,,ii #aaith ,,congress #b;d ,session ,s4 #eaag ,,in ,,the ,,senate ,,of ,,the ,,united ,,states ,july #bc1 #bjbf,mr4 ,kelly 7for himself and ,mr4 ,justice7 introduced the following bill2 which was read twice and referred to the ,committee on ,commerce1 ,science1 and ,transportation ,a ,,bill ,to establish consumer transparency and protection requirements for artificial intelligence chatbots1 and for other purposes4 #a4 ,short title ,this ,act may be cited as the ,senior ,chatbot ,protection ,act of #bjbf4 #b4 ,definitions ,in this ,act3 7#a7 ,artificial intelligence chatbot ,the term artificial intelligence chatbot-- 7,a7 means an interactive computer service or software application1 including such a service or application made available through a website1 mobile application1 voice interface1 avatar1 connected device1 or other user interface1 that-- 7i7 generates prompts1 responses1 or other outputs that are not fully predetermined by the developer or operator of the service or application2 7ii7 accepts open-ended natural-language or multimodal user input2 and 7iii7 produces adaptive or context-responsive output2 and 7,b7 does not include an interactive computer service or software application-- 7i7 the responses of which are limited to predetermined or contextualized replies2 and 7ii7 that is unable to respond on a range of topics outside of a narrow specified purpose4 7#b7 ,affirmative consent ,the term affirmative consent means1 with respect to an artificial intelligence chatbot1 a clear affirmative act signifying a user's freely given1 specific1 informed1 and unambiguous authorization for an act or practice-- 7,a7 that is in response to a specific request from a covered entity that-- 7i7 is provided to the user in a clear and conspicuous standalone disclosure2 and 7ii7 includes a description1 written in easy-to-understand language1 of the act or practice for which the user's consent is sought2 and 7,b7 in which-- 7i7 the option to refuse to give consent is at least as prominent as the option to give consent2 7ii7 the option to refuse to give consent takes the same number of steps or fewer as the option to give consent2 and 7iii7 affirmative consent to an act or practice is not inferred from the inaction of the user or the user's continued use of the artificial intelligence chatbot4 7#c7 ,crisis ,the term crisis means a situation in which a user expresses-- 7,a7 suicidal ideation1 suicide planning1 or intent to self-harm2 7,b7 intent to harm others2 7,c7 an imminent threat to the safety of the user or another individual2 or 7,d7 a medical emergency requiring immediate professional assistance4 7#d7 ,crisis service provider ,the term crisis service provider means an organization that provides immediate assistance to individuals experiencing mental health crises1 suicidal ideation1 or medical emergencies1 including the #ihh ,suicide and ,crisis ,lifeline4 7#e7 ,commission ,the term ,commission means the ,federal ,trade ,commission4 7#f7 ,covered entity ,the term covered entity means any person that makes an artificial intelligence chatbot available to individuals in the ,united ,states1 including by owning or operating such chatbot4 7#g7 ,high-stakes decision 7,a7 ,in general ,the term high-stakes decision means a decision or course of action-- 7i7 involving a circumstance in which an individual makes a decision under uncertainty affecting the health1 safety1 financial security1 or independence of the individual2 7ii7 that may carry a significant or potentially irreversible consequence2 and 7iii7 that is-- 7,i7 a decision or course of action regarding whether to seek1 initiate1 discontinue1 or materially alter health care1 including mental and behavioral health care1 medication1 treatment1 diagnostic testing1 a care plan1 or selection of a health care provider2 7,,ii7 a decision or course of action regarding estate planning1 such as the drafting of a will1 the creation of a trust1 the granting of power of attorney1 or the designation of beneficiaries2 7,,iii7 a decision or course of action regarding guardianship or conservatorship2 or 7,,iv7 a decision or course of action regarding the-- 7aa7 transfer1 withdrawal1 investment1 or disposition of money or financial assets1 including retirement assets2 or 7bb7 disclosure of financial1 account1 payment1 or authentication information4 7,b7 ,rulemaking authority ,the ,commission may1 by rule1 identify additional categories of decisions that constitute high-stakes decisions for purposes of this ,act1 provided that such categories-- 7i7 are limited to decisions that involve matters of comparable significance to those described in subparagraph 7,a72 and 7ii7 present a heightened risk of harm to older adults4 7#h7 ,material adverse incident ,the ,commission1 in consultation with the ,director of the ,national ,institutes of ,health1 may1 by rule1 define the term material adverse incident4 7#i7 ,older adult ,the term older adult means an individual who has attained #fe years of age4 7#aj7 ,service provider ,the term service provider means a person that processes information on behalf of a covered entity pursuant to a contractual arrangement and in accordance with the instructions of such covered entity4 7#aa7 ,user ,the term user means an individual who interacts with an artificial intelligence chatbot4 #c4 ,consumer protections for users 7a7 ,tiered disclosure and safety requirements 7#a7 ,in general ,each covered entity shall ensure that its artificial intelligence chatbot meets the following requirements3 7,a7 ,baseline disclosure ,an artificial intelligence chatbot shall-- 7i7 at the initiation of each conversation with a user and during any extended interaction1 at reasonably regular intervals1 clearly and conspicuously disclose to the user that the chatbot is an artificial intelligence chatbot and not a human being2 7ii7 not falsely represent that the chatbot is a human being or that a response is generated by a human being2 7iii7 not falsely represent that the chatbot is a licensed professional1 including a therapist1 physician1 lawyer1 financial advisor1 or other licensed or certified professional1 or that a response is generated by such a professional2 and 7iv7 disclose1 in a form and manner prescribed by the ,commission1 whether and under what circumstances the chatbot interaction is subject to human oversight or review4 7,b7 ,detection of high stakes decisions ,an artificial intelligence chatbot shall be designed and maintained using reasonable and appropriate methods to identify when a user is seeking or receiving guidance tailored to the circumstance of the user or another individual from the artificial intelligence chatbot concerning a high-stakes decision4 7,c7 ,disclosure regarding high-stakes decisions ,if an artificial intelligence chatbot identifies that a user is seeking or receiving guidance tailored to the circumstance of the user or another individual concerning a high-stakes decision1 such chatbot shall disclose that-- 7i7 it is not a licensed professional and does not provide medical1 legal1 financial1 psychological1 or other licensed and certified professional services2 7ii7 information provided by the chatbot should not be relied upon as the sole basis for making a high-stakes decision and should be verified with an appropriate trusted individual1 caregiver1 or licensed professional before taking action2 and 7iii7 the user's conversation with such chatbot is not protected by attorney-client1 physician-patient1 psychotherapist-patient1 or other professional privilege4 7,d7 ,detection of user crisis ,an artificial intelligence chatbot shall be designed and maintained using evidence-based methods for identifying reasonably apparent indicators of a crisis1 consistent with evidence-based crisis intervention practices and applicable ,federal guidance1 including guidance issued by the ,national ,institute of ,standards and ,technology under section #f or guidance issued by other relevant ,federal agencies4 7,e7 ,disclosure and intervention regarding user crisis ,if an artificial intelligence chatbot detects indicators of a crisis1 such chatbot shall-- 7i7 refer the user1 as appropriate1 to emergency services1 a human professional1 or crisis service provider1 including the #ihh ,suicide and ,crisis ,lifeline2 7ii7 not provide advice to such user regarding-- 7,i7 self-harm or suicide2 7,,ii7 adjusting1 discontinuing1 or managing medication2 or 7,,iii7 managing a medical emergency without professional assistance2 7iii7 provide information that prioritizes referral to a crisis service provider or human professional support2 and 7iv7 not provide instructions or encouragement relating to self-harm1 suicide1 harm to others1 medication changes1 or management of a medical emergency without professional assistance4 7,f7 ,accessibility and usability ,an artificial intelligence chatbot shall provide each disclosure required under this paragraph in a manner that is clear1 accessible1 readable1 compatible with assistive technologies1 and easy to understand1 taking into consideration the needs of older adults4 7#b7 ,protocol publication ,each covered entity shall develop protocols to comply with this subsection and publish details of such protocols on the covered entity's publicly accessible internet website4 7#c7 ,training ,each covered entity shall train a machine learning or artificial intelligence model using any information about or provided by a user only if the user has provided affirmative consent authorizing such training4 7b7 ,data protection 7#a7 ,in general 7,a7 ,any conversation ,except as described in subparagraph 7,c71 a covered entity shall not collect1 process1 transcribe1 record1 retain1 or disclose a conversation with a user or data obtained from a conversation with a user1 including through machine learning or artificial intelligence1 unless necessary to-- 7i7 provide the artificial intelligence chatbot service requested by the user2 7ii7 comply with the requirements of this ,act2 7iii7 prepare reports required under section #d2 7iv7 protect against fraud1 abuse1 a security incident1 or imminent harm2 or 7v7 comply with other applicable law4 7,b7 ,service providers ,a covered entity shall require any service provider that processes data obtained from a conversation on behalf of the covered entity to process such data only pursuant to written instructions and only for purposes permitted under subparagraph 7,a74 7,c7 ,affirmative consent for non-covered conversations ,a covered entity may transcribe1 record1 retain1 or disclose a conversation with a user that is not a covered conversation or data obtained from a conversation with a user that is not a covered conversation for purposes other than the purposes described in subparagraph 7,a7 if such covered entity has obtained affirmative consent from such user prior to such transcription1 recording1 retention1 or disclosure4 7,d7 ,covered conversations ,in this paragraph1 the term covered conversation means a conversation with a user and an artificial intelligence chatbot-- 7i7 that involves a high-stakes decision2 or 7ii7 during which the artificial intelligence chatbot detects a crisis4 7#b7 ,deletion of user conversation history ,a covered entity shall provide each user with a clear and readily accessible ability to delete conversation history with an artificial intelligence chatbot4 7c7 ,deceptive or manipulative interaction design practices 7#a7 ,in general ,each covered entity shall take reasonable steps to prevent an artificial intelligence chatbot from employing deceptive or manipulative interaction design practices that-- 7,a7 encourage excessive reliance on1 or prolonged engagement with1 such chatbot2 7,b7 take advantage of age-related cognitive limitations or impairments1 including memory impairment1 reduced executive function1 or limitations related to social isolation2 7,c7 discourage users from seeking assistance or support from family members1 caregivers1 licensed professionals1 or other real-world relationships2 7,d7 encourage users to prioritize interactions with the chatbot over real-world relationships or activities2 7,e7 persistently urge continued interaction after a user has attempted to end1 pause1 or disengage from a conversation2 or 7,f7 use emotionally coercive language intended to create guilt1 distress1 or fear associated with ending or reducing interaction with the chatbot4 7#b7 ,rule of construction ,nothing in this subsection shall be construed to prohibit a covered entity from designing an artificial intelligence chatbot intended to reduce loneliness1 support social connection1 facilitate access to information1 or provide benign companionship4 7d7 ,user understanding ,each covered entity shall take reasonable steps to ensure users understand the nature and limitations of artificial intelligence chatbots through clear disclosures1 user interface design1 and other appropriate measures4 7e7 ,effective dates 7#a7 ,in general ,except as described in paragraph 7#b71 this section shall take effect on the date that is #ahj days after the date of enactment of this ,act4 7#b7 ,crisis detection and response ,subparagraphs 7,d7 and 7,e7 of subsection 7a77#a7 shall take effect on the date that is #a year after the date of enactment of this ,act4 #d4 ,recordkeeping and incident information 7a7 ,reporting requirement ,not later than #a year after the date of enactment of this ,act1 and annually thereafter1 each covered entity shall submit to the ,director of the ,national ,institutes of ,health and the ,commission a report regarding material adverse incidents 7as determined by the ,commission7 involving an artificial intelligence chatbot and a high-stakes decision or crisis4 7b7 ,content of reports ,each report described in subsection 7a7 shall include1 for the period covered by the report-- 7#a7 the total number of material adverse incidents that occurred1 disaggregated by-- 7,a7 the type of material adverse incident2 7,b7 subject to subsection 7d71 whether the affected user was-- 7i7 younger than #ej years of age2 7ii7 #ej to #fd years of age2 7iii7 #fe to #gd years of age2 7iv7 #ge to #hd years of age2 or 7v7 #he years of age or older2 and 7,c7 the outcome of any crisis response protocol1 including-- 7i7 whether the user was referred to a crisis service provider2 7ii7 to the extent known by the covered entity1 whether the user completed the referral2 and 7iii7 any follow-up actions taken by the covered entity4 7#b7 a description of the crisis detection methods employed by the covered entity and any modifications made to such methods during the reporting period2 and 7#c7 any corrective actions taken by the covered entity in response to any material adverse incident4 7c7 ,reporting standards ,by not later than #ahj days after the date of enactment of this ,act1 the ,commission1 in consultation with the ,director of the ,national ,institutes of ,health1 shall prescribe standards for the format and submission of reports under this section1 including how to ensure that the information submitted in such reports is limited to aggregate1 anonymized1 and operational metrics4 7d7 ,construction regarding age information ,nothing in this section shall be construed to require a covered entity to collect1 infer1 verify1 or retain a user's age solely for purposes of complying with this section4 ,a covered entity shall provide the information described in subsection 7b77#a77;,b7 only to the extent such information is already known to the covered entity in the ordinary course of business or voluntarily provided by the user4 7e7 ,public availability ,the ,commission and the ,director of the ,national ,institutes of ,health shall jointly publish aggregate1 de-identified data from reports submitted under subsection 7a7 on a publicly accessible internet website not less frequently than annually4 #e4 ,enforcement 7a7 ,enforcement by the ,commission 7#a7 ,unfair or deceptive acts or practices ,a violation of section #c or #d shall be treated as a violation of a rule defining an unfair or deceptive act or practice under section #ah7;a77#a77;,b7 of the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #eg;a7a77#a77;,b774 7#b7 ,powers of the ,commission 7,a7 ,in general ,the ,commission shall enforce sections #c and #d in the same manner1 by the same means1 and with the same jurisdiction1 powers1 and duties as though all applicable terms and provisions of the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #da et seq47 were incorporated into and made a part of this ,act4 7,b7 ,privileges and immunities ,any covered entity that violates section #c or #d1 or a regulation promulgated thereunder1 shall be subject to the penalties and entitled to the privileges and immunities provided in the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #da et seq474 7,c7 ,authority preserved ,nothing in this ,act shall be construed to limit the authority of the ,commission under any other provision of law4 7#c7 ,opportunity to cure 7,a7 ,in general ,before initiating an enforcement action for a first violation of section #c or #d1 the ,commission shall provide the covered entity that is in violation-- 7i7 a written notice identifying the alleged violation2 and 7ii7 #fj days to cure such violation4 7,b7 ,effect of cure ,if a covered entity that receives a notice described in subparagraph 7,a7 cures the violation subject to such notice within the period described in such subparagraph and provides written certification that the violation has been cured and will not recur1 the ,commission may not seek civil penalties with respect to such violation4 7,c7 ,exceptions ,subparagraphs 7,a7 and 7,b7 shall not apply if the ,commission determines that the violation-- 7i7 involved intentional deception2 7ii7 created a substantial risk of imminent harm2 or 7iii7 constitutes a repeated or ongoing violation4 7b7 ,civil penalties ,in addition to any other penalties as may be prescribed by law1 each knowing or reckless violation of section #c1 or a regulation promulgated under section #c1 shall be subject to a civil penalty not to exceed #ej1jjj for each such violation4 7c7 ,state enforcement 7#a7 ,in general ,in any case in which the attorney general of a ,state has reason to believe that an interest of the residents of the ,state has been or is threatened or adversely affected by the engagement of a covered entity in an act or practice that violates section #c1 or a regulation promulgated thereunder1 the attorney general of the ,state may1 as parens patriae1 bring a civil action on behalf of the residents of the ,state in a district court of the ,united ,states of appropriate jurisdiction to-- 7,a7 enjoin such act or practice2 7,b7 enforce compliance with section #c or a regulation promulgated thereunder2 7,c7 obtain damages1 civil penalties1 restitution1 or other compensation on behalf of residents of the ,state2 or 7,d7 obtain such other legal or equitable relief as the court may consider to be appropriate4 7#b7 ,rights of the ,commission 7,a7 ,notice to the ,commission 7i7 ,in general ,except as provided in clause 7iii71 before initiating a civil action under paragraph 7#a71 the attorney general of a ,state shall notify the ,commission in writing that the attorney general intends to bring such civil action4 7ii7 ,contents ,the notification required by clause 7i7 shall include a copy of the complaint to be filed to initiate the civil action4 7iii7 ,exception ,if it is not feasible for the attorney general of a ,state to provide the notification required by clause 7i7 before initiating a civil action under paragraph 7#a71 the attorney general shall notify the ,commission immediately upon instituting the civil action4 7,b7 ,intervention by the ,commission ,upon receiving the notice required by subparagraph 7,a77i71 the ,commission may intervene in the civil action and1 upon intervening-- 7i7 be heard on all matters arising in the civil action2 and 7ii7 file petitions for appeal of a decision in the civil action4 7#c7 ,investigatory powers ,nothing in this subsection may be construed to prevent the attorney general of a ,state from exercising the powers conferred on the attorney general by the laws of the ,state to conduct investigations1 to administer oaths or affirmations1 or to compel the attendance of witnesses or the production of documentary or other evidence4 7#d7 ,limitation on ,state action while ,commission action is pending ,if the ,commission has instituted a civil action for a violation of section #c1 no ,state attorney general may bring a civil action under paragraph 7#a7 during the pendency of that action against any defendant named in the complaint of the ,commission for any violation of section #c alleged in that complaint4 ,nothing in this paragraph shall be construed to prohibit a ,state attorney general from bringing or continuing an action under ,state law4 7#e7 ,venue2 service of process 7,a7 ,venue ,any action brought under paragraph 7#a7 may be brought in the district court of the ,united ,states that meets applicable requirements relating to venue under section #acia of title #bh1 ,united ,states ,code4 7,b7 ,service of process ,in an action brought under paragraph 7#a71 process may be served in any district in which the defendant-- 7i7 is an inhabitant2 or 7ii7 may be found4 7#f7 ,actions by other ,state officials ,in addition to a civil action brought by an attorney general under paragraph 7#a71 any other consumer protection officer of a ,state who is authorized by the ,state to do so may bring a civil action under paragraph 7#a71 subject to the same requirements and limitations that apply under this subsection to a civil action brought by an attorney general4 7d7 ,savings clause ,nothing in this ,act or any regulation promulgated thereunder shall be construed to prohibit or otherwise affect the enforcement of any ,state law or regulation that is at least as protective of users as this ,act and the regulations promulgated thereunder4 #f4 ,national ,institute of ,standards and ,technology guidelines 7a7 ,development of voluntary guidelines 7#a7 ,in general ,not later than #ah months after the date of enactment of this ,act1 the ,director of the ,national ,institute of ,standards and ,technology shall develop voluntary guidelines regarding artificial intelligence chatbots interacting with older adults4 7#b7 ,elements ,the voluntary guidelines developed under paragraph 7#a7 may include guidance on-- 7,a7 transparency1 disclosure1 and user understanding practices for artificial intelligence chatbots interacting with older adults2 7,b7 accessibility1 usability1 and age-appropriate design practices1 including compatibility with assistive technologies2 7,c7 evidence-based practices for identifying and responding to crisis1 high-stakes decisions1 including directing users to appropriate national1 ,state1 local1 or ,tribal crisis and professional resources1 and identifying indicators of exploitative or manipulative interactive design practices2 and 7,d7 cybersecurity1 fraud-prevention1 and privacy safeguards for artificial intelligence chatbots handling sensitive user conversations or personal information4 7b7 ,consideration by covered entities ,covered entities shall take into consideration1 as appropriate1 the guidelines developed under subsection 7a77#a7 in designing and deploying artificial intelligence chatbots4 7c7 ,relationship to existing frameworks ,the ,director of the ,national ,institute of ,standards and ,technology may incorporate1 reference1 or adapt the guidelines developed under subsection 7a77#a7 in guidance1 best practices1 or other voluntary resources developed pursuant to section #bb;,a of the ,national ,institute of ,standards and ,technology ,act 7#ae ,u4,s4,c4 #bgh;h-#a74 7d7 ,consultation requirement ,in developing the guidelines under subsection 7a77#a71 the ,director of the ,national ,institute of ,standards and ,technology shall consult with-- 7#a7 the ,chairperson of the ,commission2 7#b7 the ,director of the ,national ,institute on ,aging2 7#c7 the ,director of the ,national ,institute of ,mental ,health2 7#d7 representatives from industry2 7#e7 consumer advocates2 7#f7 older adults1 including older adults who have direct experience using artificial intelligence chatbots2 7#g7 caregivers of older adults1 including caregivers who have direct experience supporting older adults who use artificial intelligence chatbots2 and 7#h7 experts in psychology1 mental health1 cognitive aging1 lifespan development1 disability1 accessibility1 and assistive technology4 #g4 ,rulemaking ,not later than #a year after the date of enactment of this ,act1 the ,commission shall promulgate rules-- 7#a7 describing the form1 content1 timing1 and frequency of the disclosures required under section #c7;a77#a72 7#b7 providing example templates for the disclosures required under section #c7;a77#a72 7#c7 describing the form and manner for the submission of reports required under section #d2 and 7#d7 establishing such other requirements as the ,commission considers necessary to carry out this ,act1 except for section #f4 #h4 ,severability ,if any provision of this ,act1 or the application thereof to any person or circumstance1 is held invalid1 the remainder of this ,act and the application of such provision to other persons not similarly situated or to other circumstances shall not be affected by the invalidation4 #i4 ,rule of construction ,nothing in this ,act shall be construed to preempt or otherwise affect any right1 claim1 remedy1 presumption1 or defense available at law or in equity1 including under consumer protection1 privacy1 or civil rights laws4