II 

118TH CONGRESS 

2D SESSION S. 4495 

To enable safe, responsible, and agile procurement, development, and use 

of artificial intelligence by the Federal Government, and for other purposes. 

IN THE SENATE OF THE UNITED STATES 

JUNE 11, 2024 

Mr. PETERS (for himself and Mr. TILLIS) introduced the following bill; which 

was read twice and referred to the Committee on Homeland Security and 

Governmental Affairs 

A BILL 

To enable safe, responsible, and agile procurement, development, and use of artificial intelligence by the Federal 

Government, and for other purposes. 

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 

3 SECTION 1. SHORT TITLE. 

4 This Act may be cited as the ‘‘Promoting Responsible 

5 Evaluation and Procurement to Advance Readiness for 

6 Enterprise-wide Deployment for Artificial Intelligence 

7 Act’’ or the ‘‘PREPARED for AI Act’’. 

8 SEC. 2. DEFINITIONS. 

9 In this Act: 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
2 

•S 4495 IS

1 (1) ADVERSE INCIDENT.—The term ‘‘adverse 

2 incident’’ means any incident or malfunction of arti3 ficial intelligence that directly or indirectly leads 

4 to— 

5 (A) harm impacting rights or safety, as de6 scribed in section 7(a)(2)(D); 

7 (B) the death of an individual or damage 

8 to the health of an individual; 

9 (C) material or irreversible disruption of 

10 the management and operation of critical infra11 structure, as described in section 

12 7(a)(2)(D)(i)(II)(cc); 

13 (D) material damage to property or the en14 vironment; 

15 (E) loss of a mission-critical system or 

16 equipment; 

17 (F) failure of the mission of an agency; 

18 (G) the denial of a benefit, payment, or 

19 other service to an individual or group of indi20 viduals who would have otherwise been eligible; 

21 (H) the denial of an employment, contract, 

22 grant, or similar opportunity that would have 

23 otherwise been offered; or 

24 (I) another consequence, as determined by 

25 the Director with public notice. 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
3 

•S 4495 IS

1 (2) AGENCY.—The term ‘‘agency’’— 

2 (A) has the meaning given that term in 

3 section 3502(1) of title 44, United States Code; 

4 and 

5 (B) includes each of the independent regu6 latory agencies described in section 3502(5) of 

7 title 44, United States Code. 

8 (3) ARTIFICIAL INTELLIGENCE.—The term ‘‘ar9 tificial intelligence’’— 

10 (A) has the meaning given that term in 

11 section 5002 of the National Artificial Intel12 ligence Initiative Act of 2020 (15 U.S.C. 9401); 

13 and 

14 (B) includes the artificial systems and 

15 techniques described in paragraphs (1) through 

16 (5) of section 238(g) of the John S. McCain 

17 National Defense Authorization Act for Fiscal 

18 Year 2019 (Public Law 115–232; 10 U.S.C. 

19 4061 note prec.). 

20 (4) BIOMETRIC DATA.—The term ‘‘biometric 

21 data’’ means data resulting from specific technical 

22 processing relating to the unique physical, physio23 logical, or behavioral characteristics of an individual, 

24 including facial images, dactyloscopic data, physical 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
4 

•S 4495 IS

1 movement and gait, breath, voice, DNA, blood type, 

2 and expression of emotion, thought, or feeling. 

3 (5) COMMERCIAL TECHNOLOGY.—The term 

4 ‘‘commercial technology’’— 

5 (A) means a technology, process, or meth6 od, including research or development; and 

7 (B) includes commercial products, commer8 cial services, and other commercial items, as de9 fined in the Federal Acquisition Regulation, in10 cluding any addition or update thereto by the 

11 Federal Acquisition Regulatory Council. 

12 (6) COUNCIL.—The term ‘‘Council’’ means the 

13 Chief Artificial Intelligence Officers Council estab14 lished under section 5(a). 

15 (7) DEPLOYER.—The term ‘‘deployer’’ means 

16 an entity that operates or provides artificial intel17 ligence, whether developed internally or by a third18 party developer. 

19 (8) DEVELOPER.—The term ‘‘developer’’ means 

20 an entity that designs, codes, produces, or owns arti21 ficial intelligence. 

22 (9) DIRECTOR.—The term ‘‘Director’’ means 

23 the Director of the Office of Management and Budg24 et. 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
5 

•S 4495 IS

1 (10) IMPACT ASSESSMENT.—The term ‘‘impact 

2 assessment’’ means a structured process for consid3 ering the implications of a proposed artificial intel4 ligence use case. 

5 (11) OPERATIONAL DESIGN DOMAIN.—The 

6 term ‘‘operational design domain’’ means a set of 

7 operating conditions for an automated system. 

8 (12) PROCURE OR OBTAIN.—The term ‘‘procure 

9 or obtain’’ means— 

10 (A) to acquire through contract actions 

11 awarded pursuant to the Federal Acquisition 

12 Regulation, including through interagency 

13 agreements, multi-agency use, and purchase 

14 card transactions; 

15 (B) to acquire through contracts and 

16 agreements awarded through other special pro17 curement authorities, including through other 

18 transactions and commercial solutions opening 

19 authorities; or 

20 (C) to obtain through other means, includ21 ing through open source platforms or freeware. 

22 (13) RELEVANT CONGRESSIONAL COMMIT23 TEES.—The term ‘‘relevant congressional commit24 tees’’ means the Committee on Homeland Security 

25 and Governmental Affairs of the Senate and the 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
6 

•S 4495 IS

1 Committee on Oversight and Accountability of the 

2 House of Representatives. 

3 (14) RISK.—The term ‘‘risk’’ means the com4 bination of the probability of an occurrence of harm 

5 and the potential severity of that harm. 

6 (15) USE CASE.—The term ‘‘use case’’ means 

7 the ways and context in which artificial intelligence 

8 is operated to perform a specific function. 

9 SEC. 3. IMPLEMENTATION OF REQUIREMENTS. 

10 (a) AGENCY IMPLEMENTATION.—Not later than 1 

11 year after the date of enactment of this Act, the Director 

12 shall ensure that agencies have implemented the require13 ments of this Act. 

14 (b) ANNUAL BRIEFING.—Not later than 180 days 

15 after the date of enactment of this Act, and annually 

16 thereafter, the Director shall brief the appropriate Con17 gressional committees on implementation of this Act and 

18 related considerations. 

19 SEC. 4. PROCUREMENT OF ARTIFICIAL INTELLIGENCE. 

20 (a) GOVERNMENT-WIDE REQUIREMENTS.— 

21 (1) IN GENERAL.—Not later than 1 year after 

22 the date of enactment of this Act, the Federal Ac23 quisition Regulatory Council shall review Federal 

24 Acquisition Regulation acquisition planning, source 

25 selection, and other requirements and update the 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
7 

•S 4495 IS

1 Federal Acquisition Regulation as needed to ensure 

2 that agency procurement of artificial intelligence in3 cludes— 

4 (A) a requirement to address the outcomes 

5 of the risk evaluation and impact assessments 

6 required under section 8(a); 

7 (B) a requirement for consultation with an 

8 interdisciplinary team of agency experts prior 

9 to, and throughout, as necessary, procuring or 

10 obtaining artificial intelligence; and 

11 (C) any other considerations determined 

12 relevant by the Federal Acquisition Regulatory 

13 Council. 

14 (2) INTERDISCIPLINARY TEAM OF EXPERTS.— 

15 The interdisciplinary team of experts described in 

16 paragraph (1)(B) may— 

17 (A) vary depending on the use case and 

18 the risks determined to be associated with the 

19 use case; and 

20 (B) include technologists, information se21 curity personnel, domain experts, privacy offi22 cers, data officers, civil rights and civil liberties 

23 officers, contracting officials, legal counsel, cus24 tomer experience professionals, and others. 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
8 

•S 4495 IS

1 (3) ACQUISITION PLANNING.—The acquisition 

2 planning updates described in paragraph (1) shall 

3 include considerations for, at minimum, as appro4 priate depending on the use case— 

5 (A) data ownership and privacy; 

6 (B) data information security; 

7 (C) interoperability requirements; 

8 (D) data and model assessment processes; 

9 (E) scope of use; 

10 (F) ongoing monitoring techniques; 

11 (G) type and scope of artificial intelligence 

12 audits; 

13 (H) environmental impact; and 

14 (I) safety and security risk mitigation tech15 niques, including a plan for how adverse event 

16 reporting can be incorporated, pursuant to sec17 tion 5(g). 

18 (b) REQUIREMENTS FOR HIGH RISK USE CASES.— 

19 (1) IN GENERAL.— 

20 (A) ESTABLISHMENT.—Beginning on the 

21 date that is 1 year after the date of enactment 

22 of this Act, the head of an agency may not pro23 cure or obtain artificial intelligence for a high 

24 risk use case, as defined in section 7(a)(2)(D), 

25 prior to establishing and incorporating certain 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
9 

•S 4495 IS

1 terms into relevant contracts, agreements, and 

2 employee guidelines for artificial intelligence, in3 cluding— 

4 (i) a requirement that the use of the 

5 artificial intelligence be limited to its oper6 ational design domain; 

7 (ii) requirements for safety, security, 

8 and trustworthiness, including— 

9 (I) a reporting mechanism 

10 through which agency personnel are 

11 notified by the deployer of any ad12 verse incident; 

13 (II) a requirement, in accordance 

14 with section 5(g), that agency per15 sonnel receive from the deployer a no16 tification of any adverse incident, an 

17 explanation of the cause of the ad18 verse incident, and any data directly 

19 connected to the adverse incident in 

20 order to address and mitigate the 

21 harm; and 

22 (III) that the agency has the 

23 right to temporarily or permanently 

24 suspend use of the artificial intel25 ligence if— 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
10 

•S 4495 IS

1 (aa) the risks of the artifi2 cial intelligence to rights or safe3 ty become unacceptable, as deter4 mined under the agency risk clas5 sification system pursuant to sec6 tion 7; or 

7 (bb) on or after the date 

8 that is 180 days after the publi9 cation of the most recently up10 dated version of the framework 

11 developed and updated pursuant 

12 to section 22(A)(c) of the Na13 tional Institute of Standards and 

14 Technology Act (15 U.S.C. 

15 278h–1(c)), the deployer is found 

16 not to comply with such most re17 cent update; 

18 (iii) requirements for quality, rel19 evance, sourcing and ownership of data, as 

20 appropriate by use case, and applicable un21 less the head of the agency waives such re22 quirements in writing, including— 

23 (I) retention of rights to Govern24 ment data and any modification to the 

25 data including to protect the data 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
11 

•S 4495 IS

1 from unauthorized disclosure and use 

2 to subsequently train or improve the 

3 functionality of commercial products 

4 offered by the deployer, any relevant 

5 developers, or others; and 

6 (II) a requirement that the 

7 deployer and any relevant developers 

8 or other parties isolate Government 

9 data from all other data, through 

10 physical separation, electronic separa11 tion via secure copies with strict ac12 cess controls, or other computational 

13 isolation mechanisms; 

14 (iv) requirements for evaluation and 

15 testing of artificial intelligence based on 

16 use case, to be performed on an ongoing 

17 basis; and 

18 (v) requirements that the deployer 

19 and any relevant developers provide docu20 mentation, as determined necessary and 

21 requested by the agency, in accordance 

22 with section 8(b). 

23 (B) REVIEW.—The Senior Procurement 

24 Executive, in coordination with the Chief Artifi25 cial Intelligence Officer, shall consult with techVerDate Sep 11 2014 00:25 Jul 13, 2024 Jkt 049200 PO 00000 Frm 00011 Fmt 6652 Sfmt 6201 E:\BILLS\S4495.IS S4495

kjohnson on DSK7ZCZBW3PROD with $$_JOB
12 

•S 4495 IS

1 nologists, information security personnel, do2 main experts, privacy officers, data officers, 

3 civil rights and civil liberties officers, con4 tracting officials, legal counsel, customer experi5 ence professionals, and other relevant agency 

6 officials to review the requirements described in 

7 clauses (i) through (v) of subparagraph (A) and 

8 determine whether it may be necessary to incor9 porate additional requirements into relevant 

10 contracts or agreements. 

11 (C) REGULATION.—The Federal Acquisi12 tion Regulatory Council shall revise the Federal 

13 Acquisition Regulation as necessary to imple14 ment the requirements of this subsection. 

15 (2) RULES OF CONSTRUCTION.—This Act shall 

16 supersede any requirements that conflict with this 

17 Act under the guidance required to be produced by 

18 the Director pursuant to section 7224(d) of the Ad19 vancing American AI Act (40 U.S.C. 11301 note). 

20 SEC. 5. INTERAGENCY GOVERNANCE OF ARTIFICIAL INTEL21 LIGENCE. 

22 (a) CHIEF ARTIFICIAL INTELLIGENCE OFFICERS

23 COUNCIL.—Not later than 60 days after the date of enact24 ment of this Act, the Director shall establish a Chief Arti25 ficial Intelligence Officers Council. 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
13 

•S 4495 IS

1 (b) DUTIES.—The duties of the Council shall in2 clude— 

3 (1) coordinating agency development and use of 

4 artificial intelligence in agency programs and oper5 ations, including practices relating to the design, op6 eration, risk management, and performance of artifi7 cial intelligence; 

8 (2) sharing experiences, ideas, best practices, 

9 and innovative approaches relating to artificial intel10 ligence; and 

11 (3) assisting the Director, as necessary, with re12 spect to— 

13 (A) the identification, development, and co14 ordination of multi-agency projects and other 

15 initiatives, including initiatives to improve Gov16 ernment performance; 

17 (B) the management of risks relating to 

18 developing, obtaining, or using artificial intel19 ligence, including by developing a common tem20 plate to guide agency Chief Artificial Intel21 ligence Officers in implementing a risk classi22 fication system that may incorporate best prac23 tices, such as those from— 

24 (i) the most recently updated version 

25 of the framework developed and updated 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
14 

•S 4495 IS

1 pursuant to section 22A(c) of the National 

2 Institute of Standards and Technology Act 

3 (15 U.S.C. 278h–1(c)); and 

4 (ii) the report published by the Gov5 ernment Accountability Office entitled ‘‘Ar6 tificial Intelligence: An Accountability 

7 Framework for Federal Agencies and 

8 Other Entities’’ (GAO–21–519SP), pub9 lished on June 30, 2021; 

10 (C) promoting the development and use of 

11 efficient, effective, common, shared, or other 

12 approaches to key processes that improve the 

13 delivery of services for the public; and 

14 (D) soliciting and providing perspectives 

15 on matters of concern, including from and to— 

16 (i) interagency councils; 

17 (ii) Federal Government entities; 

18 (iii) private sector, public sector, non19 profit, and academic experts; 

20 (iv) State, local, Tribal, territorial, 

21 and international governments; and 

22 (v) other individuals and entities, as 

23 determined relevant by the Council. 

24 (c) MEMBERSHIP OF THE COUNCIL.— 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
15 

•S 4495 IS

1 (1) CO-CHAIRS.—The Council shall have 2 co2 chairs, which shall be— 

3 (A) the Director; and 

4 (B) an individual selected by a majority of 

5 the members of the Council. 

6 (2) MEMBERS.—Other members of the Council 

7 shall include— 

8 (A) the Chief Artificial Intelligence Officer 

9 of each agency; and 

10 (B) the senior official for artificial intel11 ligence of the Office of Management and Budg12 et. 

13 (d) STANDING COMMITTEES; WORKING GROUPS.— 

14 The Council shall have the authority to establish standing 

15 committees, including an executive committee, and work16 ing groups. 

17 (e) COUNCIL STAFF.—The Council may enter into an 

18 interagency agreement with the Administrator of General 

19 Services for shared services for the purpose of staffing the 

20 Council. 

21 (f) DEVELOPMENT, ADAPTATION, AND DOCUMENTA22 TION.— 

23 (1) GUIDANCE.—Not later than 90 days after 

24 the date of enactment of this Act, the Director, in 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
16 

•S 4495 IS

1 consultation with the Council, shall issue guidance 

2 relating to— 

3 (A) developments in artificial intelligence 

4 and implications for management of agency 

5 programs; 

6 (B) the agency impact assessments de7 scribed in section 8(a) and other relevant im8 pact assessments as determined appropriate by 

9 the Director, including the appropriateness of 

10 substituting pre-existing assessments, including 

11 privacy impact assessments, for purposes of an 

12 artificial intelligence impact assessment; 

13 (C) documentation for agencies to require 

14 from deployers of artificial intelligence; 

15 (D) a model template for the explanations 

16 for use case risk classifications that each agen17 cy must provide under section 8(a)(4); and 

18 (E) other matters, as determined relevant 

19 by the Director. 

20 (2) ANNUAL REVIEW.—The Director, in con21 sultation with the Council, shall periodically, but not 

22 less frequently than annually, review and update, as 

23 needed, the guidelines issued under paragraph (1). 

24 (g) INCIDENT REPORTING.— 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
17 

•S 4495 IS

1 (1) IN GENERAL.—Not later than 180 days 

2 after the date of enactment of this Act, the Director, 

3 in consultation with the Council, shall develop proce4 dures for ensuring that— 

5 (A) adverse incidents involving artificial in6 telligence procured, obtained, or used by agen7 cies are reported promptly to the agency by the 

8 developer or deployer, or to the developer or 

9 deployer by the agency, whichever first becomes 

10 aware of the adverse incident; and 

11 (B) information relating to an adverse inci12 dent described in subparagraph (A) is appro13 priately shared among agencies. 

14 (2) SINGLE REPORT.—Adverse incidents also 

15 qualifying for incident reporting under section 3554 

16 of title 44, United States Code, or other relevant 

17 laws or policies, may be reported under such other 

18 reporting requirement and are not required to be ad19 ditionally reported under this subsection. 

20 (3) NOTICE TO DEPLOYER.— 

21 (A) IN GENERAL.—If an adverse incident 

22 is discovered by an agency, the agency shall re23 port the adverse incident to the deployer and 

24 the deployer, in consultation with any relevant 

25 developers, shall take immediate action to reVerDate Sep 11 2014 00:25 Jul 13, 2024 Jkt 049200 PO 00000 Frm 00017 Fmt 6652 Sfmt 6201 E:\BILLS\S4495.IS S4495

kjohnson on DSK7ZCZBW3PROD with $$_JOB
18 

•S 4495 IS

1 solve the adverse incident and mitigate the po2 tential for future adverse incidents. 

3 (B) WAIVER.— 

4 (i) IN GENERAL.—Unless otherwise 

5 required by law, the head of an agency 

6 may issue a written waiver that waives the 

7 applicability of some or all of the require8 ments under subparagraph (A), with re9 spect to a specific adverse incident. 

10 (ii) WRITTEN WAIVER CONTENTS.—A 

11 written waiver under clause (i) shall in12 clude justification for the waiver. 

13 (iii) NOTICE.—The head of an agency 

14 shall forward advance notice of any waiver 

15 under this subparagraph to the Director, 

16 or the designee of the Director. 

17 SEC. 6. AGENCY GOVERNANCE OF ARTIFICIAL INTEL18 LIGENCE. 

19 (a) IN GENERAL.—The head of an agency shall— 

20 (1) ensure the responsible adoption of artificial 

21 intelligence, including by— 

22 (A) articulating a clear vision of what the 

23 head of the agency wants to achieve by devel24 oping, procuring or obtaining, or using artificial 

25 intelligence; 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
19 

•S 4495 IS

1 (B) ensuring the agency develops, pro2 cures, obtains, or uses artificial intelligence that 

3 follows the principles of trustworthy artificial 

4 intelligence in government set forth under Exec5 utive Order 13960 (85 Fed. Reg. 78939; relat6 ing to promoting the use of trustworthy artifi7 cial intelligence in Federal Government) and 

8 the principles for safe, secure, and trustworthy 

9 artificial intelligence in government set forth 

10 under section 2 of Executive Order 14110 (88 

11 Fed. Reg. 75191; relating to the safe, secure, 

12 and trustworthy development and use of artifi13 cial intelligence); 

14 (C) testing, validating, and monitoring ar15 tificial intelligence and the use case-specific per16 formance of artificial intelligence, among oth17 ers, to— 

18 (i) ensure all use of artificial intel19 ligence is appropriate to and improves the 

20 effectiveness of the mission of the agency; 

21 (ii) guard against bias in data collec22 tion, use, and dissemination; 

23 (iii) ensure reliability, fairness, and 

24 transparency; and 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
20 

•S 4495 IS

1 (iv) protect against impermissible dis2 crimination; 

3 (D) developing, adopting, and applying a 

4 suitable enterprise risk management framework 

5 approach to artificial intelligence, incorporating 

6 the requirements under this Act; 

7 (E) continuing to develop a workforce 

8 that— 

9 (i) understands the strengths and 

10 weaknesses of artificial intelligence, includ11 ing artificial intelligence embedded in 

12 agency data systems and operations; 

13 (ii) is aware of the benefits and risk 

14 of artificial intelligence; 

15 (iii) is able to provide human over16 sight for the design, implementation, and 

17 end uses of artificial intelligence; and 

18 (iv) is able to review and provide re19 dress for erroneous decisions made in the 

20 course of artificial intelligence-assisted 

21 processes; and 

22 (F) ensuring implementation of the re23 quirements under section 8(a) for the identifica24 tion and evaluation of risks posed by the deVerDate Sep 11 2014 00:25 Jul 13, 2024 Jkt 049200 PO 00000 Frm 00020 Fmt 6652 Sfmt 6201 E:\BILLS\S4495.IS S4495

kjohnson on DSK7ZCZBW3PROD with $$_JOB
21 

•S 4495 IS

1 ployment of artificial intelligence in agency use 

2 cases; 

3 (2) designate a Chief Artificial Intelligence Offi4 cer, whose duties shall include— 

5 (A) ensuring appropriate use of artificial 

6 intelligence; 

7 (B) coordinating agency use of artificial in8 telligence; 

9 (C) promoting artificial intelligence innova10 tion; 

11 (D) managing the risks of use of artificial 

12 intelligence; 

13 (E) supporting the head of the agency with 

14 developing the risk classification system re15 quired under section 7(a) and complying with 

16 other requirements of this Act; and 

17 (F) supporting agency personnel leading 

18 the procurement and deployment of artificial in19 telligence to comply with the requirements 

20 under this Act; and 

21 (3) form and convene an Artificial Intelligence 

22 Governance Board, as described in subsection (b), 

23 which shall coordinate and govern artificial intel24 ligence issues across the agency. 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
22 

•S 4495 IS

1 (b) ARTIFICIAL INTELLIGENCE GOVERNANCE

2 BOARD.— 

3 (1) LEADERSHIP.—Each Artificial Intelligence 

4 Governance Board (referred to in this subsection as 

5 ‘‘Board’’) of an agency shall be chaired by the Dep6 uty Secretary of the agency or equivalent official and 

7 vice-chaired by the Chief Artificial Intelligence Offi8 cer of the agency. Neither the chair nor the vice9 chair may assign or delegate these roles to other of10 ficials. 

11 (2) REPRESENTATION.—The Board shall, at a 

12 minimum, include representatives comprised of sen13 ior agency officials from operational components, if 

14 relevant, program officials responsible for imple15 menting artificial intelligence, and officials respon16 sible for information technology, data, privacy, civil 

17 rights and civil liberties, human capital, procure18 ment, finance, legal counsel, and customer experi19 ence. 

20 (3) EXISTING BODIES.—An agency may rely on 

21 an existing governance body to fulfill the require22 ments of this subsection if the body satisfies or is 

23 adjusted to satisfy the leadership and representation 

24 requirements of paragraphs (1) and (2). 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
23 

•S 4495 IS

1 (c) DESIGNATION OF CHIEF ARTIFICIAL INTEL2 LIGENCE OFFICER.—The head of an agency may des3 ignate as Chief Artificial Intelligence Officer an existing 

4 official within the agency, including the Chief Technology 

5 Officer, Chief Data Officer, Chief Information Officer, or 

6 other official with relevant or complementary authorities 

7 and responsibilities, if such existing official has expertise 

8 in artificial intelligence and meets the requirements of this 

9 section. 

10 (d) EFFECTIVE DATE.—Beginning on the date that 

11 is 120 days after the date of enactment of this Act, an 

12 agency shall not develop or procure or obtain artificial in13 telligence prior to completing the requirements under 

14 paragraphs (2) and (3) of subsection (a). 

15 SEC. 7. AGENCY RISK CLASSIFICATION OF ARTIFICIAL IN16 TELLIGENCE USE CASES FOR PROCUREMENT 

17 AND USE. 

18 (a) RISK CLASSIFICATION SYSTEM.— 

19 (1) DEVELOPMENT.—The head of each agency 

20 shall be responsible for developing, not later than 1 

21 year after the date of enactment of this Act, a risk 

22 classification system for agency use cases of artifi23 cial intelligence, without respect to whether artificial 

24 intelligence is embedded in a commercial product. 

25 (2) REQUIREMENTS.— 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
24 

•S 4495 IS

1 (A) RISK CLASSIFICATIONS.—The risk 

2 classification system under paragraph (1) shall, 

3 at a minimum, include unacceptable, high, me4 dium, and low risk classifications. 

5 (B) FACTORS FOR RISK CLASSIFICA6 TIONS.—In developing the risk classifications 

7 under subparagraph (A), the head of the agency 

8 shall consider the following: 

9 (i) MISSION AND OPERATION.—The 

10 mission and operations of the agency. 

11 (ii) SCALE.—The seriousness and 

12 probability of adverse impacts. 

13 (iii) SCOPE.—The breadth of applica14 tion, such as the number of individuals af15 fected. 

16 (iv) OPTIONALITY.—The degree of 

17 choice that an individual, group, or entity 

18 has as to whether to be subject to the ef19 fects of artificial intelligence. 

20 (v) STANDARDS AND FRAMEWORKS.— 

21 Standards and frameworks for risk classi22 fication of use cases that support demo23 cratic values, such as the standards and 

24 frameworks developed by the National In25 stitute of Standards and Technology, the 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
25 

•S 4495 IS

1 International Standards Organization, and 

2 the Institute of Electrical and Electronics 

3 Engineers. 

4 (C) CLASSIFICATION VARIANCE.— 

5 (i) CERTAIN LOWER RISK USE

6 CASES.—The risk classification system 

7 may allow for an operational use case to be 

8 categorized under a lower risk classifica9 tion, even if the use case is a part of a 

10 larger area of the mission of the agency 

11 that is categorized under a higher risk 

12 classification. 

13 (ii) CHANGES BASED ON TESTING OR

14 NEW INFORMATION.—The risk classifica15 tion system may allow for changes to the 

16 risk classification of an artificial intel17 ligence use case based on the results from 

18 procurement process testing or other infor19 mation that becomes available. 

20 (D) HIGH RISK USE CASES.— 

21 (i) IN GENERAL.—High risk classi22 fication shall, at a minimum, apply to use 

23 cases for which the outputs of the sys24 tem— 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
26 

•S 4495 IS

1 (I) are presumed to serve as a 

2 principal basis for a decision or action 

3 that has a legal, material, binding, or 

4 similarly significant effect, with re5 spect to an individual or community, 

6 on— 

7 (aa) civil rights, civil lib8 erties, or privacy; 

9 (bb) equal opportunities, in10 cluding in access to education, 

11 housing, insurance, credit, em12 ployment, and other programs 

13 where civil rights and equal op14 portunity protections apply; or 

15 (cc) access to or the ability 

16 to apply for critical government 

17 resources or services, including 

18 healthcare, financial services, 

19 public housing, social services, 

20 transportation, and essential 

21 goods and services; or 

22 (II) are presumed to serve as a 

23 principal basis for a decision that sub24 stantially impacts the safety of, or has 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
27 

•S 4495 IS

1 the potential to substantially impact 

2 the safety of— 

3 (aa) the well-being of an in4 dividual or community, including 

5 loss of life, serious injury, bodily 

6 harm, biological or chemical 

7 harms, occupational hazards, 

8 harassment or abuse, or mental 

9 health; 

10 (bb) the environment, in11 cluding irreversible or significant 

12 environmental damage; 

13 (cc) critical infrastructure, 

14 including the critical infrastruc15 ture sectors defined in Presi16 dential Policy Directive 21, enti17 tled ‘‘Critical Infrastructure Se18 curity and Resilience’’ (dated 

19 February 12, 2013) (or any suc20 cessor directive) and the infra21 structure for voting and pro22 tecting the integrity of elections; 

23 or 

24 (dd) strategic assets or re25 sources, including high-value 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
28 

•S 4495 IS

1 property and information marked 

2 as sensitive or classified by the 

3 Federal Government and con4 trolled unclassified information. 

5 (ii) ADDITIONS.—The head of each 

6 agency shall add other use cases to the 

7 high risk category, as appropriate. 

8 (E) MEDIUM AND LOW RISK USE CASES.— 

9 If a use case is not high risk, as described in 

10 subparagraph (D), the head of an agency shall 

11 have the discretion to define the risk classifica12 tion. 

13 (F) UNACCEPTABLE RISK.—If an agency 

14 identifies, through testing, adverse incident, or 

15 other means or information available to the 

16 agency, that a use or outcome of an artificial 

17 intelligence use case is a clear threat to human 

18 safety or rights that cannot be adequately or 

19 practicably mitigated, the agency shall identify 

20 the risk classification of that use case as unac21 ceptable risk. 

22 (3) TRANSPARENCY.—The risk classification 

23 system under paragraph (1) shall be published on a 

24 public-facing website, with the methodology used to 

25 determine different risk levels and examples of parVerDate Sep 11 2014 00:25 Jul 13, 2024 Jkt 049200 PO 00000 Frm 00028 Fmt 6652 Sfmt 6201 E:\BILLS\S4495.IS S4495

kjohnson on DSK7ZCZBW3PROD with $$_JOB
29 

•S 4495 IS

1 ticular use cases for each category in language that 

2 is easy to understand to the people affected by the 

3 decisions and outcomes of artificial intelligence. 

4 (b) EFFECTIVE DATE.—This section shall take effect 

5 on the date that is 180 days after the date of enactment 

6 of this Act, on and after which an agency that has not 

7 complied with the requirements of this section may not 

8 develop, procure or obtain, or use artificial intelligence 

9 until the agency complies with such requirements. 

10 SEC. 8. AGENCY REQUIREMENTS FOR USE OF ARTIFICIAL 

11 INTELLIGENCE. 

12 (a) RISK EVALUATION PROCESS.— 

13 (1) IN GENERAL.—Not later than 180 days 

14 after the effective date in section 7(b), the Chief Ar15 tificial Intelligence Officer of each agency, in coordi16 nation with the Artificial Intelligence Governance 

17 Board of the agency, shall develop and implement a 

18 process for the identification and evaluation of risks 

19 posed by the deployment of artificial intelligence in 

20 agency use cases to ensure an interdisciplinary and 

21 comprehensive evaluation of potential risks and de22 termination of risk classifications under such sec23 tion. 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
30 

•S 4495 IS

1 (2) PROCESS REQUIREMENTS.—The risk eval2 uation process described in paragraph (1), shall in3 clude, for each artificial intelligence use case— 

4 (A) identification of the risks and benefits 

5 of the artificial intelligence use case; 

6 (B) a plan to periodically review the artifi7 cial intelligence use case to examine whether 

8 risks have changed or evolved and to update the 

9 corresponding risk classification as necessary; 

10 (C) a determination of the need for tar11 geted impact assessments to further evaluate 

12 specific risks of the artificial intelligence use 

13 case within certain impact areas, which shall in14 clude privacy, security, civil rights and civil lib15 erties, accessibility, environmental impact, 

16 health and safety, and any other impact area 

17 relating to high risk classification under section 

18 7(a)(2)(D) as determined appropriate by the 

19 Chief Artificial Intelligence Officer; and 

20 (D) if appropriate, consultation with and 

21 feedback from affected communities and the 

22 public on the design, development, and use of 

23 the artificial intelligence use case. 

24 (3) REVIEW.— 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
31 

•S 4495 IS

1 (A) EXISTING USE CASES.—With respect 

2 to each use case that an agency is planning, de3 veloping, or using on the date of enactment of 

4 this Act, not later than 1 year after such date, 

5 the Chief Artificial Intelligence Officer of the 

6 agency shall identify and review the use case to 

7 determine the risk classification of the use case, 

8 pursuant to the risk evaluation process under 

9 paragraphs (1) and (2). 

10 (B) NEW USE CASES.— 

11 (i) IN GENERAL.—Beginning on the 

12 date of enactment of this Act, the Chief 

13 Artificial Intelligence Officer of an agency 

14 shall identify and review any artificial in15 telligence use case that the agency will 

16 plan, develop, or use and determine the 

17 risk classification of the use case, pursuant 

18 to the risk evaluation process under para19 graphs (1) and (2), before procuring or ob20 taining, developing, or using the use case. 

21 (ii) DEVELOPMENT.—For any use 

22 case described in clause (i) that is devel23 oped by the agency, the agency shall per24 form an additional risk evaluation prior to 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
32 

•S 4495 IS

1 deployment in a production or operational 

2 environment. 

3 (4) RATIONALE FOR RISK CLASSIFICATION.— 

4 Risk classification of an artificial intelligence use 

5 case shall be accompanied by an explanation from 

6 the agency of how the risk classification was deter7 mined, which shall be included in the artificial intel8 ligence use case inventory of the agency, and written 

9 referencing the model template developed by the Di10 rector under section 5(f)(1)(D). 

11 (b) MODEL CARD DOCUMENTATION REQUIRE12 MENTS.— 

13 (1) IN GENERAL.—Beginning on the date that 

14 is 180 days after the date of enactment of this Act, 

15 any time during developing, procuring or obtaining, 

16 or using artificial intelligence, an agency shall re17 quire, as determined necessary by the Chief Artifi18 cial Intelligence Officer, that the deployer and any 

19 relevant developer submit documentation about the 

20 artificial intelligence, including— 

21 (A) a description of the architecture of the 

22 artificial intelligence, highlighting key param23 eters, design choices, and the machine learning 

24 techniques employed; 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
33 

•S 4495 IS

1 (B) information on the training of the arti2 ficial intelligence, including computational re3 sources utilized; 

4 (C) an account of the source of the data, 

5 size of the data, any licenses under which the 

6 data is used, collection methods and dates of 

7 the data, and any preprocessing of the data un8 dertaken, including human or automated refine9 ment, review, or feedback; 

10 (D) information on the management and 

11 collection of personal data, outlining data pro12 tection and privacy measures adhered to in 

13 compliance with applicable laws; 

14 (E) a description of the methodologies 

15 used to evaluate the performance of the artifi16 cial intelligence, including key metrics and out17 comes; and 

18 (F) an estimate of the energy consumed by 

19 the artificial intelligence during training and in20 ference. 

21 (2) ADDITIONAL DOCUMENTATION FOR MEDIUM

22 AND HIGH RISK USE CASES.—Beginning on the date 

23 that is 270 days after the date of enactment of this 

24 Act, with respect to use cases categorized as medium 

25 risk or higher, an agency shall require that the 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
34 

•S 4495 IS

1 deployer of artificial intelligence, in consultation 

2 with any relevant developers, submit (including 

3 proactively, as material updates of the artificial in4 telligence occur) the following documentation: 

5 (A) MODEL ARCHITECTURE.—Detailed in6 formation on the model or models used in the 

7 artificial intelligence, including model date, 

8 model version, model type, key parameters (in9 cluding number of parameters), interpretability 

10 measures, and maintenance and updating poli11 cies. 

12 (B) ADVANCED TRAINING DETAILS.—A de13 tailed description of training algorithms, meth14 odologies, optimization techniques, computa15 tional resources, and the environmental impact 

16 of the training process. 

17 (C) DATA PROVENANCE AND INTEGRITY.— 

18 A detailed description of the training and test19 ing data, including the origins, collection meth20 ods, preprocessing steps, and demographic dis21 tribution of the data, and known discriminatory 

22 impacts and mitigation measures with respect 

23 to the data. 

24 (D) PRIVACY AND DATA PROTECTION.— 

25 Detailed information on data handling pracVerDate Sep 11 2014 00:25 Jul 13, 2024 Jkt 049200 PO 00000 Frm 00034 Fmt 6652 Sfmt 6201 E:\BILLS\S4495.IS S4495

kjohnson on DSK7ZCZBW3PROD with $$_JOB
35 

•S 4495 IS

1 tices, including compliance with legal standards, 

2 anonymization techniques, data security meas3 ures, and whether and how permission for use 

4 of data is obtained. 

5 (E) RIGOROUS TESTING AND OVER6 SIGHT.—A comprehensive disclosure of per7 formance evaluation metrics, including accu8 racy, precision, recall, and fairness metrics, and 

9 test dataset results. 

10 (F) NIST ARTIFICIAL INTELLIGENCE RISK

11 MANAGEMENT FRAMEWORK.—Documentation 

12 demonstrating compliance with the most re13 cently updated version of the framework devel14 oped and updated pursuant to section 22A(c) of 

15 the National Institute of Standards and Tech16 nology Act (15 U.S.C. 278h–1(c)). 

17 (3) REVIEW OF REQUIREMENTS.—Not later 

18 than 1 year after the date of enactment of this Act, 

19 the Comptroller General shall conduct a review of 

20 the documentation requirements under paragraphs 

21 (1) and (2) to— 

22 (A) examine whether agencies and 

23 deployers are complying with the requirements 

24 under those paragraphs; and 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
36 

•S 4495 IS

1 (B) make findings and recommendations to 

2 further assist in ensuring safe, responsible, and 

3 efficient artificial intelligence. 

4 (4) SECURITY OF PROVIDED DOCUMENTA5 TION.—The head of each agency shall ensure that 

6 appropriate security measures and access controls 

7 are in place to protect documentation provided pur8 suant to this section. 

9 (c) INFORMATION AND USE PROTECTIONS.—Infor10 mation provided to an agency under subsection (b)(3) is 

11 exempt from disclosure under section 552 of title 5, 

12 United States Code (commonly known as the ‘‘Freedom 

13 of Information Act’’) and may be used by the agency, con14 sistent with otherwise applicable provisions of Federal law, 

15 solely for— 

16 (1) assessing the ability of artificial intelligence 

17 to achieve the requirements and objectives of the 

18 agency and the requirements of this Act; and 

19 (2) identifying— 

20 (A) adverse effects of artificial intelligence 

21 on the rights or safety factors identified in sec22 tion 7(a)(2)(D); 

23 (B) cyber threats, including the sources of 

24 the cyber threats; and 

25 (C) security vulnerabilities. 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
37 

•S 4495 IS

1 (d) PRE-DEPLOYMENT REQUIREMENTS FOR HIGH

2 RISK USE CASES.—Beginning on the date that is 1 year 

3 after the date of enactment of this Act, the head of an 

4 agency shall not deploy or use artificial intelligence for a 

5 high risk use case prior to— 

6 (1) collecting documentation of the artificial in7 telligence, source, and use case in agency software 

8 and use case inventories; 

9 (2) testing of the artificial intelligence in an 

10 operational, real-world setting with privacy, civil 

11 rights, and civil liberty safeguards to ensure the ar12 tificial intelligence is capable of meeting its objec13 tives; 

14 (3) establishing appropriate agency rules of be15 havior for the use case, including required human 

16 involvement in, and user-facing explainability of, de17 cisions made in whole or part by the artificial intel18 ligence, as determined by the Chief Artificial Intel19 ligence Officer in coordination with the program 

20 manager or equivalent agency personnel; and 

21 (4) establishing appropriate agency training 

22 programs, including documentation of completion of 

23 training prior to use of artificial intelligence, that 

24 educate agency personnel involved with the applica25 tion of artificial intelligence in high risk use cases on 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
38 

•S 4495 IS

1 the capacities and limitations of artificial intel2 ligence, including training on— 

3 (A) monitoring the operation of artificial 

4 intelligence in high risk use cases to detect and 

5 address anomalies, dysfunctions, and unex6 pected performance in a timely manner to miti7 gate harm; 

8 (B) lessening reliance or over-reliance on 

9 the output produced by artificial intelligence in 

10 a high risk use case, particularly if artificial in11 telligence is used to make decisions impacting 

12 individuals; 

13 (C) accurately interpreting the output of 

14 artificial intelligence, particularly considering 

15 the characteristics of the system and the inter16 pretation tools and methods available; 

17 (D) when to not use, disregard, override, 

18 or reverse the output of artificial intelligence; 

19 (E) how to intervene or interrupt the oper20 ation of artificial intelligence; 

21 (F) limiting the use of artificial intelligence 

22 to its operational design domain; and 

23 (G) procedures for reporting incidents in24 volving misuse, faulty results, safety and secu25 rity issues, and other problems with use of artiVerDate Sep 11 2014 00:25 Jul 13, 2024 Jkt 049200 PO 00000 Frm 00038 Fmt 6652 Sfmt 6201 E:\BILLS\S4495.IS S4495

kjohnson on DSK7ZCZBW3PROD with $$_JOB
39 

•S 4495 IS

1 ficial intelligence that does not function as in2 tended. 

3 (e) ONGOING MONITORING OF ARTIFICIAL INTEL4 LIGENCE IN HIGH RISK USE CASES.—The Chief Artificial 

5 Intelligence Officer of each agency shall— 

6 (1) establish a reporting system, consistent with 

7 section 5(g), and suspension and shut-down proto8 cols for defects or adverse impacts of artificial intel9 ligence, and conduct ongoing monitoring, as deter10 mined necessary by use case; 

11 (2) oversee the development and implementa12 tion of ongoing testing and evaluation processes for 

13 artificial intelligence in high risk use cases to ensure 

14 continued mitigation of the potential risks identified 

15 in the risk evaluation process; 

16 (3) implement a process to ensure that risk 

17 mitigation efforts for artificial intelligence are re18 viewed not less than annually and updated as nec19 essary to account for the development of new 

20 versions of artificial intelligence and changes to the 

21 risk profile; and 

22 (4) adhere to pre-deployment requirements 

23 under subsection (d) in each case in which a low or 

24 medium risk artificial intelligence use case becomes 

25 a high risk artificial intelligence use case. 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
40 

•S 4495 IS

1 (f) EXEMPTION FROM REQUIREMENTS FOR SELECT

2 USE CASES.—The Chief Artificial Intelligence Officer of 

3 each agency— 

4 (1) may designate select, low risk use cases, in5 cluding current and future use cases, that do not 

6 have to comply with all or some of the requirements 

7 in this Act; and 

8 (2) shall publicly disclose all use cases exempted 

9 under paragraph (1) with a justification for each ex10 empted use case. 

11 (g) EXCEPTION.—The requirements under sub12 sections (a) and (b) shall not apply to an algorithm soft13 ware update, enhancement, derivative, correction, defect, 

14 or fix for artificial intelligence that does not materially 

15 change the compliance of the deployer with the require16 ments of those subsections, unless determined otherwise 

17 by the agency Chief Artificial Intelligence Officer. 

18 (h) WAIVERS.— 

19 (1) IN GENERAL.—The head of an agency, on 

20 a case by case basis, may waive 1 or more require21 ments under subsection (d) for a specific use case 

22 after making a written determination, based upon a 

23 risk assessment conducted by a human with respect 

24 to the specific use case, that fulfilling the require25 ment or requirements prior to procuring or obtainVerDate Sep 11 2014 00:25 Jul 13, 2024 Jkt 049200 PO 00000 Frm 00040 Fmt 6652 Sfmt 6201 E:\BILLS\S4495.IS S4495

kjohnson on DSK7ZCZBW3PROD with $$_JOB
41 

•S 4495 IS

1 ing, developing, or using artificial intelligence would 

2 increase risks to safety or rights overall or would 

3 create an unacceptable impediment to critical agency 

4 operations. 

5 (2) REQUIREMENTS; LIMITATIONS.—A waiver 

6 under this subsection shall be— 

7 (A) in the national security interests of the 

8 United States, as determined by the head of the 

9 agency; 

10 (B) submitted to the relevant congressional 

11 committees not later than 15 days after the 

12 head of the agency grants the waiver; and 

13 (C) limited to a duration of 1 year, at 

14 which time the head of the agency may renew 

15 the waiver and submit the renewed waiver to 

16 the relevant congressional committees. 

17 (i) INFRASTRUCTURE SECURITY.—The head of an 

18 agency, in consultation with the agency Chief Artificial In19 telligence Officer, Chief Information Officer, Chief Data 

20 Officer, and other relevant agency officials, shall reevalu21 ate infrastructure security protocols based on the artificial 

22 intelligence use cases and associated risks to infrastruc23 ture security of the agency. 

24 (j) COMPLIANCE DEADLINE.—Not later than 270 

25 days after the date of enactment of this Act, the requireVerDate Sep 11 2014 00:25 Jul 13, 2024 Jkt 049200 PO 00000 Frm 00041 Fmt 6652 Sfmt 6201 E:\BILLS\S4495.IS S4495

kjohnson on DSK7ZCZBW3PROD with $$_JOB
42 

•S 4495 IS

1 ments of subsections (a) through (i) of this section shall 

2 apply with respect to artificial intelligence that is already 

3 in use on the date of enactment of this Act. 

4 SEC. 9. PROHIBITION ON SELECT ARTIFICIAL INTEL5 LIGENCE USE CASES. 

6 No agency may develop, procure or obtain, or use ar7 tificial intelligence for— 

8 (1) mapping facial biometric features of an in9 dividual to assign corresponding emotion and poten10 tially take action against the individual; 

11 (2) categorizing and taking action against an 

12 individual based on biometric data of the individual 

13 to deduce or infer race, political opinion, religious or 

14 philosophical beliefs, trade union status, sexual ori15 entation, or other personal trait; 

16 (3) evaluating, classifying, rating, or scoring 

17 the trustworthiness or social standing of an indi18 vidual based on multiple data points and time occur19 rences related to the social behavior of the individual 

20 in multiple contexts or known or predicted personal 

21 or personality characteristics in a manner that may 

22 lead to discriminatory outcomes; or 

23 (4) any other use found by the agency to pose 

24 an unacceptable risk under the risk classification 

25 system of the agency, pursuant to section 7. 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
43 

•S 4495 IS

1 SEC. 10. AGENCY PROCUREMENT INNOVATION LABS. 

2 (a) IN GENERAL.—An agency subject to the Chief Fi3 nancial Officers Act of 1990 (31 U.S.C. 901 note; Public 

4 Law 101–576) that does not have a Procurement Innova5 tion Lab on the date of enactment of this Act should con6 sider establishing a lab or similar mechanism to test new 

7 approaches, share lessons learned, and promote best prac8 tices in procurement, including for commercial technology, 

9 such as artificial intelligence, that is trustworthy and best10 suited for the needs of the agency. 

11 (b) FUNCTIONS.—The functions of the Procurement 

12 Innovation Lab or similar mechanism should include— 

13 (1) providing leadership support as well as ca14 pability and capacity to test, document, and help 

15 agency programs adopt new and better practices 

16 through all stages of the acquisition lifecycle, begin17 ning with project definition and requirements devel18 opment; 

19 (2) providing the workforce of the agency with 

20 a clear pathway to test and document new acquisi21 tion practices and facilitate fresh perspectives on ex22 isting practices; 

23 (3) helping programs and integrated project 

24 teams successfully execute emerging and well-estab25 lished acquisition practices to achieve better results; 

26 and 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
44 

•S 4495 IS

1 (4) promoting meaningful collaboration among 

2 offices that are responsible for requirements develop3 ment, contracting officers, and others, including fi4 nancial and legal experts, that share in the responsi5 bility for making a successful procurement. 

6 (c) STRUCTURE.—An agency should consider placing 

7 the Procurement Innovation Lab or similar mechanism as 

8 a supporting arm of the Chief Acquisition Officer or Sen9 ior Procurement Executive of the agency and shall have 

10 wide latitude in structuring the Procurement Innovation 

11 Lab or similar mechanism and in addressing associated 

12 personnel staffing issues. 

13 SEC. 11. MULTI-PHASE COMMERCIAL TECHNOLOGY TEST 

14 PROGRAM. 

15 (a) TEST PROGRAM.—The head of an agency may 

16 procure commercial technology through a multi-phase test 

17 program of contracts in accordance with this section. 

18 (b) PURPOSE.—A test program established under 

19 this section shall— 

20 (1) provide a means by which an agency may 

21 post a solicitation, including for a general need or 

22 area of interest, for which the agency intends to ex23 plore commercial technology solutions and for which 

24 an offeror may submit a bid based on existing com25 mercial capabilities of the offeror with minimal 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
45 

•S 4495 IS

1 modifications or a technology that the offeror is de2 veloping for commercial purposes; and 

3 (2) use phases, as described in subsection (c), 

4 to minimize government risk and incentivize com5 petition. 

6 (c) CONTRACTING PROCEDURES.—Under a test pro7 gram established under this section, the head of an agency 

8 may acquire commercial technology through a competitive 

9 evaluation of proposals resulting from general solicitation 

10 in the following phases: 

11 (1) PHASE 1 (VIABILITY OF POTENTIAL SOLU12 TION).—Selectees may be awarded a portion of the 

13 total contract award and have a period of perform14 ance of not longer than 1 year to prove the merits, 

15 feasibility, and technological benefit the proposal 

16 would achieve for the agency. 

17 (2) PHASE 2 (MAJOR DETAILS AND SCALED

18 TEST).—Selectees may be awarded a portion of the 

19 total contract award and have a period of perform20 ance of not longer than 1 year to create a detailed 

21 timeline, establish an agreeable intellectual property 

22 ownership agreement, and implement the proposal 

23 on a small scale. 

24 (3) PHASE 3 (IMPLEMENTATION OR RECY25 CLE).— 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
46 

•S 4495 IS

1 (A) IN GENERAL.—Following successful 

2 performance on phase 1 and 2, selectees may be 

3 awarded up to the full remainder of the total 

4 contract award to implement the proposal, de5 pending on the agreed upon costs and the num6 ber of contractors selected. 

7 (B) FAILURE TO FIND SUITABLE SELECT8 EES.—If no selectees are found suitable for 

9 phase 3, the agency head may determine not to 

10 make any selections for phase 3, terminate the 

11 solicitation and utilize any remaining funds to 

12 issue a modified general solicitation for the 

13 same area of interest. 

14 (d) TREATMENT AS COMPETITIVE PROCEDURES.— 

15 The use of general solicitation competitive procedures for 

16 a test program under this section shall be considered to 

17 be use of competitive procedures as defined in section 152 

18 of title 41, United States Code. 

19 (e) LIMITATION.—The head of an agency shall not 

20 enter into a contract under the test program for an 

21 amount in excess of $25,000,000. 

22 (f) GUIDANCE.— 

23 (1) FEDERAL ACQUISITION REGULATORY COUN24 CIL.—The Federal Acquisition Regulatory Council 

25 shall revise the Federal Acquisition Regulation as 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
47 

•S 4495 IS

1 necessary to implement this section, including re2 quirements for each general solicitation under a test 

3 program to be made publicly available through a 

4 means that provides access to the notice of the gen5 eral solicitation through the System for Award Man6 agement or subsequent government-wide point of 

7 entry, with classified solicitations posted to the ap8 propriate government portal. 

9 (2) AGENCY PROCEDURES.—The head of an 

10 agency may not award contracts under a test pro11 gram until the agency issues guidance with proce12 dures for use of the authority. The guidance shall be 

13 issued in consultation with the relevant Acquisition 

14 Regulatory Council and shall be publicly available. 

15 (g) SUNSET.—The authority for a test program 

16 under this section shall terminate on the date that is 5 

17 years after the date the Federal Acquisition Regulation 

18 is revised pursuant to subsection (f)(1) to implement the 

19 program. 

20 SEC. 12. RESEARCH AND DEVELOPMENT PROJECT PILOT 

21 PROGRAM. 

22 (a) PILOT PROGRAM.—The head of an agency may 

23 carry out research and prototype projects in accordance 

24 with this section. 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
48 

•S 4495 IS

1 (b) PURPOSE.—A pilot program established under 

2 this section shall provide a means by which an agency 

3 may— 

4 (1) carry out basic, applied, and advanced re5 search and development projects; and 

6 (2) carry out prototype projects that address— 

7 (A) a proof of concept, model, or process, 

8 including a business process; 

9 (B) reverse engineering to address obsoles10 cence; 

11 (C) a pilot or novel application of commer12 cial technologies for agency mission purposes; 

13 (D) agile development activity; 

14 (E) the creation, design, development, or 

15 demonstration of operational utility; or 

16 (F) any combination of items described in 

17 subparagraphs (A) through (E). 

18 (c) CONTRACTING PROCEDURES.—Under a pilot pro19 gram established under this section, the head of an agency 

20 may carry out research and prototype projects— 

21 (1) using small businesses to the maximum ex22 tent practicable; 

23 (2) using cost sharing arrangements where 

24 practicable; 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
49 

•S 4495 IS

1 (3) tailoring intellectual property terms and 

2 conditions relevant to the project and commercializa3 tion opportunities; and 

4 (4) ensuring that such projects do not duplicate 

5 research being conducted under existing agency pro6 grams. 

7 (d) TREATMENT AS COMPETITIVE PROCEDURES.— 

8 The use of research and development contracting proce9 dures under this section shall be considered to be use of 

10 competitive procedures, as defined in section 152 of title 

11 41, United States Code. 

12 (e) TREATMENT AS COMMERCIAL TECHNOLOGY.— 

13 The use of research and development contracting proce14 dures under this section shall be considered to be use of 

15 commercial technology, as defined in section 2. 

16 (f) FOLLOW-ON PROJECTS OR PHASES.—A follow-on 

17 contract provided for in a contract opportunity announced 

18 under this section may, at the discretion of the head of 

19 the agency, be awarded to a participant in the original 

20 project or phase if the original project or phase was suc21 cessfully completed. 

22 (g) LIMITATION.—The head of an agency shall not 

23 enter into a contract under the pilot program for an 

24 amount in excess of $10,000,000. 

25 (h) GUIDANCE.— 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
50 

•S 4495 IS

1 (1) FEDERAL ACQUISITION REGULATORY COUN2 CIL.—The Federal Acquisition Regulatory Council 

3 shall revise the Federal Acquisition Regulation re4 search and development contracting procedures as 

5 necessary to implement this section, including re6 quirements for each research and development 

7 project under a pilot program to be made publicly 

8 available through a means that provides access to 

9 the notice of the opportunity through the System for 

10 Award Management or subsequent government-wide 

11 point of entry, with classified solicitations posted to 

12 the appropriate government portal. 

13 (2) AGENCY PROCEDURES.—The head of an 

14 agency may not award contracts under a pilot pro15 gram until the agency, in consultation with the rel16 evant Acquisition Regulatory Council issues and 

17 makes publicly available guidance on procedures for 

18 use of the authority. 

19 (i) REPORTING.—Contract actions entered into under 

20 this section shall be reported to the Federal Procurement 

21 Data System, or any successor system. 

22 (j) SUNSET.—The authority for a pilot program 

23 under this section shall terminate on the date that is 5 

24 years from the date the Federal Acquisition Regulation 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
51 

•S 4495 IS

1 is revised pursuant to subsection (h)(1) to implement the 

2 program. 

3 SEC. 13. DEVELOPMENT OF TOOLS AND GUIDANCE FOR 

4 TESTING AND EVALUATING ARTIFICIAL IN5 TELLIGENCE. 

6 (a) AGENCY REPORT REQUIREMENTS.—In a manner 

7 specified by the Director, the Chief Artificial Intelligence 

8 Officer shall identify and annually submit to the Council 

9 a report on obstacles encountered in the testing and eval10 uation of artificial intelligence, specifying— 

11 (1) the nature of the obstacles; 

12 (2) the impact of the obstacles on agency oper13 ations, mission achievement, and artificial intel14 ligence adoption; 

15 (3) recommendations for addressing the identi16 fied obstacles, including the need for particular re17 sources or guidance to address certain obstacles; and 

18 (4) a timeline that would be needed to imple19 ment proposed solutions. 

20 (b) COUNCIL REVIEW AND COLLABORATION.— 

21 (1) ANNUAL REVIEW.—Not less frequently than 

22 annually, the Council shall conduct a review of agen23 cy reports under subsection (a) to identify common 

24 challenges and opportunities for cross-agency col25 laboration. 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
52 

•S 4495 IS

1 (2) DEVELOPMENT OF TOOLS AND GUID2 ANCE.— 

3 (A) IN GENERAL.—Not later than 2 years 

4 after the date of enactment of this Act, the Di5 rector, in consultation with the Council, shall 

6 convene a working group to— 

7 (i) develop tools and guidance to as8 sist agencies in addressing the obstacles 

9 that agencies identify in the reports under 

10 subsection (a); 

11 (ii) support interagency coordination 

12 to facilitate the identification and use of 

13 relevant voluntary standards, guidelines, 

14 and other consensus-based approaches for 

15 testing and evaluation and other relevant 

16 areas; and 

17 (iii) address any additional matters 

18 determined appropriate by the Director. 

19 (B) WORKING GROUP MEMBERSHIP.—The 

20 working group described in subparagraph (A) 

21 shall include Federal interdisciplinary per22 sonnel, such as technologists, information secu23 rity personnel, domain experts, privacy officers, 

24 data officers, civil rights and civil liberties offi25 cers, contracting officials, legal counsel, cusVerDate Sep 11 2014 00:25 Jul 13, 2024 Jkt 049200 PO 00000 Frm 00052 Fmt 6652 Sfmt 6201 E:\BILLS\S4495.IS S4495

kjohnson on DSK7ZCZBW3PROD with $$_JOB
53 

•S 4495 IS

1 tomer experience professionals, and others, as 

2 determined by the Director. 

3 (3) INFORMATION SHARING.—The Director, in 

4 consultation with the Council, shall establish a 

5 mechanism for sharing tools and guidance developed 

6 under paragraph (2) across agencies. 

7 (c) CONGRESSIONAL REPORTING.— 

8 (1) IN GENERAL.—Each agency shall submit 

9 the annual report under subsection (a) to relevant 

10 congressional committees. 

11 (2) CONSOLIDATED REPORT.—The Director, in 

12 consultation with the Council, may suspend the re13 quirement under paragraph (1) and submit to the 

14 relevant congressional committees a consolidated re15 port that conveys government-wide testing and eval16 uation challenges, recommended solutions, and 

17 progress toward implementing recommendations 

18 from prior reports developed in fulfillment of this 

19 subsection. 

20 (d) SUNSET.—The requirements under this section 

21 shall terminate on the date that is 10 years after the date 

22 of enactment of this Act. 

23 SEC. 14. UPDATES TO ARTIFICIAL INTELLIGENCE USE CASE 

24 INVENTORIES. 

25 (a) AMENDMENTS.— 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
54 

•S 4495 IS

1 (1) ADVANCING AMERICAN AI ACT.—The Ad2 vancing American AI Act (Public Law 117–263; 40 

3 U.S.C. 11301 note) is amended— 

4 (A) in section 7223(3), by striking the pe5 riod and inserting ‘‘and in section 5002 of the 

6 National Artificial Intelligence Initiative Act of 

7 2020 (15 U.S.C. 9401).’’; and 

8 (B) in section 7225, by striking subsection 

9 (d). 

10 (2) EXECUTIVE ORDER 13960.—The provisions 

11 of section 5 of Executive Order 13960 (85 Fed. Reg. 

12 78939; relating to promoting the use of trustworthy 

13 artificial intelligence in Federal Government) that 

14 exempt classified and sensitive use cases from agen15 cy inventories of artificial intelligence use cases shall 

16 cease to have legal effect. 

17 (b) COMPLIANCE.— 

18 (1) IN GENERAL.—The Director shall ensure 

19 that agencies submit artificial intelligence use case 

20 inventories and that the inventories comply with ap21 plicable artificial intelligence inventory guidance. 

22 (2) ANNUAL REPORT.—The Director shall sub23 mit to the relevant congressional committees an an24 nual report on agency compliance with artificial in25 telligence inventory guidance. 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
55 

•S 4495 IS

1 (c) DISCLOSURE.— 

2 (1) IN GENERAL.—The artificial intelligence in3 ventory of each agency shall publicly disclose— 

4 (A) whether artificial intelligence was de5 veloped internally by the agency or procured ex6 ternally, without excluding any use case on 

7 basis that the use case is ‘‘sensitive’’ solely be8 cause it was externally procured; 

9 (B) data provenance information, including 

10 identifying the source of the training data of 

11 the artificial intelligence, including internal gov12 ernment data, public data, commercially held 

13 data, or similar data; 

14 (C) the level of risk at which the agency 

15 has classified the artificial intelligence use case 

16 and a brief explanation for how the determina17 tion was made; 

18 (D) a list of targeted impact assessments 

19 conducted pursuant to section 7(a)(2)(C); and 

20 (E) the number of artificial intelligence use 

21 cases excluded from public reporting as being 

22 ‘‘sensitive.’’ 

23 (2) UPDATES.— 

24 (A) IN GENERAL.—When an agency up25 dates the public artificial intelligence use case 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
56 

•S 4495 IS

1 inventory of the agency, the agency shall dis2 close the date of the modification and make 

3 change logs publicly available and accessible. 

4 (B) GUIDANCE.—The Director shall issue 

5 guidance to agencies that describes how to ap6 propriately update artificial intelligence use case 

7 inventories and clarifies how sub-agencies and 

8 regulatory agencies should participate in the ar9 tificial intelligence use case inventorying proc10 ess. 

11 (d) CONGRESSIONAL REPORTING.—The head of each 

12 agency shall submit to the relevant congressional commit13 tees a copy of the annual artificial intelligence use case 

14 inventory of the agency, including— 

15 (1) the use cases that have been identified as 

16 ‘‘sensitive’’ and not for public disclosure; and 

17 (2) a classified annex of classified use cases. 

18 (e) GOVERNMENT TRENDS REPORT.—Beginning 1 

19 year after the date of enactment of this Act, and annually 

20 thereafter, the Director, in coordination with the Council, 

21 shall issue a report, based on the artificial intelligence use 

22 cases reported in use case inventories, that describes 

23 trends in the use of artificial intelligence in the Federal 

24 Government. 

25 (f) COMPTROLLER GENERAL.— 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
57 

•S 4495 IS

1 (1) REPORT REQUIRED.—Not later than 1 year 

2 after the date of enactment of this Act, and annually 

3 thereafter, the Comptroller General of the United 

4 States shall submit to relevant congressional com5 mittees a report on whether agencies are appro6 priately classifying use cases. 

7 (2) APPROPRIATE CLASSIFICATION.—The 

8 Comptroller General of the United States shall ex9 amine whether the appropriate level of disclosure of 

10 artificial intelligence use cases by agencies should be 

11 included on the High Risk List of the Government 

12 Accountability Office. 

Æ 


kjohnson on DSK7ZCZBW3PROD with $$_JOB