II 

Calendar No. 727 

118TH CONGRESS 

2D SESSION S. 4769 

To require the Director of the National Institute of Standards and Technology 

to develop voluntary guidelines and specifications for internal and external assurances of artificial intelligence systems, and for other purposes. 

IN THE SENATE OF THE UNITED STATES 

JULY 24, 2024 

Mr. HICKENLOOPER (for himself and Mrs. CAPITO) introduced the following 

bill; which was read twice and referred to the Committee on Commerce, 

Science, and Transportation 

DECEMBER 18 (legislative day, DECEMBER 16), 2024 

Reported by Ms. CANTWELL, with amendments 

[Omit the part struck through and insert the part printed in italic] 

A BILL 

To require the Director of the National Institute of Standards and Technology to develop voluntary guidelines and 

specifications for internal and external assurances of artificial intelligence systems, and for other purposes. 

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
2 

•S 4769 RS

1 SECTION 1. SHORT TITLE. 

2 This Act may be cited as the ‘‘Validation and Evalua3 tion for Trustworthy (VET) Artificial Intelligence Act’’ or 

4 the ‘‘VET Artificial Intelligence Act’’. 

5 SEC. 2. PURPOSES. 

6 The purposes of this Act are— 

7 (1) to develop consensus-driven, evidence-based 

8 voluntary guidelines technical guidelines and speci9 fications for internal and external assurances 

10 through the testing, evaluation, validation, and 

11 verification of artificial intelligence systems, as ap12 propriate based on the intended application, use13 case, and risk profile of the artificial intelligence sys14 tem; 

15 (2) to use meaningful assurance to supplement 

16 methodologies used to build trust in artificial intel17 ligence systems, increase adoption of artificial intel18 ligence systems, and provide for accountability and 

19 governance of artificial intelligence systems; and 

20 (3) to further the goals of the Artificial Intel21 ligence Risk Management Framework, including any 

22 successor framework, published by the National In23 stitute of Standards and Technology and the Artifi24 cial Intelligence Safety Institute pursuant to section 

25 22A(c) of the National Institute of Standards and 

26 Technology Act (15 U.S.C. 278h–1(c)). 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
3 

•S 4769 RS

1 SEC. 3. DEFINITIONS. 

2 In this Act: 

3 (1) ARTIFICIAL INTELLIGENCE.—The term ‘‘ar4 tificial intelligence’’ has the meaning given the term 

5 in section 5002 of the National Artificial Intelligence 

6 Initiative Act of 2020 (15 U.S.C. 9401). 

7 (21) ARTIFICIAL INTELLIGENCE SYSTEM.—The 

8 term ‘‘artificial intelligence system’’ has the meaning 

9 given such term in section 7223 of the Advancing 

10 American AI Act (40 U.S.C. 11301 note). term ‘‘ar11 tificial intelligence system’’ means a machine-based 

12 system that, for explicit or implicit objectives, infers, 

13 from the input the system receives, how to generate 

14 outputs, such as predictions, content, recommenda15 tions, or decisions, that can influence physical or vir16 tual environments. 

17 (32) DEPLOYER.—The term ‘‘deployer’’ means 

18 an entity that operates an artificial intelligence sys19 tem for internal use or for use by a third party. 

20 (43) DEVELOPER.—The term ‘‘developer’’— 

21 (A) means an entity that builds, designs, 

22 codes, produces, trains, or owns an artificial in23 telligence system for internal use or for use by 

24 a third party; and 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
4 

•S 4769 RS

1 (B) does not include an entity that is sole2 ly a deployer of the artificial intelligence sys3 tem. 

4 (54) DIRECTOR.—The term ‘‘Director’’ means 

5 the Director of the National Institute of Standards 

6 and Technology. 

7 (65) EXTERNAL ARTIFICIAL INTELLIGENCE AS8 SURANCE.—The term ‘‘external artificial intelligence 

9 assurance’’ means an independent and impartial 

10 evaluation of an artificial intelligence system con11 ducted by a nonaffiliated third party in accordance 

12 with the voluntary assurance guidelines technical 

13 guidelines and specifications described in section 4 

14 or consensus-driven voluntary standards, for the 

15 purpose of— 

16 (A) verifying claims with respect to the 

17 functionality and testing of the artificial intel18 ligence system, including verifying whether it is 

19 fit for its intended purpose; or 

20 (B) identifying any significant error or in21 consistency in the testing, risk management 

22 processes, or internal governance, any substan23 tial vulnerability, or any negative societal im24 pact of the artificial intelligence system. 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
5 

•S 4769 RS

1 (76) INTERNAL ARTIFICIAL INTELLIGENCE AS2 SURANCE.—The term ‘‘internal artificial intelligence 

3 assurance’’ means an independent evaluation of an 

4 artificial intelligence system conducted by the party 

5 being evaluated with an internal reporting structure 

6 that encourages impartial evaluations and prevents 

7 conflicts of interest, for the purpose of— 

8 (A) verifying claims with respect to the 

9 functionality and testing of the artificial intel10 ligence system, including verifying whether it is 

11 fit for its intended purpose; or 

12 (B) identifying any significant error or in13 consistency in the testing, risk management 

14 processes, or internal governance, any substan15 tial vulnerability, or any negative societal im16 pact of the artificial intelligence system. process, 

17 or internal governance or any substantial vul18 nerability of the artificial intelligence system. 

19 (87) NONAFFILIATED THIRD PARTY.—The term 

20 ‘‘nonaffiliated third party’’ with respect to the eval21 uation of an artificial intelligence system, means a 

22 person who— 

23 (A) is not related by common ownership or 

24 affiliated by common corporate control with the 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
6 

•S 4769 RS

1 developer or deployer of the artificial intel2 ligence system; 

3 (B) can demonstrate financial independ4 ence from the developer or deployer of the arti5 ficial intelligence system; 

6 (C) does not employ any individual, who is 

7 also employed by the developer or deployer of 

8 the artificial intelligence system; and 

9 (D) is a qualified evaluator of artificial in10 telligence systems as determined by the vol11 untary guidelines and specifications rec12 ommended under section 4(b)(6), with— 

13 (i) demonstrated expertise in relevant 

14 technical domains, including— 

15 (I) data privacy and security 

16 principles; and 

17 (II) risk management practices in 

18 artificial intelligence systems; and 

19 (ii) familiarity with the relevant de20 tails regarding the type of artificial intel21 ligence system being evaluated. 

22 (98) SECRETARY.—The term ‘‘Secretary’’ 

23 means the Secretary of Commerce. 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
7 

•S 4769 RS

1 SEC. 4. VOLUNTARY ASSURANCE GUIDELINES TECHNICAL 

2 GUIDELINES AND SPECIFICATIONS FOR ARTI3 FICIAL INTELLIGENCE SYSTEMS. 

4 (a) VOLUNTARY GUIDELINES TECHNICAL GUIDE5 LINES AND SPECIFICATIONS FOR ASSURANCE.—Not later 

6 than 1 year after the date of the enactment of this Act, 

7 the Director, in collaboration with public and private sec8 tor organizations, including the National Science Founda9 tion and the Department of Energy, shall develop and pe10 riodically and, not less frequently than every 2 years, shall 

11 review and update as the Director considers appropriate, 

12 a set of voluntary guidelines technical guidelines and speci13 fications for internal artificial intelligence assurance and 

14 external artificial intelligence assurance. 

15 (b) CONTENTS.—The guidelines technical guidelines 

16 and specifications required by subsection (a) shall— 

17 (1) identify consensus-driven, voluntary stand18 ards for internal artificial intelligence assurance and 

19 external artificial intelligence assurance that ad20 dress— 

21 (A) safeguards for consumer privacy; 

22 (B) methods to assess and mitigate harms 

23 to individuals by artificial intelligence systems; 

24 (C) dataset quality; 

25 (D) documentation, disclosure, and prove26 nance communications to external parties; and 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
8 

•S 4769 RS

1 (E) governance and process controls; 

2 (2) provide guidelines technical guidelines, best 

3 practices, methodologies, procedures, and processes, 

4 as appropriate, for internal artificial intelligence as5 surance and external artificial intelligence assurance 

6 that effectively address the elements listed in para7 graph (1); 

8 (3) establish common definitions and character9 izations for testing, evaluating, verifying, and vali10 dating methods for internal artificial intelligence as11 surance and external artificial intelligence assurance; 

12 (4) recommend criteria or approaches for a de13 veloper or deployer to determine the frequency and 

14 circumstances under which internal artificial intel15 ligence assurance and external artificial intelligence 

16 assurance activities should be conducted, accounting 

17 for the relevant risk and use-case profile of the arti18 ficial intelligence system, and any additional cir19 cumstance under which an assurance should be con20 ducted; 

21 (5) recommend criteria or approaches for a de22 veloper or deployer to determine the scope of inter23 nal artificial intelligence assurance and external arti24 ficial intelligence assurance conducted through test25 ing and evaluating, accounting for the relevant risk 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
9 

•S 4769 RS

1 and use-case profile of the artificial intelligence sys2 tem, including the minimum information or technical 

3 resources that should be provided to the party con4 ducting the assurance to enable assurance activities; 

5 (6) recommend the appropriate qualifications, 

6 expertise, professional licensing, and accountability 

7 that a party conducting internal artificial intel8 ligence assurance or external artificial intelligence 

9 assurance should have with respect to— 

10 (A) the type of artificial intelligence system 

11 under evaluation; and 

12 (B) the internal and external assurance 

13 processes; 

14 (76) provide guidance for the manner in which 

15 a developer or deployer may disclose, as appropriate, 

16 the results of an internal or external assurance or 

17 carry out corrective actions with respect to an artifi18 cial intelligence system following the completion of 

19 an internal or external assurance of such system, 

20 and guidance on the manner in which a developer or 

21 deployer may properly document any corrective ac22 tion taken; 

23 (87) align with the voluntary consensus stand24 ards, including international standards, identified 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
10 

•S 4769 RS

1 pursuant to paragraph (1) to the fullest extent pos2 sible; 

3 (98) incorporate the relevant voluntary con4 sensus standards identified pursuant to paragraph 

5 (1) and industry best practices to the fullest extent 

6 possible; 

7 (109) not prescribe or otherwise require— 

8 (A) the use of any specific solution; or 

9 (B) the use of any specific information or 

10 any communications technology product or serv11 ice; and 

12 (1110) recommend methods to protect the con13 fidentiality of sensitive information, including per14 sonal data and proprietary knowledge of an artificial 

15 intelligence system, that may be obtained during the 

16 assurance process. 

17 (c) STAKEHOLDER OUTREACH.—In developing the 

18 voluntary guidelines technical guidelines and specifications 

19 required by subsection (a), the Director shall— 

20 (1) solicit public comment on at least 1 draft of 

21 the guidelines technical guidelines and specifications, 

22 and provide a reasonable period of not less than 30 

23 days for the submission of comments by interested 

24 stakeholders; 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
11 

•S 4769 RS

1 (2) make each complete draft of the voluntary 

2 guidelines technical guidelines and specifications de3 veloped under subsection (a) available to the public 

4 on the website of the National Institute of Stand5 ards and Technology; and 

6 (3) convene workshops, roundtables, and other 

7 public forums, as the Director considers appropriate, 

8 to consult with relevant stakeholders in industry, 

9 academia, civil society, consumer advocacy, work10 force development organizations, labor organizations, 

11 conformance assessment bodies, and any other sec12 tor the Director considers appropriate, on the devel13 opment of the voluntary guidelines technical guide14 lines and specifications. 

15 (d) PUBLICATION.—The Director shall publish the 

16 voluntary guidelines technical guidelines and specifications 

17 required by sub section (a)— section (a) as a standalone 

18 framework or document available to the public on the 

19 website of the National Institute of Standards and Tech20 nology. 

21 (1) as a standalone framework or document 

22 available to the public on the website of the National 

23 Institute of Standards and Technology; or 

24 (2) as a component of— 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
12 

•S 4769 RS

1 (A) any successor of the Artificial Intel2 ligence Risk Management Framework developed 

3 and updated pursuant to section 22A(c) of the 

4 National Institute of Standards and Technology 

5 Act (15 U.S.C. 278h–1(c)); or 

6 (B) any guidance issued by the Artificial 

7 Intelligence Safety Institute. 

8 SEC. 5. QUALIFICATIONS ADVISORY COMMITTEE. 

9 (a) ADVISORY COMMITTEE.—Not later than 90 days 

10 after the date on which the Director publishes the vol11 untary guidelines technical guidelines and specifications 

12 required under section 4(a), the Secretary shall establish 

13 the Artificial Intelligence Assurance Qualifications Advi14 sory Committee (referred to in this section as the ‘‘Advi15 sory Committee’’). 

16 (b) MEMBERSHIP.—The Secretary shall appoint to 

17 the Advisory Committee not more than 15 individuals 20 

18 individuals with expertise relating to artificial intelligence 

19 systems, including at least 1 representative from each of 

20 the following: 

21 (1) Institutions of higher education. 

22 (2) Organizations developing artificial intel23 ligence systems. 

24 (3) Organizations deploying artificial intel25 ligence systems. 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
13 

•S 4769 RS

1 (4) Organizations assessing artificial intel2 ligence systems. 

3 (5) Consumers or consumer advocacy groups. 

4 (6) Public health organizations. 

5 (7) Public safety organizations. 

6 (8) Civil rights organizations. 

7 (9) Professional accreditation organizations. 

8 (10) Workforce development organizations. 

9 (11) Labor organizations. 

10 (12) Nonprofit assurance professional organiza11 tions. 

12 (c) DUTIES.—The Advisory Committee shall— 

13 (1) review and assess case studies from entities 

14 that provide licensure, certification, or accreditation 

15 to independent organizations with a primary mission 

16 of verifying compliance with applicable statutes, reg17 ulations, standards, or guidelines; and 

18 (2) determine the applicability of the case stud19 ies reviewed and assessed under paragraph (1) to 

20 the development, maintenance, and use of artificial 

21 intelligence systems for the purpose of developing 

22 recommendations under subsection (d). 

23 (d) RECOMMENDATIONS.—Not later than 1 year 

24 after the date on which the Secretary establishes the Advi25 sory Committee under this section, the Advisory ComVerDate Sep 11 2014 06:51 Dec 19, 2024 Jkt 059200 PO 00000 Frm 00013 Fmt 6652 Sfmt 6201 E:\BILLS\S4769.RS S4769

kjohnson on DSK7ZCZBW3PROD with $$_JOB
14 

•S 4769 RS

1 mittee shall submit to the Secretary and Congress and 

2 make publicly available a report that includes rec3 ommendations for the Secretary to consider regarding— 

4 (1) the qualifications, expertise, professional li5 censing, independence, and accountability that a 

6 party conducting an assurance of an artificial intel7 ligence system should have, including with respect to 

8 the type of artificial intelligence system under eval9 uation and the internal and external assurance proc10 esses; and 

11 (2) whether accreditation for internal artificial 

12 intelligence assurance and external artificial intel13 ligence assurance can be met through a combination 

14 of existing licensure, certification, or accreditation 

15 programs. 

16 (e) TERMINATION.—The Advisory Committee shall 

17 terminate not later than 1 year after the date on which 

18 the Advisory Committee submits the recommendations re19 quired under subsection (d). 

20 SEC. 6. STUDY AND REPORT ON ENTITIES THAT CONDUCT 

21 ASSURANCES OF ARTIFICIAL INTELLIGENCE 

22 SYSTEMS. 

23 (a) STUDY.—Not later than 90 days after the date 

24 on which the Director publishes the voluntary guidelines 

25 technical guidelines and specifications required under secVerDate Sep 11 2014 06:51 Dec 19, 2024 Jkt 059200 PO 00000 Frm 00014 Fmt 6652 Sfmt 6201 E:\BILLS\S4769.RS S4769

kjohnson on DSK7ZCZBW3PROD with $$_JOB
15 

•S 4769 RS

1 tion 4(a), the Secretary shall commence a study to evalu2 ate the capabilities of the sector of entities that conduct 

3 internal artificial intelligence assurances and external arti4 ficial intelligence assurances. 

5 (b) CONSIDERATIONS.—In carrying out the study re6 quired by subsection (a), the Secretary shall— 

7 (1) assess the capabilities of the sector of enti8 ties described in subsection (a) with respect to per9 sonnel, technical tools, evaluation methods, com10 puting infrastructure, and physical infrastructure 

11 and whether such capabilities are adequate for pro12 viding internal artificial intelligence assurances or 

13 external artificial intelligence assurances that com14 port with the voluntary guidelines technical guide15 lines and specifications required under section 4(a); 

16 (2) review the features, best practices, and safe17 guards employed by such entities to maintain the in18 tegrity of confidential or proprietary information of 

19 a developer or deployer during an internal artificial 

20 intelligence assurance or an external artificial intel21 ligence assurance; 

22 (3) assess the market demand for internal arti23 ficial intelligence assurances and external artificial 

24 intelligence assurances and the availability of such 

25 assurers; and 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
16 

•S 4769 RS

1 (4) assess the feasibility of leveraging an exist2 ing facility accredited by the Director under the Na3 tional Voluntary Laboratory Accreditation Program 

4 established under section part 285 of title 15, Code 

5 of Federal Regulations, to conduct external assur6 ances of artificial intelligence systems. 

7 (c) REPORT.—Not later than 1 year after the date 

8 on which the Secretary commences the study required by 

9 subsection (a), the Secretary shall submit to the appro10 priate committees of Congress and the head of any Fed11 eral agency that the Secretary considers relevant, a report 

12 that contains the results of the study required by sub13 section (a), including— 

14 (1) recommendations for improving the capa15 bilities and the availability of the entities assessed in 

16 the study; 

17 (2) descriptions of the features, best practices, 

18 and safeguards of the entities studied and the effec19 tiveness of such features, practices, or safeguards at 

20 implementing the voluntary guidelines technical 

21 guidelines and specifications required under section 

22 4(a) and at maintaining the integrity of confidential 

23 and proprietary information, as described under sub24 section (b)(2); and 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
17 

•S 4769 RS

1 (3) any conclusions drawn from the assessment 

2 of the facilities described in subsection (b)(4). 

3 (d) APPROPRIATE COMMITTEES OF CONGRESS DE4 FINED.—In this section, the term the ‘‘appropriate com5 mittees of Congress’’ means— 

6 (1) the Committee of Commerce, Science, and 

7 Transportation of the Senate; and 

8 (2) the Committee on Science, Space, and 

9 Technology of the House of Representatives. 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
Calendar No. 727 

118TH CONGRESS 

2D SESSION S. 4769 

A BILL 

To require the Director of the National Institute of 

D

tems, and for other purposes. ternal assurances of artificial intelligence sysguidelines and specifications for internal and exStandards and Technology to develop voluntary 

ECEMBER 18 (legislative day, DECEMBER 16), 2024 

Reported with amendments 


kjohnson on DSK7ZCZBW3PROD with $$_JOB