Bipartisan
Frameworkfor U.S. AI Act
Senator Richard Blumenthal& Senator Josh Hawley
Chair and Ranking Member of theSubcommittee on Privacy, Technology,and the Law

Establish a Licensing Regime Administered by an Independent
Oversight Body: Companies developing sophisticated general-purpose
A.I. models (e.g., GPT-4) or models used in high-risk situations (e.g., facialrecognition) should be required to register with an independent oversight
body. Licensing requirements should include the registration ofinformation about AI models and be conditioned on developers maintaining
risk management, pre-deployment testing, data governance, and adverse
incident reporting programs. The oversight body should have the authority
to conduct audits of companies seeking licenses and cooperate with otherenforcers, including considering vesting concurrent enforcement authority instate Attorneys General. The entity should also monitor and report ontechnological developments and economic impacts of A.I., such as effects
on employment. Personnel must be subject to strong conflict of interest
rules to mitigate capture and revolving door concerns.
Ensure Legal Accountability for Harms: Congress should ensure that A.I.
companies can be held liable through oversight body enforcement andprivate rights of action when their models and systems breach privacy,
violate civil rights, or otherwise cause cognizable harms. Where existinglaws are insufficient to address new harms created by A.I., Congress should
ensure that enforcers and victims can take companies and perpetrators tocourt, including clarifying that Section 230 does not apply to A.I. In
particular, Congress must take steps to directly prohibit harms that arealready emerging from A.I., such as non-consensual explicit deepfake
imagery of real people, production of child sexual abuse material fromgenerative A.I., and election interference.
Defend National Security and International Competition: Congressshould utilize export controls, sanctions, and other legal restrictions to limit
the transfer of advanced A.I. models, hardware and related equipment, andother technologies to China, Russia, and other adversary nations, as wellas countries engaged in gross human rights violations.
Promote Transparency: Congress should promote responsibility, due
diligence, and consumer redress by requiring transparency from thecompanies developing and deploying A.I. systems.
Developers should be required to disclose essential information about
the training data, limitations, accuracy, and safety of A.I. models tousers and companies deploying systems, including through simple,
comprehendible disclosures and to provide independent researchers
access to data necessary to evaluate A.I. model performance.
Users should have a right to an affirmative notice that they areinteracting with an A.I. model or system.
A.I. system providers should be required to watermark or otherwise
provide technical disclosures of A.I.-generated deepfakes.
The new oversight body should establish a public database andreporting so that consumers and researchers have easy access to A.I.
model and system information, including when significant adverse
incidents occur or failures in A.I. cause harms.
Protect Consumers and Kids: Companies deploying A.I. in high-risk orconsequential situations should be required to implement safety brakes,
including giving notice when A.I. is being used to make decisions,particularly adverse decisions, and have the right to a human review.
Consumers should have control over how their personal data is used in
A.I. systems and strict limits should be imposed on generative A.I. involving
kids.