,,ai organization to address stakeholders affected by such noncompliance4 #bjh4 ,enforcement 7a7 ,in general ,upon discovering noncompliance with a provision of this ,act by a deployer of a high-impact artificial intelligence system or a critical-impact ,,ai organization if the ,secretary determines that actions taken by the critical-impact ,,ai organization are insufficient to remedy the noncompliance1 the ,secretary shall take an action described in this section4 7b7 ,civil penalties 7#a7 ,in general ,the ,secretary may impose a penalty described in paragraph 7#b7 on deployer of a high-impact artificial intelligence system or a critical-impact ,,ai organization for each violation by that entity of this ,act or any regulation or order issued under this ,act4 7#b7 ,penalty described ,the penalty described in this paragraph is the greater of-- 7,a7 an amount not to exceed #cjj1jjj2 or 7,b7 an amount that is twice the value of the transaction that is the basis of the violation with respect to which the penalty is imposed4 7c7 ,violation with intent 7#a7 ,in general ,if the ,secretary determines that a deployer of a high-impact artificial intelligence system or a critical-impact ,,ai organization intentionally violates this ,act or any regulation or order issued under this ,act1 the ,secretary may prohibit the critical-impact ,,ai organization from deploying a critical-impact artificial intelligence system4 7#b7 ,in addition ,a prohibition imposed under paragraph 7#a7 shall be in addition to any other civil penalties provided under this ,act4 7d7 ,factors ,the ,secretary may by regulation provide standards for establishing levels of civil penalty under this section based upon factors such as the seriousness of the violation1 the culpability of the violator1 and such mitigating factors as the violator's record of cooperation with the ,secretary in disclosing the violation4 7e7 ,civil action 7#a7 ,in general ,upon referral by the ,secretary1 the ,attorney ,general may bring a civil action in a ,united ,states district court to-- 7,a7 enjoin a violation of section #bjg2 or 7,b7 collect a civil penalty upon a finding of noncompliance with this ,act4 7#b7 ,venue ,a civil action may be brought under paragraph 7#a7 in the judicial district in which the violation occurred or the defendant is found1 resides1 or does business4 7#c7 ,process ,process in a civil action under paragraph 7#a7 may be served in any judicial district in which the defendant resides or is found4 7f7 ,rule of construction ,nothing in this section shall be construed to require a developer of a critical-impact artificial intelligence system to disclose any information1 including data or algorithms-- 7#a7 relating to a trade secret or other protected intellectual property right2 7#b7 that is confidential business information2 or 7#c7 that is privileged4 #bji4 ,artificial intelligence consumer education 7a7 ,establishment ,not later than #ahj days after the date of enactment of this ,act1 the ,secretary shall establish a working group relating to responsible education efforts for artificial intelligence systems4 7b7 ,membership 7#a7 ,in general ,the ,secretary shall appoint to serve as members of the working group established under this section not more than #ae individuals with expertise relating to artificial intelligence systems1 including-- 7,a7 representatives of-- 7i7 institutions of higher education2 7ii7 companies developing or operating artificial intelligence systems2 7iii7 consumers or consumer advocacy groups2 7iv7 public health organizations2 7v7 marketing professionals2 7vi7 entities with national experience relating to consumer education1 including technology education2 7vii7 public safety organizations2 7viii7 rural workforce development advocates2 7ix7 enabling technology companies2 and 7x7 nonprofit technology industry trade associations2 and 7,b7 any other members the ,secretary considers to be appropriate4 7#b7 ,compensation ,a member of the working group established under this section shall serve without compensation4 7c7 ,duties 7#a7 ,in general ,the working group established under this section shall-- 7,a7 identify recommended education and programs that may be voluntarily employed by industry to inform-- 7i7 consumers and other stakeholders with respect to artificial intelligence systems as those systems-- 7,i7 become available2 or 7,,ii7 are soon to be made widely available for public use or consumption2 and 7,b7 submit to ,congress1 and make available to the public1 a report containing the findings and recommendations under subparagraph 7,a74 7#b7 ,factors for consideration ,the working group established under this section shall take into consideration topics relating to-- 7,a7 the intent1 capabilities1 and limitations of artificial intelligence systems2 7,b7 use cases of artificial intelligence applications that improve lives of the people of the ,united ,states1 such as improving government efficiency1 filling critical roles1 and reducing mundane work tasks2 7,c7 artificial intelligence research breakthroughs2 7,d7 engagement and interaction methods1 including how to adequately inform consumers of interaction with an artificial intelligence system2 7,e7 human-machine interfaces2 7,f7 emergency fallback scenarios2 7,g7 operational boundary responsibilities2 7,h7 potential mechanisms that could change function behavior in service2 and 7,i7 consistent nomenclature and taxonomy for safety features and systems4 7#c7 ,consultation ,the ,secretary shall consult with the ,chair of the ,federal ,trade ,commission with respect to the recommendations of the working group established under this section1 as appropriate4 7d7 ,termination ,the working group established under this section shall terminate on the date that is #b years after the date of enactment of this ,act4