II 

Calendar No. 697 

118TH CONGRESS 

2D SESSION S. 4495 

[Report No. 118–291] 

To enable safe, responsible, and agile procurement, development, and use 

of artificial intelligence by the Federal Government, and for other purposes. 

IN THE SENATE OF THE UNITED STATES 

JUNE 11, 2024 

Mr. PETERS (for himself and Mr. TILLIS) introduced the following bill; which 

was read twice and referred to the Committee on Homeland Security and 

Governmental Affairs 

DECEMBER 16, 2024 

Reported by Mr. PETERS, with an amendment 

[Strike out all after the enacting clause and insert the part printed in italic] 

A BILL 

To enable safe, responsible, and agile procurement, development, and use of artificial intelligence by the Federal 

Government, and for other purposes. 

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 

3 SECTION 1. SHORT TITLE. 

4 This Act may be cited as the ‘‘Promoting Responsible 

5 Evaluation and Procurement to Advance Readiness for 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
2 

•S 4495 RS

1 Enterprise-wide Deployment for Artificial Intelligence 

2 Act’’ or the ‘‘PREPARED for AI Act’’. 

3 SEC. 2. DEFINITIONS. 

4 In this Act: 

5 (1) ADVERSE INCIDENT.—The term ‘‘adverse 

6 incident’’ means any incident or malfunction of arti7 ficial intelligence that directly or indirectly leads 

8 to— 

9 (A) harm impacting rights or safety, as de10 scribed in section 7(a)(2)(D); 

11 (B) the death of an individual or damage 

12 to the health of an individual; 

13 (C) material or irreversible disruption of 

14 the management and operation of critical infra15 structure, as described in section 

16 7(a)(2)(D)(i)(II)(cc); 

17 (D) material damage to property or the en18 vironment; 

19 (E) loss of a mission-critical system or 

20 equipment; 

21 (F) failure of the mission of an agency; 

22 (G) the denial of a benefit, payment, or 

23 other service to an individual or group of indi24 viduals who would have otherwise been eligible; 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
3 

•S 4495 RS

1 (H) the denial of an employment, contract, 

2 grant, or similar opportunity that would have 

3 otherwise been offered; or 

4 (I) another consequence, as determined by 

5 the Director with public notice. 

6 (2) AGENCY.—The term ‘‘agency’’— 

7 (A) has the meaning given that term in 

8 section 3502(1) of title 44, United States Code; 

9 and 

10 (B) includes each of the independent regu11 latory agencies described in section 3502(5) of 

12 title 44, United States Code. 

13 (3) ARTIFICIAL INTELLIGENCE.—The term ‘‘ar14 tificial intelligence’’— 

15 (A) has the meaning given that term in 

16 section 5002 of the National Artificial Intel17 ligence Initiative Act of 2020 (15 U.S.C. 9401); 

18 and 

19 (B) includes the artificial systems and 

20 techniques described in paragraphs (1) through 

21 (5) of section 238(g) of the John S. McCain 

22 National Defense Authorization Act for Fiscal 

23 Year 2019 (Public Law 115–232; 10 U.S.C. 

24 4061 note prec.). 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
4 

•S 4495 RS

1 (4) BIOMETRIC DATA.—The term ‘‘biometric 

2 data’’ means data resulting from specific technical 

3 processing relating to the unique physical, physio4 logical, or behavioral characteristics of an individual, 

5 including facial images, dactyloscopic data, physical 

6 movement and gait, breath, voice, DNA, blood type, 

7 and expression of emotion, thought, or feeling. 

8 (5) COMMERCIAL TECHNOLOGY.—The term 

9 ‘‘commercial technology’’— 

10 (A) means a technology, process, or meth11 od, including research or development; and 

12 (B) includes commercial products, commer13 cial services, and other commercial items, as de14 fined in the Federal Acquisition Regulation, in15 cluding any addition or update thereto by the 

16 Federal Acquisition Regulatory Council. 

17 (6) COUNCIL.—The term ‘‘Council’’ means the 

18 Chief Artificial Intelligence Officers Council estab19 lished under section 5(a). 

20 (7) DEPLOYER.—The term ‘‘deployer’’ means 

21 an entity that operates or provides artificial intel22 ligence, whether developed internally or by a third23 party developer. 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
5 

•S 4495 RS

1 (8) DEVELOPER.—The term ‘‘developer’’ means 

2 an entity that designs, codes, produces, or owns arti3 ficial intelligence. 

4 (9) DIRECTOR.—The term ‘‘Director’’ means 

5 the Director of the Office of Management and Budg6 et. 

7 (10) IMPACT ASSESSMENT.—The term ‘‘impact 

8 assessment’’ means a structured process for consid9 ering the implications of a proposed artificial intel10 ligence use case. 

11 (11) OPERATIONAL DESIGN DOMAIN.—The 

12 term ‘‘operational design domain’’ means a set of 

13 operating conditions for an automated system. 

14 (12) PROCURE OR OBTAIN.—The term ‘‘procure 

15 or obtain’’ means— 

16 (A) to acquire through contract actions 

17 awarded pursuant to the Federal Acquisition 

18 Regulation, including through interagency 

19 agreements, multi-agency use, and purchase 

20 card transactions; 

21 (B) to acquire through contracts and 

22 agreements awarded through other special pro23 curement authorities, including through other 

24 transactions and commercial solutions opening 

25 authorities; or 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
6 

•S 4495 RS

1 (C) to obtain through other means, includ2 ing through open source platforms or freeware. 

3 (13) RELEVANT CONGRESSIONAL COMMIT4 TEES.—The term ‘‘relevant congressional commit5 tees’’ means the Committee on Homeland Security 

6 and Governmental Affairs of the Senate and the 

7 Committee on Oversight and Accountability of the 

8 House of Representatives. 

9 (14) RISK.—The term ‘‘risk’’ means the com10 bination of the probability of an occurrence of harm 

11 and the potential severity of that harm. 

12 (15) USE CASE.—The term ‘‘use case’’ means 

13 the ways and context in which artificial intelligence 

14 is operated to perform a specific function. 

15 SEC. 3. IMPLEMENTATION OF REQUIREMENTS. 

16 (a) AGENCY IMPLEMENTATION.—Not later than 1 

17 year after the date of enactment of this Act, the Director 

18 shall ensure that agencies have implemented the require19 ments of this Act. 

20 (b) ANNUAL BRIEFING.—Not later than 180 days 

21 after the date of enactment of this Act, and annually 

22 thereafter, the Director shall brief the appropriate Con23 gressional committees on implementation of this Act and 

24 related considerations. 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
7 

•S 4495 RS

1 SEC. 4. PROCUREMENT OF ARTIFICIAL INTELLIGENCE. 

2 (a) GOVERNMENT-WIDE REQUIREMENTS.— 

3 (1) IN GENERAL.—Not later than 1 year after 

4 the date of enactment of this Act, the Federal Ac5 quisition Regulatory Council shall review Federal 

6 Acquisition Regulation acquisition planning, source 

7 selection, and other requirements and update the 

8 Federal Acquisition Regulation as needed to ensure 

9 that agency procurement of artificial intelligence in10 cludes— 

11 (A) a requirement to address the outcomes 

12 of the risk evaluation and impact assessments 

13 required under section 8(a); 

14 (B) a requirement for consultation with an 

15 interdisciplinary team of agency experts prior 

16 to, and throughout, as necessary, procuring or 

17 obtaining artificial intelligence; and 

18 (C) any other considerations determined 

19 relevant by the Federal Acquisition Regulatory 

20 Council. 

21 (2) INTERDISCIPLINARY TEAM OF EXPERTS.— 

22 The interdisciplinary team of experts described in 

23 paragraph (1)(B) may— 

24 (A) vary depending on the use case and 

25 the risks determined to be associated with the 

26 use case; and 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
8 

•S 4495 RS

1 (B) include technologists, information se2 curity personnel, domain experts, privacy offi3 cers, data officers, civil rights and civil liberties 

4 officers, contracting officials, legal counsel, cus5 tomer experience professionals, and others. 

6 (3) ACQUISITION PLANNING.—The acquisition 

7 planning updates described in paragraph (1) shall 

8 include considerations for, at minimum, as appro9 priate depending on the use case— 

10 (A) data ownership and privacy; 

11 (B) data information security; 

12 (C) interoperability requirements; 

13 (D) data and model assessment processes; 

14 (E) scope of use; 

15 (F) ongoing monitoring techniques; 

16 (G) type and scope of artificial intelligence 

17 audits; 

18 (H) environmental impact; and 

19 (I) safety and security risk mitigation tech20 niques, including a plan for how adverse event 

21 reporting can be incorporated, pursuant to sec22 tion 5(g). 

23 (b) REQUIREMENTS FOR HIGH RISK USE CASES.— 

24 (1) IN GENERAL.— 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
9 

•S 4495 RS

1 (A) ESTABLISHMENT.—Beginning on the 

2 date that is 1 year after the date of enactment 

3 of this Act, the head of an agency may not pro4 cure or obtain artificial intelligence for a high 

5 risk use case, as defined in section 7(a)(2)(D), 

6 prior to establishing and incorporating certain 

7 terms into relevant contracts, agreements, and 

8 employee guidelines for artificial intelligence, in9 cluding— 

10 (i) a requirement that the use of the 

11 artificial intelligence be limited to its oper12 ational design domain; 

13 (ii) requirements for safety, security, 

14 and trustworthiness, including— 

15 (I) a reporting mechanism 

16 through which agency personnel are 

17 notified by the deployer of any ad18 verse incident; 

19 (II) a requirement, in accordance 

20 with section 5(g), that agency per21 sonnel receive from the deployer a no22 tification of any adverse incident, an 

23 explanation of the cause of the ad24 verse incident, and any data directly 

25 connected to the adverse incident in 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
10 

•S 4495 RS

1 order to address and mitigate the 

2 harm; and 

3 (III) that the agency has the 

4 right to temporarily or permanently 

5 suspend use of the artificial intel6 ligence if— 

7 (aa) the risks of the artifi8 cial intelligence to rights or safe9 ty become unacceptable, as deter10 mined under the agency risk clas11 sification system pursuant to sec12 tion 7; or 

13 (bb) on or after the date 

14 that is 180 days after the publi15 cation of the most recently up16 dated version of the framework 

17 developed and updated pursuant 

18 to section 22(A)(c) of the Na19 tional Institute of Standards and 

20 Technology Act (15 U.S.C. 

21 278h–1(c)), the deployer is found 

22 not to comply with such most re23 cent update; 

24 (iii) requirements for quality, rel25 evance, sourcing and ownership of data, as 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
11 

•S 4495 RS

1 appropriate by use case, and applicable un2 less the head of the agency waives such re3 quirements in writing, including— 

4 (I) retention of rights to Govern5 ment data and any modification to the 

6 data including to protect the data 

7 from unauthorized disclosure and use 

8 to subsequently train or improve the 

9 functionality of commercial products 

10 offered by the deployer, any relevant 

11 developers, or others; and 

12 (II) a requirement that the 

13 deployer and any relevant developers 

14 or other parties isolate Government 

15 data from all other data, through 

16 physical separation, electronic separa17 tion via secure copies with strict ac18 cess controls, or other computational 

19 isolation mechanisms; 

20 (iv) requirements for evaluation and 

21 testing of artificial intelligence based on 

22 use case, to be performed on an ongoing 

23 basis; and 

24 (v) requirements that the deployer 

25 and any relevant developers provide docuVerDate Sep 11 2014 03:17 Dec 17, 2024 Jkt 059200 PO 00000 Frm 00011 Fmt 6652 Sfmt 6401 E:\BILLS\S4495.RS S4495

kjohnson on DSK7ZCZBW3PROD with $$_JOB
12 

•S 4495 RS

1 mentation, as determined necessary and 

2 requested by the agency, in accordance 

3 with section 8(b). 

4 (B) REVIEW.—The Senior Procurement 

5 Executive, in coordination with the Chief Artifi6 cial Intelligence Officer, shall consult with tech7 nologists, information security personnel, do8 main experts, privacy officers, data officers, 

9 civil rights and civil liberties officers, con10 tracting officials, legal counsel, customer experi11 ence professionals, and other relevant agency 

12 officials to review the requirements described in 

13 clauses (i) through (v) of subparagraph (A) and 

14 determine whether it may be necessary to incor15 porate additional requirements into relevant 

16 contracts or agreements. 

17 (C) REGULATION.—The Federal Acquisi18 tion Regulatory Council shall revise the Federal 

19 Acquisition Regulation as necessary to imple20 ment the requirements of this subsection. 

21 (2) RULES OF CONSTRUCTION.—This Act shall 

22 supersede any requirements that conflict with this 

23 Act under the guidance required to be produced by 

24 the Director pursuant to section 7224(d) of the Ad25 vancing American AI Act (40 U.S.C. 11301 note). 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
13 

•S 4495 RS

1 SEC. 5. INTERAGENCY GOVERNANCE OF ARTIFICIAL INTEL2 LIGENCE. 

3 (a) CHIEF ARTIFICIAL INTELLIGENCE OFFICERS

4 COUNCIL.—Not later than 60 days after the date of enact5 ment of this Act, the Director shall establish a Chief Arti6 ficial Intelligence Officers Council. 

7 (b) DUTIES.—The duties of the Council shall in8 clude— 

9 (1) coordinating agency development and use of 

10 artificial intelligence in agency programs and oper11 ations, including practices relating to the design, op12 eration, risk management, and performance of artifi13 cial intelligence; 

14 (2) sharing experiences, ideas, best practices, 

15 and innovative approaches relating to artificial intel16 ligence; and 

17 (3) assisting the Director, as necessary, with re18 spect to— 

19 (A) the identification, development, and co20 ordination of multi-agency projects and other 

21 initiatives, including initiatives to improve Gov22 ernment performance; 

23 (B) the management of risks relating to 

24 developing, obtaining, or using artificial intel25 ligence, including by developing a common tem26 plate to guide agency Chief Artificial IntelVerDate Sep 11 2014 03:17 Dec 17, 2024 Jkt 059200 PO 00000 Frm 00013 Fmt 6652 Sfmt 6401 E:\BILLS\S4495.RS S4495

kjohnson on DSK7ZCZBW3PROD with $$_JOB
14 

•S 4495 RS

1 ligence Officers in implementing a risk classi2 fication system that may incorporate best prac3 tices, such as those from— 

4 (i) the most recently updated version 

5 of the framework developed and updated 

6 pursuant to section 22A(c) of the National 

7 Institute of Standards and Technology Act 

8 (15 U.S.C. 278h–1(c)); and 

9 (ii) the report published by the Gov10 ernment Accountability Office entitled ‘‘Ar11 tificial Intelligence: An Accountability 

12 Framework for Federal Agencies and 

13 Other Entities’’ (GAO–21–519SP), pub14 lished on June 30, 2021; 

15 (C) promoting the development and use of 

16 efficient, effective, common, shared, or other 

17 approaches to key processes that improve the 

18 delivery of services for the public; and 

19 (D) soliciting and providing perspectives 

20 on matters of concern, including from and to— 

21 (i) interagency councils; 

22 (ii) Federal Government entities; 

23 (iii) private sector, public sector, non24 profit, and academic experts; 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
15 

•S 4495 RS

1 (iv) State, local, Tribal, territorial, 

2 and international governments; and 

3 (v) other individuals and entities, as 

4 determined relevant by the Council. 

5 (c) MEMBERSHIP OF THE COUNCIL.— 

6 (1) CO-CHAIRS.—The Council shall have 2 co7 chairs, which shall be— 

8 (A) the Director; and 

9 (B) an individual selected by a majority of 

10 the members of the Council. 

11 (2) MEMBERS.—Other members of the Council 

12 shall include— 

13 (A) the Chief Artificial Intelligence Officer 

14 of each agency; and 

15 (B) the senior official for artificial intel16 ligence of the Office of Management and Budg17 et. 

18 (d) STANDING COMMITTEES; WORKING GROUPS.— 

19 The Council shall have the authority to establish standing 

20 committees, including an executive committee, and work21 ing groups. 

22 (e) COUNCIL STAFF.—The Council may enter into an 

23 interagency agreement with the Administrator of General 

24 Services for shared services for the purpose of staffing the 

25 Council. 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
16 

•S 4495 RS

1 (f) DEVELOPMENT, ADAPTATION, AND DOCUMENTA2 TION.— 

3 (1) GUIDANCE.—Not later than 90 days after 

4 the date of enactment of this Act, the Director, in 

5 consultation with the Council, shall issue guidance 

6 relating to— 

7 (A) developments in artificial intelligence 

8 and implications for management of agency 

9 programs; 

10 (B) the agency impact assessments de11 scribed in section 8(a) and other relevant im12 pact assessments as determined appropriate by 

13 the Director, including the appropriateness of 

14 substituting pre-existing assessments, including 

15 privacy impact assessments, for purposes of an 

16 artificial intelligence impact assessment; 

17 (C) documentation for agencies to require 

18 from deployers of artificial intelligence; 

19 (D) a model template for the explanations 

20 for use case risk classifications that each agen21 cy must provide under section 8(a)(4); and 

22 (E) other matters, as determined relevant 

23 by the Director. 

24 (2) ANNUAL REVIEW.—The Director, in con25 sultation with the Council, shall periodically, but not 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
17 

•S 4495 RS

1 less frequently than annually, review and update, as 

2 needed, the guidelines issued under paragraph (1). 

3 (g) INCIDENT REPORTING.— 

4 (1) IN GENERAL.—Not later than 180 days 

5 after the date of enactment of this Act, the Director, 

6 in consultation with the Council, shall develop proce7 dures for ensuring that— 

8 (A) adverse incidents involving artificial in9 telligence procured, obtained, or used by agen10 cies are reported promptly to the agency by the 

11 developer or deployer, or to the developer or 

12 deployer by the agency, whichever first becomes 

13 aware of the adverse incident; and 

14 (B) information relating to an adverse inci15 dent described in subparagraph (A) is appro16 priately shared among agencies. 

17 (2) SINGLE REPORT.—Adverse incidents also 

18 qualifying for incident reporting under section 3554 

19 of title 44, United States Code, or other relevant 

20 laws or policies, may be reported under such other 

21 reporting requirement and are not required to be ad22 ditionally reported under this subsection. 

23 (3) NOTICE TO DEPLOYER.— 

24 (A) IN GENERAL.—If an adverse incident 

25 is discovered by an agency, the agency shall reVerDate Sep 11 2014 03:17 Dec 17, 2024 Jkt 059200 PO 00000 Frm 00017 Fmt 6652 Sfmt 6401 E:\BILLS\S4495.RS S4495

kjohnson on DSK7ZCZBW3PROD with $$_JOB
18 

•S 4495 RS

1 port the adverse incident to the deployer and 

2 the deployer, in consultation with any relevant 

3 developers, shall take immediate action to re4 solve the adverse incident and mitigate the po5 tential for future adverse incidents. 

6 (B) WAIVER.— 

7 (i) IN GENERAL.—Unless otherwise 

8 required by law, the head of an agency 

9 may issue a written waiver that waives the 

10 applicability of some or all of the require11 ments under subparagraph (A), with re12 spect to a specific adverse incident. 

13 (ii) WRITTEN WAIVER CONTENTS.—A 

14 written waiver under clause (i) shall in15 clude justification for the waiver. 

16 (iii) NOTICE.—The head of an agency 

17 shall forward advance notice of any waiver 

18 under this subparagraph to the Director, 

19 or the designee of the Director. 

20 SEC. 6. AGENCY GOVERNANCE OF ARTIFICIAL INTEL21 LIGENCE. 

22 (a) IN GENERAL.—The head of an agency shall— 

23 (1) ensure the responsible adoption of artificial 

24 intelligence, including by— 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
19 

•S 4495 RS

1 (A) articulating a clear vision of what the 

2 head of the agency wants to achieve by devel3 oping, procuring or obtaining, or using artificial 

4 intelligence; 

5 (B) ensuring the agency develops, pro6 cures, obtains, or uses artificial intelligence that 

7 follows the principles of trustworthy artificial 

8 intelligence in government set forth under Exec9 utive Order 13960 (85 Fed. Reg. 78939; relat10 ing to promoting the use of trustworthy artifi11 cial intelligence in Federal Government) and 

12 the principles for safe, secure, and trustworthy 

13 artificial intelligence in government set forth 

14 under section 2 of Executive Order 14110 (88 

15 Fed. Reg. 75191; relating to the safe, secure, 

16 and trustworthy development and use of artifi17 cial intelligence); 

18 (C) testing, validating, and monitoring ar19 tificial intelligence and the use case-specific per20 formance of artificial intelligence, among oth21 ers, to— 

22 (i) ensure all use of artificial intel23 ligence is appropriate to and improves the 

24 effectiveness of the mission of the agency; 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
20 

•S 4495 RS

1 (ii) guard against bias in data collec2 tion, use, and dissemination; 

3 (iii) ensure reliability, fairness, and 

4 transparency; and 

5 (iv) protect against impermissible dis6 crimination; 

7 (D) developing, adopting, and applying a 

8 suitable enterprise risk management framework 

9 approach to artificial intelligence, incorporating 

10 the requirements under this Act; 

11 (E) continuing to develop a workforce 

12 that— 

13 (i) understands the strengths and 

14 weaknesses of artificial intelligence, includ15 ing artificial intelligence embedded in 

16 agency data systems and operations; 

17 (ii) is aware of the benefits and risk 

18 of artificial intelligence; 

19 (iii) is able to provide human over20 sight for the design, implementation, and 

21 end uses of artificial intelligence; and 

22 (iv) is able to review and provide re23 dress for erroneous decisions made in the 

24 course of artificial intelligence-assisted 

25 processes; and 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
21 

•S 4495 RS

1 (F) ensuring implementation of the re2 quirements under section 8(a) for the identifica3 tion and evaluation of risks posed by the de4 ployment of artificial intelligence in agency use 

5 cases; 

6 (2) designate a Chief Artificial Intelligence Offi7 cer, whose duties shall include— 

8 (A) ensuring appropriate use of artificial 

9 intelligence; 

10 (B) coordinating agency use of artificial in11 telligence; 

12 (C) promoting artificial intelligence innova13 tion; 

14 (D) managing the risks of use of artificial 

15 intelligence; 

16 (E) supporting the head of the agency with 

17 developing the risk classification system re18 quired under section 7(a) and complying with 

19 other requirements of this Act; and 

20 (F) supporting agency personnel leading 

21 the procurement and deployment of artificial in22 telligence to comply with the requirements 

23 under this Act; and 

24 (3) form and convene an Artificial Intelligence 

25 Governance Board, as described in subsection (b), 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
22 

•S 4495 RS

1 which shall coordinate and govern artificial intel2 ligence issues across the agency. 

3 (b) ARTIFICIAL INTELLIGENCE GOVERNANCE

4 BOARD.— 

5 (1) LEADERSHIP.—Each Artificial Intelligence 

6 Governance Board (referred to in this subsection as 

7 ‘‘Board’’) of an agency shall be chaired by the Dep8 uty Secretary of the agency or equivalent official and 

9 vice-chaired by the Chief Artificial Intelligence Offi10 cer of the agency. Neither the chair nor the vice11 chair may assign or delegate these roles to other of12 ficials. 

13 (2) REPRESENTATION.—The Board shall, at a 

14 minimum, include representatives comprised of sen15 ior agency officials from operational components, if 

16 relevant, program officials responsible for imple17 menting artificial intelligence, and officials respon18 sible for information technology, data, privacy, civil 

19 rights and civil liberties, human capital, procure20 ment, finance, legal counsel, and customer experi21 ence. 

22 (3) EXISTING BODIES.—An agency may rely on 

23 an existing governance body to fulfill the require24 ments of this subsection if the body satisfies or is 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
23 

•S 4495 RS

1 adjusted to satisfy the leadership and representation 

2 requirements of paragraphs (1) and (2). 

3 (c) DESIGNATION OF CHIEF ARTIFICIAL INTEL4 LIGENCE OFFICER.—The head of an agency may des5 ignate as Chief Artificial Intelligence Officer an existing 

6 official within the agency, including the Chief Technology 

7 Officer, Chief Data Officer, Chief Information Officer, or 

8 other official with relevant or complementary authorities 

9 and responsibilities, if such existing official has expertise 

10 in artificial intelligence and meets the requirements of this 

11 section. 

12 (d) EFFECTIVE DATE.—Beginning on the date that 

13 is 120 days after the date of enactment of this Act, an 

14 agency shall not develop or procure or obtain artificial in15 telligence prior to completing the requirements under 

16 paragraphs (2) and (3) of subsection (a). 

17 SEC. 7. AGENCY RISK CLASSIFICATION OF ARTIFICIAL IN18 TELLIGENCE USE CASES FOR PROCUREMENT 

19 AND USE. 

20 (a) RISK CLASSIFICATION SYSTEM.— 

21 (1) DEVELOPMENT.—The head of each agency 

22 shall be responsible for developing, not later than 1 

23 year after the date of enactment of this Act, a risk 

24 classification system for agency use cases of artifiVerDate Sep 11 2014 03:17 Dec 17, 2024 Jkt 059200 PO 00000 Frm 00023 Fmt 6652 Sfmt 6401 E:\BILLS\S4495.RS S4495

kjohnson on DSK7ZCZBW3PROD with $$_JOB
24 

•S 4495 RS

1 cial intelligence, without respect to whether artificial 

2 intelligence is embedded in a commercial product. 

3 (2) REQUIREMENTS.— 

4 (A) RISK CLASSIFICATIONS.—The risk 

5 classification system under paragraph (1) shall, 

6 at a minimum, include unacceptable, high, me7 dium, and low risk classifications. 

8 (B) FACTORS FOR RISK CLASSIFICA9 TIONS.—In developing the risk classifications 

10 under subparagraph (A), the head of the agency 

11 shall consider the following: 

12 (i) MISSION AND OPERATION.—The 

13 mission and operations of the agency. 

14 (ii) SCALE.—The seriousness and 

15 probability of adverse impacts. 

16 (iii) SCOPE.—The breadth of applica17 tion, such as the number of individuals af18 fected. 

19 (iv) OPTIONALITY.—The degree of 

20 choice that an individual, group, or entity 

21 has as to whether to be subject to the ef22 fects of artificial intelligence. 

23 (v) STANDARDS AND FRAMEWORKS.— 

24 Standards and frameworks for risk classi25 fication of use cases that support demoVerDate Sep 11 2014 03:17 Dec 17, 2024 Jkt 059200 PO 00000 Frm 00024 Fmt 6652 Sfmt 6401 E:\BILLS\S4495.RS S4495

kjohnson on DSK7ZCZBW3PROD with $$_JOB
25 

•S 4495 RS

1 cratic values, such as the standards and 

2 frameworks developed by the National In3 stitute of Standards and Technology, the 

4 International Standards Organization, and 

5 the Institute of Electrical and Electronics 

6 Engineers. 

7 (C) CLASSIFICATION VARIANCE.— 

8 (i) CERTAIN LOWER RISK USE

9 CASES.—The risk classification system 

10 may allow for an operational use case to be 

11 categorized under a lower risk classifica12 tion, even if the use case is a part of a 

13 larger area of the mission of the agency 

14 that is categorized under a higher risk 

15 classification. 

16 (ii) CHANGES BASED ON TESTING OR

17 NEW INFORMATION.—The risk classifica18 tion system may allow for changes to the 

19 risk classification of an artificial intel20 ligence use case based on the results from 

21 procurement process testing or other infor22 mation that becomes available. 

23 (D) HIGH RISK USE CASES.— 

24 (i) IN GENERAL.—High risk classi25 fication shall, at a minimum, apply to use 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
26 

•S 4495 RS

1 cases for which the outputs of the sys2 tem— 

3 (I) are presumed to serve as a 

4 principal basis for a decision or action 

5 that has a legal, material, binding, or 

6 similarly significant effect, with re7 spect to an individual or community, 

8 on— 

9 (aa) civil rights, civil lib10 erties, or privacy; 

11 (bb) equal opportunities, in12 cluding in access to education, 

13 housing, insurance, credit, em14 ployment, and other programs 

15 where civil rights and equal op16 portunity protections apply; or 

17 (cc) access to or the ability 

18 to apply for critical government 

19 resources or services, including 

20 healthcare, financial services, 

21 public housing, social services, 

22 transportation, and essential 

23 goods and services; or 

24 (II) are presumed to serve as a 

25 principal basis for a decision that subVerDate Sep 11 2014 03:17 Dec 17, 2024 Jkt 059200 PO 00000 Frm 00026 Fmt 6652 Sfmt 6401 E:\BILLS\S4495.RS S4495

kjohnson on DSK7ZCZBW3PROD with $$_JOB
27 

•S 4495 RS

1 stantially impacts the safety of, or has 

2 the potential to substantially impact 

3 the safety of— 

4 (aa) the well-being of an in5 dividual or community, including 

6 loss of life, serious injury, bodily 

7 harm, biological or chemical 

8 harms, occupational hazards, 

9 harassment or abuse, or mental 

10 health; 

11 (bb) the environment, in12 cluding irreversible or significant 

13 environmental damage; 

14 (cc) critical infrastructure, 

15 including the critical infrastruc16 ture sectors defined in Presi17 dential Policy Directive 21, enti18 tled ‘‘Critical Infrastructure Se19 curity and Resilience’’ (dated 

20 February 12, 2013) (or any suc21 cessor directive) and the infra22 structure for voting and pro23 tecting the integrity of elections; 

24 or 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
28 

•S 4495 RS

1 (dd) strategic assets or re2 sources, including high-value 

3 property and information marked 

4 as sensitive or classified by the 

5 Federal Government and con6 trolled unclassified information. 

7 (ii) ADDITIONS.—The head of each 

8 agency shall add other use cases to the 

9 high risk category, as appropriate. 

10 (E) MEDIUM AND LOW RISK USE CASES.— 

11 If a use case is not high risk, as described in 

12 subparagraph (D), the head of an agency shall 

13 have the discretion to define the risk classifica14 tion. 

15 (F) UNACCEPTABLE RISK.—If an agency 

16 identifies, through testing, adverse incident, or 

17 other means or information available to the 

18 agency, that a use or outcome of an artificial 

19 intelligence use case is a clear threat to human 

20 safety or rights that cannot be adequately or 

21 practicably mitigated, the agency shall identify 

22 the risk classification of that use case as unac23 ceptable risk. 

24 (3) TRANSPARENCY.—The risk classification 

25 system under paragraph (1) shall be published on a 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
29 

•S 4495 RS

1 public-facing website, with the methodology used to 

2 determine different risk levels and examples of par3 ticular use cases for each category in language that 

4 is easy to understand to the people affected by the 

5 decisions and outcomes of artificial intelligence. 

6 (b) EFFECTIVE DATE.—This section shall take effect 

7 on the date that is 180 days after the date of enactment 

8 of this Act, on and after which an agency that has not 

9 complied with the requirements of this section may not 

10 develop, procure or obtain, or use artificial intelligence 

11 until the agency complies with such requirements. 

12 SEC. 8. AGENCY REQUIREMENTS FOR USE OF ARTIFICIAL 

13 INTELLIGENCE. 

14 (a) RISK EVALUATION PROCESS.— 

15 (1) IN GENERAL.—Not later than 180 days 

16 after the effective date in section 7(b), the Chief Ar17 tificial Intelligence Officer of each agency, in coordi18 nation with the Artificial Intelligence Governance 

19 Board of the agency, shall develop and implement a 

20 process for the identification and evaluation of risks 

21 posed by the deployment of artificial intelligence in 

22 agency use cases to ensure an interdisciplinary and 

23 comprehensive evaluation of potential risks and de24 termination of risk classifications under such sec25 tion. 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
30 

•S 4495 RS

1 (2) PROCESS REQUIREMENTS.—The risk eval2 uation process described in paragraph (1), shall in3 clude, for each artificial intelligence use case— 

4 (A) identification of the risks and benefits 

5 of the artificial intelligence use case; 

6 (B) a plan to periodically review the artifi7 cial intelligence use case to examine whether 

8 risks have changed or evolved and to update the 

9 corresponding risk classification as necessary; 

10 (C) a determination of the need for tar11 geted impact assessments to further evaluate 

12 specific risks of the artificial intelligence use 

13 case within certain impact areas, which shall in14 clude privacy, security, civil rights and civil lib15 erties, accessibility, environmental impact, 

16 health and safety, and any other impact area 

17 relating to high risk classification under section 

18 7(a)(2)(D) as determined appropriate by the 

19 Chief Artificial Intelligence Officer; and 

20 (D) if appropriate, consultation with and 

21 feedback from affected communities and the 

22 public on the design, development, and use of 

23 the artificial intelligence use case. 

24 (3) REVIEW.— 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
31 

•S 4495 RS

1 (A) EXISTING USE CASES.—With respect 

2 to each use case that an agency is planning, de3 veloping, or using on the date of enactment of 

4 this Act, not later than 1 year after such date, 

5 the Chief Artificial Intelligence Officer of the 

6 agency shall identify and review the use case to 

7 determine the risk classification of the use case, 

8 pursuant to the risk evaluation process under 

9 paragraphs (1) and (2). 

10 (B) NEW USE CASES.— 

11 (i) IN GENERAL.—Beginning on the 

12 date of enactment of this Act, the Chief 

13 Artificial Intelligence Officer of an agency 

14 shall identify and review any artificial in15 telligence use case that the agency will 

16 plan, develop, or use and determine the 

17 risk classification of the use case, pursuant 

18 to the risk evaluation process under para19 graphs (1) and (2), before procuring or ob20 taining, developing, or using the use case. 

21 (ii) DEVELOPMENT.—For any use 

22 case described in clause (i) that is devel23 oped by the agency, the agency shall per24 form an additional risk evaluation prior to 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
32 

•S 4495 RS

1 deployment in a production or operational 

2 environment. 

3 (4) RATIONALE FOR RISK CLASSIFICATION.— 

4 Risk classification of an artificial intelligence use 

5 case shall be accompanied by an explanation from 

6 the agency of how the risk classification was deter7 mined, which shall be included in the artificial intel8 ligence use case inventory of the agency, and written 

9 referencing the model template developed by the Di10 rector under section 5(f)(1)(D). 

11 (b) MODEL CARD DOCUMENTATION REQUIRE12 MENTS.— 

13 (1) IN GENERAL.—Beginning on the date that 

14 is 180 days after the date of enactment of this Act, 

15 any time during developing, procuring or obtaining, 

16 or using artificial intelligence, an agency shall re17 quire, as determined necessary by the Chief Artifi18 cial Intelligence Officer, that the deployer and any 

19 relevant developer submit documentation about the 

20 artificial intelligence, including— 

21 (A) a description of the architecture of the 

22 artificial intelligence, highlighting key param23 eters, design choices, and the machine learning 

24 techniques employed; 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
33 

•S 4495 RS

1 (B) information on the training of the arti2 ficial intelligence, including computational re3 sources utilized; 

4 (C) an account of the source of the data, 

5 size of the data, any licenses under which the 

6 data is used, collection methods and dates of 

7 the data, and any preprocessing of the data un8 dertaken, including human or automated refine9 ment, review, or feedback; 

10 (D) information on the management and 

11 collection of personal data, outlining data pro12 tection and privacy measures adhered to in 

13 compliance with applicable laws; 

14 (E) a description of the methodologies 

15 used to evaluate the performance of the artifi16 cial intelligence, including key metrics and out17 comes; and 

18 (F) an estimate of the energy consumed by 

19 the artificial intelligence during training and in20 ference. 

21 (2) ADDITIONAL DOCUMENTATION FOR MEDIUM

22 AND HIGH RISK USE CASES.—Beginning on the date 

23 that is 270 days after the date of enactment of this 

24 Act, with respect to use cases categorized as medium 

25 risk or higher, an agency shall require that the 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
34 

•S 4495 RS

1 deployer of artificial intelligence, in consultation 

2 with any relevant developers, submit (including 

3 proactively, as material updates of the artificial in4 telligence occur) the following documentation: 

5 (A) MODEL ARCHITECTURE.—Detailed in6 formation on the model or models used in the 

7 artificial intelligence, including model date, 

8 model version, model type, key parameters (in9 cluding number of parameters), interpretability 

10 measures, and maintenance and updating poli11 cies. 

12 (B) ADVANCED TRAINING DETAILS.—A de13 tailed description of training algorithms, meth14 odologies, optimization techniques, computa15 tional resources, and the environmental impact 

16 of the training process. 

17 (C) DATA PROVENANCE AND INTEGRITY.— 

18 A detailed description of the training and test19 ing data, including the origins, collection meth20 ods, preprocessing steps, and demographic dis21 tribution of the data, and known discriminatory 

22 impacts and mitigation measures with respect 

23 to the data. 

24 (D) PRIVACY AND DATA PROTECTION.— 

25 Detailed information on data handling pracVerDate Sep 11 2014 03:17 Dec 17, 2024 Jkt 059200 PO 00000 Frm 00034 Fmt 6652 Sfmt 6401 E:\BILLS\S4495.RS S4495

kjohnson on DSK7ZCZBW3PROD with $$_JOB
35 

•S 4495 RS

1 tices, including compliance with legal standards, 

2 anonymization techniques, data security meas3 ures, and whether and how permission for use 

4 of data is obtained. 

5 (E) RIGOROUS TESTING AND OVER6 SIGHT.—A comprehensive disclosure of per7 formance evaluation metrics, including accu8 racy, precision, recall, and fairness metrics, and 

9 test dataset results. 

10 (F) NIST ARTIFICIAL INTELLIGENCE RISK

11 MANAGEMENT FRAMEWORK.—Documentation 

12 demonstrating compliance with the most re13 cently updated version of the framework devel14 oped and updated pursuant to section 22A(c) of 

15 the National Institute of Standards and Tech16 nology Act (15 U.S.C. 278h–1(c)). 

17 (3) REVIEW OF REQUIREMENTS.—Not later 

18 than 1 year after the date of enactment of this Act, 

19 the Comptroller General shall conduct a review of 

20 the documentation requirements under paragraphs 

21 (1) and (2) to— 

22 (A) examine whether agencies and 

23 deployers are complying with the requirements 

24 under those paragraphs; and 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
36 

•S 4495 RS

1 (B) make findings and recommendations to 

2 further assist in ensuring safe, responsible, and 

3 efficient artificial intelligence. 

4 (4) SECURITY OF PROVIDED DOCUMENTA5 TION.—The head of each agency shall ensure that 

6 appropriate security measures and access controls 

7 are in place to protect documentation provided pur8 suant to this section. 

9 (c) INFORMATION AND USE PROTECTIONS.—Infor10 mation provided to an agency under subsection (b)(3) is 

11 exempt from disclosure under section 552 of title 5, 

12 United States Code (commonly known as the ‘‘Freedom 

13 of Information Act’’) and may be used by the agency, con14 sistent with otherwise applicable provisions of Federal law, 

15 solely for— 

16 (1) assessing the ability of artificial intelligence 

17 to achieve the requirements and objectives of the 

18 agency and the requirements of this Act; and 

19 (2) identifying— 

20 (A) adverse effects of artificial intelligence 

21 on the rights or safety factors identified in sec22 tion 7(a)(2)(D); 

23 (B) cyber threats, including the sources of 

24 the cyber threats; and 

25 (C) security vulnerabilities. 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
37 

•S 4495 RS

1 (d) PRE-DEPLOYMENT REQUIREMENTS FOR HIGH

2 RISK USE CASES.—Beginning on the date that is 1 year 

3 after the date of enactment of this Act, the head of an 

4 agency shall not deploy or use artificial intelligence for a 

5 high risk use case prior to— 

6 (1) collecting documentation of the artificial in7 telligence, source, and use case in agency software 

8 and use case inventories; 

9 (2) testing of the artificial intelligence in an 

10 operational, real-world setting with privacy, civil 

11 rights, and civil liberty safeguards to ensure the ar12 tificial intelligence is capable of meeting its objec13 tives; 

14 (3) establishing appropriate agency rules of be15 havior for the use case, including required human 

16 involvement in, and user-facing explainability of, de17 cisions made in whole or part by the artificial intel18 ligence, as determined by the Chief Artificial Intel19 ligence Officer in coordination with the program 

20 manager or equivalent agency personnel; and 

21 (4) establishing appropriate agency training 

22 programs, including documentation of completion of 

23 training prior to use of artificial intelligence, that 

24 educate agency personnel involved with the applica25 tion of artificial intelligence in high risk use cases on 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
38 

•S 4495 RS

1 the capacities and limitations of artificial intel2 ligence, including training on— 

3 (A) monitoring the operation of artificial 

4 intelligence in high risk use cases to detect and 

5 address anomalies, dysfunctions, and unex6 pected performance in a timely manner to miti7 gate harm; 

8 (B) lessening reliance or over-reliance on 

9 the output produced by artificial intelligence in 

10 a high risk use case, particularly if artificial in11 telligence is used to make decisions impacting 

12 individuals; 

13 (C) accurately interpreting the output of 

14 artificial intelligence, particularly considering 

15 the characteristics of the system and the inter16 pretation tools and methods available; 

17 (D) when to not use, disregard, override, 

18 or reverse the output of artificial intelligence; 

19 (E) how to intervene or interrupt the oper20 ation of artificial intelligence; 

21 (F) limiting the use of artificial intelligence 

22 to its operational design domain; and 

23 (G) procedures for reporting incidents in24 volving misuse, faulty results, safety and secu25 rity issues, and other problems with use of artiVerDate Sep 11 2014 03:17 Dec 17, 2024 Jkt 059200 PO 00000 Frm 00038 Fmt 6652 Sfmt 6401 E:\BILLS\S4495.RS S4495

kjohnson on DSK7ZCZBW3PROD with $$_JOB
39 

•S 4495 RS

1 ficial intelligence that does not function as in2 tended. 

3 (e) ONGOING MONITORING OF ARTIFICIAL INTEL4 LIGENCE IN HIGH RISK USE CASES.—The Chief Artificial 

5 Intelligence Officer of each agency shall— 

6 (1) establish a reporting system, consistent with 

7 section 5(g), and suspension and shut-down proto8 cols for defects or adverse impacts of artificial intel9 ligence, and conduct ongoing monitoring, as deter10 mined necessary by use case; 

11 (2) oversee the development and implementa12 tion of ongoing testing and evaluation processes for 

13 artificial intelligence in high risk use cases to ensure 

14 continued mitigation of the potential risks identified 

15 in the risk evaluation process; 

16 (3) implement a process to ensure that risk 

17 mitigation efforts for artificial intelligence are re18 viewed not less than annually and updated as nec19 essary to account for the development of new 

20 versions of artificial intelligence and changes to the 

21 risk profile; and 

22 (4) adhere to pre-deployment requirements 

23 under subsection (d) in each case in which a low or 

24 medium risk artificial intelligence use case becomes 

25 a high risk artificial intelligence use case. 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
40 

•S 4495 RS

1 (f) EXEMPTION FROM REQUIREMENTS FOR SELECT

2 USE CASES.—The Chief Artificial Intelligence Officer of 

3 each agency— 

4 (1) may designate select, low risk use cases, in5 cluding current and future use cases, that do not 

6 have to comply with all or some of the requirements 

7 in this Act; and 

8 (2) shall publicly disclose all use cases exempted 

9 under paragraph (1) with a justification for each ex10 empted use case. 

11 (g) EXCEPTION.—The requirements under sub12 sections (a) and (b) shall not apply to an algorithm soft13 ware update, enhancement, derivative, correction, defect, 

14 or fix for artificial intelligence that does not materially 

15 change the compliance of the deployer with the require16 ments of those subsections, unless determined otherwise 

17 by the agency Chief Artificial Intelligence Officer. 

18 (h) WAIVERS.— 

19 (1) IN GENERAL.—The head of an agency, on 

20 a case by case basis, may waive 1 or more require21 ments under subsection (d) for a specific use case 

22 after making a written determination, based upon a 

23 risk assessment conducted by a human with respect 

24 to the specific use case, that fulfilling the require25 ment or requirements prior to procuring or obtainVerDate Sep 11 2014 03:17 Dec 17, 2024 Jkt 059200 PO 00000 Frm 00040 Fmt 6652 Sfmt 6401 E:\BILLS\S4495.RS S4495

kjohnson on DSK7ZCZBW3PROD with $$_JOB
41 

•S 4495 RS

1 ing, developing, or using artificial intelligence would 

2 increase risks to safety or rights overall or would 

3 create an unacceptable impediment to critical agency 

4 operations. 

5 (2) REQUIREMENTS; LIMITATIONS.—A waiver 

6 under this subsection shall be— 

7 (A) in the national security interests of the 

8 United States, as determined by the head of the 

9 agency; 

10 (B) submitted to the relevant congressional 

11 committees not later than 15 days after the 

12 head of the agency grants the waiver; and 

13 (C) limited to a duration of 1 year, at 

14 which time the head of the agency may renew 

15 the waiver and submit the renewed waiver to 

16 the relevant congressional committees. 

17 (i) INFRASTRUCTURE SECURITY.—The head of an 

18 agency, in consultation with the agency Chief Artificial In19 telligence Officer, Chief Information Officer, Chief Data 

20 Officer, and other relevant agency officials, shall reevalu21 ate infrastructure security protocols based on the artificial 

22 intelligence use cases and associated risks to infrastruc23 ture security of the agency. 

24 (j) COMPLIANCE DEADLINE.—Not later than 270 

25 days after the date of enactment of this Act, the requireVerDate Sep 11 2014 03:17 Dec 17, 2024 Jkt 059200 PO 00000 Frm 00041 Fmt 6652 Sfmt 6401 E:\BILLS\S4495.RS S4495

kjohnson on DSK7ZCZBW3PROD with $$_JOB
42 

•S 4495 RS

1 ments of subsections (a) through (i) of this section shall 

2 apply with respect to artificial intelligence that is already 

3 in use on the date of enactment of this Act. 

4 SEC. 9. PROHIBITION ON SELECT ARTIFICIAL INTEL5 LIGENCE USE CASES. 

6 No agency may develop, procure or obtain, or use ar7 tificial intelligence for— 

8 (1) mapping facial biometric features of an in9 dividual to assign corresponding emotion and poten10 tially take action against the individual; 

11 (2) categorizing and taking action against an 

12 individual based on biometric data of the individual 

13 to deduce or infer race, political opinion, religious or 

14 philosophical beliefs, trade union status, sexual ori15 entation, or other personal trait; 

16 (3) evaluating, classifying, rating, or scoring 

17 the trustworthiness or social standing of an indi18 vidual based on multiple data points and time occur19 rences related to the social behavior of the individual 

20 in multiple contexts or known or predicted personal 

21 or personality characteristics in a manner that may 

22 lead to discriminatory outcomes; or 

23 (4) any other use found by the agency to pose 

24 an unacceptable risk under the risk classification 

25 system of the agency, pursuant to section 7. 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
43 

•S 4495 RS

1 SEC. 10. AGENCY PROCUREMENT INNOVATION LABS. 

2 (a) IN GENERAL.—An agency subject to the Chief Fi3 nancial Officers Act of 1990 (31 U.S.C. 901 note; Public 

4 Law 101–576) that does not have a Procurement Innova5 tion Lab on the date of enactment of this Act should con6 sider establishing a lab or similar mechanism to test new 

7 approaches, share lessons learned, and promote best prac8 tices in procurement, including for commercial technology, 

9 such as artificial intelligence, that is trustworthy and best10 suited for the needs of the agency. 

11 (b) FUNCTIONS.—The functions of the Procurement 

12 Innovation Lab or similar mechanism should include— 

13 (1) providing leadership support as well as ca14 pability and capacity to test, document, and help 

15 agency programs adopt new and better practices 

16 through all stages of the acquisition lifecycle, begin17 ning with project definition and requirements devel18 opment; 

19 (2) providing the workforce of the agency with 

20 a clear pathway to test and document new acquisi21 tion practices and facilitate fresh perspectives on ex22 isting practices; 

23 (3) helping programs and integrated project 

24 teams successfully execute emerging and well-estab25 lished acquisition practices to achieve better results; 

26 and 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
44 

•S 4495 RS

1 (4) promoting meaningful collaboration among 

2 offices that are responsible for requirements develop3 ment, contracting officers, and others, including fi4 nancial and legal experts, that share in the responsi5 bility for making a successful procurement. 

6 (c) STRUCTURE.—An agency should consider placing 

7 the Procurement Innovation Lab or similar mechanism as 

8 a supporting arm of the Chief Acquisition Officer or Sen9 ior Procurement Executive of the agency and shall have 

10 wide latitude in structuring the Procurement Innovation 

11 Lab or similar mechanism and in addressing associated 

12 personnel staffing issues. 

13 SEC. 11. MULTI-PHASE COMMERCIAL TECHNOLOGY TEST 

14 PROGRAM. 

15 (a) TEST PROGRAM.—The head of an agency may 

16 procure commercial technology through a multi-phase test 

17 program of contracts in accordance with this section. 

18 (b) PURPOSE.—A test program established under 

19 this section shall— 

20 (1) provide a means by which an agency may 

21 post a solicitation, including for a general need or 

22 area of interest, for which the agency intends to ex23 plore commercial technology solutions and for which 

24 an offeror may submit a bid based on existing com25 mercial capabilities of the offeror with minimal 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
45 

•S 4495 RS

1 modifications or a technology that the offeror is de2 veloping for commercial purposes; and 

3 (2) use phases, as described in subsection (c), 

4 to minimize government risk and incentivize com5 petition. 

6 (c) CONTRACTING PROCEDURES.—Under a test pro7 gram established under this section, the head of an agency 

8 may acquire commercial technology through a competitive 

9 evaluation of proposals resulting from general solicitation 

10 in the following phases: 

11 (1) PHASE 1 (VIABILITY OF POTENTIAL SOLU12 TION).—Selectees may be awarded a portion of the 

13 total contract award and have a period of perform14 ance of not longer than 1 year to prove the merits, 

15 feasibility, and technological benefit the proposal 

16 would achieve for the agency. 

17 (2) PHASE 2 (MAJOR DETAILS AND SCALED

18 TEST).—Selectees may be awarded a portion of the 

19 total contract award and have a period of perform20 ance of not longer than 1 year to create a detailed 

21 timeline, establish an agreeable intellectual property 

22 ownership agreement, and implement the proposal 

23 on a small scale. 

24 (3) PHASE 3 (IMPLEMENTATION OR RECY25 CLE).— 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
46 

•S 4495 RS

1 (A) IN GENERAL.—Following successful 

2 performance on phase 1 and 2, selectees may be 

3 awarded up to the full remainder of the total 

4 contract award to implement the proposal, de5 pending on the agreed upon costs and the num6 ber of contractors selected. 

7 (B) FAILURE TO FIND SUITABLE SELECT8 EES.—If no selectees are found suitable for 

9 phase 3, the agency head may determine not to 

10 make any selections for phase 3, terminate the 

11 solicitation and utilize any remaining funds to 

12 issue a modified general solicitation for the 

13 same area of interest. 

14 (d) TREATMENT AS COMPETITIVE PROCEDURES.— 

15 The use of general solicitation competitive procedures for 

16 a test program under this section shall be considered to 

17 be use of competitive procedures as defined in section 152 

18 of title 41, United States Code. 

19 (e) LIMITATION.—The head of an agency shall not 

20 enter into a contract under the test program for an 

21 amount in excess of $25,000,000. 

22 (f) GUIDANCE.— 

23 (1) FEDERAL ACQUISITION REGULATORY COUN24 CIL.—The Federal Acquisition Regulatory Council 

25 shall revise the Federal Acquisition Regulation as 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
47 

•S 4495 RS

1 necessary to implement this section, including re2 quirements for each general solicitation under a test 

3 program to be made publicly available through a 

4 means that provides access to the notice of the gen5 eral solicitation through the System for Award Man6 agement or subsequent government-wide point of 

7 entry, with classified solicitations posted to the ap8 propriate government portal. 

9 (2) AGENCY PROCEDURES.—The head of an 

10 agency may not award contracts under a test pro11 gram until the agency issues guidance with proce12 dures for use of the authority. The guidance shall be 

13 issued in consultation with the relevant Acquisition 

14 Regulatory Council and shall be publicly available. 

15 (g) SUNSET.—The authority for a test program 

16 under this section shall terminate on the date that is 5 

17 years after the date the Federal Acquisition Regulation 

18 is revised pursuant to subsection (f)(1) to implement the 

19 program. 

20 SEC. 12. RESEARCH AND DEVELOPMENT PROJECT PILOT 

21 PROGRAM. 

22 (a) PILOT PROGRAM.—The head of an agency may 

23 carry out research and prototype projects in accordance 

24 with this section. 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
48 

•S 4495 RS

1 (b) PURPOSE.—A pilot program established under 

2 this section shall provide a means by which an agency 

3 may— 

4 (1) carry out basic, applied, and advanced re5 search and development projects; and 

6 (2) carry out prototype projects that address— 

7 (A) a proof of concept, model, or process, 

8 including a business process; 

9 (B) reverse engineering to address obsoles10 cence; 

11 (C) a pilot or novel application of commer12 cial technologies for agency mission purposes; 

13 (D) agile development activity; 

14 (E) the creation, design, development, or 

15 demonstration of operational utility; or 

16 (F) any combination of items described in 

17 subparagraphs (A) through (E). 

18 (c) CONTRACTING PROCEDURES.—Under a pilot pro19 gram established under this section, the head of an agency 

20 may carry out research and prototype projects— 

21 (1) using small businesses to the maximum ex22 tent practicable; 

23 (2) using cost sharing arrangements where 

24 practicable; 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
49 

•S 4495 RS

1 (3) tailoring intellectual property terms and 

2 conditions relevant to the project and commercializa3 tion opportunities; and 

4 (4) ensuring that such projects do not duplicate 

5 research being conducted under existing agency pro6 grams. 

7 (d) TREATMENT AS COMPETITIVE PROCEDURES.— 

8 The use of research and development contracting proce9 dures under this section shall be considered to be use of 

10 competitive procedures, as defined in section 152 of title 

11 41, United States Code. 

12 (e) TREATMENT AS COMMERCIAL TECHNOLOGY.— 

13 The use of research and development contracting proce14 dures under this section shall be considered to be use of 

15 commercial technology, as defined in section 2. 

16 (f) FOLLOW-ON PROJECTS OR PHASES.—A follow-on 

17 contract provided for in a contract opportunity announced 

18 under this section may, at the discretion of the head of 

19 the agency, be awarded to a participant in the original 

20 project or phase if the original project or phase was suc21 cessfully completed. 

22 (g) LIMITATION.—The head of an agency shall not 

23 enter into a contract under the pilot program for an 

24 amount in excess of $10,000,000. 

25 (h) GUIDANCE.— 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
50 

•S 4495 RS

1 (1) FEDERAL ACQUISITION REGULATORY COUN2 CIL.—The Federal Acquisition Regulatory Council 

3 shall revise the Federal Acquisition Regulation re4 search and development contracting procedures as 

5 necessary to implement this section, including re6 quirements for each research and development 

7 project under a pilot program to be made publicly 

8 available through a means that provides access to 

9 the notice of the opportunity through the System for 

10 Award Management or subsequent government-wide 

11 point of entry, with classified solicitations posted to 

12 the appropriate government portal. 

13 (2) AGENCY PROCEDURES.—The head of an 

14 agency may not award contracts under a pilot pro15 gram until the agency, in consultation with the rel16 evant Acquisition Regulatory Council issues and 

17 makes publicly available guidance on procedures for 

18 use of the authority. 

19 (i) REPORTING.—Contract actions entered into under 

20 this section shall be reported to the Federal Procurement 

21 Data System, or any successor system. 

22 (j) SUNSET.—The authority for a pilot program 

23 under this section shall terminate on the date that is 5 

24 years from the date the Federal Acquisition Regulation 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
51 

•S 4495 RS

1 is revised pursuant to subsection (h)(1) to implement the 

2 program. 

3 SEC. 13. DEVELOPMENT OF TOOLS AND GUIDANCE FOR 

4 TESTING AND EVALUATING ARTIFICIAL IN5 TELLIGENCE. 

6 (a) AGENCY REPORT REQUIREMENTS.—In a manner 

7 specified by the Director, the Chief Artificial Intelligence 

8 Officer shall identify and annually submit to the Council 

9 a report on obstacles encountered in the testing and eval10 uation of artificial intelligence, specifying— 

11 (1) the nature of the obstacles; 

12 (2) the impact of the obstacles on agency oper13 ations, mission achievement, and artificial intel14 ligence adoption; 

15 (3) recommendations for addressing the identi16 fied obstacles, including the need for particular re17 sources or guidance to address certain obstacles; and 

18 (4) a timeline that would be needed to imple19 ment proposed solutions. 

20 (b) COUNCIL REVIEW AND COLLABORATION.— 

21 (1) ANNUAL REVIEW.—Not less frequently than 

22 annually, the Council shall conduct a review of agen23 cy reports under subsection (a) to identify common 

24 challenges and opportunities for cross-agency col25 laboration. 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
52 

•S 4495 RS

1 (2) DEVELOPMENT OF TOOLS AND GUID2 ANCE.— 

3 (A) IN GENERAL.—Not later than 2 years 

4 after the date of enactment of this Act, the Di5 rector, in consultation with the Council, shall 

6 convene a working group to— 

7 (i) develop tools and guidance to as8 sist agencies in addressing the obstacles 

9 that agencies identify in the reports under 

10 subsection (a); 

11 (ii) support interagency coordination 

12 to facilitate the identification and use of 

13 relevant voluntary standards, guidelines, 

14 and other consensus-based approaches for 

15 testing and evaluation and other relevant 

16 areas; and 

17 (iii) address any additional matters 

18 determined appropriate by the Director. 

19 (B) WORKING GROUP MEMBERSHIP.—The 

20 working group described in subparagraph (A) 

21 shall include Federal interdisciplinary per22 sonnel, such as technologists, information secu23 rity personnel, domain experts, privacy officers, 

24 data officers, civil rights and civil liberties offi25 cers, contracting officials, legal counsel, cusVerDate Sep 11 2014 03:17 Dec 17, 2024 Jkt 059200 PO 00000 Frm 00052 Fmt 6652 Sfmt 6401 E:\BILLS\S4495.RS S4495

kjohnson on DSK7ZCZBW3PROD with $$_JOB
53 

•S 4495 RS

1 tomer experience professionals, and others, as 

2 determined by the Director. 

3 (3) INFORMATION SHARING.—The Director, in 

4 consultation with the Council, shall establish a 

5 mechanism for sharing tools and guidance developed 

6 under paragraph (2) across agencies. 

7 (c) CONGRESSIONAL REPORTING.— 

8 (1) IN GENERAL.—Each agency shall submit 

9 the annual report under subsection (a) to relevant 

10 congressional committees. 

11 (2) CONSOLIDATED REPORT.—The Director, in 

12 consultation with the Council, may suspend the re13 quirement under paragraph (1) and submit to the 

14 relevant congressional committees a consolidated re15 port that conveys government-wide testing and eval16 uation challenges, recommended solutions, and 

17 progress toward implementing recommendations 

18 from prior reports developed in fulfillment of this 

19 subsection. 

20 (d) SUNSET.—The requirements under this section 

21 shall terminate on the date that is 10 years after the date 

22 of enactment of this Act. 

23 SEC. 14. UPDATES TO ARTIFICIAL INTELLIGENCE USE CASE 

24 INVENTORIES. 

25 (a) AMENDMENTS.— 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
54 

•S 4495 RS

1 (1) ADVANCING AMERICAN AI ACT.—The Ad2 vancing American AI Act (Public Law 117–263; 40 

3 U.S.C. 11301 note) is amended— 

4 (A) in section 7223(3), by striking the pe5 riod and inserting ‘‘and in section 5002 of the 

6 National Artificial Intelligence Initiative Act of 

7 2020 (15 U.S.C. 9401).’’; and 

8 (B) in section 7225, by striking subsection 

9 (d). 

10 (2) EXECUTIVE ORDER 13960.—The provisions 

11 of section 5 of Executive Order 13960 (85 Fed. Reg. 

12 78939; relating to promoting the use of trustworthy 

13 artificial intelligence in Federal Government) that 

14 exempt classified and sensitive use cases from agen15 cy inventories of artificial intelligence use cases shall 

16 cease to have legal effect. 

17 (b) COMPLIANCE.— 

18 (1) IN GENERAL.—The Director shall ensure 

19 that agencies submit artificial intelligence use case 

20 inventories and that the inventories comply with ap21 plicable artificial intelligence inventory guidance. 

22 (2) ANNUAL REPORT.—The Director shall sub23 mit to the relevant congressional committees an an24 nual report on agency compliance with artificial in25 telligence inventory guidance. 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
55 

•S 4495 RS

1 (c) DISCLOSURE.— 

2 (1) IN GENERAL.—The artificial intelligence in3 ventory of each agency shall publicly disclose— 

4 (A) whether artificial intelligence was de5 veloped internally by the agency or procured ex6 ternally, without excluding any use case on 

7 basis that the use case is ‘‘sensitive’’ solely be8 cause it was externally procured; 

9 (B) data provenance information, including 

10 identifying the source of the training data of 

11 the artificial intelligence, including internal gov12 ernment data, public data, commercially held 

13 data, or similar data; 

14 (C) the level of risk at which the agency 

15 has classified the artificial intelligence use case 

16 and a brief explanation for how the determina17 tion was made; 

18 (D) a list of targeted impact assessments 

19 conducted pursuant to section 7(a)(2)(C); and 

20 (E) the number of artificial intelligence use 

21 cases excluded from public reporting as being 

22 ‘‘sensitive.’’ 

23 (2) UPDATES.— 

24 (A) IN GENERAL.—When an agency up25 dates the public artificial intelligence use case 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
56 

•S 4495 RS

1 inventory of the agency, the agency shall dis2 close the date of the modification and make 

3 change logs publicly available and accessible. 

4 (B) GUIDANCE.—The Director shall issue 

5 guidance to agencies that describes how to ap6 propriately update artificial intelligence use case 

7 inventories and clarifies how sub-agencies and 

8 regulatory agencies should participate in the ar9 tificial intelligence use case inventorying proc10 ess. 

11 (d) CONGRESSIONAL REPORTING.—The head of each 

12 agency shall submit to the relevant congressional commit13 tees a copy of the annual artificial intelligence use case 

14 inventory of the agency, including— 

15 (1) the use cases that have been identified as 

16 ‘‘sensitive’’ and not for public disclosure; and 

17 (2) a classified annex of classified use cases. 

18 (e) GOVERNMENT TRENDS REPORT.—Beginning 1 

19 year after the date of enactment of this Act, and annually 

20 thereafter, the Director, in coordination with the Council, 

21 shall issue a report, based on the artificial intelligence use 

22 cases reported in use case inventories, that describes 

23 trends in the use of artificial intelligence in the Federal 

24 Government. 

25 (f) COMPTROLLER GENERAL.— 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
57 

•S 4495 RS

1 (1) REPORT REQUIRED.—Not later than 1 year 

2 after the date of enactment of this Act, and annually 

3 thereafter, the Comptroller General of the United 

4 States shall submit to relevant congressional com5 mittees a report on whether agencies are appro6 priately classifying use cases. 

7 (2) APPROPRIATE CLASSIFICATION.—The 

8 Comptroller General of the United States shall ex9 amine whether the appropriate level of disclosure of 

10 artificial intelligence use cases by agencies should be 

11 included on the High Risk List of the Government 

12 Accountability Office. 

13 SECTION 1. SHORT TITLE. 

14 This Act may be cited as the ‘‘Promoting Responsible 

15 Evaluation and Procurement to Advance Readiness for En16 terprise-wide Deployment for Artificial Intelligence Act’’ or 

17 the ‘‘PREPARED for AI Act’’. 

18 SEC. 2. DEFINITIONS. 

19 In this Act: 

20 (1) ADVERSE OUTCOME.—The term ‘‘adverse out21 come’’ means any behavior or malfunction, such as a 

22 hallucination, algorithmic bias, or inconsistent out23 put, of artificial intelligence that leads to— 

24 (A) harm impacting rights or safety, as de25 scribed in section 7(a)(3); 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
58 

•S 4495 RS

1 (B) the death of an individual or damage to 

2 the health of an individual; 

3 (C) material or irreversible disruption of 

4 the management and operation of critical infra5 structure, as described in section 

6 7(a)(3)(A)(ii)(III); 

7 (D) material damage to property or the en8 vironment; 

9 (E) loss of a mission-critical system or 

10 equipment; 

11 (F) failure of the mission of an agency; 

12 (G) the wrongful denial of a benefit, pay13 ment, or other service to an individual or group 

14 of individuals who would have otherwise been el15 igible; 

16 (H) the denial of an employment, contract, 

17 grant, or similar opportunity that would have 

18 otherwise been offered; or 

19 (I) another consequence, as determined by 

20 the Director with public notice. 

21 (2) AGENCY.—The term ‘‘agency’’— 

22 (A) means each agency described in section 

23 3502(1) of title 44, United States Code; and 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
59 

•S 4495 RS

1 (B) does not include each of the independent 

2 regulatory agencies described in section 3502(5) 

3 of title 44, United States Code. 

4 (3) ARTIFICIAL INTELLIGENCE.—The term ‘‘arti5 ficial intelligence’’— 

6 (A) has the meaning given that term in sec7 tion 5002 of the National Artificial Intelligence 

8 Initiative Act of 2020 (15 U.S.C. 9401); and 

9 (B) includes the artificial systems and tech10 niques described in paragraphs (1) through (5) 

11 of section 238(g) of the John S. McCain National 

12 Defense Authorization Act for Fiscal Year 2019 

13 (Public Law 115–232; 10 U.S.C. 4061 note 

14 prec.). 

15 (4) BIOMETRIC DATA.—The term ‘‘biometric 

16 data’’ means data resulting from specific technical 

17 processing relating to the unique physical, physio18 logical, or behavioral characteristics of an individual, 

19 including facial images, dactyloscopic data, physical 

20 movement and gait, breath, voice, DNA, blood type, 

21 and expression of emotion, thought, or feeling. 

22 (5) COMMERCIAL TECHNOLOGY.—The term 

23 ‘‘commercial technology’’— 

24 (A) means a technology, process, or method, 

25 including research or development; and 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
60 

•S 4495 RS

1 (B) includes commercial products, commer2 cial services, and other commercial items, as de3 fined in the Federal Acquisition Regulation, in4 cluding any addition or update thereto by the 

5 Federal Acquisition Regulatory Council. 

6 (6) COUNCIL.—The term ‘‘Council’’ means the 

7 Chief Artificial Intelligence Officers Council estab8 lished under section 5(a). 

9 (7) DEPLOYER.—The term ‘‘deployer’’ means an 

10 entity that operates, whether for the entity itself or on 

11 behalf of a third party, artificial intelligence, whether 

12 developed internally or by a third-party developer. 

13 (8) DEVELOPER.—The term ‘‘developer’’ means 

14 an entity that designs, codes, or produces artificial 

15 intelligence, including materially modifying artificial 

16 intelligence designed, coded, or produced by another 

17 entity. 

18 (9) DIRECTOR.—The term ‘‘Director’’ means the 

19 Director of the Office of Management and Budget. 

20 (10) GOVERNMENT DATA.—The term ‘‘Govern21 ment data’’ means data collected, processed, main22 tained, disseminated, or managed by an agency, in23 cluding data reported to an agency. 

24 (11) IMPACT ASSESSMENT.—The term ‘‘impact 

25 assessment’’ means a structured process for considVerDate Sep 11 2014 03:17 Dec 17, 2024 Jkt 059200 PO 00000 Frm 00060 Fmt 6652 Sfmt 6203 E:\BILLS\S4495.RS S4495

kjohnson on DSK7ZCZBW3PROD with $$_JOB
61 

•S 4495 RS

1 ering and evaluating the implications of a proposed 

2 artificial intelligence use case. 

3 (12) RELEVANT CONGRESSIONAL COMMITTEES.— 

4 The term ‘‘relevant congressional committees’’ means 

5 the Committee on Homeland Security and Govern6 mental Affairs of the Senate and the Committee on 

7 Oversight and Accountability of the House of Rep8 resentatives. 

9 (13) RISK.—The term ‘‘risk’’ means the com10 bination of the probability of an occurrence of harm 

11 and the potential severity of that harm. 

12 (14) USE CASE.—The term ‘‘use case’’ means the 

13 ways and context in which artificial intelligence is 

14 deployed to achieve a specific objective. 

15 SEC. 3. IMPLEMENTATION OF REQUIREMENTS. 

16 (a) AGENCY IMPLEMENTATION.—The Director shall fa17 cilitate the implementation of the requirements of this Act, 

18 including through the issuance of binding or nonbinding 

19 guidance, as the Director determines appropriate. 

20 (b) ANNUAL BRIEFING.—Not later than 180 days after 

21 the date of enactment of this Act, and annually thereafter, 

22 the Director shall brief the appropriate Congressional com23 mittees on implementation of this Act and related consider24 ations. 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
62 

•S 4495 RS

1 SEC. 4. PROCUREMENT OF ARTIFICIAL INTELLIGENCE. 

2 (a) GOVERNMENT-WIDE REQUIREMENTS.— 

3 (1) IN GENERAL.—Not later than 15 months 

4 after the date of enactment of this Act, the Federal 

5 Acquisition Regulatory Council shall review Federal 

6 Acquisition Regulation acquisition planning, source 

7 selection, and other requirements and update the Fed8 eral Acquisition Regulation as needed for agency pro9 curement of artificial intelligence, including— 

10 (A) a requirement to address the outcomes 

11 of the risk evaluation and impact assessments re12 quired under section 7(a); 

13 (B) a requirement for an interdisciplinary 

14 approach that includes consultation with agency 

15 experts prior to, and throughout, as necessary, 

16 procuring or obtaining artificial intelligence; 

17 and 

18 (C) any other considerations determined rel19 evant by the Federal Acquisition Regulatory 

20 Council. 

21 (2) HARMONIZATION.—The Federal Acquisition 

22 Regulation review described in paragraph (1) shall 

23 determine the extent to which existing requirements 

24 and procedures need to be revised or supplemented to 

25 address risks and opportunities specific to procure26 ment of artificial intelligence. 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
63 

•S 4495 RS

1 (3) INTERDISCIPLINARY APPROACH.—The inter2 disciplinary approach described in paragraph (1)(B) 

3 may— 

4 (A) vary depending on the use case and the 

5 risks determined to be associated with the use 

6 case; and 

7 (B) include, as practicable, technologists, 

8 information security personnel, domain experts, 

9 privacy officers, data officers, civil rights and 

10 civil liberties officers, contracting officials, legal 

11 counsel, customer experience professionals, and 

12 others. 

13 (4) ACQUISITION PLANNING.—The updates de14 scribed in paragraph (1) shall, at a minimum, in15 clude— 

16 (A) data ownership and privacy; 

17 (B) data information security; 

18 (C) interoperability requirements; 

19 (D) data and model assessment processes; 

20 (E) scope of use; 

21 (F) ongoing monitoring and evaluation 

22 techniques; 

23 (G) environmental impact; 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
64 

•S 4495 RS

1 (H) cybersecurity minimum standards, in2 cluding regular vulnerability testing and 

3 patching and cybersecurity monitoring; 

4 (I) risk mitigation techniques, including a 

5 plan for minimizing the likelihood of adverse 

6 outcomes and reporting adverse outcomes, pursu7 ant to section 5(h); and 

8 (J) developer and deployer disclosure re9 quirements necessary to comply with the require10 ments of this Act. 

11 (b) REQUIREMENTS FOR HIGH RISK ARTIFICIAL IN12 TELLIGENCE USE CASES.— 

13 (1) ESTABLISHMENT.—Beginning on the date 

14 that is 1 year after the date of enactment of this Act, 

15 the head of an agency may not procure or obtain ar16 tificial intelligence for a high risk use case, as de17 scribed in section 7(a)(3), prior to establishing and 

18 incorporating certain terms into relevant contracts 

19 and agreements for an artificial intelligence use case, 

20 including— 

21 (A) a requirement to disclose to the agency 

22 the purpose for which the artificial intelligence 

23 was intended to be used and any potential risks 

24 from the use of the artificial intelligence; 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
65 

•S 4495 RS

1 (B) requirements for safety, security, pri2 vacy, and trustworthiness, including— 

3 (i) a reporting mechanism through 

4 which agency personnel are notified of an 

5 adverse outcome involving artificial intel6 ligence procured or obtained by the agency; 

7 (ii) a requirement, in accordance with 

8 section 5(h), that agency personnel receive a 

9 notification of an adverse outcome involving 

10 artificial intelligence procured or obtained 

11 by the agency, and, at a minimum, an ex12 planation of the cause of the adverse out13 come and any data directly connected to the 

14 adverse outcome; 

15 (iii) that the agency may consider tem16 porarily or permanently suspending use of 

17 the artificial intelligence, with minimal im18 pact on unrelated services, if the risks of the 

19 artificial intelligence to rights or safety out20 weigh the benefits of the use case; and 

21 (iv) a requirement that the deployer 

22 and any relevant developer utilize the most 

23 recently updated version of the framework 

24 developed and updated pursuant to section 

25 22(A)(c) of the National Institute of StandVerDate Sep 11 2014 03:17 Dec 17, 2024 Jkt 059200 PO 00000 Frm 00065 Fmt 6652 Sfmt 6203 E:\BILLS\S4495.RS S4495

kjohnson on DSK7ZCZBW3PROD with $$_JOB
66 

•S 4495 RS

1 ards and Technology Act (15 U.S.C. 278h2 1(c)); 

3 (C) requirements to disclose to the agency 

4 sufficient descriptive information relating to the 

5 ownership of data, as appropriate by use case, 

6 including— 

7 (i) requirements for retention of rights 

8 to Government data and any modification 

9 to Government data, including to protect 

10 Government data from unauthorized disclo11 sure and use to subsequently train or im12 prove the functionality of commercial prod13 ucts offered by the deployer, any relevant 

14 developers, or others; and 

15 (ii) a requirement that the deployer, if 

16 the deployer is not the agency, and any rel17 evant developers or other parties isolate 

18 non-public Government data from all other 

19 data through methods, such as physical sep20 aration, electronic separation via secure 

21 copies with strict access controls, or other 

22 computational isolation mechanisms; 

23 (D) requirements for evaluation and testing 

24 of artificial intelligence based on use case, to be 

25 performed on an ongoing basis; and 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
67 

•S 4495 RS

1 (E) requirements to provide documentation, 

2 as determined necessary and requested by the 

3 agency, in accordance with section 7(b). 

4 (2) REVIEW.—The Senior Procurement Execu5 tive, in coordination with the Chief Artificial Intel6 ligence Officer, shall, as practicable, consult with tech7 nologists, information security and cybersecurity per8 sonnel, domain experts, privacy officers, data officers, 

9 civil rights and civil liberties officers, contracting offi10 cials, legal counsel, customer experience professionals, 

11 program evaluation officers, and other relevant agen12 cy officials to review the requirements described in 

13 subparagraphs (A) through (E) of paragraph (1) and 

14 determine whether it may be necessary to incorporate 

15 additional requirements into relevant contracts or 

16 agreements. 

17 (3) REGULATION.—The Federal Acquisition Reg18 ulatory Council shall revise the Federal Acquisition 

19 Regulation as necessary to implement the require20 ments of this subsection. 

21 SEC. 5. INTERAGENCY GOVERNANCE OF ARTIFICIAL INTEL22 LIGENCE. 

23 (a) CHIEF ARTIFICIAL INTELLIGENCE OFFICERS

24 COUNCIL.—Not later than 60 days after the date of enactVerDate Sep 11 2014 03:17 Dec 17, 2024 Jkt 059200 PO 00000 Frm 00067 Fmt 6652 Sfmt 6203 E:\BILLS\S4495.RS S4495

kjohnson on DSK7ZCZBW3PROD with $$_JOB
68 

•S 4495 RS

1 ment of this Act, the Director shall establish a Chief Artifi2 cial Intelligence Officers Council. 

3 (b) DUTIES.—The duties of the Council shall include— 

4 (1) coordinating agency development and use of 

5 artificial intelligence in agency programs and oper6 ations, including practices relating to the design, op7 eration, risk management, and performance of artifi8 cial intelligence; 

9 (2) sharing experiences, ideas, best practices, and 

10 innovative approaches relating to artificial intel11 ligence; 

12 (3) identifying, developing, and coordinating 

13 multi-agency projects and other initiatives; 

14 (4) harmonizing agency management of risks re15 lating to developing, obtaining, or using artificial in16 telligence, including by developing a common tem17 plate to guide agency Chief Artificial Intelligence Of18 ficers in implementing a risk evaluation process that 

19 may incorporate best practices, such as those from— 

20 (A) the most recently updated version of the 

21 framework developed and updated pursuant to 

22 section 22A(c) of the National Institute of Stand23 ards and Technology Act (15 U.S.C. 278h–1(c)); 

24 and 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
69 

•S 4495 RS

1 (B) the report published by the Government 

2 Accountability Office entitled ‘‘Artificial Intel3 ligence: An Accountability Framework for Fed4 eral Agencies and Other Entities’’ (GAO-21- 

5 519SP), published on June 30, 2021; 

6 (5) promoting the development and use of secure, 

7 common, shared, or other approaches to key processes 

8 that improve the delivery of services for the public; 

9 (6) soliciting and providing perspectives on mat10 ters of concern, including from and to— 

11 (A) interagency councils; 

12 (B) Federal Government entities; 

13 (C) private sector, public sector, nonprofit, 

14 and academic experts; 

15 (D) State, local, Tribal, territorial, and 

16 international governments; and 

17 (E) other individuals and entities, as deter18 mined relevant by the Council; 

19 (7) working with the Chief Acquisition Officers 

20 Council— 

21 (A) to ensure contractors, including small 

22 businesses, have the benefit of integrity, fairness, 

23 competition, openness, and efficiency in accord24 ance with the statutory functions of the Chief AcVerDate Sep 11 2014 03:17 Dec 17, 2024 Jkt 059200 PO 00000 Frm 00069 Fmt 6652 Sfmt 6203 E:\BILLS\S4495.RS S4495

kjohnson on DSK7ZCZBW3PROD with $$_JOB
70 

•S 4495 RS

1 quisition Officers Council, as described in section 

2 1312 of title 41, United States Code; and 

3 (B) which shall establish a working group 

4 for the purpose described in subparagraph (A) 

5 and related purposes; and 

6 (8) any other matters determined by the Council 

7 to be relevant. 

8 (c) MEMBERSHIP OF THE COUNCIL.— 

9 (1) LEADERS.— 

10 (A) CHAIR.—The Director shall serve as 

11 Chair of the Council. 

12 (B) VICE CHAIR.—The Council shall have a 

13 Vice Chair, who shall be an individual selected 

14 by a majority of the members of the Council. 

15 (C) ADDITIONAL ROLES.—The Council may 

16 establish additional leadership roles, at the dis17 cretion of the Council. 

18 (2) MEMBERS.—Other members of the Council 

19 shall include— 

20 (A) the Chief Artificial Intelligence Officer 

21 of each agency; and 

22 (B) the senior official for artificial intel23 ligence of the Office of Management and Budget. 

24 (d) STANDING COMMITTEES; WORKING GROUPS.—The 

25 Council shall have the authority to establish standing comVerDate Sep 11 2014 03:17 Dec 17, 2024 Jkt 059200 PO 00000 Frm 00070 Fmt 6652 Sfmt 6203 E:\BILLS\S4495.RS S4495

kjohnson on DSK7ZCZBW3PROD with $$_JOB
71 

•S 4495 RS

1 mittees, including an executive committee, and working 

2 groups. 

3 (e) COUNCIL STAFF.—The Council may enter into an 

4 interagency agreement with the Administrator of General 

5 Services for shared services for the purpose of staffing the 

6 Council. 

7 (f) REPORTS.— 

8 (1) IN GENERAL.—Not later than 3 years after 

9 the date of enactment of this Act, the Comptroller 

10 General of the United States shall submit to the rel11 evant congressional committees a report that— 

12 (A) identifies, to the extent practicable, 

13 ways to improve coordination with other coun14 cils throughout the Federal Government; and 

15 (B) recommends ways to improve the utility 

16 of the Council for the public and other agencies. 

17 (2) CONSOLIDATION.—In fulfilling the require18 ment under paragraph (1), the Comptroller General 

19 of the United States may, if desired, consolidate the 

20 report under that paragraph with another report con21 cerning interagency coordination. 

22 (g) DEVELOPMENT, ADAPTATION, AND DOCUMENTA23 TION.— 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
72 

•S 4495 RS

1 (1) GUIDANCE.—Not later than 1 year after the 

2 date of enactment of this Act, the Director shall issue 

3 guidance on— 

4 (A) how to conduct the agency impact as5 sessments described in section 7(a) and other rel6 evant impact assessments as determined appro7 priate by the Director, including the appro8 priateness of adapting pre-existing assessments, 

9 including privacy and security impact assess10 ments, for purposes of an artificial intelligence 

11 impact assessment; 

12 (B) development of a model template for the 

13 risk classification explanations that each agency 

14 must provide under section 7(a)(6); 

15 (C) development of a model template for 

16 procurement of artificial intelligence intended to 

17 help agencies use consistent terms, definitions, 

18 and documentation requirements; and 

19 (D) additional matters relating to the im20 plementation of this Act, as determined relevant 

21 by the Director. 

22 (2) BIENNIAL REVIEW.—The Director shall peri23 odically, but not less frequently than biennially, re24 view and update, as needed, the guidance issued 

25 under paragraph (1). 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
73 

•S 4495 RS

1 (h) ADVERSE OUTCOME REPORTING.— 

2 (1) IN GENERAL.—Not later than 1 year after 

3 the date of enactment of this Act, the Director shall 

4 develop procedures for ensuring that, at a min5 imum— 

6 (A) adverse outcomes involving artificial in7 telligence procured or obtained or used by agen8 cies are reported promptly to the relevant agency 

9 or agencies by the developer or deployer, if the 

10 deployer is not the agency, or to the developer or 

11 deployer by the relevant agency, whichever first 

12 becomes aware of the adverse outcome; and 

13 (B) information relating to an adverse out14 come described in subparagraph (A) is appro15 priately shared among agencies. 

16 (2) SINGLE REPORT.—Adverse outcomes also 

17 qualifying for incident reporting under section 3554 

18 of title 44, United States Code, or other relevant laws 

19 or policies, may be reported under such other report20 ing requirement and are not required to be addition21 ally reported under this subsection. 

22 (3) NOTICE TO DEVELOPERS AND DEPLOYERS.— 

23 (A) IN GENERAL.—If and upon discovery of 

24 an adverse outcome by an agency, the agency 

25 shall— 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
74 

•S 4495 RS

1 (i) report the adverse outcome to the 

2 deployer, if the deployer is not the agency, 

3 and any relevant developers; and 

4 (ii) in consultation with any relevant 

5 deployers and developers, take action to re6 solve the adverse outcome and mitigate the 

7 potential for future adverse outcomes. 

8 (B) WAIVER.— 

9 (i) IN GENERAL.—Unless otherwise re10 quired by law, the head of an agency may 

11 issue a written waiver that waives the ap12 plicability of some or all of the requirements 

13 under subparagraph (A), with respect to a 

14 specific adverse outcome. 

15 (ii) WRITTEN WAIVER CONTENTS.—A 

16 written waiver under clause (i) shall in17 clude justification for the waiver. 

18 (iii) NOTICE.—The head of an agency 

19 shall forward advance notice of any waiver 

20 under this subparagraph to the Director. 

21 SEC. 6. AGENCY GOVERNANCE OF ARTIFICIAL INTEL22 LIGENCE. 

23 (a) IN GENERAL.—The head of an agency shall— 

24 (1) ensure the responsible adoption of artificial 

25 intelligence, including by— 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
75 

•S 4495 RS

1 (A) requiring the development or revision of 

2 relevant agency policies and directives; 

3 (B) testing, verifying, validating, and mon4 itoring artificial intelligence and the use case5 specific performance of artificial intelligence, 

6 proportionate to risk level, to minimize the like7 lihood of adverse outcomes by— 

8 (i) ensuring the use of artificial intel9 ligence is appropriate to and improves the 

10 effectiveness of the mission of the agency; 

11 (ii) guarding against bias in data col12 lection, use, and dissemination; 

13 (iii) ensuring reliability, fairness, and 

14 transparency; and 

15 (iv) protecting against impermissible 

16 discrimination; 

17 (C) continuing to hire, train, and develop a 

18 workforce that— 

19 (i) understands the risks and benefits 

20 of artificial intelligence, including artificial 

21 intelligence embedded in agency systems 

22 and operations; 

23 (ii) is able to provide human oversight 

24 for the design, implementation, and end 

25 uses of artificial intelligence; and 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
76 

•S 4495 RS

1 (iii) is able to review and provide re2 dress for erroneous decisions made in the 

3 course of artificial intelligence-assisted proc4 esses; and 

5 (D) ensuring implementation of the agency 

6 requirements under this Act; 

7 (2) designate a Chief Artificial Intelligence Offi8 cer, whose duties shall include— 

9 (A) ensuring appropriate use of artificial 

10 intelligence; 

11 (B) coordinating agency use of artificial in12 telligence; 

13 (C) promoting artificial intelligence innova14 tion; 

15 (D) managing the risks of use of artificial 

16 intelligence; 

17 (E) minimizing the likelihood of adverse 

18 outcomes; 

19 (F) supporting the head of the agency with 

20 developing the risk evaluation process required 

21 under section 7(a) and complying with other re22 quirements of this Act; 

23 (G) supporting agency personnel leading the 

24 procurement and deployment of artificial intelVerDate Sep 11 2014 03:17 Dec 17, 2024 Jkt 059200 PO 00000 Frm 00076 Fmt 6652 Sfmt 6203 E:\BILLS\S4495.RS S4495

kjohnson on DSK7ZCZBW3PROD with $$_JOB
77 

•S 4495 RS

1 ligence to comply with the requirements under 

2 this Act; and 

3 (H) coordinating with other responsible offi4 cials and appropriate stakeholders with respect 

5 to the duties described in subparagraphs (A) 

6 through (G), as appropriate; and 

7 (3) form and convene an Artificial Intelligence 

8 Governance Board, if required by subsection (c), 

9 which shall coordinate and govern artificial intel10 ligence issues across the agency. 

11 (b) DESIGNATION OF CHIEF ARTIFICIAL INTEL12 LIGENCE OFFICER.—The head of an agency may designate 

13 as Chief Artificial Intelligence Officer an existing official 

14 within the agency, including the Chief Technology Officer, 

15 Chief Data Officer, Chief Information Officer, or other offi16 cial with relevant or complementary authorities and re17 sponsibilities, if such existing official has expertise in artifi18 cial intelligence and meets the requirements of this section. 

19 (c) ARTIFICIAL INTELLIGENCE GOVERNANCE

20 BOARD.— 

21 (1) LEADERSHIP.—Each agency identified in 

22 section 901(b) of title 31, United States Code, shall es23 tablish an Artificial Intelligence Governance Board 

24 (referred to in this subsection as ‘‘Board’’) that shall 

25 be chaired by the deputy head of the agency or equivVerDate Sep 11 2014 03:17 Dec 17, 2024 Jkt 059200 PO 00000 Frm 00077 Fmt 6652 Sfmt 6203 E:\BILLS\S4495.RS S4495

kjohnson on DSK7ZCZBW3PROD with $$_JOB
78 

•S 4495 RS

1 alent official and vice-chaired by the Chief Artificial 

2 Intelligence Officer of the agency. Neither the chair 

3 nor the vice-chair may assign or delegate these roles 

4 to other officials. 

5 (2) REPRESENTATION.—The Board shall, at a 

6 minimum, include representatives consisting of— 

7 (A) senior agency officials from operational 

8 components, if relevant; 

9 (B) program officials responsible for imple10 menting artificial intelligence; and 

11 (C) officials responsible for information 

12 technology, data, cybersecurity, privacy, statis13 tics, civil rights and civil liberties, human cap14 ital, procurement, finance, legal counsel, agency 

15 management, program evaluation, and customer 

16 experience. 

17 (3) EXISTING BODIES.—An agency may rely on 

18 an existing governance body to fulfill the requirements 

19 of this subsection if the body satisfies or is adjusted 

20 to satisfy the leadership and representation require21 ments of paragraphs (1) and (2). 

22 (d) EFFECTIVE DATE.—Beginning on the date that is 

23 120 days after the date of enactment of this Act, an agency 

24 shall not develop, procure, or obtain artificial intelligence 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
79 

•S 4495 RS

1 prior to completing the requirements under paragraphs (2) 

2 and (3) of subsection (a). 

3 SEC. 7. AGENCY REQUIREMENTS FOR USE OF ARTIFICIAL 

4 INTELLIGENCE. 

5 (a) RISK EVALUATION PROCESS.— 

6 (1) IN GENERAL.—Not later than 180 days after 

7 the date of enactment of this Act, the Chief Artificial 

8 Intelligence Officer of each agency, in coordination 

9 with the Artificial Intelligence Governance Board of 

10 the agency, shall develop and implement a process for 

11 identifying when the use of artificial intelligence by 

12 the agency meets the classification of high risk, as de13 scribed in paragraph (3). 

14 (2) PROCESS REQUIREMENTS.—The risk evalua15 tion process described in paragraph (1), shall include, 

16 for each artificial intelligence use case— 

17 (A) identification of the purpose, expected 

18 benefits, and potential risks of the artificial in19 telligence use case; 

20 (B) a plan to periodically review the artifi21 cial intelligence use case to examine whether the 

22 expected benefits and potential risks identified 

23 under subparagraph (A) have changed or 

24 evolved; and 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
80 

•S 4495 RS

1 (C) if a high risk determination has been 

2 made, the need for targeted impact assessments, 

3 beyond those required under any other provision 

4 of law, to further evaluate specific risks of the ar5 tificial intelligence use case in coordination with 

6 other responsible officials within certain impact 

7 areas, which shall include privacy, security, civil 

8 rights and civil liberties, accessibility, environ9 mental impact, health and safety, and any other 

10 impact area relating to high risk classification 

11 under paragraph (3) as determined appropriate 

12 by the Chief Artificial Intelligence Officer. 

13 (3) HIGH RISK USE CASES.— 

14 (A) IN GENERAL.—High risk classification 

15 shall, at a minimum, apply to use cases for 

16 which the outputs serve as a principal basis 

17 for— 

18 (i) a decision or action that has a 

19 legal, material, binding, or similarly sig20 nificant effect, with respect to an individual 

21 or community, on— 

22 (I) civil rights, civil liberties, or 

23 privacy; 

24 (II) access to education, housing, 

25 insurance, credit, employment, and 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
81 

•S 4495 RS

1 other programs where civil rights and 

2 equal opportunity protections apply; or 

3 (III) access to or the ability to 

4 apply for critical government resources 

5 or services, including healthcare, finan6 cial services, public housing, social 

7 services, transportation, and essential 

8 goods and services; or 

9 (ii) a decision that substantially im10 pacts the safety of, or has the potential to 

11 substantially impact the safety of— 

12 (I) an individual or community, 

13 including loss of life, serious injury, 

14 bodily harm, biological or chemical 

15 harms, occupational hazards, harass16 ment or abuse, or mental health; 

17 (II) the environment, including 

18 irreversible or significant environ19 mental damage; 

20 (III) critical infrastructure, in21 cluding the critical infrastructure sec22 tors defined in National Security 

23 Memorandum 22 (NSM-22) (dated 

24 April 30, 2024) (or any successor di25 rective) and the infrastructure for votVerDate Sep 11 2014 03:17 Dec 17, 2024 Jkt 059200 PO 00000 Frm 00081 Fmt 6652 Sfmt 6203 E:\BILLS\S4495.RS S4495

kjohnson on DSK7ZCZBW3PROD with $$_JOB
82 

•S 4495 RS

1 ing and protecting the integrity of elec2 tions; or 

3 (IV) strategic assets or resources, 

4 including high-value property and in5 formation marked as sensitive or clas6 sified by the Federal Government. 

7 (B) CLASSIFICATION VARIANCE.— 

8 (i) VARIANCE WITHIN A MISSION

9 AREA.—The risk evaluation process under 

10 this paragraph may allow for a particular 

11 operational use case to not be classified as 

12 high risk, even if the use case is a part of 

13 a larger area of the mission of the agency 

14 that is thought to be high risk, if the oper15 ational use case is determined not to be 

16 high risk based on the required risk evalua17 tion under paragraph (1). 

18 (ii) CHANGES BASED ON TESTING OR

19 NEW INFORMATION.—The risk evaluation 

20 process under this paragraph may allow for 

21 changes to the risk classification of an arti22 ficial intelligence use case based on the re23 sults from testing during the procurement 

24 process or other information that becomes 

25 available. 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
83 

•S 4495 RS

1 (4) REVIEW.—Not later than 1 year after the 

2 date of enactment of this Act, the Chief Artificial In3 telligence Officer of the agency shall— 

4 (A) certify whether each existing use case 

5 presents a high risk; and 

6 (B) identify and review any use cases the 

7 agency is planning, developing, procuring, or ob8 taining to determine whether each such use cases 

9 presents a high risk. 

10 (5) DEVELOPMENT.—For any artificial intel11 ligence that is developed by the agency, the agency 

12 shall ensure a risk evaluation is conducted prior to 

13 deployment in a production or operational environ14 ment that is fit for the intended use. 

15 (6) RATIONALE FOR RISK CLASSIFICATION.— 

16 (A) IN GENERAL.—A high risk classification 

17 of an artificial intelligence use case shall be ac18 companied by an explanation from the agency, 

19 that a reasonable person would consider suffi20 cient to understand, of how the classification was 

21 determined, which shall be included in the artifi22 cial intelligence use case inventory of the agency. 

23 (B) TEMPLATE.—A risk classification ex24 planation under subparagraph (A) shall utilize 

25 the model template developed by the Director 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
84 

•S 4495 RS

1 under section 5(g)(1)(B) if the explanation is 

2 written after the date that such model template 

3 has become available. 

4 (b) DOCUMENTATION REQUIREMENTS.— 

5 (1) DOCUMENTATION FOR HIGH RISK USE

6 CASES.—Beginning on the date that is 1 year after 

7 the date of enactment of this Act, prior to developing, 

8 procuring or obtaining, or using artificial intelligence 

9 to be used in a high risk use case, an agency shall 

10 require the deployer, if the deployer is not the agency, 

11 in consultation with any relevant developers, to sub12 mit the following documentation: 

13 (A) A description of the types of data 

14 sources used to train the artificial intelligence, 

15 whether the data is from licensed material, and 

16 an identification of the specific issues related to 

17 safety, bias, and fairness, that may be expected 

18 to arise from the use of the data, and any miti19 gation techniques used, if applicable. 

20 (B) A description of the methodologies used 

21 to evaluate the performance of the artificial in22 telligence for its intended use. 

23 (C) Documentation demonstrating imple24 mentation of risk evaluation and management 

25 measures, including the evaluation and manageVerDate Sep 11 2014 03:17 Dec 17, 2024 Jkt 059200 PO 00000 Frm 00084 Fmt 6652 Sfmt 6203 E:\BILLS\S4495.RS S4495

kjohnson on DSK7ZCZBW3PROD with $$_JOB
85 

•S 4495 RS

1 ment of safety, bias, and fairness risks, as appro2 priate. 

3 (D) Information on the collection, manage4 ment, and protection of data, in compliance with 

5 applicable laws. 

6 (E) Documentation of the known limita7 tions of the artificial intelligence, and if applica8 ble, supplementary guidelines on how the artifi9 cial intelligence is intended to be used. 

10 (2) SUFFICIENCY OF DOCUMENTATION.—The 

11 Chief Artificial Intelligence Officer of an agency shall 

12 determine the sufficiency of the documentation pro13 vided in meeting the requirements under paragraph 

14 (1). 

15 (3) UPDATES.—An agency shall require that a 

16 deployer, if the deployer is not the agency, in con17 sultation with any relevant developers, submit up18 dates to the documentation required under paragraph 

19 (1), if and when there are any material changes to 

20 the information in such documentation. 

21 (4) REVIEW OF REQUIREMENTS.—Not later than 

22 2 years after the date of enactment of this Act, the 

23 Comptroller General of the United States shall con24 duct a review of the documentation requirements 

25 under paragraphs (1) and (3) to— 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
86 

•S 4495 RS

1 (A) examine whether agencies, third-party 

2 deployers, and developers are complying with the 

3 requirements under those paragraphs, and make 

4 associated findings and recommendations; and 

5 (B) make general findings and rec6 ommendations to further assist in ensuring safe, 

7 responsible, and efficient agency procurement 

8 and use of artificial intelligence. 

9 (5) SECURITY OF PROVIDED DOCUMENTATION.— 

10 The head of each agency shall ensure that appropriate 

11 security measures and access controls are in place to 

12 protect documentation provided pursuant to this sec13 tion. 

14 (c) INFORMATION AND USE PROTECTIONS.—Informa15 tion provided to an agency under subsection (b) may be 

16 used by the agency, consistent with otherwise applicable 

17 provisions of Federal law, solely for— 

18 (1) assessing the ability of artificial intelligence 

19 to achieve the requirements and objectives of the agen20 cy and the requirements of this Act; and 

21 (2) identifying— 

22 (A) adverse effects of artificial intelligence 

23 on the rights or safety factors identified in sub24 section (a)(3); 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
87 

•S 4495 RS

1 (B) cyber threats, including the sources of 

2 the cyber threats; and 

3 (C) security vulnerabilities. 

4 (d) PRE-DEPLOYMENT REQUIREMENTS FOR HIGH

5 RISK ARTIFICIAL INTELLIGENCE USE CASES.—Beginning 

6 on the date that is 18 months after the date of enactment 

7 of this Act, the head of an agency shall not deploy or use 

8 artificial intelligence for a high risk use case prior to— 

9 (1) complying with the requirements of sub10 section (a); 

11 (2) obtaining documentation of the artificial in12 telligence described in subsection (b)(2), source, and 

13 use case in agency software and use case inventories; 

14 (3) testing the artificial intelligence in an oper15 ational, real-world setting with privacy, security, 

16 civil rights, and civil liberty safeguards to ensure the 

17 artificial intelligence is capable of meeting its objec18 tives, and to determine, to the maximum extent prac19 ticable, the likelihood and impact of adverse outcomes 

20 occurring during use; 

21 (4) establishing appropriate agency rules of be22 havior for the use case, including required human in23 volvement in, and reasonable plain-language notice 

24 about, decisions made in whole or part by the artifi25 cial intelligence, as determined by the Chief Artificial 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
88 

•S 4495 RS

1 Intelligence Officer in coordination with the program 

2 manager or equivalent agency personnel; 

3 (5) if appropriate, consultation with and collec4 tion of feedback from affected communities and the 

5 public on the design, development, and use of the high 

6 risk use case; 

7 (6) establishing appropriate agency training 

8 programs, including documentation of completion of 

9 training prior to use of artificial intelligence, that 

10 educate agency personnel involved with the applica11 tion of artificial intelligence in high risk use cases on 

12 the capacities and limitations of artificial intel13 ligence, including training on— 

14 (A) monitoring, detecting, and reporting 

15 anomalies, dysfunctions, and unexpected per16 formance in a timely manner; 

17 (B) reducing over-reliance on the output 

18 produced by artificial intelligence in a high risk 

19 use case, particularly if artificial intelligence is 

20 used to make decisions impacting individuals; 

21 (C) accurately interpreting the output of ar22 tificial intelligence, particularly considering the 

23 characteristics of the system and the interpreta24 tion tools and methods available; 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
89 

•S 4495 RS

1 (D) when to not use, disregard, override, or 

2 reverse the output of artificial intelligence; 

3 (E) how to intervene or interrupt the oper4 ation of artificial intelligence; 

5 (F) limiting the use of artificial intelligence 

6 to its intended purpose; and 

7 (G) procedures for reporting adverse out8 comes, as determined under section 5(h), and 

9 other problems that may arise with artificial in10 telligence that does not function as intended; and 

11 (7) determining whether the benefits of the use 

12 case outweigh the risks by— 

13 (A) evaluating the information learned from 

14 completing the requirements under paragraphs 

15 (2) and (3); and 

16 (B) assessing whether the requirements 

17 under paragraphs (2) through (6) have been ac18 complished and known risks have been effectively 

19 mitigated. 

20 (e) DETERMINATIONS.— 

21 (1) REQUESTS FOR DETERMINATION INFORMA22 TION.—The head of an agency shall make available to 

23 the relevant congressional committees or the Director, 

24 upon request, a determination under subsection (d)(7) 

25 and the respective supporting documentation. 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
90 

•S 4495 RS

1 (2) REEVALUATION.—If it is determined under 

2 subsection (d)(7) that the benefits of a use case do not 

3 outweigh the risks and the risks cannot be effectively 

4 mitigated, the agency may decide to reevaluate the 

5 use case indefinitely or until appropriate measures 

6 under the requirements in paragraphs (2) through (6) 

7 of that subsection are established. 

8 (f) ONGOING MONITORING OF ARTIFICIAL INTEL9 LIGENCE IN HIGH RISK USE CASES.—Beginning on the 

10 date that is 1 year after the date of enactment of this Act, 

11 the Chief Artificial Intelligence Officer of each agency 

12 shall— 

13 (1) establish a reporting system, consistent with 

14 section 5(h), and suspension and shut-down protocols 

15 for defects or adverse outcomes of artificial intel16 ligence, and conduct ongoing monitoring, as deter17 mined necessary by use case; 

18 (2) oversee the development and implementation 

19 of ongoing testing and evaluation processes for artifi20 cial intelligence in high risk use cases to ensure con21 tinued mitigation of the potential risks identified in 

22 the risk evaluation process; and 

23 (3) implement a process to ensure that risk miti24 gation efforts for artificial intelligence are reviewed 

25 not less than annually and updated as necessary to 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
91 

•S 4495 RS

1 account for the development of new versions of artifi2 cial intelligence and changes to the risk profile. 

3 (g) CHANGED RISKS.—In the process of complying 

4 with subsections (d) and (f), an agency shall determine 

5 whether an intended use case should be paused, stopped per6 manently, or continued if new information changes the 

7 risks associated with the use case or requires new testing 

8 and monitoring procedures under those subsections. 

9 (h) EXCEPTION.—The requirements under subsections 

10 (a) and (b) shall not apply to an algorithm software up11 date, enhancement, derivative, correction, defect, or fix for 

12 artificial intelligence that does not materially change the 

13 compliance of the deployer with the requirements of those 

14 subsections, unless determined otherwise by the agency Chief 

15 Artificial Intelligence Officer. 

16 (i) WAIVERS.— 

17 (1) IN GENERAL.—The head of an agency, or 1 

18 or more deputy heads of an agency designated by the 

19 head of the agency, may waive 1 or more require20 ments under subsection (d) for a specific use case 

21 after making a written determination, based upon a 

22 risk assessment conducted by a human, that fulfilling 

23 the requirement or requirements would increase risks 

24 to safety or rights overall, would create an unaccept25 able impediment to critical agency operations, or 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
92 

•S 4495 RS

1 would not be in the national security interests of the 

2 United States. 

3 (2) REQUIREMENTS.—A waiver under para4 graph (1) shall— 

5 (A) include, at a minimum, the reasons for 

6 the waiver and a plan to bring the specific use 

7 case into compliance with subsection (d) before 

8 the end of the waiver, pursuant to paragraph 

9 (4); and 

10 (B) be submitted to the relevant congres11 sional committees and the Director not later 

12 than 15 days after the head of the agency grants 

13 the waiver. 

14 (3) REVIEW.—The Director shall review the 

15 waiver and relevant documentation to determine 

16 whether the waiver was improperly granted. 

17 (4) DURATION.—A waiver under paragraph (1) 

18 shall be limited to a duration of 1 year, at which 

19 time, if the agency is unable to bring the specific use 

20 case into compliance with subsection (d), the agency 

21 shall cease use or deployment of the use case until the 

22 use case can be brought into compliance with that 

23 subsection. 

24 (j) INFRASTRUCTURE SECURITY.—The head of an 

25 agency, in consultation with the agency Chief Artificial InVerDate Sep 11 2014 03:17 Dec 17, 2024 Jkt 059200 PO 00000 Frm 00092 Fmt 6652 Sfmt 6203 E:\BILLS\S4495.RS S4495

kjohnson on DSK7ZCZBW3PROD with $$_JOB
93 

•S 4495 RS

1 telligence Officer, Chief Information Officer, Chief Data Of2 ficer, and other relevant agency officials, shall reevaluate 

3 infrastructure security protocols based on the artificial in4 telligence use cases and associated risks to infrastructure 

5 security of the agency. 

6 (k) COMPLIANCE DEADLINE.—Not later than 270 days 

7 after the date of enactment of this Act, the requirements 

8 of subsections (a) through (j) of this section shall apply with 

9 respect to artificial intelligence that is already in use on 

10 the date of enactment of this Act. 

11 SEC. 8. PROHIBITION ON SELECT ARTIFICIAL INTEL12 LIGENCE USE CASES. 

13 No agency may develop, procure, obtain, or use artifi14 cial intelligence for— 

15 (1) mapping facial biometric features of an indi16 vidual to assign corresponding emotion and poten17 tially take action against the individual; 

18 (2) categorizing and taking action against an 

19 individual based on biometric data of the individual 

20 to deduce or infer race, political opinion, religious or 

21 philosophical beliefs, trade union status, sexual ori22 entation, or other personal trait, with the exception of 

23 deducing or inferring age in the context of inves24 tigating child sexual abuse; or 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
94 

•S 4495 RS

1 (3) evaluating, classifying, rating, or scoring the 

2 trustworthiness or social standing of an individual 

3 based on multiple data points and time occurrences 

4 related to the social behavior of the individual in 

5 multiple contexts or known or predicted personal or 

6 personality characteristics in a manner that may 

7 lead to discriminatory outcomes. 

8 SEC. 9. AGENCY PROCUREMENT INNOVATION LABS. 

9 (a) IN GENERAL.—Each agency identified in 901(b) 

10 of title 31, United States Code, that does not have a Pro11 curement Innovation Lab on the date of enactment of this 

12 Act should consider establishing a lab or similar mechanism 

13 to test new approaches, share lessons learned, and promote 

14 best practices in procurement, including for commercial 

15 technology, such as artificial intelligence, that is trust16 worthy and best-suited for the needs of the agency. 

17 (b) FUNCTIONS.—The functions of the Procurement In18 novation Lab or similar mechanism should include— 

19 (1) providing leadership support as well as ca20 pability and capacity to test, document, and help 

21 agency programs adopt new and better practices 

22 through all stages of the acquisition lifecycle, begin23 ning with project definition and requirements devel24 opment; 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
95 

•S 4495 RS

1 (2) providing the workforce of the agency with a 

2 clear pathway to test and document new acquisition 

3 practices and facilitate fresh perspectives on existing 

4 practices; 

5 (3) helping programs and integrated project 

6 teams successfully execute emerging and well-estab7 lished acquisition practices to achieve better results; 

8 and 

9 (4) promoting meaningful collaboration among 

10 offices that are responsible for requirements develop11 ment, contracting officers, and others, including fi12 nancial and legal experts, that share in the responsi13 bility for making a successful procurement. 

14 (c) STRUCTURE.—An agency should consider placing 

15 the Procurement Innovation Lab or similar mechanism as 

16 a supporting arm of the Chief Acquisition Officer or Senior 

17 Procurement Executive of the agency and shall have wide 

18 latitude in structuring the Procurement Innovation Lab or 

19 similar mechanism and in addressing associated personnel 

20 staffing issues. 

21 SEC. 10. MULTI-PHASE COMMERCIAL TECHNOLOGY TEST 

22 PROGRAM. 

23 (a) TEST PROGRAM.—The head of an agency may, if 

24 desired, procure commercial technology through a multiVerDate Sep 11 2014 03:17 Dec 17, 2024 Jkt 059200 PO 00000 Frm 00095 Fmt 6652 Sfmt 6203 E:\BILLS\S4495.RS S4495

kjohnson on DSK7ZCZBW3PROD with $$_JOB
96 

•S 4495 RS

1 phase test program of contracts in accordance with this sec2 tion. 

3 (b) PURPOSE.—A test program established under this 

4 section shall— 

5 (1) provide a means by which an agency may 

6 post a solicitation, including for a general need or 

7 area of interest, for which the agency intends to ex8 plore commercial technology solutions and for which 

9 an offeror may submit a bid based on existing com10 mercial capabilities of the offeror with minimal modi11 fications or a technology that the offeror is developing 

12 for commercial purposes; and 

13 (2) use phases, as described in subsection (c), to 

14 minimize government risk and incentivize competi15 tion. 

16 (c) CONTRACTING PROCEDURES.—Under a test pro17 gram established under this section, the head of an agency 

18 may acquire commercial technology through a competitive 

19 evaluation of proposals resulting from general solicitation 

20 in the following phases: 

21 (1) PHASE 1 (VIABILITY OF POTENTIAL SOLU22 TION).—Selectees may be awarded a portion of the 

23 total contract award and have a period of perform24 ance of not longer than 1 year to prove the merits, 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
97 

•S 4495 RS

1 feasibility, and technological benefit the proposal 

2 would achieve for the agency. 

3 (2) PHASE 2 (MAJOR DETAILS AND SCALED

4 TEST).—Selectees may be awarded a portion of the 

5 total contract award and have a period of perform6 ance of not longer than 1 year to create a detailed 

7 timeline, establish an agreeable intellectual property 

8 ownership agreement, and implement the proposal on 

9 a small scale. 

10 (3) PHASE 3 (IMPLEMENTATION OR RECYCLE).— 

11 (A) IN GENERAL.—Following successful per12 formance on phase 1 and 2, selectees may be 

13 awarded up to the full remainder of the total 

14 contract award to implement the proposal, de15 pending on the agreed upon costs and the num16 ber of contractors selected. 

17 (B) FAILURE TO FIND SUITABLE SELECT18 EES.—If no selectees are found suitable for phase 

19 3, the agency head may determine not to make 

20 any selections for phase 3, terminate the solicita21 tion and utilize any remaining funds to issue a 

22 modified general solicitation for the same area of 

23 interest. 

24 (d) TREATMENT AS COMPETITIVE PROCEDURES.—The 

25 use of general solicitation competitive procedures for a test 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
98 

•S 4495 RS

1 program under this section shall be considered to be use of 

2 competitive procedures as defined in section 152 of title 41, 

3 United States Code. 

4 (e) LIMITATION.—The head of an agency shall not 

5 enter into a contract under the test program for an amount 

6 in excess of $25,000,000. 

7 (f) GUIDANCE.— 

8 (1) FEDERAL ACQUISITION REGULATORY COUN9 CIL.—The Federal Acquisition Regulatory Council 

10 shall revise the Federal Acquisition Regulation as 

11 necessary to implement this section, including re12 quirements for each general solicitation under a test 

13 program to be made publicly available through a 

14 means that provides access to the notice of the general 

15 solicitation through the System for Award Manage16 ment or subsequent government-wide point of entry, 

17 with classified solicitations posted to the appropriate 

18 government portal. 

19 (2) AGENCY PROCEDURES.—The head of an 

20 agency may not award contracts under a test pro21 gram until the agency issues guidance with proce22 dures for use of the authority. The guidance shall be 

23 issued in consultation with the relevant Acquisition 

24 Regulatory Council and shall be publicly available. 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
99 

•S 4495 RS

1 (g) SUNSET.—The authority for a test program under 

2 this section shall terminate on the date that is 5 years after 

3 the date the Federal Acquisition Regulation is revised pur4 suant to subsection (f)(1) to implement the program. 

5 SEC. 11. RESEARCH AND DEVELOPMENT PROJECT PILOT 

6 PROGRAM. 

7 (a) PILOT PROGRAM.—The head of an agency may, 

8 if desired, carry out research and prototype projects in ac9 cordance with this section. 

10 (b) PURPOSE.—A pilot program established under this 

11 section shall provide a means by which an agency may— 

12 (1) carry out basic, applied, and advanced re13 search and development projects; and 

14 (2) carry out prototype projects that address— 

15 (A) a proof of concept, model, or process, in16 cluding a business process; 

17 (B) reverse engineering to address obsoles18 cence; 

19 (C) a pilot or novel application of commer20 cial technologies for agency mission purposes; 

21 (D) agile development activity; 

22 (E) the creation, design, development, or 

23 demonstration of operational utility; or 

24 (F) any combination of items described in 

25 subparagraphs (A) through (E). 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
100 

•S 4495 RS

1 (c) CONTRACTING PROCEDURES.—Under a pilot pro2 gram established under this section, the head of an agency 

3 may carry out research and prototype projects— 

4 (1) using small businesses to the maximum ex5 tent practicable; 

6 (2) using cost sharing arrangements where prac7 ticable; 

8 (3) tailoring intellectual property terms and con9 ditions relevant to the project and commercialization 

10 opportunities; and 

11 (4) ensuring that such projects do not duplicate 

12 research being conducted under existing agency pro13 grams. 

14 (d) TREATMENT AS COMPETITIVE PROCEDURES.—The 

15 use of research and development contracting procedures 

16 under this section shall be considered to be use of competi17 tive procedures, as defined in section 152 of title 41, United 

18 States Code. 

19 (e) TREATMENT AS COMMERCIAL TECHNOLOGY.—The 

20 use of research and development contracting procedures 

21 under this section shall be considered to be use of commer22 cial technology. 

23 (f) FOLLOW-ON PROJECTS OR PHASES.—A follow-on 

24 contract provided for in a contract opportunity announced 

25 under this section may, at the discretion of the head of the 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
101 

•S 4495 RS

1 agency, be awarded to a participant in the original project 

2 or phase if the original project or phase was successfully 

3 completed. 

4 (g) LIMITATION.—The head of an agency shall not 

5 enter into a contract under the pilot program under this 

6 section for an amount in excess of $10,000,000. 

7 (h) GUIDANCE.— 

8 (1) FEDERAL ACQUISITION REGULATORY COUN9 CIL.—The Federal Acquisition Regulatory Council 

10 shall revise the Federal Acquisition Regulation re11 search and development contracting procedures as 

12 necessary to implement this section, including re13 quirements for each research and development project 

14 under a pilot program to be made publicly available 

15 through a means that provides access to the notice of 

16 the opportunity through the System for Award Man17 agement or subsequent government-wide point of 

18 entry, with classified solicitations posted to the ap19 propriate government portal. 

20 (2) AGENCY PROCEDURES.—The head of an 

21 agency may not award contracts under a pilot pro22 gram until the agency, in consultation with the rel23 evant Acquisition Regulatory Council issues and 

24 makes publicly available guidance on procedures for 

25 use of the authority. 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
102 

•S 4495 RS

1 (i) REPORTING.—Contract actions entered into under 

2 this section shall be reported to the Federal Procurement 

3 Data System, or any successor system. 

4 (j) SUNSET.—The authority for a pilot program under 

5 this section shall terminate on the date that is 5 years from 

6 the date the Federal Acquisition Regulation is revised pur7 suant to subsection (h)(1) to implement the program. 

8 SEC. 12. DEVELOPMENT OF TOOLS AND GUIDANCE FOR 

9 TESTING AND EVALUATING ARTIFICIAL IN10 TELLIGENCE. 

11 (a) AGENCY REPORT REQUIREMENTS.—In a manner 

12 specified by the Director, the Chief Artificial Intelligence 

13 Officer of each agency shall identify and annually submit 

14 to the Council a report on obstacles encountered in the test15 ing and evaluation of artificial intelligence, specifying— 

16 (1) the nature of the obstacles; 

17 (2) the impact of the obstacles on agency oper18 ations, mission achievement, and artificial intel19 ligence adoption; 

20 (3) recommendations for addressing the identi21 fied obstacles, including the need for particular re22 sources or guidance to address certain obstacles; and 

23 (4) a timeline that would be needed to imple24 ment proposed solutions. 

25 (b) COUNCIL REVIEW AND COLLABORATION.— 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
103 

•S 4495 RS

1 (1) ANNUAL REVIEW.—Not less frequently than 

2 annually, the Council shall conduct a review of agen3 cy reports under subsection (a) to identify common 

4 challenges and opportunities for cross-agency collabo5 ration. 

6 (2) DEVELOPMENT OF TOOLS AND GUIDANCE.— 

7 (A) IN GENERAL.—Not later than 2 years 

8 after the date of enactment of this Act, the Direc9 tor, in consultation with the Council, shall con10 vene a working group to— 

11 (i) develop tools and guidance to assist 

12 agencies in addressing the obstacles that 

13 agencies identify in the reports under sub14 section (a); 

15 (ii) support interagency coordination 

16 to facilitate the identification and use of 

17 relevant voluntary standards, guidelines, 

18 and other consensus-based approaches for 

19 testing and evaluation and other relevant 

20 areas; and 

21 (iii) address any additional matters 

22 determined appropriate by the Director. 

23 (B) WORKING GROUP MEMBERSHIP.—The 

24 working group described in subparagraph (A) 

25 shall include Federal interdisciplinary personnel, 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
104 

•S 4495 RS

1 such as technologists, information security and 

2 cybersecurity personnel, domain experts, privacy 

3 officers, data officers, civil rights and civil lib4 erties officers, contracting officials, legal counsel, 

5 customer experience professionals, program eval6 uation officers, and others, as determined by the 

7 Director. 

8 (3) INFORMATION SHARING.—The Director, in 

9 consultation with the Council, shall establish a mech10 anism for sharing tools and guidance developed under 

11 paragraph (2) across agencies. 

12 (c) CONGRESSIONAL REPORTING.— 

13 (1) IN GENERAL.—Each agency shall submit the 

14 annual report under subsection (a) to the relevant 

15 congressional committees. 

16 (2) CONSOLIDATED REPORT.—The Director, in 

17 consultation with the Council, may suspend the re18 quirement under paragraph (1) and submit to the rel19 evant congressional committees a consolidated report 

20 that conveys government-wide testing and evaluation 

21 challenges, recommended solutions, and progress to22 ward implementing recommendations from prior re23 ports developed in fulfillment of this subsection. 

24 (d) EXTREMELY LOW RISK ARTIFICIAL INTELLIGENCE

25 USE CASES.—Not later than 2 years after the date of enactVerDate Sep 11 2014 03:17 Dec 17, 2024 Jkt 059200 PO 00000 Frm 00104 Fmt 6652 Sfmt 6203 E:\BILLS\S4495.RS S4495

kjohnson on DSK7ZCZBW3PROD with $$_JOB
105 

•S 4495 RS

1 ment of this Act, the Chief Artificial Intelligence Officers 

2 Council shall submit to the Director and the relevant con3 gressional committees a report outlining— 

4 (1) a proposed framework for identifying ex5 tremely low risk artificial intelligence use cases; and 

6 (2) opportunities to facilitate the deployment 

7 and use of extremely low risk artificial intelligence. 

8 (e) SUNSET.—The requirements under this section 

9 shall terminate on the date that is 10 years after the date 

10 of enactment of this Act. 

11 SEC. 13. UPDATES TO ARTIFICIAL INTELLIGENCE USE CASE 

12 INVENTORIES. 

13 (a) AMENDMENTS.— 

14 (1) ADVANCING AMERICAN AI ACT.—The Advanc15 ing American AI Act (Public Law 117–263; 40 

16 U.S.C. 11301 note) is amended— 

17 (A) in section 7223(3), by striking the pe18 riod and inserting ‘‘and in section 5002 of the 

19 National Artificial Intelligence Initiative Act of 

20 2020 (15 U.S.C. 9401).’’; and 

21 (B) in section 7225, by striking subsection 

22 (d). 

23 (2) EXECUTIVE ORDER 13960.—The provisions of 

24 section 5 of Executive Order 13960 (85 Fed. Reg. 

25 78939; relating to promoting the use of trustworthy 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
106 

•S 4495 RS

1 artificial intelligence in Federal Government) that ex2 empt classified and sensitive use cases from agency 

3 inventories of artificial intelligence use cases shall 

4 cease to have legal effect. 

5 (b) DISCLOSURE.— 

6 (1) IN GENERAL.—The artificial intelligence in7 ventory of each agency shall publicly disclose, subject 

8 to applicable laws and policies relating to the protec9 tion of privacy and classified and sensitive informa10 tion— 

11 (A) whether artificial intelligence was devel12 oped internally by the agency or procured exter13 nally, without excluding any use case on basis 

14 that the use case is ‘‘sensitive’’ solely because it 

15 was externally procured; 

16 (B) data provenance information for high 

17 risk artificial intelligence use cases to identify 

18 the types of sources of the training data of the 

19 artificial intelligence, including internal govern20 ment data, public data, commercially held data, 

21 or similar data; 

22 (C) the level of risk at which the agency has 

23 classified the artificial intelligence use case and 

24 a brief explanation for how the determination 

25 was made; and 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
107 

•S 4495 RS

1 (D) the number of artificial intelligence use 

2 cases excluded from public reporting as being 

3 classified or ‘‘sensitive’’, and an unclassified 

4 summary of each of these use cases. 

5 (2) UPDATES.— 

6 (A) IN GENERAL.—When an agency updates 

7 the public artificial intelligence use case inven8 tory of the agency, the agency shall disclose the 

9 date of the modification and make change logs 

10 publicly available and accessible. 

11 (B) GUIDANCE.—The Director shall issue 

12 guidance to agencies that describes how to appro13 priately update artificial intelligence use case 

14 inventories and clarifies how sub-agencies and 

15 regulatory agencies should participate in the ar16 tificial intelligence use case inventorying process. 

17 (c) CONGRESSIONAL REPORTING.—The head of each 

18 agency shall, upon request, submit to the relevant congres19 sional committees a copy of the annual artificial intel20 ligence use case inventory of the agency, including— 

21 (1) the use cases that have been identified as 

22 ‘‘sensitive’’ and not for public disclosure; and 

23 (2) a classified annex of classified use cases. 

24 (d) COMPTROLLER GENERAL.— 

25 (1) REPORTS REQUIRED.— 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
108 

•S 4495 RS

1 (A) APPROPRIATE CLASSIFICATION.—Not 

2 later than 1 year after the date of enactment of 

3 this Act, and annually thereafter for a period of 

4 5 years, the Comptroller General of the United 

5 States shall submit to relevant congressional 

6 committees a report on whether agencies are ap7 propriately classifying use cases. 

8 (B) GOVERNMENT TRENDS.—Beginning 2 

9 years after the date of enactment of this Act, and 

10 annually thereafter, the Comptroller General of 

11 the United States, shall issue a report, based on 

12 the artificial intelligence use cases reported in 

13 use case inventories and other relevant informa14 tion, that describes trends in the use of artificial 

15 intelligence by agencies and the impact of— 

16 (i) such use on the Federal workforce 

17 and any cost savings; and 

18 (ii) this Act on Federal contractors 

19 that are small business concerns, includ20 ing— 

21 (I) small business concerns owned 

22 and controlled by service-disabled vet23 erans (as defined in section 3 of the 

24 Small Business Act (15 U.S.C. 632)); 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
109 

•S 4495 RS

1 (II) qualified HUBZone small 

2 business concerns (as defined in section 

3 31(b) of the Small Business Act (15 

4 U.S.C. 657(b)(1))); 

5 (III) socially and economically 

6 disadvantaged small business concerns 

7 (as defined in section 8(a)(4) of the 

8 Small Business Act (15 U.S.C. 

9 637(a)(4))), and 

10 (IV) small business concerns 

11 owned and controlled by women (as de12 fined in section 3 of the Small Busi13 ness Act (15 U.S.C. 632)). 

14 (2) APPROPRIATE CLASSIFICATION.—The Comp15 troller General of the United States shall determine 

16 whether the appropriate level of disclosure of artificial 

17 intelligence use cases by agencies should be included 

18 on the High Risk List of the Government Account19 ability Office. 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
Calendar No. 697 

118TH CONGRESS 

2D SESSION S. 4495 

[Report No. 118–291] 

A BILL 

To enable safe, responsible, and agile procurement, 

the Federal Government, and for other purposes. development, and use of artificial intelligence by 

DECEMBER 16, 2024 

Reported with an amendment 


kjohnson on DSK7ZCZBW3PROD with $$_JOB