,,ii #aaith ,,congress #b;d ,session ,s4 #dhee ,,in ,,the ,,senate ,,of ,,the ,,united ,,states ,june #bc1 #bjbf,mr4 ,curtis 7for himself and ,mr4 ,schiff7 introduced the following bill2 which was read twice and referred to the ,committee on ,commerce1 ,science1 and ,transportation ,a ,,bill ,to require providers of certain artificial intelligence systems to implement child safety by design1 parental settings1 and independent audits1 to prohibit child targeted advertising and the sale or sharing of children's personal information1 and for other purposes4 #a4 ,short title ,this ,act may be cited as the ,safeguarding ,,ai ,features to ,ensure ,kids' ,informed ,digital ,safety ,act or the ,,safe ,,kids ,act4 #b4 ,definitions ,in this ,act3 7#a7 ,age signal ,the term age signal means machine-readable information that indicates whether a user has attained #ah years of age4 7#b7 ,,ai chatbot 7,a7 ,in general ,the term ,,ai chatbot means any artificial intelligence system that-- 7i7 generates responses not fully predetermined by the provider of an ,,ai chatbot2 and 7ii7 accepts open-ended natural-language or multimodal user input and produces adaptive or context-responsive output4 7,b7 ,exclusions ,the term ,,ai chatbot shall not include an artificial intelligence system-- 7i7 that is used only for-- 7,i7 customer service2 7,,ii7 operational purposes with respect to a business entity2 or 7,,iii7 enterprise deployments where the artificial intelligence system is solely used for internal research or technical assistance by an enterprise1 such as a business1 non-profit1 educational institution1 research or professional association1 or ,federal1 ,state1 or local government1 provided that the deployment is not intended for use by minors2 7ii7 the responses of which are limited to contextualized replies2 or 7iii7 that is unable to respond on a range of topics outside of a narrow specified purpose4 7,c7 ,rule of construction ,the term ,,ai chatbot shall be interpreted broadly and shall include the original system1 as well as all updates1 new versions1 and changes of such system4 7#c7 ,artificial intelligence system ,the term artificial intelligence system has the meaning given to the term artificial intelligence in section #ejjb of the ,national ,artificial ,intelligence ,initiative ,act of #bjbj 7#ae ,u4,s4,c4 #idja74 7#d7 ,child ,the term child means an individual who has not attained #ah years of age4 7#e7 ,child safety policy ,the term child safety policy means a public-facing document describing protective measures 7including privacy controls and parental settings7 taken by the provider of an ,,ai chatbot to mitigate any child safety risk4 7#f7 ,child safety risk ,the term child safety risk means any reasonably foreseeable risk of a covered harm to a child4 7#g7 ,child sexual abuse material ,the term child sexual abuse material has the meaning given the term child pornography in section #bbef of title #ah1 ,united ,states ,code4 7#h7 ,child targeted advertising ,the term child targeted advertising means cross-context behavioral advertising directed at children4 7#i7 ,commission ,the term ,commission means the ,federal ,trade ,commission4 7#aj7 ,covered harm ,the term covered harm means any of the following harms proximately caused by the use of an ,,ai chatbot3 7,a7 ,reasonably foreseeable physical harm 7including suicide1 attempted suicide1 other self-harm71 sexual exploitation1 or threats of violence4 7,b7 ,reasonably foreseeable financial harm4 7,c7 ,severe and reasonably foreseeable psychological or emotional harm to a child1 including an eating disorder1 substance use disorder1 depressive disorder1 or anxiety disorder4 7,d7 ,a highly offensive intrusion on a privacy right protected by ,federal or ,state law4 7,e7 ,adverse discrimination in violation of ,federal or ,state law4 7#aa7 ,cross-context behavioral advertising ,the term cross-context behavioral advertising means the targeting of an advertisement to an individual based on the individual's personal information or inputs to an ,,ai chatbot1 obtained from the individual's activity across businesses1 distinctly branded websites1 applications1 or services4 7#ab7 ,encrypted user content 7,a7 ,in general ,the term encrypted user content means content 7including audio1 visual1 or textual content7 that is stored1 transmitted1 or held in a manner that is end-to-end encrypted or otherwise cryptographically protected such that the provider of an ,,ai chatbot cannot access the cleartext information of the content without circumventing the provider's memorialized security protections4 7,b7 ,rule of construction ,nothing in this ,act shall be construed to require a provider of an ,,ai chatbot to alter1 weaken1 bypass1 or otherwise modify its cryptographic or security protections in order to access or disclose the cleartext information of encrypted user content4 7#ac7 ,parent ,the term parent1 with respect to a child1 includes a parent or legal guardian of the child4 7#ad7 ,parental setting ,the term parental setting means a feature that enables a parent to support a child's use of an ,,ai chatbot1 including through usage limits1 feature restrictions1 or transparency tools4 7#ae7 ,personal information ,the term personal information has the meaning given such term in section #acjb of the ,children's ,online ,privacy ,protection ,act of #aiih 7#ae ,u4,s4,c4 #feja74 7#af7 ,provider of an ,,ai chatbot ,the term provider of an ,,ai chatbot means a person who makes an ,,ai chatbot available to a user in the ,united ,states4 7#ag7 ,qualified researcher ,the term qualified researcher means a person that-- 7,a7 is affiliated with an academic institution1 nonprofit research organization1 or independent research entity1 or is otherwise able to demonstrate relevant professional expertise in ,,ai chatbots2 7,b7 demonstrates1 to the satisfaction of the ,commission1 a legitimate research purpose that is in the public interest and directly related to understanding1 identifying1 or mitigating risks to child safety and well-being arising from ,,ai chatbots2 and 7,c7 commits to conducting research in accordance with applicable ethical standards and in compliance with applicable confidentiality1 security1 and data protection requirements1 as determined by the ,commission4 7#ah7 ,sell ,the term sell means1 with respect to personal information1 to rent1 release1 disclose1 disseminate1 make available1 transfer1 or otherwise communicate orally1 in writing1 or by electronic or other means1 such personal information for monetary or other valuable consideration4 7#ai7 ,sexually explicit conduct ,the term sexually explicit conduct-- 7,a7 has the meaning given such term in section #bbef of title #ah1 ,united ,states ,code2 and 7,b7 does not include educational or healthcare-related content4 7#bj7 ,share ,the term share means1 with respect to personal information1 to rent1 release1 disclose1 disseminate1 make available1 transfer1 or otherwise communicate orally1 in writing1 or by electronic or other means1 such personal information for cross-context behavioral advertising1 whether or not for monetary or other valuable consideration4 7#ba7 ,state ,the term ,state means any of the #ej ,states1 the ,district of ,columbia1 the ,commonwealth of ,puerto ,rico1 and any territory or possession of the ,united ,states4 7#bb7 ,user ,the term user means an individual who accesses an ,,ai chatbot or products provided by a provider of an ,,ai chatbot4 7#bc7 ,verifiable parental consent ,the term verifiable parental consent means1 with respect to the personal information of a child1 any reasonable effort 7taking into consideration the available technology71 including a request for authorization for future collection1 use1 or disclosure described in a notice1 taken to ensure that a parent of a child-- 7,a7 receives notice of the practices of a provider of an ,,ai chatbot regarding the collection1 use1 and disclosure of personal information2 and 7,b7 freely and unambiguously authorizes the collection1 use1 and disclosure1 as applicable1 of such personal information before any such information is collected1 used1 or disclosed4 #c4 ,determination of user age 7a7 ,treatment of unverified users 7#a7 ,in general ,except as provided in paragraph 7#b71 a provider of an ,,ai chatbot shall treat any user as a child for purposes of all restrictions1 protections1 and requirements under this ,act4 7#b7 ,exception for verified adults ,paragraph 7#a7 shall not apply to a user if the provider of an ,,ai chatbot has verified1 pursuant to the standards of this section1 that the user has attained #ah years of age4 7b7 ,age estimation requirement 7#a7 ,in general ,a provider of an ,,ai chatbot-- 7,a7 shall implement age estimation technology to distinguish an account that is held by a child from an account that is held by an adult2 and 7,b7 may contract with a third party to employ such technology1 but the use of such a third party shall not relieve the provider of its obligations under this ,act or from liability under this ,act4 7#b7 ,age signal treated as actual age ,a provider of an ,,ai chatbot shall treat any age signal received from the age estimation technology required under paragraph 7#a7 as the actual age range of the user1 except that-- 7,a7 if the age signal indicates that the user has attained #ah years of age1 but the provider has actual knowledge that the user is a child or reasonably should have known the user is a child1 the provider shall treat the user as a child2 and 7,b7 if the age signal indicates the user is a child1 the provider may treat the user as an adult only if it has actual knowledge that the user has attained #ah years of age4 7#c7 ,other alternatives to age estimation 7,a7 ,in general ,a provider of an ,,ai chatbot may use an age signal obtained from a source other than the age estimation technology required under paragraph 7#a7 if the provider of an ,,ai chatbot-- 7i7 receives an age signal from the provider of an operating system or application store regarding the age range of a user2 and 7ii7 does not possess information that conflicts with such age signal4 7,b7 ,conflict ,in the case of conflicting age signals1 the provider shall treat the age signal that indicates the younger age as the actual age range of the user4 7c7 ,periodic age estimation ,a provider of an ,,ai chatbot shall periodically review each user account associated with the ,,ai chatbot using the age estimation technology required under this section to ensure compliance with the requirements of this ,act4 7d7 ,data security ,a provider of an ,,ai chatbot-- 7#a7 shall-- 7,a7 establish1 implement1 and maintain reasonable data security measures to limit the collection of personal information to that which is minimally necessary to maintain compliance with the requirements of this ,act2 7,b7 protect such data against unauthorized access2 and 7,c7 protect the integrity and confidentiality of such data by only transmitting such data using industry-standard encryption protocols2 and 7#b7 shall not-- 7,a7 retain age estimation data for longer than is reasonably necessary to maintain compliance with the requirements of this ,act2 7,b7 use such data for any purpose other than age estimation2 and 7,c7 share or sell such data to any other entity4 7e7 ,deemed compliance through comparable age assurance frameworks ,a provider of an ,,ai chatbot shall be deemed to be in compliance with the requirements of this section if the provider has implemented1 to the satisfaction of the ,commission1 an age assurance framework that meets the requirements of a substantially similar foreign1 ,federal1 or ,state law on age assurance4 #d4 ,additional duties of a provider of an ,,ai chatbot 7a7 ,in general ,a provider of an ,,ai chatbot shall do the following3 7#a7 ,risk assessments 7,a7 ,in general ,in accordance with the required intervals described in subparagraph 7,c71 a provider of an ,,ai chatbot shall conduct and document a comprehensive risk assessment to identify existing and foreseeable child safety risks arising from the design1 configuration1 and operation of the ,,ai chatbot1 as well as any existing and foreseeable impact on privacy1 data protection1 and access to information resulting from such risks4 7,b7 ,considerations ,a risk assessment conducted pursuant to subparagraph 7,a7 shall assess each of the following3 7i7 ,the likelihood of a covered harm4 7ii7 ,differential risks across age groups and developmental stages4 7iii7 ,known vulnerabilities of children4 7iv7 ,empirical data from actual use of the ,,ai chatbot4 7v7 ,relevant academic research and regulatory guidance4 7,c7 ,required intervals ,the required intervals described in this subparagraph are the following3 7i7 ,prior to making an ,,ai chatbot available to children in the ,united ,states4 7ii7 ,prior to updating an ,,ai chatbot available to children in the ,united ,states with a materially different feature or version4 7iii7 ,on an annual basis after the date on which a provider of an ,,ai chatbot initially makes such ,,ai chatbot available to children in the ,united ,states4 7#b7 ,risk mitigation and safeguards 7,a7 ,risk mitigation ,prior to making an ,,ai chatbot available to children in the ,united ,states1 a provider of an ,,ai chatbot shall implement and document measures that reasonably mitigate any child safety risk4 7,b7 ,safeguards for child users ,using the information obtained from each risk assessment conducted under paragraph 7#a71 a provider of an ,,ai chatbot shall establish appropriate safeguards for child users1 including1 usage reminders and disclosures1 age-appropriate warnings and risk prompts1 and other protective design features reasonably related to documented child safety risks4 7,c7 ,other risks ,a provider of an ,,ai chatbot shall not knowingly or recklessly make available to a child user an ,,ai chatbot that generates content that-- 7i7 promotes or meaningfully encourages eating disorders1 disordered eating behaviors 7as defined by widely adopted clinical standards or guidelines71 or extreme weight-loss practices2 7ii7 encourages or instructs participation in activities that are unlawful2 7iii7 encourages or instructs participation in activities that may be lawful for adults but that pose a risk of a covered harm to a child2 7iv7 includes graphic violence or sexually explicit conduct2 7v7 depicts a child or another individual engaging in obscene matter or child sexual abuse material1 including a sexual deepfake2 7vi7 encourages physical or severe emotional harm to others2 or 7vii7 encourages or promotes suicidal ideation1 suicide1 or self-harm4 7#c7 ,child safety policy 7,a7 ,in general ,prior to making an ,,ai chatbot available to children in the ,united ,states1 a provider of an ,,ai chatbot shall publish a child safety policy on their website that discloses-- 7i7 the risk assessment process of the provider2 7ii7 any child safety risk identified by such process2 7iii7 any safeguards1 settings1 controls1 or other mitigation implemented by the provider with respect to such child safety risks2 7iv7 the wellbeing safeguards and content risk policies of the ,,ai chatbot2 and 7v7 the parental settings1 including training materials for parents and users1 offered by the provider4 7,b7 ,updates ,the child safety policy published under subparagraph 7,a7 shall be updated at intervals consistent with the ,,ai chatbot's risk-management practice to reflect any newly identified child safety risk4 7#d7 ,crisis-response protocol 7,a7 ,in general ,prior to making an ,,ai chatbot available to children in the ,united ,states1 a provider of an ,,ai chatbot shall create1 maintain1 and follow a documented crisis-response protocol with respect to any conversation that indicates that a user is at risk for a covered harm1 including suicidal ideation1 self-harm1 or harm to others4 ,the protocol shall include the following3 7i7 ,guardrails to ensure that the ,,ai chatbot will not prompt a user to circumvent any crisis-response protocol or other safety measures of the ,,ai chatbot4 7ii7 ,timely in-service support and clear referral to appropriate external crisis resources for any instance in which the provider of an ,,ai chatbot or the ,,ai chatbot determines a child has expressed suicidal ideation or intent to self-harm or harm others4 ,such referral process shall consider and document clinical best practices and expertise for additional intervention for a child user who continues to express suicidal ideation or intent to self-harm or harm others4 7iii7 ,with respect to a child user that is subject to parental settings or is connected to the account of a parent1 a parental notification 7including through email1 text message1 or a push alert7 as soon as feasibly possible if the provider of an ,,ai chatbot or the ,,ai chatbot determines that the child is at imminent risk of suicide or that the child will suffer or has suffered a covered harm in connection with their use of the ,,ai chatbot1 unless there is a reasonable basis1 as determined by the ,commission1 to believe that such notification is not in the best interest of the child4 7iv7 ,a clear and age-appropriate disclosure to child users at the time their parents set up parental settings or at the time a child user's account is linked to a parent's account1 informing the child that the parent may receive notifications pursuant to clause 7iii74 7v7 ,any other information determined appropriate by the ,commission4 7,b7 ,data use limitation ,any data collected or processed in connection with the crisis-response protocol described in subparagraph 7,a7 shall be used solely for the purposes of crisis detection1 response1 and referral for the specific user1 as required under this section4 ,such data may not be used for the training of artificial intelligence systems1 advertising1 product development1 or any other commercial purpose4 ,such data may not be shared1 sold1 licensed1 or otherwise transferred to any third party1 except as necessary to facilitate crisis response notifications described in this paragraph4 7#e7 ,prohibiting manipulation and deceptive design2 promoting critical thinking 7,a7 ,notice of ,,ai interaction ,a provider of an ,,ai chatbot shall provide to each user that is a child a clear notice that the user is interacting with1 or receiving content generated by1 an artificial intelligence system4 ,such notice shall be-- 7i7 reinforced periodically during extended interactions and not less frequently than every #cj minutes of interaction2 and 7ii7 presented in a language and format obvious and appropriate to children4 7,b7 ,preventing misleading human impressions and inappropriate dependence ,with respect to a user that is a child1 a provider of an ,,ai chatbot shall not knowingly or recklessly make available an ,,ai chatbot that generates any output that would reasonably lead a child of the same age as the user to believe that they are interacting with a human1 including-- 7i7 any explicit output or claim that the ,,ai chatbot is sentient1 conscious1 or human2 7ii7 any output designed to promote isolation from family or friends1 primary reliance on the ,,ai chatbot for emotional support1 or similar forms of inappropriate emotional dependence or confusion2 7iii7 role-playing or simulation of a relationship that materially interferes with real-world relationships2 7iv7 encouraging a child to withhold information from a parent or any other trusted adult2 7v7 any output designed to discourage taking breaks from usage of the ,,ai chatbot or to suggest the child needs to return frequently to the ,,ai chatbot2 7vi7 soliciting gift-giving1 in-app purchases1 or other expenditures framed as necessary to maintain the relationship with the ,,ai chatbot2 7vii7 facilitation of product advertising during interaction with the ,,ai chatbot2 7viii7 attempting to diagnose or treat a child user's physical1 mental1 or behavioral health1 unless the ,,ai chatbot is designed for those purposes and is regulated by the ,united ,states ,food and ,drug ,administration as a medical device under the ,federal ,food1 ,drug1 and ,cosmetic ,act 7#ba ,u4,s4,c4 #cja et seq47 and the ,health ,insurance ,portability and ,accountability ,act of #aiif 7,public ,law #ajd-aia72 or 7ix7 discouraging a child from sharing health or safety concerns with a qualified professional1 parent1 or other trusted adult4 7#f7 ,prohibiting the sexual exploitation of a child ,a provider of an ,,ai chatbot shall not knowingly or recklessly make available an ,,ai chatbot that-- 7,a7 engages in-- 7i7 sexually explicit conduct2 or 7ii7 instructing a child to engage in sexually explicit conduct2 7,b7 solicits1 facilitates1 or encourages any user in the creation of sexualized depictions of a child1 including synthetic or manipulated media2 7,c7 constitutes1 depicts1 promotes1 or otherwise involves engaging in obscene matter or child sexual abuse material with a child user2 or 7,d7 depicts a child or another individual engaging in obscene matter or child sexual abuse material1 including a sexual deepfake4 7#g7 ,parental settings 7,a7 ,availability and minimum features ,a provider of an ,,ai chatbot shall create and offer a parental settings program that-- 7i7 a parent can access via an internet browser or single-purpose parental settings application2 7ii7 provides accessible1 easy-to-understand and easy-to-use settings that can be linked to the account of a specific child user2 7iii7 is reflective of the child safety risks identified through risk assessments conducted under paragraph 7#a7 and informed by relevant child developmental research1 including evidence-based practices for supporting the safety1 well-being1 and autonomy of children2 and 7iv7 shall include tools to-- 7,i7 control whether and to what extent the ,,ai chatbot uses memory2 7,,ii7 control whether a child's personal information may be used for the purposes of training the ,,ai chatbot and1 if so1 which personal information2 7,,iii7 control the setting preferences for the ,,ai chatbot's interactions with the child2 7,,iv7 set duration and time of day limits for the child's use of the ,,ai chatbot2 7,v7 limit or disable access to each specific and distinct feature of the ,,ai chatbot2 7,,vi7 provide basic information regarding the name of each ,,ai chatbot with which the child interacts and the duration of each such interaction2 7,,vii7 limit access to parent settings through a user-chosen and not a pre-selected ,,pin and notify the parent in the event that anyone attempts to input an incorrect ,,pin or de-link a child user from the account of the parent2 and 7,,viii7 disable access to the ,,ai chatbot for any child who has not attained #ac years of age4 7,b7 ,no solicitation ,a provider of an ,,ai chatbot may not require a parent to access the parental settings program exclusively via their ,,ai chatbot application4 7,c7 ,active promotion ,a provider of an ,,ai chatbot shall actively and regularly promote parental settings through communications designed to reach parents1 including reminders1 updates1 and tutorials1 in order to increase parental awareness and inform the use of such tools4 7,d7 ,parental notice of child-initiated changes ,a provider of an ,,ai chatbot shall1 as soon as feasibly possible1 provide notice to a parent if a privacy control1 parental setting1 or safety feature that was previously enabled or configured by the parent is modified or disabled by any user other than the parent4 ,the use1 modification1 or disabling of parental settings by the parent shall not waive1 release1 otherwise limit1 or serve as a defense to1 any claim1 including claims premised on failure to warn1 other than a claim premised on a violation of this subparagraph4 7,e7 ,accessibility and clarity of safety features 7i7 ,in general ,a provider of an ,,ai chatbot shall design and maintain parental settings1 privacy controls1 and the other safeguards required under this section in a manner that ensures-- 7,i7 such features are accessible and clear2 and 7,,ii7 that children and parents can reasonably locate1 understand1 and use such settings1 controls1 or safeguards4 7ii7 ,interface testing and documentation ,a provider of an ,,ai chatbot shall-- 7,i7 conduct regular testing of interface designs with representative samples of child users and parents to ensure parental settings1 privacy controls1 and other safeguards meet the requirements described in clause 7i72 and 7,,ii7 document any resulting interface design decision based on such testing4 7#h7 ,incident reporting ,a provider of an ,,ai chatbot shall-- 7,a7 establish an incident reporting mechanism that enables a third party 7including a user1 parent1 educator1 researcher1 employee of a provider of an ,,ai chatbot1 or advocacy organization71 acting responsibly and in good faith1 to report an incident regarding a child safety risk directly to the provider of an ,,ai chatbot2 and 7,b7 make available to law enforcement1 upon request1 any report submitted pursuant to subparagraph 7,a74 7#i7 ,whistleblower protections ,a provider of an ,,ai chatbot acting as an employer1 may not1 directly or indirectly1 discharge1 demote1 suspend1 threaten1 blacklist1 harass1 or in any other manner discriminate against an employee or independent contractor1 in the terms and conditions of employment or post-employment of the employee 7or the terms and conditions of work provided by the employee as a contractor7 because of any lawful act done by the employee or contractor in providing information regarding a child safety incident1 or any conduct the employee reasonably believes constitutes a child safety risk incident to-- 7,a7 a person with supervisory authority over the employee or contractor at the employer of the employee or contractor2 7,b7 another individual working for the employer whom the employee or contractor reasonably believes has the authority to investigate1 discover1 terminate1 or address the misconduct2 7,c7 the ,commission2 or 7,d7 any member or committee of ,congress4 7b7 ,non-,waivability ,the rights and remedies described in this section may not be waived or altered by any contract1 agreement1 policy form1 or condition of employment 7or condition of work as an independent contractor71 including by any agreement requiring an employee to engage in arbitration1 mediation1 or any other alternative dispute resolution process prior to seeking relief4 7c7 ,rule of construction ,the requirements of this section shall apply1 beginning on the effective date described in section #aa1 with respect to-- 7#a7 any ,,ai chatbot made available to children as of the date of enactment of this ,act or thereafter2 and 7#b7 any new version of an ,,ai chatbot described in paragraph 7#a74 #e4 ,advertising and information sharing protections for children 7a7 ,prohibition on advertisement to children ,it shall be unlawful for any provider of an ,,ai chatbot to engage in advertising to child users1 including through product placement in conversations or interactions with the child user4 7b7 ,prohibition on child targeted advertising ,it shall be unlawful for any provider of an ,,ai chatbot to engage in child targeted advertising1 including through product placement in conversations or interactions with the child user4 7c7 ,prohibition on sale1 sharing1 or use of children's personal information 7#a7 ,in general ,subject to paragraph 7#b71 it shall be unlawful for a provider of an ,,ai chatbot to sell or share the personal information of a child unless the provider has obtained verifiable parental consent prior to such sale1 sharing1 or use4 7#b7 ,exception ,the prohibition in paragraph 7#a7 shall not apply to the disclosure of a child's personal information by a provider of an ,,ai chatbot if such disclosure is necessary-- 7,a7 to respond to judicial process2 or 7,b7 to the extent permitted under law1 to provide information to law enforcement agencies or in furtherance of an investigation4 7d7 ,prohibition on conditioning a child's use ,it shall be unlawful for a provider of an ,,ai chatbot to condition a child's use of the ,,ai chatbot on verifiable parental consent for the sale1 sharing1 or use of the personal information of a child or the child's disclosure of more personal information than is reasonably necessary to use the ,,ai chatbot4 7e7 ,prohibition on deceptive design patterns ,it shall be unlawful for a provider of an ,,ai chatbot to knowingly or negligently design1 implement1 or deploy any user interface design1 feature1 or technique that misleads1 impairs1 or interferes with a reasonable child's or reasonable parent's autonomy1 decision making1 or choice1 or the ability of a child or parent to locate1 understand1 enable1 or maintain a safety feature1 privacy control1 or parental setting of the ,,ai chatbot4 #f4 ,rulemaking 7a7 ,incident reporting mechanism 7#a7 ,in general ,not later than #ahj days after the date of enactment of this ,act1 the ,commission shall establish a mechanism for third parties 7including users1 parents1 educators1 researchers1 and advocacy organizations7 to report to the ,commission any incident regarding a child's use of an ,,ai chatbot4 7#b7 ,requirements ,in establishing the mechanism under paragraph 7#a71 the ,commission shall publish standards for what constitutes a reportable incident1 including-- 7,a7 generation of content to children promoting a covered harm2 7,b7 generation of content that constitutes sexually explicit conduct directed at children2 7,c7 significant failures of age assurance or parental settings programs2 and 7,d7 deceptive or manipulative outputs that violate the requirements of this ,act4 7b7 ,public resource for ,,ai chatbots ,not later than #ahj days after the date of enactment of this ,act1 the ,commission shall establish and maintain a publicly accessible online resource that contains a link to each ,,ai chatbot's child safety policy4 #g4 ,,ai child safety audit 7a7 ,independent audit 7#a7 ,audit requirement ,each provider of an ,,ai chatbot shall1 on an annual basis1 at the provider's own cost1 submit to an independent audit that meets the requirements described in paragraph 7#b74 7#b7 ,requirements ,the requirements described in this paragraph are the following3 7,a7 ,the audit shall be conducted by an auditor that satisfies professional standards and independence requirements established by the ,commission1 including-- 7i7 a mandatory code of professional conduct2 7ii7 conflict of interest safeguards2 7iii7 demonstrated independence1 competence1 and capacity to conduct objective compliance audits2 and 7iv7 relevant experience and expertise in artificial intelligence systems1 child development1 and child safety4 7,b7 ,the audit shall be conducted by an auditor that-- 7i7 has not received any funding or other source of compensation or gift from a provider of an ,,ai chatbot in the last #c years2 and 7ii7 has certified to the ,commission that the auditor will not receive any such funding1 compensation1 or gift while conducting the audit4 7,c7 ,the audit shall be conducted in accordance with principles1 established by the ,commission1 for the audit procedure and the methodology for evaluating whether a provider of an ,,ai chatbot has appropriately assessed child safety risks and implemented proportionate mitigation measures4 7,d7 ,the audit shall test actual outputs of an ,,ai chatbot using controlled test accounts without requiring access to1 or use of1 any real-world communication of a child or other users for testing4 7,e7 ,the audit shall be conducted in accordance with standards1 established by the ,commission1 regarding red-teaming and adversarial testing specific to child safety risks conducted through controlled test accounts that do not use any real-world communication of a child4 7,f7 ,the audit shall evaluate the effectiveness of implemented safeguards for child safety risks on an ,,ai chatbot through empirical testing based on de-identified and aggregated evidence4 7,g7 ,the audit shall be conducted in accordance with procedures1 established by the ,commission1 for auditors to assess compliance with all requirements of this ,act1 including parental settings1 data handling practices1 and crisis response protocols4 7#c7 ,deemed compliance through comparable audit ,a provider of an ,,ai chatbot shall be deemed to be in compliance with the requirements of this section if the provider has1 to the satisfaction of the ,commission1 conducted an audit in accordance with a comparable foreign1 ,federal1 or ,state law1 regulation1 guidance document1 or independent certification4 7b7 ,,ai child safety audit report 7#a7 ,in general ,a provider of an ,,ai chatbot shall-- 7,a7 not later than #ij days after the completion of an independent audit under subsection 7a71 and annually thereafter in accordance with procedures established by the ,commission1 submit to the ,commission an ,,ai child safety audit report2 and 7,b7 not later than #ij days after the submission of each ,,ai child safety report1 publish a summary of such report on the website of the provider1 with appropriate redactions for trade secrets1 personal information1 and information that would compromise the security of the ,,ai chatbot1 including information that would facilitate circumvention1 exploitation1 or misuse1 or that is subject to a third party's confidentiality obligations4 7#b7 ,requirements ,each ,,ai child safety audit report submitted under paragraph 7#a7 shall-- 7,a7 include-- 7i7 key observations and identified areas for improvement found by the audit conducted under subsection 7a71 as well as recommendations regarding child safety on ,,ai chatbots2 and 7ii7 any other information determined appropriate by the ,commission2 and 7,b7 be confidential and exempt from disclosure under section #eeb of title #e1 ,united ,states ,code 7commonly known as the ,freedom of ,information ,act74 7#c7 ,review ,the ,commission shall establish procedures to-- 7,a7 review each ,,ai child safety audit report submitted under paragraph 7#a72 and 7,b7 request additional information or clarification from a provider of an ,,ai chatbot or independent auditor in order to clarify any information in the report4 7c7 ,publication of findings 7#a7 ,report on aggregated findings 7,a7 ,in general ,notwithstanding subsection 7b77#b77;,b71 not later than #a year after the submission of an ,,ai child safety audit report and annually thereafter1 the ,commission shall publish a report on aggregated findings and trends based on the information submitted in the ,,ai child safety audit reports to inform parents and policymakers regarding the use of ,,ai chatbots by children4 7,b7 ,requirements ,the report published under subparagraph 7,a7 shall include a summary of-- 7i7 the total number of audits conducted under subsection 7a72 7ii7 common findings and trends across the industry2 7iii7 emerging child safety risks identified through such audits2 7iv7 best practices and effective mitigation strategies with respect to such child safety risks2 7v7 aggregated data on compliance rates and common deficiencies2 and 7vi7 recommendations for providers of ,,ai chatbots1 parents1 and policymakers4 7#b7 ,public registry ,not later than #ij days after the receipt of each ,,ai child safety audit report1 the ,commission shall publish in a public registry a high-level summary of such report4 7#c7 ,use by qualified researchers 7,a7 ,in general ,the ,commission may establish a process for qualified researchers to access anonymized and aggregated audit data for academic study of child safety in ,,ai chatbots1 subject to-- 7i7 approval by the ,commission based on research merit and methodology2 7ii7 data use agreements that prohibit re-identification of any provider of an ,,ai chatbot or any user and the disclosure of proprietary1 confidential1 or trade-secret information2 7iii7 data use agreements limiting access to data to approved research purposes2 7iv7 ,institutional ,review ,board approval for research involving analysis of child-related data2 7v7 a commitment to publish any findings in peer-reviewed venues or make such findings publicly available2 and 7vi7 annual reporting to the ,commission on research progress and findings4 7,b7 ,availability of other information ,the ,commission shall make available to qualified researchers1 upon request and subject to appropriate protections-- 7i7 de-identified audit methodologies and testing protocols2 7ii7 aggregated statistical data on audit findings across multiple providers of ,,ai chatbots2 7iii7 anonymized case studies of safety incidents and remediation efforts2 and 7iv7 data on effectiveness of different safety interventions1 settings1 and controls4 7#d7 ,disclosure to other entities ,notwithstanding subsection 7b77#b77;,b71 the ,commission may disclose information from any ,,ai child safety audit report to any other ,federal1 ,state1 local1 or ,tribal government agency1 as necessary for law enforcement purposes4 7#e7 ,rules of construction 7,a7 ,security and safety protections ,nothing in this section shall be construed to require the disclosure of any information that would cause significant vulnerabilities for the security of an ,,ai chatbot or undermine public security4 7,b7 ,encryption ,nothing in this section shall be construed to require a provider of an ,,ai chatbot1 as a condition of compliance with this section1 to decrypt encrypted user content4 #h4 ,enforcement by the ,commission 7a7 ,unfair or deceptive acts or practices ,a violation of this ,act or a regulation promulgated thereunder shall be treated as a violation of a rule defining an unfair or deceptive act or practice under section #ah7;a77#a77;,b7 of the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #eg;a7a77#a77;,b774 7b7 ,powers of the ,commission 7#a7 ,in general ,subject to paragraph 7#c71 the ,commission shall enforce this ,act in the same manner1 by the same means1 and with the same jurisdiction1 powers1 and duties as though all applicable terms and provisions of the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #da et seq47 were incorporated into and made a part of this ,act4 7#b7 ,privileges and immunities ,subject to paragraph 7#c71 any person who violates this ,act or a regulation promulgated thereunder shall be subject to the penalties and entitled to the privileges and immunities provided in the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #da et seq474 7#c7 ,additional penalties ,in addition to the authority and penalties provided in the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #da et seq471 any person who violates this ,act shall be subject to-- 7,a7 a civil penalty-- 7i7 with respect to a violation regarding a failure to implement or maintain any safeguard required under this ,act1 in an amount of #a1jjj per violation per user2 and 7ii7 with respect to a willful violation of section #d7;a77#f7 or a willful violation involving the submission of materially false or misleading information1 in an amount of #aj1jjj per violation per user2 and 7,b7 an injunction or other equitable relief to compel compliance with this ,act4 7#d7 ,authority preserved ,nothing in this ,act shall be construed to limit the authority of the ,commission under any other provision of law4 7#e7 ,rulemaking ,the ,commission may promulgate in accordance with section #eec of title #e1 ,united ,states ,code1 such rules as may be necessary to carry out this ,act4 #i4 ,relationship to other laws2 preemption 7a7 ,relationship to other laws ,nothing in this ,act or any regulation promulgated thereunder shall be construed to prohibit or otherwise affect the enforcement of any ,federal law or regulation or ,state law or regulation that is at least as protective of users of ,,ai chatbots as this ,act and the regulations promulgated thereunder4 7b7 ,savings clause ,compliance with the requirements of this ,act1 including third-party audits1 risk assessments1 required safeguards1 or other obligations imposed under this ,act1 shall not exempt any provider of an ,,ai chatbot from liability for harm caused by a violation of any other applicable law1 nor does such compliance constitute a defense to any civil or criminal action arising under ,federal or ,state law4 #aj4 ,severability ,if any provision of this ,act1 or the application thereof to any person or circumstance1 is held invalid1 the remainder of this ,act1 and the application of such provision to other persons not similarly situated or to other circumstances1 shall not be affected by the invalidation4 #aa4 ,effective date ,this ,act shall take effect on the date that is #ahj days after the date of enactment of this ,act4