II 

118TH CONGRESS 

2D SESSION S. 4769 

To require the Director of the National Institute of Standards and Technology 

to develop voluntary guidelines and specifications for internal and external assurances of artificial intelligence systems, and for other purposes. 

IN THE SENATE OF THE UNITED STATES 

JULY 24, 2024 

Mr. HICKENLOOPER (for himself and Mrs. CAPITO) introduced the following 

bill; which was read twice and referred to the Committee on Commerce, 

Science, and Transportation 

A BILL 

To require the Director of the National Institute of Standards and Technology to develop voluntary guidelines and 

specifications for internal and external assurances of artificial intelligence systems, and for other purposes. 

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 

3 SECTION 1. SHORT TITLE. 

4 This Act may be cited as the ‘‘Validation and Evalua5 tion for Trustworthy (VET) Artificial Intelligence Act’’ or 

6 the ‘‘VET Artificial Intelligence Act’’. 

7 SEC. 2. PURPOSES. 

8 The purposes of this Act are— 


ssavage on LAPJG3WLY3PROD with BILLS
2 

•S 4769 IS

1 (1) to develop consensus-driven, evidence-based 

2 voluntary guidelines and specifications for internal 

3 and external assurances through the testing, evalua4 tion, validation, and verification of artificial intel5 ligence systems, as appropriate based on the in6 tended application, use-case, and risk profile of the 

7 artificial intelligence system; 

8 (2) to use meaningful assurance to supplement 

9 methodologies used to build trust in artificial intel10 ligence systems, increase adoption of artificial intel11 ligence systems, and provide for accountability and 

12 governance of artificial intelligence systems; and 

13 (3) to further the goals of the Artificial Intel14 ligence Risk Management Framework, including any 

15 successor framework, published by the National In16 stitute of Standards and Technology and the Artifi17 cial Intelligence Safety Institute pursuant to section 

18 22A(c) of the National Institute of Standards and 

19 Technology Act (15 U.S.C. 278h–1(c)). 

20 SEC. 3. DEFINITIONS. 

21 In this Act: 

22 (1) ARTIFICIAL INTELLIGENCE.—The term ‘‘ar23 tificial intelligence’’ has the meaning given the term 

24 in section 5002 of the National Artificial Intelligence 

25 Initiative Act of 2020 (15 U.S.C. 9401). 


ssavage on LAPJG3WLY3PROD with BILLS
3 

•S 4769 IS

1 (2) ARTIFICIAL INTELLIGENCE SYSTEM.—The 

2 term ‘‘artificial intelligence system’’ has the meaning 

3 given such term in section 7223 of the Advancing 

4 American AI Act (40 U.S.C. 11301 note). 

5 (3) DEPLOYER.—The term ‘‘deployer’’ means 

6 an entity that operates an artificial intelligence sys7 tem for internal use or for use by a third party. 

8 (4) DEVELOPER.—The term ‘‘developer’’— 

9 (A) means an entity that builds, designs, 

10 codes, produces, trains, or owns an artificial in11 telligence system for internal use or for use by 

12 a third party; and 

13 (B) does not include an entity that is sole14 ly a deployer of the artificial intelligence sys15 tem. 

16 (5) DIRECTOR.—The term ‘‘Director’’ means 

17 the Director of the National Institute of Standards 

18 and Technology. 

19 (6) EXTERNAL ARTIFICIAL INTELLIGENCE AS20 SURANCE.—The term ‘‘external artificial intelligence 

21 assurance’’ means an independent and impartial 

22 evaluation of an artificial intelligence system con23 ducted by a nonaffiliated third party in accordance 

24 with the voluntary assurance guidelines and speciVerDate Sep 11 2014 22:25 Jul 29, 2024 Jkt 049200 PO 00000 Frm 00003 Fmt 6652 Sfmt 6201 E:\BILLS\S4769.IS S4769

ssavage on LAPJG3WLY3PROD with BILLS
4 

•S 4769 IS

1 fications described in section 4 or consensus-driven 

2 voluntary standards, for the purpose of— 

3 (A) verifying claims with respect to the 

4 functionality and testing of the artificial intel5 ligence system, including verifying whether it is 

6 fit for its intended purpose; or 

7 (B) identifying any significant error or in8 consistency in the testing, risk management 

9 processes, or internal governance, any substan10 tial vulnerability, or any negative societal im11 pact of the artificial intelligence system. 

12 (7) INTERNAL ARTIFICIAL INTELLIGENCE AS13 SURANCE.—The term ‘‘internal artificial intelligence 

14 assurance’’ means an independent evaluation of an 

15 artificial intelligence system conducted by the party 

16 being evaluated with an internal reporting structure 

17 that encourages impartial evaluations and prevents 

18 conflicts of interest, for the purpose of— 

19 (A) verifying claims with respect to the 

20 functionality and testing of the artificial intel21 ligence system, including verifying whether it is 

22 fit for its intended purpose; or 

23 (B) identifying any significant error or in24 consistency in the testing, risk management 

25 processes, or internal governance, any substanVerDate Sep 11 2014 22:25 Jul 29, 2024 Jkt 049200 PO 00000 Frm 00004 Fmt 6652 Sfmt 6201 E:\BILLS\S4769.IS S4769

ssavage on LAPJG3WLY3PROD with BILLS
5 

•S 4769 IS

1 tial vulnerability, or any negative societal im2 pact of the artificial intelligence system. 

3 (8) NONAFFILIATED THIRD PARTY.—The term 

4 ‘‘nonaffiliated third party’’ with respect to the eval5 uation of an artificial intelligence system, means a 

6 person who— 

7 (A) is not related by common ownership or 

8 affiliated by common corporate control with the 

9 developer or deployer of the artificial intel10 ligence system; 

11 (B) can demonstrate financial independ12 ence from the developer or deployer of the arti13 ficial intelligence system; 

14 (C) does not employ any individual, who is 

15 also employed by the developer or deployer of 

16 the artificial intelligence system; and 

17 (D) is a qualified evaluator of artificial in18 telligence systems as determined by the vol19 untary guidelines and specifications rec20 ommended under section 4(b)(6), with— 

21 (i) demonstrated expertise in relevant 

22 technical domains, including— 

23 (I) data privacy and security 

24 principles; and 


ssavage on LAPJG3WLY3PROD with BILLS
6 

•S 4769 IS

1 (II) risk management practices in 

2 artificial intelligence; and 

3 (ii) familiarity with the relevant de4 tails regarding the type of artificial intel5 ligence system being evaluated. 

6 (9) SECRETARY.—The term ‘‘Secretary’’ means 

7 the Secretary of Commerce. 

8 SEC. 4. VOLUNTARY ASSURANCE GUIDELINES AND SPECI9 FICATIONS FOR ARTIFICIAL INTELLIGENCE 

10 SYSTEMS. 

11 (a) VOLUNTARY GUIDELINES AND SPECIFICATIONS

12 FOR ASSURANCE.—Not later than 1 year after the date 

13 of the enactment of this Act, the Director, in collaboration 

14 with public and private sector organizations, including the 

15 National Science Foundation and the Department of En16 ergy, shall develop and periodically update as the Director 

17 considers appropriate, a set of voluntary guidelines and 

18 specifications for internal artificial intelligence assurance 

19 and external artificial intelligence assurance. 

20 (b) CONTENTS.—The guidelines and specifications 

21 required by subsection (a) shall— 

22 (1) identify consensus-driven, voluntary stand23 ards for internal artificial intelligence assurance and 

24 external artificial intelligence assurance that ad25 dress— 


ssavage on LAPJG3WLY3PROD with BILLS
7 

•S 4769 IS

1 (A) safeguards for consumer privacy; 

2 (B) methods to assess and mitigate harms 

3 to individuals by artificial intelligence systems; 

4 (C) dataset quality; 

5 (D) documentation, disclosure, and prove6 nance communications to external parties; and 

7 (E) governance and process controls; 

8 (2) provide guidelines, best practices, meth9 odologies, procedures, and processes, as appropriate, 

10 for internal artificial intelligence assurance and ex11 ternal artificial intelligence assurance that effectively 

12 address the elements listed in paragraph (1); 

13 (3) establish common definitions and character14 izations for testing, evaluating, verifying, and vali15 dating methods for internal artificial intelligence as16 surance and external artificial intelligence assurance; 

17 (4) recommend criteria or approaches for a de18 veloper or deployer to determine the frequency and 

19 circumstances under which internal artificial intel20 ligence assurance and external artificial intelligence 

21 assurance activities should be conducted, accounting 

22 for the relevant risk and use-case profile of the arti23 ficial intelligence system, and any additional cir24 cumstance under which an assurance should be con25 ducted; 


ssavage on LAPJG3WLY3PROD with BILLS
8 

•S 4769 IS

1 (5) recommend criteria or approaches for a de2 veloper or deployer to determine the scope of inter3 nal artificial intelligence assurance and external arti4 ficial intelligence assurance conducted through test5 ing and evaluating, accounting for the relevant risk 

6 and use-case profile of the artificial intelligence sys7 tem, including the minimum information or technical 

8 resources that should be provided to the party con9 ducting the assurance to enable assurance activities; 

10 (6) recommend the appropriate qualifications, 

11 expertise, professional licensing, and accountability 

12 that a party conducting internal artificial intel13 ligence assurance or external artificial intelligence 

14 assurance should have with respect to— 

15 (A) the type of artificial intelligence system 

16 under evaluation; and 

17 (B) the internal and external assurance 

18 processes; 

19 (7) provide guidance for the manner in which a 

20 developer or deployer may disclose, as appropriate, 

21 the results of an internal or external assurance or 

22 carry out corrective actions with respect to an artifi23 cial intelligence system following the completion of 

24 an internal or external assurance of such system, 

25 and guidance on the manner in which a developer or 


ssavage on LAPJG3WLY3PROD with BILLS
9 

•S 4769 IS

1 deployer may properly document any corrective ac2 tion taken; 

3 (8) align with the voluntary consensus stand4 ards, including international standards, identified 

5 pursuant to paragraph (1) to the fullest extent pos6 sible; 

7 (9) incorporate the relevant voluntary consensus 

8 standards identified pursuant to paragraph (1) and 

9 industry best practices to the fullest extent possible; 

10 (10) not prescribe or otherwise require— 

11 (A) the use of any specific solution; or 

12 (B) the use of any specific information or 

13 any communications technology product or serv14 ice; and 

15 (11) recommend methods to protect the con16 fidentiality of sensitive information, including per17 sonal data and proprietary knowledge of an artificial 

18 intelligence system, that may be obtained during the 

19 assurance process. 

20 (c) STAKEHOLDER OUTREACH.—In developing the 

21 voluntary guidelines and specifications required by sub22 section (a), the Director shall— 

23 (1) solicit public comment on at least 1 draft of 

24 the guidelines and specifications, and provide a reaVerDate Sep 11 2014 22:25 Jul 29, 2024 Jkt 049200 PO 00000 Frm 00009 Fmt 6652 Sfmt 6201 E:\BILLS\S4769.IS S4769

ssavage on LAPJG3WLY3PROD with BILLS
10 

•S 4769 IS

1 sonable period of not less than 30 days for the sub2 mission of comments by interested stakeholders; 

3 (2) make each draft of the voluntary guidelines 

4 and specifications developed under subsection (a) 

5 available to the public on the website of the National 

6 Institute of Standards and Technology; and 

7 (3) convene workshops, roundtables, and other 

8 public forums, as the Director considers appropriate, 

9 to consult with relevant stakeholders in industry, 

10 academia, civil society, consumer advocacy, work11 force development organizations, labor organizations, 

12 conformance assessment bodies, and any other sec13 tor the Director considers appropriate, on the devel14 opment of the voluntary guidelines and specifica15 tions. 

16 (d) PUBLICATION.—The Director shall publish the 

17 voluntary guidelines and specifications required by sub18 section (a)— 

19 (1) as a standalone framework or document 

20 available to the public on the website of the National 

21 Institute of Standards and Technology; or 

22 (2) as a component of— 

23 (A) any successor of the Artificial Intel24 ligence Risk Management Framework developed 

25 and updated pursuant to section 22A(c) of the 


ssavage on LAPJG3WLY3PROD with BILLS
11 

•S 4769 IS

1 National Institute of Standards and Technology 

2 Act (15 U.S.C. 278h–1(c)); or 

3 (B) any guidance issued by the Artificial 

4 Intelligence Safety Institute. 

5 SEC. 5. QUALIFICATIONS ADVISORY COMMITTEE. 

6 (a) ADVISORY COMMITTEE.—Not later than 90 days 

7 after the date on which the Director publishes the vol8 untary guidelines and specifications required under section 

9 4(a), the Secretary shall establish the Artificial Intel10 ligence Assurance Qualifications Advisory Committee (re11 ferred to in this section as the ‘‘Advisory Committee’’). 

12 (b) MEMBERSHIP.—The Secretary shall appoint to 

13 the Advisory Committee not more than 15 individuals with 

14 expertise relating to artificial intelligence systems, includ15 ing at least 1 representative from each of the following: 

16 (1) Institutions of higher education. 

17 (2) Organizations developing artificial intel18 ligence systems. 

19 (3) Organizations deploying artificial intel20 ligence systems. 

21 (4) Organizations assessing artificial intel22 ligence systems. 

23 (5) Consumers or consumer advocacy groups. 

24 (6) Public health organizations. 

25 (7) Public safety organizations. 


ssavage on LAPJG3WLY3PROD with BILLS
12 

•S 4769 IS

1 (8) Civil rights organizations. 

2 (9) Professional accreditation organizations. 

3 (10) Workforce development organizations. 

4 (11) Labor organizations. 

5 (c) DUTIES.—The Advisory Committee shall— 

6 (1) review and assess case studies from entities 

7 that provide licensure, certification, or accreditation 

8 to independent organizations with a primary mission 

9 of verifying compliance with applicable statutes, reg10 ulations, standards, or guidelines; and 

11 (2) determine the applicability of the case stud12 ies reviewed and assessed under paragraph (1) to 

13 the development, maintenance, and use of artificial 

14 intelligence systems for the purpose of developing 

15 recommendations under subsection (d). 

16 (d) RECOMMENDATIONS.—Not later than 1 year 

17 after the date on which the Secretary establishes the Advi18 sory Committee under this section, the Advisory Com19 mittee shall submit to the Secretary and Congress and 

20 make publicly available a report that includes rec21 ommendations for the Secretary to consider regarding— 

22 (1) the qualifications, expertise, professional li23 censing, independence, and accountability that a 

24 party conducting an assurance of an artificial intel25 ligence system should have, including with respect to 


ssavage on LAPJG3WLY3PROD with BILLS
13 

•S 4769 IS

1 the type of artificial intelligence system under eval2 uation and the internal and external assurance proc3 esses; and 

4 (2) whether accreditation for internal artificial 

5 intelligence assurance and external artificial intel6 ligence assurance can be met through a combination 

7 of existing licensure, certification, or accreditation 

8 programs. 

9 (e) TERMINATION.—The Advisory Committee shall 

10 terminate not later than 1 year after the date on which 

11 the Advisory Committee submits the recommendations re12 quired under subsection (d). 

13 SEC. 6. STUDY AND REPORT ON ENTITIES THAT CONDUCT 

14 ASSURANCES OF ARTIFICIAL INTELLIGENCE 

15 SYSTEMS. 

16 (a) STUDY.—Not later than 90 days after the date 

17 on which the Director publishes the voluntary guidelines 

18 and specifications required under section 4(a), the Sec19 retary shall commence a study to evaluate the capabilities 

20 of the sector of entities that conduct internal artificial in21 telligence assurances and external artificial intelligence as22 surances. 

23 (b) CONSIDERATIONS.—In carrying out the study re24 quired by subsection (a), the Secretary shall— 


ssavage on LAPJG3WLY3PROD with BILLS
14 

•S 4769 IS

1 (1) assess the capabilities of the sector of enti2 ties described in subsection (a) with respect to per3 sonnel, technical tools, evaluation methods, com4 puting infrastructure, and physical infrastructure 

5 and whether such capabilities are adequate for pro6 viding internal artificial intelligence assurances or 

7 external artificial intelligence assurances that com8 port with the voluntary guidelines and specifications 

9 required under section 4(a); 

10 (2) review the features, best practices, and safe11 guards employed by such entities to maintain the in12 tegrity of confidential or proprietary information of 

13 a developer or deployer during an internal artificial 

14 intelligence assurance or an external artificial intel15 ligence assurance; 

16 (3) assess the market demand for internal arti17 ficial intelligence assurances and external artificial 

18 intelligence assurances and the availability of such 

19 assurers; and 

20 (4) assess the feasibility of leveraging an exist21 ing facility accredited by the Director under the Na22 tional Voluntary Laboratory Accreditation Program 

23 established under section 285 of title 15, Code of 

24 Federal Regulations, to conduct external assurances 

25 of artificial intelligence systems. 


ssavage on LAPJG3WLY3PROD with BILLS
15 

•S 4769 IS

1 (c) REPORT.—Not later than 1 year after the date 

2 on which the Secretary commences the study required by 

3 subsection (a), the Secretary shall submit to the appro4 priate committees of Congress and the head of any Fed5 eral agency that the Secretary considers relevant, a report 

6 that contains the results of the study required by sub7 section (a), including— 

8 (1) recommendations for improving the capa9 bilities and the availability of the entities assessed in 

10 the study; 

11 (2) descriptions of the features, best practices, 

12 and safeguards of the entities studied and the effec13 tiveness of such features, practices, or safeguards at 

14 implementing the voluntary guidelines and specifica15 tions required under section 4(a) and at maintaining 

16 the integrity of confidential and proprietary informa17 tion, as described under subsection (b)(2); and 

18 (3) any conclusions drawn from the assessment 

19 of the facilities described in subsection (b)(4). 

20 (d) APPROPRIATE COMMITTEES OF CONGRESS DE21 FINED.—In this section, the term the ‘‘appropriate com22 mittees of Congress’’ means— 

23 (1) the Committee of Commerce, Science, and 

24 Transportation of the Senate; and 


ssavage on LAPJG3WLY3PROD with BILLS
16 

•S 4769 IS

1 (2) the Committee on Science, Space, and 

2 Technology of the House of Representatives. 

Æ 


ssavage on LAPJG3WLY3PROD with BILLS