II 

118TH CONGRESS 

1ST SESSION S. 3205 

To require Federal agencies to use the Artificial Intelligence Risk Management Framework developed by the National Institute of Standards and 

Technology with respect to the use of artificial intelligence. 

IN THE SENATE OF THE UNITED STATES 

NOVEMBER 2, 2023 

Mr. MORAN (for himself and Mr. WARNER) introduced the following bill; 

which was read twice and referred to the Committee on Homeland Security and Governmental Affairs 

A BILL 

To require Federal agencies to use the Artificial Intelligence 

Risk Management Framework developed by the National 

Institute of Standards and Technology with respect to 

the use of artificial intelligence. 

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 

3 SECTION 1. SHORT TITLE. 

4 This Act may be cited as the ‘‘Federal Artificial Intel5 ligence Risk Management Act of 2023’’. 

6 SEC. 2. AGENCY USE OF ARTIFICIAL INTELLIGENCE. 

7 (a) DEFINITIONS.—In this section: 

2 

•S 3205 IS

1 (1) ADMINISTRATOR.—The term ‘‘Adminis2 trator’’ means the Administrator of Federal Pro3 curement Policy. 

4 (2) AGENCY.—The term ‘‘agency’’ means any 

5 department, independent establishment, Government 

6 corporation, or other agency of the executive branch 

7 of the Federal Government. 

8 (3) ARTIFICIAL INTELLIGENCE.—The term ‘‘ar9 tificial intelligence’’ has the meaning given the term 

10 in section 5002 of the National Artificial Intelligence 

11 Initiative Act of 2020 (15 U.S.C. 9401). 

12 (4) DIRECTOR.—The term ‘‘Director’’ means 

13 the Director of the National Institute of Standards 

14 and Technology. 

15 (5) FRAMEWORK.—The term ‘‘framework’’ 

16 means document number NIST AI 100–1 of the Na17 tional Institute of Standards and Technology enti18 tled ‘‘Artificial Intelligence Risk Management 

19 Framework’’, or any successor document. 

20 (6) PLAYBOOK.—The term ‘‘playbook’’ means 

21 the AI RMF Playbook developed by the National In22 stitute of Standards and Technology. 

23 (7) PROFILE.—The term ‘‘profile’’ means an 

24 implementation of the artificial intelligence risk 

25 management functions, categories, and subcategories 

3 

•S 3205 IS

1 for a specific setting or application based on the re2 quirements, risk tolerance, and resources of the 

3 framework user. 

4 (b) REQUIREMENTS FOR AGENCY USE OF ARTIFI5 CIAL INTELLIGENCE.— 

6 (1) OMB GUIDANCE.—Not later than 180 days 

7 after the date on which the Director of the National 

8 Institute of Standards and Technology issues guide9 lines under paragraph (2), the Director of the Office 

10 of Management and Budget shall issue guidance re11 quiring agencies to incorporate the framework and 

12 the guidelines into their artificial intelligence risk 

13 management efforts, consistent with such guidelines. 

14 (2) NIST GUIDELINES.—Not later than 1 year 

15 after the date of the enactment of this Act, the Di16 rector of the National Institute of Standards and 

17 Technology shall, in consultation with the Adminis18 trator, issue guidance for agencies to incorporate the 

19 framework into the artificial intelligence risk man20 agement efforts of the agency, which shall— 

21 (A) provide standards, practices, and tools 

22 consistent with the framework and how they 

23 can leverage the framework to reduce risks to 

24 people and the planet for agency implementaVerDate Sep 11 2014 23:45 Nov 03, 2023 Jkt 049200 PO 00000 Frm 00003 Fmt 6652 Sfmt 6201 E:\BILLS\S3205.IS S3205
4 

•S 3205 IS

1 tion in the development, procurement, and use 

2 of artificial intelligence; 

3 (B) specify appropriate cybersecurity strat4 egies and the installation of effective cybersecu5 rity tools to improve security of artificial intel6 ligence systems; 

7 (C) provide standards— 

8 (i) that are consistent with the frame9 work and Circular A–119 of the Office of 

10 Management and Budget; 

11 (ii) that are tailored to risks that 

12 could endanger people and the planet; and 

13 (iii) which a supplier of artificial intel14 ligence for the agency must attest to meet 

15 before the head of an agency may procure 

16 artificial intelligence from that supplier; 

17 (D) recommend training on the framework 

18 and the guidelines for each agency responsible 

19 for procuring artificial intelligence; 

20 (E) set minimum requirements for devel21 oping profiles for agency use of artificial intel22 ligence consistent with the framework; and 

23 (F) develop profiles for framework use for 

24 an entity that is a small business concern (as 

5 

•S 3205 IS

1 defined in section 3 of the Small Business Act 

2 (15 U.S.C. 632)). 

3 (3) ADDITIONAL REQUIREMENTS.— 

4 (A) DRAFT CONTRACT LANGUAGE.—The 

5 Administrator shall, in consultation with the 

6 Director, provide draft contract language for 

7 each agency to use in procurement that requires 

8 a supplier of artificial intelligence— 

9 (i) to adhere to certain actions that 

10 are consistent with the framework; and 

11 (ii) to provide appropriate access to 

12 data, models, and parameters, as defined 

13 by the Director, to enable sufficient test 

14 and evaluation, verification, and validation. 

15 (B) TEMPLATES.—The Director of the Of16 fice of Management and Budget shall, in con17 sultation with the Director, provide a template 

18 for agency use on the guidance issued under 

19 paragraph (1) that includes recommended pro20 cedures for implementation. 

21 (4) CONFORMING REQUIREMENT.—The head of 

22 each agency shall conform any policy, principle, 

23 practice, procedure, or guideline governing the de24 sign, development, implementation, deployment, use, 

25 or evaluation of an artificial intelligence system by 

6 

•S 3205 IS

1 the agency to the framework and to the guidance 

2 issued under paragraph (1). 

3 (5) SUPPORTING MATERIAL.—In carrying out 

4 paragraph (4), the head of each agency may use the 

5 supporting materials of the framework, including the 

6 playbook. 

7 (6) STUDY.—Not later than 1 year after the 

8 date of enactment of this Act, the Comptroller Gen9 eral of the United States shall conduct a study on 

10 the impact of the application of the framework on 

11 agency use of artificial intelligence. 

12 (7) REPORTING REQUIREMENT.—Not later than 

13 1 year after the date of the enactment of this Act, 

14 and not less frequently than once every 3 years 

15 thereafter, the Director of the Office of Management 

16 and Budget shall submit to Congress a report on 

17 agency implementation of and conformity to the 

18 framework. 

19 (8) EXCEPTION FOR NATIONAL SECURITY SYS20 TEMS.—Nothing in this subsection shall apply to a 

21 national security system (as defined in section 3552 

22 of title 44, United States Code). 

23 (c) REQUIREMENTS FOR AGENCY PROCUREMENT OF

24 ARTIFICIAL INTELLIGENCE.—Not later than 1 year after 

25 the issuance of guidance pursuant to subsection (b)(1), the 

7 

•S 3205 IS

1 Federal Acquisition Regulatory Council shall promulgate 

2 regulations that provide for— 

3 (1) the requirements for the acquisition of arti4 ficial intelligence products, services, tools, and sys5 tems, to include risk-based compliance with the 

6 framework; and 

7 (2) solicitation provisions and contract clauses 

8 that include references to the requirements described 

9 in paragraph (1) and the framework for use in arti10 ficial intelligence acquisitions. 

11 (d) ARTIFICIAL INTELLIGENCE WORKFORCE.— 

12 (1) IN GENERAL.—Not later than 180 days 

13 after the date of the enactment of this Act, the Di14 rector of the Office of Management and Budget 

15 shall, in consultation with the Administrator of the 

16 General Services Administration, establish an initia17 tive to provide to agencies expertise on artificial in18 telligence pursuant to requests for such expertise by 

19 the heads of such agencies. 

20 (2) ELEMENTS.—The initiative established pur21 suant to paragraph (1) shall include the following: 

22 (A) The recruitment and hiring of inter23 disciplinary experts who can assist agencies in 

24 the development, procurement, use, and assess25 ment of artificial intelligence tools. 

8 

•S 3205 IS

1 (B) A process for establishing development 

2 and deployment guidelines and tools for man3 aging artificial intelligence risks under which 

4 the initiative can assist agencies. 

5 (C) Consultation with existing initiatives, 

6 including United States Digital Service and the 

7 technology transformation services of the Gen8 eral Services Administration, to incorporate 

9 best practices for assisting agencies in the de10 velopment, procurement, use, and assessment of 

11 artificial intelligence tools. 

12 (e) TESTING AND EVALUATION OF ARTIFICIAL IN13 TELLIGENCE.— 

14 (1) STUDY.—Not later than 90 days after the 

15 date of the enactment of this Act, the Director of 

16 the National Institute of Standards and Technology 

17 shall complete a study to review the existing and 

18 forthcoming voluntary consensus standards for the 

19 test, evaluation, verification, and validation of artifi20 cial intelligence acquisitions. 

21 (2) DEVELOPMENT OF VOLUNTARY CONSENSUS

22 STANDARDS.—Not later than 90 days after the date 

23 of the completion of the study required by paragraph 

24 (1), the Director shall— 

9 

•S 3205 IS

1 (A) convene relevant stakeholders to de2 velop voluntary consensus standards for the 

3 test, evaluation, verification, and validation of 

4 artificial intelligence acquisitions; 

5 (B) upon completion of the standards de6 scribed in subparagraph (A) or within 1 year, 

7 whichever is sooner— 

8 (i) develop methods and principles, 

9 based on the standards described in sub10 paragraph (A), for the conduct of test, 

11 evaluation, verification, and validation of 

12 artificial intelligence acquisitions; 

13 (ii) establish the resources for the 

14 conduct of test, evaluation, verification, 

15 and validation of artificial intelligence ac16 quisitions; 

17 (iii) monitor and review all test, eval18 uation, verification, and validation of artifi19 cial intelligence acquisitions; and 

20 (iv) review and make recommenda21 tions to the head of each agency of risks 

22 to people and the plant on relevant artifi23 cial intelligence acquisitions; and 

24 (C) continuously update the methods and 

25 principles described in subparagraph (B)(i) 

10 

•S 3205 IS

1 based on evolving voluntary consensus stand2 ards. 

Æ