,,ii #aahth ,,congress #b;d ,session ,s4 #ddie ,,in ,,the ,,senate ,,of ,,the ,,united ,,states ,june #aa1 #bjbd ,mr4 ,peters 7for himself and ,mr4 ,tillis7 introduced the following bill2 which was read twice and referred to the ,committee on ,homeland ,security and ,governmental ,affairs ,a ,,bill ,to enable safe1 responsible1 and agile procurement1 development1 and use of artificial intelligence by the ,federal ,government1 and for other purposes4 #a4 ,short title ,this ,act may be cited as the ,promoting ,responsible ,evaluation and ,procurement to ,advance ,readiness for ,enterprise-wide ,deployment for ,artificial ,intelligence ,act or the ,,prepared for ,,ai ,act4 #b4 ,definitions ,in this ,act3 7#a7 ,adverse incident ,the term adverse incident means any incident or malfunction of artificial intelligence that directly or indirectly leads to-- 7,a7 harm impacting rights or safety1 as described in section #g7;a77#b77;,d72 7,b7 the death of an individual or damage to the health of an individual2 7,c7 material or irreversible disruption of the management and operation of critical infrastructure1 as described in section #g7;a77#b77;,d77i77,,ii77cc72 7,d7 material damage to property or the environment2 7,e7 loss of a mission-critical system or equipment2 7,f7 failure of the mission of an agency2 7,g7 the denial of a benefit1 payment1 or other service to an individual or group of individuals who would have otherwise been eligible2 7,h7 the denial of an employment1 contract1 grant1 or similar opportunity that would have otherwise been offered2 or 7,i7 another consequence1 as determined by the ,director with public notice4 7#b7 ,agency ,the term agency-- 7,a7 has the meaning given that term in section #cejb7a7 of title #dd1 ,united ,states ,code2 and 7,b7 includes each of the independent regulatory agencies described in section #cejb7e7 of title #dd1 ,united ,states ,code4 7#c7 ,artificial intelligence ,the term artificial intelligence-- 7,a7 has the meaning given that term in section #ejjb of the ,national ,artificial ,intelligence ,initiative ,act of #bjbj 7#ae ,u4,s4,c4 #idja72 and 7,b7 includes the artificial systems and techniques described in paragraphs 7#a7 through 7#e7 of section #bch7;g7 of the ,john ,s4 ,mc,cain ,national ,defense ,authorization ,act for ,fiscal ,year #bjai 7,public ,law #aae-bcb2 #aj ,u4,s4,c4 #djfa note prec474 7#d7 ,biometric data ,the term biometric data means data resulting from specific technical processing relating to the unique physical1 physiological1 or behavioral characteristics of an individual1 including facial images1 dactyloscopic data1 physical movement and gait1 breath1 voice1 ,,dna1 blood type1 and expression of emotion1 thought1 or feeling4 7#e7 ,commercial technology ,the term commercial technology-- 7,a7 means a technology1 process1 or method1 including research or development2 and 7,b7 includes commercial products1 commercial services1 and other commercial items1 as defined in the ,federal ,acquisition ,regulation1 including any addition or update thereto by the ,federal ,acquisition ,regulatory ,council4 7#f7 ,council ,the term ,council means the ,chief ,artificial ,intelligence ,officers ,council established under section #e7;a74 7#g7 ,deployer ,the term deployer means an entity that operates or provides artificial intelligence1 whether developed internally or by a third-party developer4 7#h7 ,developer ,the term developer means an entity that designs1 codes1 produces1 or owns artificial intelligence4 7#i7 ,director ,the term ,director means the ,director of the ,office of ,management and ,budget4 7#aj7 ,impact assessment ,the term impact assessment means a structured process for considering the implications of a proposed artificial intelligence use case4 7#aa7 ,operational design domain ,the term operational design domain means a set of operating conditions for an automated system4 7#ab7 ,procure or obtain ,the term procure or obtain means-- 7,a7 to acquire through contract actions awarded pursuant to the ,federal ,acquisition ,regulation1 including through interagency agreements1 multi-agency use1 and purchase card transactions2 7,b7 to acquire through contracts and agreements awarded through other special procurement authorities1 including through other transactions and commercial solutions opening authorities2 or 7,c7 to obtain through other means1 including through open source platforms or freeware4 7#ac7 ,relevant congressional committees ,the term relevant congressional committees means the ,committee on ,homeland ,security and ,governmental ,affairs of the ,senate and the ,committee on ,oversight and ,accountability of the ,house of ,representatives4 7#ad7 ,risk ,the term risk means the combination of the probability of an occurrence of harm and the potential severity of that harm4 7#ae7 ,use case ,the term use case means the ways and context in which artificial intelligence is operated to perform a specific function4 #c4 ,implementation of requirements 7a7 ,agency implementation ,not later than #a year after the date of enactment of this ,act1 the ,director shall ensure that agencies have implemented the requirements of this ,act4 7b7 ,annual briefing ,not later than #ahj days after the date of enactment of this ,act1 and annually thereafter1 the ,director shall brief the appropriate ,congressional committees on implementation of this ,act and related considerations4 #d4 ,procurement of artificial intelligence 7a7 ,government-,wide requirements 7#a7 ,in general ,not later than #a year after the date of enactment of this ,act1 the ,federal ,acquisition ,regulatory ,council shall review ,federal ,acquisition ,regulation acquisition planning1 source selection1 and other requirements and update the ,federal ,acquisition ,regulation as needed to ensure that agency procurement of artificial intelligence includes-- 7,a7 a requirement to address the outcomes of the risk evaluation and impact assessments required under section #h7;a72 7,b7 a requirement for consultation with an interdisciplinary team of agency experts prior to1 and throughout1 as necessary1 procuring or obtaining artificial intelligence2 and 7,c7 any other considerations determined relevant by the ,federal ,acquisition ,regulatory ,council4 7#b7 ,interdisciplinary team of experts ,the interdisciplinary team of experts described in paragraph 7#a77;,b7 may-- 7,a7 vary depending on the use case and the risks determined to be associated with the use case2 and 7,b7 include technologists1 information security personnel1 domain experts1 privacy officers1 data officers1 civil rights and civil liberties officers1 contracting officials1 legal counsel1 customer experience professionals1 and others4 7#c7 ,acquisition planning ,the acquisition planning updates described in paragraph 7#a7 shall include considerations for1 at minimum1 as appropriate depending on the use case-- 7,a7 data ownership and privacy2 7,b7 data information security2 7,c7 interoperability requirements2 7,d7 data and model assessment processes2 7,e7 scope of use2 7,f7 ongoing monitoring techniques2 7,g7 type and scope of artificial intelligence audits2 7,h7 environmental impact2 and 7,i7 safety and security risk mitigation techniques1 including a plan for how adverse event reporting can be incorporated1 pursuant to section #e7;g74 7b7 ,requirements for high risk use cases 7#a7 ,in general 7,a7 ,establishment ,beginning on the date that is #a year after the date of enactment of this ,act1 the head of an agency may not procure or obtain artificial intelligence for a high risk use case1 as defined in section #g7;a77#b77;,d71 prior to establishing and incorporating certain terms into relevant contracts1 agreements1 and employee guidelines for artificial intelligence1 including-- 7i7 a requirement that the use of the artificial intelligence be limited to its operational design domain2 7ii7 requirements for safety1 security1 and trustworthiness1 including-- 7,i7 a reporting mechanism through which agency personnel are notified by the deployer of any adverse incident2 7,,ii7 a requirement1 in accordance with section #e7;g71 that agency personnel receive from the deployer a notification of any adverse incident1 an explanation of the cause of the adverse incident1 and any data directly connected to the adverse incident in order to address and mitigate the harm2 and 7,,iii7 that the agency has the right to temporarily or permanently suspend use of the artificial intelligence if-- 7aa7 the risks of the artificial intelligence to rights or safety become unacceptable1 as determined under the agency risk classification system pursuant to section #g2 or 7bb7 on or after the date that is #ahj days after the publication of the most recently updated version of the framework developed and updated pursuant to section #bb7;,a77c7 of the ,national ,institute of ,standards and ,technology ,act 7#ae ,u4,s4,c4 #bgh;h-#a7;c771 the deployer is found not to comply with such most recent update2 7iii7 requirements for quality1 relevance1 sourcing and ownership of data1 as appropriate by use case1 and applicable unless the head of the agency waives such requirements in writing1 including-- 7,i7 retention of rights to ,government data and any modification to the data including to protect the data from unauthorized disclosure and use to subsequently train or improve the functionality of commercial products offered by the deployer1 any relevant developers1 or others2 and 7,,ii7 a requirement that the deployer and any relevant developers or other parties isolate ,government data from all other data1 through physical separation1 electronic separation via secure copies with strict access controls1 or other computational isolation mechanisms2 7iv7 requirements for evaluation and testing of artificial intelligence based on use case1 to be performed on an ongoing basis2 and 7v7 requirements that the deployer and any relevant developers provide documentation1 as determined necessary and requested by the agency1 in accordance with section #h7;b74 7,b7 ,review ,the ,senior ,procurement ,executive1 in coordination with the ,chief ,artificial ,intelligence ,officer1 shall consult with technologists1 information security personnel1 domain experts1 privacy officers1 data officers1 civil rights and civil liberties officers1 contracting officials1 legal counsel1 customer experience professionals1 and other relevant agency officials to review the requirements described in clauses 7i7 through 7v7 of subparagraph 7,a7 and determine whether it may be necessary to incorporate additional requirements into relevant contracts or agreements4 7,c7 ,regulation ,the ,federal ,acquisition ,regulatory ,council shall revise the ,federal ,acquisition ,regulation as necessary to implement the requirements of this subsection4 7#b7 ,rules of construction ,this ,act shall supersede any requirements that conflict with this ,act under the guidance required to be produced by the ,director pursuant to section #gbbd7;d7 of the ,advancing ,american ,,ai ,act 7#dj ,u4,s4,c4 #aacja note74 #e4 ,interagency governance of artificial intelligence 7a7 ,chief artificial intelligence officers council ,not later than #fj days after the date of enactment of this ,act1 the ,director shall establish a ,chief ,artificial ,intelligence ,officers ,council4 7b7 ,duties ,the duties of the ,council shall include-- 7#a7 coordinating agency development and use of artificial intelligence in agency programs and operations1 including practices relating to the design1 operation1 risk management1 and performance of artificial intelligence2 7#b7 sharing experiences1 ideas1 best practices1 and innovative approaches relating to artificial intelligence2 and 7#c7 assisting the ,director1 as necessary1 with respect to-- 7,a7 the identification1 development1 and coordination of multi-agency projects and other initiatives1 including initiatives to improve ,government performance2 7,b7 the management of risks relating to developing1 obtaining1 or using artificial intelligence1 including by developing a common template to guide agency ,chief ,artificial ,intelligence ,officers in implementing a risk classification system that may incorporate best practices1 such as those from-- 7i7 the most recently updated version of the framework developed and updated pursuant to section #bb;,a7c7 of the ,national ,institute of ,standards and ,technology ,act 7#ae ,u4,s4,c4 #bgh;h-#a7;c772 and 7ii7 the report published by the ,government ,accountability ,office entitled ,artificial ,intelligence3 ,an ,accountability ,framework for ,federal ,agencies and ,other ,entities 7,,gao-#ba-eai,,sp71 published on ,june #cj1 #bjba2 7,c7 promoting the development and use of efficient1 effective1 common1 shared1 or other approaches to key processes that improve the delivery of services for the public2 and 7,d7 soliciting and providing perspectives on matters of concern1 including from and to-- 7i7 interagency councils2 7ii7 ,federal ,government entities2 7iii7 private sector1 public sector1 nonprofit1 and academic experts2 7iv7 ,state1 local1 ,tribal1 territorial1 and international governments2 and 7v7 other individuals and entities1 as determined relevant by the ,council4 7c7 ,membership of the ,council 7#a7 ,co-chairs ,the ,council shall have #b co-chairs1 which shall be-- 7,a7 the ,director2 and 7,b7 an individual selected by a majority of the members of the ,council4 7#b7 ,members ,other members of the ,council shall include-- 7,a7 the ,chief ,artificial ,intelligence ,officer of each agency2 and 7,b7 the senior official for artificial intelligence of the ,office of ,management and ,budget4 7d7 ,standing committees2 working groups ,the ,council shall have the authority to establish standing committees1 including an executive committee1 and working groups4 7e7 ,council staff ,the ,council may enter into an interagency agreement with the ,administrator of ,general ,services for shared services for the purpose of staffing the ,council4 7f7 ,development1 adaptation1 and documentation 7#a7 ,guidance ,not later than #ij days after the date of enactment of this ,act1 the ,director1 in consultation with the ,council1 shall issue guidance relating to-- 7,a7 developments in artificial intelligence and implications for management of agency programs2 7,b7 the agency impact assessments described in section #h7;a7 and other relevant impact assessments as determined appropriate by the ,director1 including the appropriateness of substituting pre-existing assessments1 including privacy impact assessments1 for purposes of an artificial intelligence impact assessment2 7,c7 documentation for agencies to require from deployers of artificial intelligence2 7,d7 a model template for the explanations for use case risk classifications that each agency must provide under section #h7;a77#d72 and 7,e7 other matters1 as determined relevant by the ,director4 7#b7 ,annual review ,the ,director1 in consultation with the ,council1 shall periodically1 but not less frequently than annually1 review and update1 as needed1 the guidelines issued under paragraph 7#a74 7g7 ,incident reporting 7#a7 ,in general ,not later than #ahj days after the date of enactment of this ,act1 the ,director1 in consultation with the ,council1 shall develop procedures for ensuring that-- 7,a7 adverse incidents involving artificial intelligence procured1 obtained1 or used by agencies are reported promptly to the agency by the developer or deployer1 or to the developer or deployer by the agency1 whichever first becomes aware of the adverse incident2 and 7,b7 information relating to an adverse incident described in subparagraph 7,a7 is appropriately shared among agencies4 7#b7 ,single report ,adverse incidents also qualifying for incident reporting under section #ceed of title #dd1 ,united ,states ,code1 or other relevant laws or policies1 may be reported under such other reporting requirement and are not required to be additionally reported under this subsection4 7#c7 ,notice to deployer 7,a7 ,in general ,if an adverse incident is discovered by an agency1 the agency shall report the adverse incident to the deployer and the deployer1 in consultation with any relevant developers1 shall take immediate action to resolve the adverse incident and mitigate the potential for future adverse incidents4 7,b7 ,waiver 7i7 ,in general ,unless otherwise required by law1 the head of an agency may issue a written waiver that waives the applicability of some or all of the requirements under subparagraph 7,a71 with respect to a specific adverse incident4 7ii7 ,written waiver contents ,a written waiver under clause 7i7 shall include justification for the waiver4 7iii7 ,notice ,the head of an agency shall forward advance notice of any waiver under this subparagraph to the ,director1 or the designee of the ,director4 #f4 ,agency governance of artificial intelligence 7a7 ,in general ,the head of an agency shall-- 7#a7 ensure the responsible adoption of artificial intelligence1 including by-- 7,a7 articulating a clear vision of what the head of the agency wants to achieve by developing1 procuring or obtaining1 or using artificial intelligence2 7,b7 ensuring the agency develops1 procures1 obtains1 or uses artificial intelligence that follows the principles of trustworthy artificial intelligence in government set forth under ,executive ,order #acifj 7#he ,fed4 ,reg4 #ghici2 relating to promoting the use of trustworthy artificial intelligence in ,federal ,government7 and the principles for safe1 secure1 and trustworthy artificial intelligence in government set forth under section #b of ,executive ,order #adaaj 7#hh ,fed4 ,reg4 #geaia2 relating to the safe1 secure1 and trustworthy development and use of artificial intelligence72 7,c7 testing1 validating1 and monitoring artificial intelligence and the use case-specific performance of artificial intelligence1 among others1 to-- 7i7 ensure all use of artificial intelligence is appropriate to and improves the effectiveness of the mission of the agency2 7ii7 guard against bias in data collection1 use1 and dissemination2 7iii7 ensure reliability1 fairness1 and transparency2 and 7iv7 protect against impermissible discrimination2 7,d7 developing1 adopting1 and applying a suitable enterprise risk management framework approach to artificial intelligence1 incorporating the requirements under this ,act2 7,e7 continuing to develop a workforce that-- 7i7 understands the strengths and weaknesses of artificial intelligence1 including artificial intelligence embedded in agency data systems and operations2 7ii7 is aware of the benefits and risk of artificial intelligence2 7iii7 is able to provide human oversight for the design1 implementation1 and end uses of artificial intelligence2 and 7iv7 is able to review and provide redress for erroneous decisions made in the course of artificial intelligence-assisted processes2 and 7,f7 ensuring implementation of the requirements under section #h7;a7 for the identification and evaluation of risks posed by the deployment of artificial intelligence in agency use cases2 7#b7 designate a ,chief ,artificial ,intelligence ,officer1 whose duties shall include-- 7,a7 ensuring appropriate use of artificial intelligence2 7,b7 coordinating agency use of artificial intelligence2 7,c7 promoting artificial intelligence innovation2 7,d7 managing the risks of use of artificial intelligence2 7,e7 supporting the head of the agency with developing the risk classification system required under section #g7;a7 and complying with other requirements of this ,act2 and 7,f7 supporting agency personnel leading the procurement and deployment of artificial intelligence to comply with the requirements under this ,act2 and 7#c7 form and convene an ,artificial ,intelligence ,governance ,board1 as described in subsection 7b71 which shall coordinate and govern artificial intelligence issues across the agency4 7b7 ,artificial ,intelligence ,governance ,board 7#a7 ,leadership ,each ,artificial ,intelligence ,governance ,board 7referred to in this subsection as ,board7 of an agency shall be chaired by the ,deputy ,secretary of the agency or equivalent official and vice-chaired by the ,chief ,artificial ,intelligence ,officer of the agency4 ,neither the chair nor the vice-chair may assign or delegate these roles to other officials4 7#b7 ,representation ,the ,board shall1 at a minimum1 include representatives comprised of senior agency officials from operational components1 if relevant1 program officials responsible for implementing artificial intelligence1 and officials responsible for information technology1 data1 privacy1 civil rights and civil liberties1 human capital1 procurement1 finance1 legal counsel1 and customer experience4 7#c7 ,existing bodies ,an agency may rely on an existing governance body to fulfill the requirements of this subsection if the body satisfies or is adjusted to satisfy the leadership and representation requirements of paragraphs 7#a7 and 7#b74 7c7 ,designation of ,chief ,artificial ,intelligence ,officer ,the head of an agency may designate as ,chief ,artificial ,intelligence ,officer an existing official within the agency1 including the ,chief ,technology ,officer1 ,chief ,data ,officer1 ,chief ,information ,officer1 or other official with relevant or complementary authorities and responsibilities1 if such existing official has expertise in artificial intelligence and meets the requirements of this section4 7d7 ,effective date ,beginning on the date that is #abj days after the date of enactment of this ,act1 an agency shall not develop or procure or obtain artificial intelligence prior to completing the requirements under paragraphs 7#b7 and 7#c7 of subsection 7a74 #g4 ,agency risk classification of artificial intelligence use cases for procurement and use 7a7 ,risk classification system 7#a7 ,development ,the head of each agency shall be responsible for developing1 not later than #a year after the date of enactment of this ,act1 a risk classification system for agency use cases of artificial intelligence1 without respect to whether artificial intelligence is embedded in a commercial product4 7#b7 ,requirements 7,a7 ,risk classifications ,the risk classification system under paragraph 7#a7 shall1 at a minimum1 include unacceptable1 high1 medium1 and low risk classifications4 7,b7 ,factors for risk classifications ,in developing the risk classifications under subparagraph 7,a71 the head of the agency shall consider the following3 7i7 ,mission and operation ,the mission and operations of the agency4 7ii7 ,scale ,the seriousness and probability of adverse impacts4 7iii7 ,scope ,the breadth of application1 such as the number of individuals affected4 7iv7 ,optionality ,the degree of choice that an individual1 group1 or entity has as to whether to be subject to the effects of artificial intelligence4 7v7 ,standards and frameworks ,standards and frameworks for risk classification of use cases that support democratic values1 such as the standards and frameworks developed by the ,national ,institute of ,standards and ,technology1 the ,international ,standards ,organization1 and the ,institute of ,electrical and ,electronics ,engineers4 7,c7 ,classification variance 7i7 ,certain lower risk use cases ,the risk classification system may allow for an operational use case to be categorized under a lower risk classification1 even if the use case is a part of a larger area of the mission of the agency that is categorized under a higher risk classification4 7ii7 ,changes based on testing or new information ,the risk classification system may allow for changes to the risk classification of an artificial intelligence use case based on the results from procurement process testing or other information that becomes available4 7,d7 ,high risk use cases 7i7 ,in general ,high risk classification shall1 at a minimum1 apply to use cases for which the outputs of the system-- 7,i7 are presumed to serve as a principal basis for a decision or action that has a legal1 material1 binding1 or similarly significant effect1 with respect to an individual or community1 on-- 7aa7 civil rights1 civil liberties1 or privacy2 7bb7 equal opportunities1 including in access to education1 housing1 insurance1 credit1 employment1 and other programs where civil rights and equal opportunity protections apply2 or 7cc7 access to or the ability to apply for critical government resources or services1 including healthcare1 financial services1 public housing1 social services1 transportation1 and essential goods and services2 or 7,,ii7 are presumed to serve as a principal basis for a decision that substantially impacts the safety of1 or has the potential to substantially impact the safety of-- 7aa7 the well-being of an individual or community1 including loss of life1 serious injury1 bodily harm1 biological or chemical harms1 occupational hazards1 harassment or abuse1 or mental health2 7bb7 the environment1 including irreversible or significant environmental damage2 7cc7 critical infrastructure1 including the critical infrastructure sectors defined in ,presidential ,policy ,directive #ba1 entitled ,critical ,infrastructure ,security and ,resilience 7dated ,february #ab1 #bjac7 7or any successor directive7 and the infrastructure for voting and protecting the integrity of elections2 or 7dd7 strategic assets or resources1 including high-value property and information marked as sensitive or classified by the ,federal ,government and controlled unclassified information4 7ii7 ,additions ,the head of each agency shall add other use cases to the high risk category1 as appropriate4 7,e7 ,medium and low risk use cases ,if a use case is not high risk1 as described in subparagraph 7,d71 the head of an agency shall have the discretion to define the risk classification4 7,f7 ,unacceptable risk ,if an agency identifies1 through testing1 adverse incident1 or other means or information available to the agency1 that a use or outcome of an artificial intelligence use case is a clear threat to human safety or rights that cannot be adequately or practicably mitigated1 the agency shall identify the risk classification of that use case as unacceptable risk4 7#c7 ,transparency ,the risk classification system under paragraph 7#a7 shall be published on a public-facing website1 with the methodology used to determine different risk levels and examples of particular use cases for each category in language that is easy to understand to the people affected by the decisions and outcomes of artificial intelligence4 7b7 ,effective date ,this section shall take effect on the date that is #ahj days after the date of enactment of this ,act1 on and after which an agency that has not complied with the requirements of this section may not develop1 procure or obtain1 or use artificial intelligence until the agency complies with such requirements4 #h4 ,agency requirements for use of artificial intelligence 7a7 ,risk evaluation process 7#a7 ,in general ,not later than #ahj days after the effective date in section #g7;b71 the ,chief ,artificial ,intelligence ,officer of each agency1 in coordination with the ,artificial ,intelligence ,governance ,board of the agency1 shall develop and implement a process for the identification and evaluation of risks posed by the deployment of artificial intelligence in agency use cases to ensure an interdisciplinary and comprehensive evaluation of potential risks and determination of risk classifications under such section4 7#b7 ,process requirements ,the risk evaluation process described in paragraph 7#a71 shall include1 for each artificial intelligence use case-- 7,a7 identification of the risks and benefits of the artificial intelligence use case2 7,b7 a plan to periodically review the artificial intelligence use case to examine whether risks have changed or evolved and to update the corresponding risk classification as necessary2 7,c7 a determination of the need for targeted impact assessments to further evaluate specific risks of the artificial intelligence use case within certain impact areas1 which shall include privacy1 security1 civil rights and civil liberties1 accessibility1 environmental impact1 health and safety1 and any other impact area relating to high risk classification under section #g7;a77#b77;,d7 as determined appropriate by the ,chief ,artificial ,intelligence ,officer2 and 7,d7 if appropriate1 consultation with and feedback from affected communities and the public on the design1 development1 and use of the artificial intelligence use case4 7#c7 ,review 7,a7 ,existing use cases ,with respect to each use case that an agency is planning1 developing1 or using on the date of enactment of this ,act1 not later than #a year after such date1 the ,chief ,artificial ,intelligence ,officer of the agency shall identify and review the use case to determine the risk classification of the use case1 pursuant to the risk evaluation process under paragraphs 7#a7 and 7#b74 7,b7 ,new use cases 7i7 ,in general ,beginning on the date of enactment of this ,act1 the ,chief ,artificial ,intelligence ,officer of an agency shall identify and review any artificial intelligence use case that the agency will plan1 develop1 or use and determine the risk classification of the use case1 pursuant to the risk evaluation process under paragraphs 7#a7 and 7#b71 before procuring or obtaining1 developing1 or using the use case4 7ii7 ,development ,for any use case described in clause 7i7 that is developed by the agency1 the agency shall perform an additional risk evaluation prior to deployment in a production or operational environment4 7#d7 ,rationale for risk classification ,risk classification of an artificial intelligence use case shall be accompanied by an explanation from the agency of how the risk classification was determined1 which shall be included in the artificial intelligence use case inventory of the agency1 and written referencing the model template developed by the ,director under section #e7;f77#a77;,d74 7b7 ,model card documentation requirements 7#a7 ,in general ,beginning on the date that is #ahj days after the date of enactment of this ,act1 any time during developing1 procuring or obtaining1 or using artificial intelligence1 an agency shall require1 as determined necessary by the ,chief ,artificial ,intelligence ,officer1 that the deployer and any relevant developer submit documentation about the artificial intelligence1 including-- 7,a7 a description of the architecture of the artificial intelligence1 highlighting key parameters1 design choices1 and the machine learning techniques employed2 7,b7 information on the training of the artificial intelligence1 including computational resources utilized2 7,c7 an account of the source of the data1 size of the data1 any licenses under which the data is used1 collection methods and dates of the data1 and any preprocessing of the data undertaken1 including human or automated refinement1 review1 or feedback2 7,d7 information on the management and collection of personal data1 outlining data protection and privacy measures adhered to in compliance with applicable laws2 7,e7 a description of the methodologies used to evaluate the performance of the artificial intelligence1 including key metrics and outcomes2 and 7,f7 an estimate of the energy consumed by the artificial intelligence during training and inference4 7#b7 ,additional documentation for medium and high risk use cases ,beginning on the date that is #bgj days after the date of enactment of this ,act1 with respect to use cases categorized as medium risk or higher1 an agency shall require that the deployer of artificial intelligence1 in consultation with any relevant developers1 submit 7including proactively1 as material updates of the artificial intelligence occur7 the following documentation3 7,a7 ,model architecture ,detailed information on the model or models used in the artificial intelligence1 including model date1 model version1 model type1 key parameters 7including number of parameters71 interpretability measures1 and maintenance and updating policies4 7,b7 ,advanced training details ,a detailed description of training algorithms1 methodologies1 optimization techniques1 computational resources1 and the environmental impact of the training process4 7,c7 ,data provenance and integrity ,a detailed description of the training and testing data1 including the origins1 collection methods1 preprocessing steps1 and demographic distribution of the data1 and known discriminatory impacts and mitigation measures with respect to the data4 7,d7 ,privacy and data protection ,detailed information on data handling practices1 including compliance with legal standards1 anonymization techniques1 data security measures1 and whether and how permission for use of data is obtained4 7,e7 ,rigorous testing and oversight ,a comprehensive disclosure of performance evaluation metrics1 including accuracy1 precision1 recall1 and fairness metrics1 and test dataset results4 7,f7 ,,nist artificial intelligence risk management framework ,documentation demonstrating compliance with the most recently updated version of the framework developed and updated pursuant to section #bb;,a7c7 of the ,national ,institute of ,standards and ,technology ,act 7#ae ,u4,s4,c4 #bgh;h-#a7;c774 7#c7 ,review of requirements ,not later than #a year after the date of enactment of this ,act1 the ,comptroller ,general shall conduct a review of the documentation requirements under paragraphs 7#a7 and 7#b7 to-- 7,a7 examine whether agencies and deployers are complying with the requirements under those paragraphs2 and 7,b7 make findings and recommendations to further assist in ensuring safe1 responsible1 and efficient artificial intelligence4 7#d7 ,security of provided documentation ,the head of each agency shall ensure that appropriate security measures and access controls are in place to protect documentation provided pursuant to this section4 7c7 ,information and use protections ,information provided to an agency under subsection 7b77#c7 is exempt from disclosure under section #eeb of title #e1 ,united ,states ,code 7commonly known as the ,freedom of ,information ,act7 and may be used by the agency1 consistent with otherwise applicable provisions of ,federal law1 solely for-- 7#a7 assessing the ability of artificial intelligence to achieve the requirements and objectives of the agency and the requirements of this ,act2 and 7#b7 identifying-- 7,a7 adverse effects of artificial intelligence on the rights or safety factors identified in section #g7;a77#b77;,d72 7,b7 cyber threats1 including the sources of the cyber threats2 and 7,c7 security vulnerabilities4 7d7 ,pre-,deployment requirements for high risk use cases ,beginning on the date that is #a year after the date of enactment of this ,act1 the head of an agency shall not deploy or use artificial intelligence for a high risk use case prior to-- 7#a7 collecting documentation of the artificial intelligence1 source1 and use case in agency software and use case inventories2 7#b7 testing of the artificial intelligence in an operational1 real-world setting with privacy1 civil rights1 and civil liberty safeguards to ensure the artificial intelligence is capable of meeting its objectives2 7#c7 establishing appropriate agency rules of behavior for the use case1 including required human involvement in1 and user-facing explainability of1 decisions made in whole or part by the artificial intelligence1 as determined by the ,chief ,artificial ,intelligence ,officer in coordination with the program manager or equivalent agency personnel2 and 7#d7 establishing appropriate agency training programs1 including documentation of completion of training prior to use of artificial intelligence1 that educate agency personnel involved with the application of artificial intelligence in high risk use cases on the capacities and limitations of artificial intelligence1 including training on-- 7,a7 monitoring the operation of artificial intelligence in high risk use cases to detect and address anomalies1 dysfunctions1 and unexpected performance in a timely manner to mitigate harm2 7,b7 lessening reliance or over-reliance on the output produced by artificial intelligence in a high risk use case1 particularly if artificial intelligence is used to make decisions impacting individuals2 7,c7 accurately interpreting the output of artificial intelligence1 particularly considering the characteristics of the system and the interpretation tools and methods available2 7,d7 when to not use1 disregard1 override1 or reverse the output of artificial intelligence2 7,e7 how to intervene or interrupt the operation of artificial intelligence2 7,f7 limiting the use of artificial intelligence to its operational design domain2 and 7,g7 procedures for reporting incidents involving misuse1 faulty results1 safety and security issues1 and other problems with use of artificial intelligence that does not function as intended4 7e7 ,ongoing monitoring of artificial intelligence in high risk use cases ,the ,chief ,artificial ,intelligence ,officer of each agency shall-- 7#a7 establish a reporting system1 consistent with section #e7;g71 and suspension and shut-down protocols for defects or adverse impacts of artificial intelligence1 and conduct ongoing monitoring1 as determined necessary by use case2 7#b7 oversee the development and implementation of ongoing testing and evaluation processes for artificial intelligence in high risk use cases to ensure continued mitigation of the potential risks identified in the risk evaluation process2 7#c7 implement a process to ensure that risk mitigation efforts for artificial intelligence are reviewed not less than annually and updated as necessary to account for the development of new versions of artificial intelligence and changes to the risk profile2 and 7#d7 adhere to pre-deployment requirements under subsection 7d7 in each case in which a low or medium risk artificial intelligence use case becomes a high risk artificial intelligence use case4 7f7 ,exemption from requirements for select use cases ,the ,chief ,artificial ,intelligence ,officer of each agency-- 7#a7 may designate select1 low risk use cases1 including current and future use cases1 that do not have to comply with all or some of the requirements in this ,act2 and 7#b7 shall publicly disclose all use cases exempted under paragraph 7#a7 with a justification for each exempted use case4 7g7 ,exception ,the requirements under subsections 7a7 and 7b7 shall not apply to an algorithm software update1 enhancement1 derivative1 correction1 defect1 or fix for artificial intelligence that does not materially change the compliance of the deployer with the requirements of those subsections1 unless determined otherwise by the agency ,chief ,artificial ,intelligence ,officer4 7h7 ,waivers 7#a7 ,in general ,the head of an agency1 on a case by case basis1 may waive #a or more requirements under subsection 7d7 for a specific use case after making a written determination1 based upon a risk assessment conducted by a human with respect to the specific use case1 that fulfilling the requirement or requirements prior to procuring or obtaining1 developing1 or using artificial intelligence would increase risks to safety or rights overall or would create an unacceptable impediment to critical agency operations4 7#b7 ,requirements2 limitations ,a waiver under this subsection shall be-- 7,a7 in the national security interests of the ,united ,states1 as determined by the head of the agency2 7,b7 submitted to the relevant congressional committees not later than #ae days after the head of the agency grants the waiver2 and 7,c7 limited to a duration of #a year1 at which time the head of the agency may renew the waiver and submit the renewed waiver to the relevant congressional committees4 7i7 ,infrastructure security ,the head of an agency1 in consultation with the agency ,chief ,artificial ,intelligence ,officer1 ,chief ,information ,officer1 ,chief ,data ,officer1 and other relevant agency officials1 shall reevaluate infrastructure security protocols based on the artificial intelligence use cases and associated risks to infrastructure security of the agency4 7j7 ,compliance deadline ,not later than #bgj days after the date of enactment of this ,act1 the requirements of subsections 7a7 through 7i7 of this section shall apply with respect to artificial intelligence that is already in use on the date of enactment of this ,act4 #i4 ,prohibition on select artificial intelligence use cases ,no agency may develop1 procure or obtain1 or use artificial intelligence for-- 7#a7 mapping facial biometric features of an individual to assign corresponding emotion and potentially take action against the individual2 7#b7 categorizing and taking action against an individual based on biometric data of the individual to deduce or infer race1 political opinion1 religious or philosophical beliefs1 trade union status1 sexual orientation1 or other personal trait2 7#c7 evaluating1 classifying1 rating1 or scoring the trustworthiness or social standing of an individual based on multiple data points and time occurrences related to the social behavior of the individual in multiple contexts or known or predicted personal or personality characteristics in a manner that may lead to discriminatory outcomes2 or 7#d7 any other use found by the agency to pose an unacceptable risk under the risk classification system of the agency1 pursuant to section #g4 #aj4 ,agency procurement innovation labs 7a7 ,in general ,an agency subject to the ,chief ,financial ,officers ,act of #aiij 7#ca ,u4,s4,c4 #ija note2 ,public ,law #aja-egf7 that does not have a ,procurement ,innovation ,lab on the date of enactment of this ,act should consider establishing a lab or similar mechanism to test new approaches1 share lessons learned1 and promote best practices in procurement1 including for commercial technology1 such as artificial intelligence1 that is trustworthy and best-suited for the needs of the agency4 7b7 ,functions ,the functions of the ,procurement ,innovation ,lab or similar mechanism should include-- 7#a7 providing leadership support as well as capability and capacity to test1 document1 and help agency programs adopt new and better practices through all stages of the acquisition lifecycle1 beginning with project definition and requirements development2 7#b7 providing the workforce of the agency with a clear pathway to test and document new acquisition practices and facilitate fresh perspectives on existing practices2 7#c7 helping programs and integrated project teams successfully execute emerging and well-established acquisition practices to achieve better results2 and 7#d7 promoting meaningful collaboration among offices that are responsible for requirements development1 contracting officers1 and others1 including financial and legal experts1 that share in the responsibility for making a successful procurement4 7c7 ,structure ,an agency should consider placing the ,procurement ,innovation ,lab or similar mechanism as a supporting arm of the ,chief ,acquisition ,officer or ,senior ,procurement ,executive of the agency and shall have wide latitude in structuring the ,procurement ,innovation ,lab or similar mechanism and in addressing associated personnel staffing issues4 #aa4 ,multi-phase commercial technology test program 7a7 ,test program ,the head of an agency may procure commercial technology through a multi-phase test program of contracts in accordance with this section4 7b7 ,purpose ,a test program established under this section shall-- 7#a7 provide a means by which an agency may post a solicitation1 including for a general need or area of interest1 for which the agency intends to explore commercial technology solutions and for which an offeror may submit a bid based on existing commercial capabilities of the offeror with minimal modifications or a technology that the offeror is developing for commercial purposes2 and 7#b7 use phases1 as described in subsection 7c71 to minimize government risk and incentivize competition4 7c7 ,contracting procedures ,under a test program established under this section1 the head of an agency may acquire commercial technology through a competitive evaluation of proposals resulting from general solicitation in the following phases3 7#a7 ,phase #a 7viability of potential solution7 ,selectees may be awarded a portion of the total contract award and have a period of performance of not longer than #a year to prove the merits1 feasibility1 and technological benefit the proposal would achieve for the agency4 7#b7 ,phase #b 7major details and scaled test7 ,selectees may be awarded a portion of the total contract award and have a period of performance of not longer than #a year to create a detailed timeline1 establish an agreeable intellectual property ownership agreement1 and implement the proposal on a small scale4 7#c7 ,phase #c 7implementation or recycle7 7,a7 ,in general ,following successful performance on phase #a and #b1 selectees may be awarded up to the full remainder of the total contract award to implement the proposal1 depending on the agreed upon costs and the number of contractors selected4 7,b7 ,failure to find suitable selectees ,if no selectees are found suitable for phase #c1 the agency head may determine not to make any selections for phase #c1 terminate the solicitation and utilize any remaining funds to issue a modified general solicitation for the same area of interest4 7d7 ,treatment as competitive procedures ,the use of general solicitation competitive procedures for a test program under this section shall be considered to be use of competitive procedures as defined in section #aeb of title #da1 ,united ,states ,code4 7e7 ,limitation ,the head of an agency shall not enter into a contract under the test program for an amount in excess of #be1jjj1jjj4 7f7 ,guidance 7#a7 ,federal ,acquisition ,regulatory ,council ,the ,federal ,acquisition ,regulatory ,council shall revise the ,federal ,acquisition ,regulation as necessary to implement this section1 including requirements for each general solicitation under a test program to be made publicly available through a means that provides access to the notice of the general solicitation through the ,system for ,award ,management or subsequent government-wide point of entry1 with classified solicitations posted to the appropriate government portal4 7#b7 ,agency procedures ,the head of an agency may not award contracts under a test program until the agency issues guidance with procedures for use of the authority4 ,the guidance shall be issued in consultation with the relevant ,acquisition ,regulatory ,council and shall be publicly available4 7g7 ,sunset ,the authority for a test program under this section shall terminate on the date that is #e years after the date the ,federal ,acquisition ,regulation is revised pursuant to subsection 7f77#a7 to implement the program4 #ab4 ,research and development project pilot program 7a7 ,pilot program ,the head of an agency may carry out research and prototype projects in accordance with this section4 7b7 ,purpose ,a pilot program established under this section shall provide a means by which an agency may-- 7#a7 carry out basic1 applied1 and advanced research and development projects2 and 7#b7 carry out prototype projects that address-- 7,a7 a proof of concept1 model1 or process1 including a business process2 7,b7 reverse engineering to address obsolescence2 7,c7 a pilot or novel application of commercial technologies for agency mission purposes2 7,d7 agile development activity2 7,e7 the creation1 design1 development1 or demonstration of operational utility2 or 7,f7 any combination of items described in subparagraphs 7,a7 through 7,e74 7c7 ,contracting procedures ,under a pilot program established under this section1 the head of an agency may carry out research and prototype projects-- 7#a7 using small businesses to the maximum extent practicable2 7#b7 using cost sharing arrangements where practicable2 7#c7 tailoring intellectual property terms and conditions relevant to the project and commercialization opportunities2 and 7#d7 ensuring that such projects do not duplicate research being conducted under existing agency programs4 7d7 ,treatment as competitive procedures ,the use of research and development contracting procedures under this section shall be considered to be use of competitive procedures1 as defined in section #aeb of title #da1 ,united ,states ,code4 7e7 ,treatment as commercial technology ,the use of research and development contracting procedures under this section shall be considered to be use of commercial technology1 as defined in section #b4 7f7 ,follow-,on ,projects or ,phases ,a follow-on contract provided for in a contract opportunity announced under this section may1 at the discretion of the head of the agency1 be awarded to a participant in the original project or phase if the original project or phase was successfully completed4 7g7 ,limitation ,the head of an agency shall not enter into a contract under the pilot program for an amount in excess of #aj1jjj1jjj4 7h7 ,guidance 7#a7 ,federal acquisition regulatory council ,the ,federal ,acquisition ,regulatory ,council shall revise the ,federal ,acquisition ,regulation research and development contracting procedures as necessary to implement this section1 including requirements for each research and development project under a pilot program to be made publicly available through a means that provides access to the notice of the opportunity through the ,system for ,award ,management or subsequent government-wide point of entry1 with classified solicitations posted to the appropriate government portal4 7#b7 ,agency procedures ,the head of an agency may not award contracts under a pilot program until the agency1 in consultation with the relevant ,acquisition ,regulatory ,council issues and makes publicly available guidance on procedures for use of the authority4 7i7 ,reporting ,contract actions entered into under this section shall be reported to the ,federal ,procurement ,data ,system1 or any successor system4 7j7 ,sunset ,the authority for a pilot program under this section shall terminate on the date that is #e years from the date the ,federal ,acquisition ,regulation is revised pursuant to subsection 7h77#a7 to implement the program4 #ac4 ,development of tools and guidance for testing and evaluating artificial intelligence 7a7 ,agency report requirements ,in a manner specified by the ,director1 the ,chief ,artificial ,intelligence ,officer shall identify and annually submit to the ,council a report on obstacles encountered in the testing and evaluation of artificial intelligence1 specifying-- 7#a7 the nature of the obstacles2 7#b7 the impact of the obstacles on agency operations1 mission achievement1 and artificial intelligence adoption2 7#c7 recommendations for addressing the identified obstacles1 including the need for particular resources or guidance to address certain obstacles2 and 7#d7 a timeline that would be needed to implement proposed solutions4 7b7 ,council review and collaboration 7#a7 ,annual review ,not less frequently than annually1 the ,council shall conduct a review of agency reports under subsection 7a7 to identify common challenges and opportunities for cross-agency collaboration4 7#b7 ,development of tools and guidance 7,a7 ,in general ,not later than #b years after the date of enactment of this ,act1 the ,director1 in consultation with the ,council1 shall convene a working group to-- 7i7 develop tools and guidance to assist agencies in addressing the obstacles that agencies identify in the reports under subsection 7a72 7ii7 support interagency coordination to facilitate the identification and use of relevant voluntary standards1 guidelines1 and other consensus-based approaches for testing and evaluation and other relevant areas2 and 7iii7 address any additional matters determined appropriate by the ,director4 7,b7 ,working group membership ,the working group described in subparagraph 7,a7 shall include ,federal interdisciplinary personnel1 such as technologists1 information security personnel1 domain experts1 privacy officers1 data officers1 civil rights and civil liberties officers1 contracting officials1 legal counsel1 customer experience professionals1 and others1 as determined by the ,director4 7#c7 ,information sharing ,the ,director1 in consultation with the ,council1 shall establish a mechanism for sharing tools and guidance developed under paragraph 7#b7 across agencies4 7c7 ,congressional reporting 7#a7 ,in general ,each agency shall submit the annual report under subsection 7a7 to relevant congressional committees4 7#b7 ,consolidated report ,the ,director1 in consultation with the ,council1 may suspend the requirement under paragraph 7#a7 and submit to the relevant congressional committees a consolidated report that conveys government-wide testing and evaluation challenges1 recommended solutions1 and progress toward implementing recommendations from prior reports developed in fulfillment of this subsection4 7d7 ,sunset ,the requirements under this section shall terminate on the date that is #aj years after the date of enactment of this ,act4 #ad4 ,updates to artificial intelligence use case inventories 7a7 ,amendments 7#a7 ,advancing ,american ,,ai ,act ,the ,advancing ,american ,,ai ,act 7,public ,law #aag-bfc2 #dj ,u4,s4,c4 #aacja note7 is amended-- 7,a7 in section #gbbc7c71 by striking the period and inserting and in section #ejjb of the ,national ,artificial ,intelligence ,initiative ,act of #bjbj 7#ae ,u4,s4,c4 #idja742 and 7,b7 in section #gbbe1 by striking subsection 7d74 7#b7 ,executive order #acifj ,the provisions of section #e of ,executive ,order #acifj 7#he ,fed4 ,reg4 #ghici2 relating to promoting the use of trustworthy artificial intelligence in ,federal ,government7 that exempt classified and sensitive use cases from agency inventories of artificial intelligence use cases shall cease to have legal effect4 7b7 ,compliance 7#a7 ,in general ,the ,director shall ensure that agencies submit artificial intelligence use case inventories and that the inventories comply with applicable artificial intelligence inventory guidance4 7#b7 ,annual report ,the ,director shall submit to the relevant congressional committees an annual report on agency compliance with artificial intelligence inventory guidance4 7c7 ,disclosure 7#a7 ,in general ,the artificial intelligence inventory of each agency shall publicly disclose-- 7,a7 whether artificial intelligence was developed internally by the agency or procured externally1 without excluding any use case on basis that the use case is sensitive solely because it was externally procured2 7,b7 data provenance information1 including identifying the source of the training data of the artificial intelligence1 including internal government data1 public data1 commercially held data1 or similar data2 7,c7 the level of risk at which the agency has classified the artificial intelligence use case and a brief explanation for how the determination was made2 7,d7 a list of targeted impact assessments conducted pursuant to section #g7;a77#b77;,c72 and 7,e7 the number of artificial intelligence use cases excluded from public reporting as being sensitive4 7#b7 ,updates 7,a7 ,in general ,when an agency updates the public artificial intelligence use case inventory of the agency1 the agency shall disclose the date of the modification and make change logs publicly available and accessible4 7,b7 ,guidance ,the ,director shall issue guidance to agencies that describes how to appropriately update artificial intelligence use case inventories and clarifies how sub-agencies and regulatory agencies should participate in the artificial intelligence use case inventorying process4 7d7 ,congressional reporting ,the head of each agency shall submit to the relevant congressional committees a copy of the annual artificial intelligence use case inventory of the agency1 including-- 7#a7 the use cases that have been identified as sensitive and not for public disclosure2 and 7#b7 a classified annex of classified use cases4 7e7 ,government trends report ,beginning #a year after the date of enactment of this ,act1 and annually thereafter1 the ,director1 in coordination with the ,council1 shall issue a report1 based on the artificial intelligence use cases reported in use case inventories1 that describes trends in the use of artificial intelligence in the ,federal ,government4 7f7 ,comptroller ,general 7#a7 ,report required ,not later than #a year after the date of enactment of this ,act1 and annually thereafter1 the ,comptroller ,general of the ,united ,states shall submit to relevant congressional committees a report on whether agencies are appropriately classifying use cases4 7#b7 ,appropriate classification ,the ,comptroller ,general of the ,united ,states shall examine whether the appropriate level of disclosure of artificial intelligence use cases by agencies should be included on the ,high ,risk ,list of the ,government ,accountability ,office4