II 

Calendar No. 723 

118TH CONGRESS 

2D SESSION S. 3312 

To provide a framework for artificial intelligence innovation and 

accountability, and for other purposes. 

IN THE SENATE OF THE UNITED STATES 

NOVEMBER 15, 2023 

Mr. THUNE (for himself, Ms. KLOBUCHAR, Mr. WICKER, Mr. HICKENLOOPER, 

Mr. LUJA ́N, Mrs. CAPITO, Ms. BALDWIN, and Ms. LUMMIS) introduced 

the following bill; which was read twice and referred to the Committee 

on Commerce, Science, and Transportation 

DECEMBER 18 (legislative day, DECEMBER 16), 2024 

Reported by Ms. CANTWELL, with an amendment 

[Strike out all after the enacting clause and insert the part printed in italic] 

A BILL 

To provide a framework for artificial intelligence innovation 

and accountability, and for other purposes. 

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 

3 SECTION 1. SHORT TITLE. 

4 This Act may be cited as the ‘‘Artificial Intelligence 

5 Research, Innovation, and Accountability Act of 2023’’. 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
2 

•S 3312 RS

1 SEC. 2. TABLE OF CONTENTS. 

2 The table of contents for this Act is as follows: 

Sec. 1. Short title. 

Sec. 2. Table of contents. 

TITLE I—ARTIFICIAL INTELLIGENCE RESEARCH AND 

INNOVATION 

Sec. 101. Open data policy amendments. 

Sec. 102. Online content authenticity and provenance standards research and 

development. 

Sec. 103. Standards for detection of emergent and anomalous behavior and AIgenerated media. 

Sec. 104. Comptroller General study on barriers and best practices to usage of 

AI in government. 

TITLE II—ARTIFICIAL INTELLIGENCE ACCOUNTABILITY 

Sec. 201. Definitions. 

Sec. 202. Generative artificial intelligence transparency. 

Sec. 203. Transparency reports for high-impact artificial intelligence systems. 

Sec. 204. Recommendations to Federal agencies for risk management of highimpact artificial intelligence systems. 

Sec. 205. Office of Management and Budget oversight of recommendations to 

agencies. 

Sec. 206. Risk management assessment for critical-impact artificial intelligence 

systems. 

Sec. 207. Certification of critical-impact artificial intelligence systems. 

Sec. 208. Enforcement. 

Sec. 209. Artificial intelligence consumer education. 

3 TITLE I—ARTIFICIAL INTEL4 LIGENCE RESEARCH AND IN5 NOVATION 

6 SEC. 101. OPEN DATA POLICY AMENDMENTS. 

7 Section 3502 of title 44, United States Code, is 

8 amended— 

9 (1) in paragraph (22)— 

10 (A) by inserting ‘‘or data model’’ after ‘‘a 

11 data asset’’; and 

12 (B) by striking ‘‘and’’ at the end; 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
3 

•S 3312 RS

1 (2) in paragraph (23), by striking the period at 

2 the end and inserting a semicolon; and 

3 (3) by adding at the end the following: 

4 ‘‘(24) the term ‘data model’ means a mathe5 matical, economic, or statistical representation of a 

6 system or process used to assist in making calcula7 tions and predictions, including through the use of 

8 algorithms, computer programs, or artificial intel9 ligence systems; and 

10 ‘‘(25) the term ‘artificial intelligence system’ 

11 means an engineered system that— 

12 ‘‘(A) generates outputs, such as content, 

13 predictions, recommendations, or decisions for a 

14 given set of objectives; and 

15 ‘‘(B) is designed to operate with varying 

16 levels of adaptability and autonomy using ma17 chine and human-based inputs.’’. 

18 SEC. 102. ONLINE CONTENT AUTHENTICITY AND PROVE19 NANCE STANDARDS RESEARCH AND DEVEL20 OPMENT. 

21 (a) RESEARCH.— 

22 (1) IN GENERAL.—Not later than 180 days 

23 after the date of the enactment of this Act, the 

24 Under Secretary of Commerce for Standards and 

25 Technology shall carry out research to facilitate the 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
4 

•S 3312 RS

1 development and standardization of means to pro2 vide authenticity and provenance information for 

3 content generated by human authors and artificial 

4 intelligence systems. 

5 (2) ELEMENTS.—The research carried out pur6 suant to paragraph (1) shall cover the following: 

7 (A) Secure and binding methods for 

8 human authors of content to append statements 

9 of provenance through the use of unique cre10 dentials, watermarking, or other data or 

11 metadata-based approaches. 

12 (B) Methods for the verification of state13 ments of content provenance to ensure authen14 ticity such as watermarking or classifiers, which 

15 are trained models that distinguish artificial in16 telligence-generated media. 

17 (C) Methods for displaying clear and con18 spicuous statements of content provenance to 

19 the end user. 

20 (D) Technologies or applications needed to 

21 facilitate the creation and verification of con22 tent provenance information. 

23 (E) Mechanisms to ensure that any tech24 nologies and methods developed under this secVerDate Sep 11 2014 06:32 Dec 19, 2024 Jkt 059200 PO 00000 Frm 00004 Fmt 6652 Sfmt 6401 E:\BILLS\S3312.RS S3312

kjohnson on DSK7ZCZBW3PROD with $$_JOB
5 

•S 3312 RS

1 tion are minimally burdensome on content pro2 ducers. 

3 (F) Such other related processes, tech4 nologies, or applications as the Under Secretary 

5 considers appropriate. 

6 (G) Use of provenance technology to en7 able attribution for content creators. 

8 (3) IMPLEMENTATION.—The Under Secretary 

9 shall carry out the research required by paragraph 

10 (1) as part of the research directives pursuant to 

11 section 22A(b)(1) of the National Institute of Stand12 ards and Technology Act (15 U.S.C. 278h–1(b)(1)). 

13 (b) DEVELOPMENT OF STANDARDS.— 

14 (1) IN GENERAL.—For methodologies and ap15 plications related to content provenance and authen16 ticity deemed by the Under Secretary to be at a 

17 readiness level sufficient for standardization, the 

18 Under Secretary shall provide technical review and 

19 assistance to such other Federal agencies and non20 governmental standards organizations as the Under 

21 Secretary considers appropriate. 

22 (2) CONSIDERATIONS.—In providing any tech23 nical review and assistance related to the develop24 ment of content provenance and authenticity standVerDate Sep 11 2014 06:32 Dec 19, 2024 Jkt 059200 PO 00000 Frm 00005 Fmt 6652 Sfmt 6401 E:\BILLS\S3312.RS S3312

kjohnson on DSK7ZCZBW3PROD with $$_JOB
6 

•S 3312 RS

1 ards under this subsection, the Under Secretary 

2 may— 

3 (A) consider whether a proposed standard 

4 is reasonable, practicable, and appropriate for 

5 the particular type of media and media environ6 ment for which the standard is proposed; 

7 (B) consult with relevant stakeholders; and 

8 (C) review industry standards issued by 

9 nongovernmental standards organizations. 

10 (c) PILOT PROGRAM.— 

11 (1) IN GENERAL.—The Under Secretary shall 

12 carry out a pilot program to assess the feasibility 

13 and advisability of using available technologies and 

14 creating open standards to facilitate the creation 

15 and verification of content governance information 

16 for digital content. 

17 (2) LOCATIONS.—The pilot program required 

18 by paragraph (1) shall be carried out at not more 

19 than 2 Federal agencies the Under Secretary shall 

20 select for purposes of the pilot program required by 

21 paragraph (1). 

22 (3) REQUIREMENTS.—In carrying out the pilot 

23 program required by paragraph (1), the Under Sec24 retary shall— 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
7 

•S 3312 RS

1 (A) apply and evaluate methods for au2 thenticating the origin of and modifications to 

3 government-produced digital content using tech4 nology and open standards described in para5 graph (1); and 

6 (B) make available to the public digital 

7 content embedded with provenance or other au8 thentication provided by the heads of the Fed9 eral agencies selected pursuant to paragraph 

10 (2) for the purposes of the pilot program. 

11 (4) BRIEFING REQUIRED.—Not later than 1 

12 year after the date of the enactment of this Act, and 

13 annually thereafter until the date described in para14 graph (5), the Under Secretary shall brief the Com15 mittee on Commerce, Science, and Transportation of 

16 the Senate and the Committee on Science, Space, 

17 and Technology of the House of Representatives on 

18 the findings of the Under Secretary with respect to 

19 the pilot program carried out under this subsection. 

20 (5) TERMINATION.—The pilot program shall 

21 terminate on the date that is 10 years after the date 

22 of the enactment of this Act. 

23 (d) REPORT TO CONGRESS.—Not later than 1 year 

24 after the date of the enactment of this Act, the Under 

25 Secretary shall submit to the Committee on Commerce, 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
8 

•S 3312 RS

1 Science, and Transportation of the Senate and the Com2 mittee on Science, Space, and Technology of the House 

3 of Representatives a report outlining the progress of 

4 standardization initiatives relating to requirements under 

5 this section, as well as recommendations for legislative or 

6 administrative action to encourage or require the wide7 spread adoption of such initiatives in the United States. 

8 SEC. 103. STANDARDS FOR DETECTION OF EMERGENT AND 

9 ANOMALOUS BEHAVIOR AND AI-GENERATED 

10 MEDIA. 

11 Section 22A(b)(1) of the National Institute of Stand12 ards and Technology Act (15 U.S.C. 278h–1(b)(1)) is 

13 amended— 

14 (1) by redesignating subparagraph (I) as sub15 paragraph (K); 

16 (2) in subparagraph (H), by striking ‘‘; and’’ 

17 and inserting a semicolon; and 

18 (3) by inserting after subparagraph (H) the fol19 lowing: 

20 ‘‘(I) best practices for detecting outputs 

21 generated by artificial intelligence systems, in22 cluding content such as text, audio, images, and 

23 videos; 

24 ‘‘(J) methods to detect and understand 

25 anomalous behavior of artificial intelligence sysVerDate Sep 11 2014 06:32 Dec 19, 2024 Jkt 059200 PO 00000 Frm 00008 Fmt 6652 Sfmt 6401 E:\BILLS\S3312.RS S3312

kjohnson on DSK7ZCZBW3PROD with $$_JOB
9 

•S 3312 RS

1 tems and safeguards to mitigate potentially ad2 versarial or compromising anomalous behavior; 

3 and’’. 

4 SEC. 104. COMPTROLLER GENERAL STUDY ON BARRIERS 

5 AND BEST PRACTICES TO USAGE OF AI IN 

6 GOVERNMENT. 

7 (a) IN GENERAL.—Not later than 1 year after the 

8 date of enactment of this Act, the Comptroller General 

9 of the United States shall— 

10 (1) conduct a review of statutory, regulatory, 

11 and other policy barriers to the use of artificial intel12 ligence systems to improve the functionality of the 

13 Federal Government; and 

14 (2) identify best practices for the adoption and 

15 use of artificial intelligence systems by the Federal 

16 Government, including— 

17 (A) ensuring that an artificial intelligence 

18 system is proportional to the need of the Fed19 eral Government; 

20 (B) restrictions on access to and use of an 

21 artificial intelligence system based on the capa22 bilities and risks of the artificial intelligence 

23 system; and 

24 (C) safety measures that ensure that an 

25 artificial intelligence system is appropriately 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
10 

•S 3312 RS

1 limited to necessary data and compartmen2 talized from other assets of the Federal Govern3 ment. 

4 (b) REPORT.—Not later than 2 years after the date 

5 of enactment of this Act, the Comptroller General of the 

6 United States shall submit to the Committee on Com7 merce, Science, and Transportation of the Senate and the 

8 Committee on Science, Space, and Technology of the 

9 House of Representatives a report that— 

10 (1) summarizes the results of the review con11 ducted under subsection (a)(1) and the best prac12 tices identified under subsection (a)(2), including 

13 recommendations, as the Comptroller General of the 

14 United States considers appropriate; 

15 (2) describes any laws, regulations, guidance 

16 documents, or other policies that may prevent the 

17 adoption of artificial intelligence systems by the 

18 Federal Government to improve certain functions of 

19 the Federal Government, including— 

20 (A) data analysis and processing; 

21 (B) paperwork reduction; 

22 (C) contracting and procurement practices; 

23 and 

24 (D) other Federal Government services; 

25 and 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
11 

•S 3312 RS

1 (3) includes, as the Comptroller General of the 

2 United States considers appropriate, recommenda3 tions to modify or eliminate barriers to the use of 

4 artificial intelligence systems by the Federal Govern5 ment. 

6 TITLE II—ARTIFICIAL INTEL7 LIGENCE ACCOUNTABILITY 

8 SEC. 201. DEFINITIONS. 

9 In this title: 

10 (1) APPROPRIATE CONGRESSIONAL COMMIT11 TEES.—The term ‘‘appropriate congressional com12 mittees’’ means— 

13 (A) the Committee on Energy and Natural 

14 Resources and the Committee on Commerce, 

15 Science, and Transportation of the Senate; 

16 (B) the Committee on Energy and Com17 merce of the House of Representatives; and 

18 (C) each congressional committee with ju19 risdiction over an applicable covered agency. 

20 (2) ARTIFICIAL INTELLIGENCE SYSTEM.—The 

21 term ‘‘artificial intelligence system’’ means an engi22 neered system that— 

23 (A) generates outputs, such as content, 

24 predictions, recommendations, or decisions for a 

25 given set of human-defined objectives; and 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
12 

•S 3312 RS

1 (B) is designed to operate with varying lev2 els of adaptability and autonomy using machine 

3 and human-based inputs. 

4 (3) COVERED AGENCY.—the term ‘‘covered 

5 agency’’ means an agency for which the Under Sec6 retary develops an NIST recommendation. 

7 (4) COVERED INTERNET PLATFORM.— 

8 (A) IN GENERAL.—The term ‘‘covered 

9 internet platform’’— 

10 (i) means any public-facing website, 

11 consumer-facing internet application, or 

12 mobile application available to consumers 

13 in the United States; and 

14 (ii) includes a social network site, 

15 video sharing service, search engine, and 

16 content aggregation service. 

17 (B) EXCLUSIONS.—The term ‘‘covered 

18 internet platform’’ does not include a platform 

19 that— 

20 (i) is wholly owned, controlled, and 

21 operated by a person that— 

22 (I) during the most recent 180- 

23 day period, did not employ more than 

24 500 employees; 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
13 

•S 3312 RS

1 (II) during the most recent 3- 

2 year period, averaged less than 

3 $50,000,000 in annual gross receipts; 

4 and 

5 (III) on an annual basis, collects 

6 or processes the personal data of less 

7 than 1,000,000 individuals; or 

8 (ii) is operated for the sole purpose of 

9 conducting research that is not directly or 

10 indirectly made for profit. 

11 (5) CRITICAL-IMPACT AI ORGANIZATION.—The 

12 term ‘‘critical-impact AI organization’’ means a non13 government organization that serves as the deployer 

14 of a critical-impact artificial intelligence system. 

15 (6) CRITICAL-IMPACT ARTIFICIAL INTEL16 LIGENCE SYSTEM.—The term ‘‘critical-impact artifi17 cial intelligence system’’ means an artificial intel18 ligence system that— 

19 (A) is deployed for a purpose other than 

20 solely for use by the Department of Defense or 

21 an intelligence agency (as defined in section 

22 3094(e) of the National Security Act of 1947 

23 (50 U.S.C. 3094(3))); and 

24 (B) is used or intended to be used— 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
14 

•S 3312 RS

1 (i) to make decisions that have a legal 

2 or similarly significant effect on— 

3 (I) the real-time or ex post facto 

4 collection of biometric data of natural 

5 persons by biometric identification 

6 systems without their consent; 

7 (II) the direct management and 

8 operation of critical infrastructure (as 

9 defined in section 1016(e) of the USA 

10 PATRIOT Act (42 U.S.C. 5195c(e))) 

11 and space-based infrastructure; or 

12 (III) criminal justice (as defined 

13 in section 901 of title I of the Omni14 bus Crime Control and Safe Streets 

15 Act of 1968 (34 U.S.C. 10251)); and 

16 (ii) in a manner that poses a signifi17 cant risk to rights afforded under the Con18 stitution of the United States or safety. 

19 (7) DEPLOYER.—The term ‘‘deployer’’— 

20 (A) means an entity that uses or operates 

21 an artificial intelligence system for internal use 

22 or for use by third parties; and 

23 (B) does not include an entity that is sole24 ly an end user of a system. 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
15 

•S 3312 RS

1 (8) DEVELOPER.—The term ‘‘developer’’ means 

2 an entity that— 

3 (A) designs, codes, produces, or owns an 

4 artificial intelligence system for internal use or 

5 for use by a third party as a baseline model; 

6 and 

7 (B) does not act as a deployer of the artifi8 cial intelligence system described in subpara9 graph (A). 

10 (9) GENERATIVE ARTIFICIAL INTELLIGENCE

11 SYSTEM.—The term ‘‘generative artificial intel12 ligence system’’ means an artificial intelligence sys13 tem that generates novel data or content in a writ14 ten, audio, or visual format. 

15 (10) HIGH-IMPACT ARTIFICIAL INTELLIGENCE

16 SYSTEM.—The term ‘‘high-impact artificial intel17 ligence system’’ means an artificial intelligence sys18 tem— 

19 (A) deployed for a purpose other than sole20 ly for use by the Department of Defense or an 

21 intelligence agency (as defined in section 

22 3094(e) of the National Security Act of 1947 

23 (50 U.S.C. 3094(3))); and 

24 (B) that is specifically developed with the 

25 intended purpose of making decisions that have 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
16 

•S 3312 RS

1 a legal or similarly significant effect on the ac2 cess of an individual to housing, employment, 

3 credit, education, healthcare, or insurance in a 

4 manner that poses a significant risk to rights 

5 afforded under the Constitution of the United 

6 States or safety. 

7 (11) NIST RECOMMENDATION.—The term 

8 ‘‘NIST recommendation’’ means a sector-specific 

9 recommendation developed under section 22B(b)(1) 

10 of the National Institute of Standards and Tech11 nology Act, as added by section 204 of this Act. 

12 (12) SECRETARY.—The term ‘‘Secretary’’ 

13 means the Secretary of Commerce. 

14 (13) SIGNIFICANT RISK.—The term ‘‘significant 

15 risk’’ means a combination of severe, high-intensity, 

16 high-probability, and long-duration risk of harm to 

17 individuals. 

18 (14) TEVV.—The term ‘‘TEVV’’ means the 

19 testing, evaluation, validation, and verification of 

20 any artificial intelligence system that includes— 

21 (A) open, transparent, testable, and 

22 verifiable specifications that characterize real23 istic operational performance, such as precision 

24 and accuracy for relevant tasks; 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
17 

•S 3312 RS

1 (B) testing methodologies and metrics that 

2 enable the evaluation of system trustworthiness, 

3 including robustness and resilience; 

4 (C) data quality standards for training and 

5 testing datasets; 

6 (D) requirements for system validation and 

7 integration into production environments, auto8 mated testing, and compliance with existing 

9 legal and regulatory specifications; 

10 (E) methods and tools for— 

11 (i) the monitoring of system behavior; 

12 (ii) the tracking of incidents or errors 

13 reported and their management; and 

14 (iii) the detection of emergent prop15 erties and related impacts; and 

16 (F) and processes for redress and re17 sponse. 

18 (15) UNDER SECRETARY.—The term ‘‘Under 

19 Secretary’’ means the Director of the National Insti20 tute of Standards and Technology. 

21 SEC. 202. GENERATIVE ARTIFICIAL INTELLIGENCE TRANS22 PARENCY. 

23 (a) PROHIBITION.— 

24 (1) IN GENERAL.—Subject to paragraph (2), it 

25 shall be unlawful for a person to operate a covered 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
18 

•S 3312 RS

1 internet platform that uses a generative artificial in2 telligence system. 

3 (2) DISCLOSURE OF USE OF GENERATIVE ARTI4 FICIAL INTELLIGENCE SYSTEMS.— 

5 (A) IN GENERAL.—A person may operate 

6 a covered internet platform that uses a genera7 tive artificial intelligence system if the person 

8 provides notice to each user of the covered 

9 internet platform that the covered internet plat10 form uses a generative artificial intelligence sys11 tem to generate content the user sees. 

12 (B) REQUIREMENTS.—A person providing 

13 the notice described in subparagraph (A) to a 

14 user— 

15 (i) subject to clause (ii), shall provide 

16 the notice in a clear and conspicuous man17 ner on the covered internet platform before 

18 the user interacts with content produced 

19 by a generative artificial intelligence sys20 tem; and 

21 (ii) may provide an option for the user 

22 to choose to see the notice described in 

23 clause (i) only upon the first interaction of 

24 the user with content produced by a gen25 erative artificial intelligence system. 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
19 

•S 3312 RS

1 (b) ENFORCEMENT ACTION.—Upon learning that a 

2 covered internet platform does not comply with the re3 quirements under this section, the Secretary— 

4 (1) shall immediately— 

5 (A) notify the covered internet platform of 

6 the finding; and 

7 (B) order the covered internet platform to 

8 take remedial action to address the noncompli9 ance of the generative artificial intelligence sys10 tem operated by the covered internet platform; 

11 and 

12 (2) may, as determined appropriate or nec13 essary by the Secretary, take enforcement action 

14 under section 208 if the covered internet platform 

15 does not take sufficient action to remedy the non16 compliance within 15 days of the notification under 

17 paragraph (1)(A). 

18 (c) EFFECTIVE DATE.—This section shall take effect 

19 on the date that is 180 days after the date of enactment 

20 of this Act. 

21 SEC. 203. TRANSPARENCY REPORTS FOR HIGH-IMPACT AR22 TIFICIAL INTELLIGENCE SYSTEMS. 

23 (a) TRANSPARENCY REPORTING.— 

24 (1) IN GENERAL.—Each deployer of a high-im25 pact artificial intelligence system shall— 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
20 

•S 3312 RS

1 (A) before deploying the high-impact artifi2 cial intelligence system, and annually there3 after, submit to the Secretary a report describ4 ing the design and safety plans for the artificial 

5 intelligence system; and 

6 (B) submit to the Secretary an updated re7 port on the high-impact artificial intelligence 

8 system if the deployer makes a material change 

9 to— 

10 (i) the purpose for which the high-im11 pact artificial intelligence system is used; 

12 or 

13 (ii) the type of data the high-impact 

14 artificial intelligence system processes or 

15 uses for training purposes. 

16 (2) CONTENTS.—Each transparency report sub17 mitted under paragraph (1) shall include, with re18 spect to the high-impact artificial intelligence sys19 tem— 

20 (A) the purpose; 

21 (B) the intended use cases; 

22 (C) deployment context; 

23 (D) benefits; 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
21 

•S 3312 RS

1 (E) a description of data that the high-im2 pact artificial intelligence system, once de3 ployed, processes as inputs; 

4 (F) if available— 

5 (i) a list of data categories and for6 mats the deployer used to retrain or con7 tinue training the high-impact artificial in8 telligence system; 

9 (ii) metrics for evaluating the high-im10 pact artificial intelligence system perform11 ance and known limitations; and 

12 (iii) transparency measures, including 

13 information identifying to individuals when 

14 a high-impact artificial intelligence system 

15 is in use; 

16 (G) processes and testing performed before 

17 each deployment to ensure the high-impact arti18 ficial intelligence system is safe, reliable, and 

19 effective; 

20 (H) if applicable, an identification of any 

21 third-party artificial intelligence systems or 

22 datasets the deployer relies on to train or oper23 ate the high-impact artificial intelligence sys24 tem; and 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
22 

•S 3312 RS

1 (I) post-deployment monitoring and user 

2 safeguards, including a description of the over3 sight process in place to address issues as 

4 issues arise. 

5 (b) DEVELOPER OBLIGATIONS.—The developer of a 

6 high-impact artificial intelligence system shall be subject 

7 to the same obligations as a developer of a critical impact 

8 artificial intelligence system under section 206(c). 

9 (c) CONSIDERATIONS.—In carrying out subsections 

10 (a) and (b), a deployer or developer of a high-impact artifi11 cial intelligence system shall consider the best practices 

12 outlined in the most recent version of the risk manage13 ment framework developed pursuant to section 22A(c) of 

14 the National Institute of Standards and Technology Act 

15 (15 U.S.C. 278h–1(c)). 

16 (d) NONCOMPLIANCE AND ENFORCEMENT ACTION.— 

17 Upon learning that a deployer of a high-impact artificial 

18 intelligence system is not in compliance with the require19 ments under this section with respect to a high-impact ar20 tificial intelligence system, the Secretary— 

21 (1) shall immediately— 

22 (A) notify the deployer of the finding; and 

23 (B) order the deployer to immediately sub24 mit to the Secretary the report required under 

25 subsection (a)(1); and 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
23 

•S 3312 RS

1 (2) if the deployer fails to submit the report by 

2 the date that is 15 days after the date of the notifi3 cation under paragraph (1)(A), may take enforce4 ment action under section 208. 

5 (e) AVOIDANCE OF DUPLICATION.— 

6 (1) IN GENERAL.—Pursuant to the 

7 deconfliction of duplicative requirements under para8 graph (2), the Secretary shall ensure that the re9 quirements under this section are not unnecessarily 

10 burdensome or duplicative of requirements made or 

11 oversight conducted by a covered agency regarding 

12 the non-Federal use of high-impact artificial intel13 ligence systems. 

14 (2) DECONFLICTION OF DUPLICATIVE REQUIRE15 MENTS.—Not later than 90 days after the date of 

16 the enactment of this Act, and annually thereafter, 

17 the Secretary, in coordination with the head of any 

18 relevant covered agency, shall complete the 

19 deconfliction of duplicative requirements relating to 

20 the submission of a transparency report for a high21 impact artificial intelligence system under this sec22 tion. 

23 (f) RULE OF CONSTRUCTION.—Nothing in this sec24 tion shall be construed to require a deployer of a highVerDate Sep 11 2014 06:32 Dec 19, 2024 Jkt 059200 PO 00000 Frm 00023 Fmt 6652 Sfmt 6401 E:\BILLS\S3312.RS S3312

kjohnson on DSK7ZCZBW3PROD with $$_JOB
24 

•S 3312 RS

1 impact artificial intelligence system to disclose any infor2 mation, including data or algorithms— 

3 (1) relating to a trade secret or other protected 

4 intellectual property right; 

5 (2) that is confidential business information; or 

6 (3) that is privileged. 

7 SEC. 204. RECOMMENDATIONS TO FEDERAL AGENCIES FOR 

8 RISK MANAGEMENT OF HIGH-IMPACT ARTIFI9 CIAL INTELLIGENCE SYSTEMS. 

10 The National Institute of Standards and Technology 

11 Act (15 U.S.C. 278h–1) is amended by inserting after sec12 tion 22A the following: 

13 ‘‘SEC. 22B. RECOMMENDATIONS TO FEDERAL AGENCIES 

14 FOR SECTOR-SPECIFIC OVERSIGHT OF ARTI15 FICIAL INTELLIGENCE. 

16 ‘‘(a) DEFINITION OF HIGH-IMPACT ARTIFICIAL IN17 TELLIGENCE SYSTEM.—In this section, the term ‘high-im18 pact artificial intelligence system’ means an artificial intel19 ligence system— 

20 ‘‘(1) deployed for purposes other than those 

21 solely for use by the Department of Defense or an 

22 element of the intelligence community (as defined in 

23 section 3 of the National Security Act of 1947 (50 

24 U.S.C. 3003)); and 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
25 

•S 3312 RS

1 ‘‘(2) that is specifically developed with the in2 tended purpose of making decisions that have a legal 

3 or similarly significant effect on the access of an in4 dividual to housing, employment, credit, education, 

5 health care, or insurance in a manner that poses a 

6 significant risk to rights afforded under the Con7 stitution of the United States or to safety. 

8 ‘‘(b) SECTOR-SPECIFIC RECOMMENDATIONS.—Not 

9 later than 1 year after the date of the enactment of the 

10 Artificial Intelligence Research, Innovation, and Account11 ability Act of 2023, the Director shall— 

12 ‘‘(1) develop sector-specific recommendations 

13 for individual Federal agencies to conduct oversight 

14 of the non-Federal, and, as appropriate, Federal use 

15 of high-impact artificial intelligence systems to im16 prove the safe and responsible use of such systems; 

17 and 

18 ‘‘(2) not less frequently than biennially, update 

19 the sector-specific recommendations to account for 

20 changes in technological capabilities or artificial in21 telligence use cases. 

22 ‘‘(c) REQUIREMENTS.—In developing recommenda23 tions under subsection (b), the Director shall use the vol24 untary risk management framework required by section 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
26 

•S 3312 RS

1 22A(c) to identify and provide recommendations to a Fed2 eral agency— 

3 ‘‘(1) to establish regulations, standards, guide4 lines, best practices, methodologies, procedures, or 

5 processes to facilitate oversight of non-Federal use 

6 of high-impact artificial intelligence systems; and 

7 ‘‘(2) to mitigate risks from such high-impact 

8 artificial intelligence systems. 

9 ‘‘(d) RECOMMENDATIONS.—In developing rec10 ommendations under subsection (b), the Director may in11 clude the following: 

12 ‘‘(1) Key design choices made during high-im13 pact artificial intelligence model development, includ14 ing rationale and assumptions made. 

15 ‘‘(2) Intended use and users, other possible use 

16 cases, including any anticipated undesirable or po17 tentially harmful use cases, and what good faith ef18 forts model developers can take to mitigate the use 

19 of the system in harmful ways. 

20 ‘‘(3) Methods for evaluating the safety of high21 impact artificial intelligence systems and approaches 

22 for responsible use. 

23 ‘‘(4) Sector-specific differences in what con24 stitutes acceptable high-impact artificial intelligence 

25 model functionality and trustworthiness, metrics 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
27 

•S 3312 RS

1 used to determine high-impact artificial intelligence 

2 model performance, and any test results reflecting 

3 application of these metrics to evaluate high-impact 

4 artificial intelligence model performance across dif5 ferent sectors. 

6 ‘‘(5) Recommendations to support iterative de7 velopment of subsequent recommendations under 

8 subsection (b). 

9 ‘‘(e) CONSULTATION.—In developing recommenda10 tions under subsection (b), the Director shall, as the Di11 rector considers applicable and practicable, consult with 

12 relevant covered agencies and stakeholders representing 

13 perspectives from civil society, academia, technologists, en14 gineers, and creators.’’. 

15 SEC. 205. OFFICE OF MANAGEMENT AND BUDGET OVER16 SIGHT OF RECOMMENDATIONS TO AGENCIES. 

17 (a) RECOMMENDATIONS.— 

18 (1) IN GENERAL.—Not later than 1 year after 

19 the date of enactment of this Act, the Under Sec20 retary shall submit to the Director, the head of each 

21 covered agency, and the appropriate congressional 

22 committees each NIST recommendation. 

23 (2) AGENCY RESPONSES TO RECOMMENDA24 TIONS.—Not later than 90 days after the date on 

25 which the Under Secretary submits a NIST recVerDate Sep 11 2014 06:32 Dec 19, 2024 Jkt 059200 PO 00000 Frm 00027 Fmt 6652 Sfmt 6401 E:\BILLS\S3312.RS S3312

kjohnson on DSK7ZCZBW3PROD with $$_JOB
28 

•S 3312 RS

1 ommendation to the head of a covered agency under 

2 paragraph (1), the head of the covered agency shall 

3 transmit to the Director a formal written response 

4 to the NIST recommendation that— 

5 (A) indicates whether the head of the cov6 ered agency intends to— 

7 (i) carry out procedures to adopt the 

8 complete NIST recommendation; 

9 (ii) carry out procedures to adopt a 

10 part of the NIST recommendation; or 

11 (iii) refuse to carry out procedures to 

12 adopt the NIST recommendation; and 

13 (B) includes— 

14 (i) with respect to a formal written re15 sponse described in clause (i) or (ii) of sub16 paragraph (A), a copy of a proposed time17 table for completing the procedures de18 scribed in that clause; 

19 (ii) with respect to a formal written 

20 response described in subparagraph (A)(ii), 

21 the reasons for the refusal to carry out 

22 procedures with respect to the remainder 

23 of the NIST recommendation described in 

24 that subparagraph; and 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
29 

•S 3312 RS

1 (iii) with respect to a formal written 

2 response described in subparagraph 

3 (A)(iii), the reasons for the refusal to carry 

4 out procedures. 

5 (b) PUBLIC AVAILABILITY.—The Director shall make 

6 a copy of each NIST recommendation and each written 

7 formal response of a covered agency required under sub8 section (a)(2) available to the public at reasonable cost. 

9 (c) REPORTING REQUIREMENTS.— 

10 (1) ANNUAL SECRETARIAL REGULATORY STA11 TUS REPORTS.— 

12 (A) IN GENERAL.—On the first February 

13 1 occurring after the date of enactment of this 

14 Act, and annually thereafter until the date de15 scribed in subparagraph (B), the head of each 

16 covered agency shall submit to the Director a 

17 report containing the regulatory status of each 

18 NIST recommendation. 

19 (B) CONTINUED REPORTING.—The date 

20 described in this subparagraph is the date on 

21 which the head of a covered agency— 

22 (i) takes final regulatory action with 

23 respect to a NIST recommendation; and 

24 (ii) determines and states in a report 

25 required under subparagraph (A) that no 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
30 

•S 3312 RS

1 regulatory action should be taken with re2 spect to a NIST recommendation. 

3 (2) COMPLIANCE REPORT TO CONGRESS.—On 

4 April 1 of each year, the Director shall— 

5 (A) review the reports received under para6 graph (1)(A); and 

7 (B) transmit comments on the reports to 

8 the heads of covered agencies and the appro9 priate congressional committees. 

10 (3) FAILURE TO REPORT.—If, on March 1 of 

11 each year, the Director has not received a report re12 quired under paragraph (1)(A) from the head of a 

13 covered agency, the Director shall notify the appro14 priate congressional committees of the failure. 

15 (d) TECHNICAL ASSISTANCE IN CARRYING OUT REC16 OMMENDATIONS.—The Under Secretary shall provide as17 sistance to the heads of covered agencies relating to the 

18 implementation of the NIST recommendations the heads 

19 of covered agencies intend to carry out. 

20 (e) REGULATION REVIEW AND IMPROVEMENT.—The 

21 Administrator of the Office of Information and Regulatory 

22 Affairs of the Office of Management and Budget, in con23 sultation with the Under Secretary, shall develop and peri24 odically revise performance indicators and measures for 

25 sector-specific regulation of artificial intelligence. 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
31 

•S 3312 RS

1 SEC. 206. RISK MANAGEMENT ASSESSMENT FOR CRITICAL2 IMPACT ARTIFICIAL INTELLIGENCE SYS3 TEMS. 

4 (a) REQUIREMENT.— 

5 (1) IN GENERAL.—Each critical-impact AI or6 ganization shall perform a risk management assess7 ment in accordance with this section. 

8 (2) ASSESSMENT.—Each critical-impact AI or9 ganization shall— 

10 (A) not later than 30 days before the date 

11 on which a critical-impact artificial intelligence 

12 system is made publicly available by the critical13 impact AI organization, perform a risk manage14 ment assessment; and 

15 (B) not less frequently than biennially dur16 ing the period beginning on the date of enact17 ment of this Act and ending on the date on 

18 which the applicable critical-impact artificial in19 telligence system is no longer being made pub20 licly available by the critical-impact AI organi21 zation, as applicable, conduct an updated risk 

22 management assessment that— 

23 (i) may find that no significant 

24 changes were made to the critical-impact 

25 artificial intelligence system; and 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
32 

•S 3312 RS

1 (ii) provides, to the extent practicable, 

2 aggregate results of any significant devi3 ation from expected performance detailed 

4 in the assessment performed under sub5 paragraph (A) or the most recent assess6 ment performed under this subparagraph. 

7 (3) REVIEW.— 

8 (A) IN GENERAL.—Not later than 90 days 

9 after the date of completion of a risk manage10 ment assessment by a critical-impact AI organi11 zation under this section, the critical-impact AI 

12 organization shall submit to the Secretary a re13 port— 

14 (i) outlining the assessment performed 

15 under this section; and 

16 (ii) that is in a consistent format, as 

17 determined by the Secretary. 

18 (B) ADDITIONAL INFORMATION.—Subject 

19 to subsection (d), the Secretary may request 

20 that a critical-impact AI organization submit to 

21 the Secretary any related additional or clari22 fying information with respect to a risk man23 agement assessment performed under this sec24 tion. 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
33 

•S 3312 RS

1 (4) LIMITATION.—The Secretary may not pro2 hibit a critical-impact AI organization from making 

3 a critical-impact artificial intelligence system avail4 able to the public based on the review by the Sec5 retary of a report submitted under paragraph (3)(A) 

6 or additional or clarifying information submitted 

7 under paragraph (3)(B). 

8 (b) ASSESSMENT SUBJECT AREAS.—Each assess9 ment performed by a critical-impact AI organization under 

10 subsection (a) shall describe the means by which the crit11 ical-impact AI organization is addressing, through a docu12 mented TEVV process, the following categories: 

13 (1) Policies, processes, procedures, and prac14 tices across the organization relating to transparent 

15 and effective mapping, measuring, and managing of 

16 artificial intelligence risks, including— 

17 (A) how the organization understands, 

18 manages, and documents legal and regulatory 

19 requirements involving artificial intelligence; 

20 (B) how the organization integrates char21 acteristics of trustworthy artificial intelligence, 

22 which include valid, reliable, safe, secure, resil23 ient, accountable, transparent, globally and lo24 cally explainable, interpretable, privacy-en25 hanced, and fair with harmful bias managed, 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
34 

•S 3312 RS

1 into organizational policies, processes, proce2 dures, and practices; 

3 (C) a methodology to determine the needed 

4 level of risk management activities based on the 

5 organization’s risk tolerance; and 

6 (D) how the organization establishes risk 

7 management processes and outcomes through 

8 transparent policies, procedures, and other con9 trols based on organizational risk priorities. 

10 (2) The structure, context, and capabilities of 

11 the critical-impact artificial intelligence system or 

12 critical-impact foundation model, including— 

13 (A) how the context was established and 

14 understood; 

15 (B) capabilities, targeted uses, goals, and 

16 expected costs and benefits; and 

17 (C) how risks and benefits are mapped for 

18 each system component. 

19 (3) A description of how the organization em20 ploys quantitative, qualitative, or mixed-method 

21 tools, techniques, and methodologies to analyze, as22 sess, benchmark, and monitor artificial intelligence 

23 risk, including— 

24 (A) identification of appropriate methods 

25 and metrics; 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
35 

•S 3312 RS

1 (B) how artificial intelligence systems are 

2 evaluated for trustworthy characteristics; 

3 (C) mechanisms for tracking artificial in4 telligence system risks over time; and 

5 (D) processes for gathering and assessing 

6 feedback relating to the efficacy of measure7 ment. 

8 (4) A description of allocation of risk resources 

9 to map and measure risks on a regular basis as de10 scribed in paragraph (1), including— 

11 (A) how artificial intelligence risks based 

12 on assessments and other analytical outputs de13 scribed in paragraphs (2) and (3) are 

14 prioritized, responded to, and managed; 

15 (B) how strategies to maximize artificial 

16 intelligence benefits and minimize negative im17 pacts were planned, prepared, implemented, 

18 documented, and informed by input from rel19 evant artificial intelligence deployers; 

20 (C) management of artificial intelligence 

21 system risks and benefits; and 

22 (D) regular monitoring of risk treatments, 

23 including response and recovery, and commu24 nication plans for the identified and measured 

25 artificial intelligence risks, as applicable. 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
36 

•S 3312 RS

1 (c) DEVELOPER OBLIGATIONS.—The developer of a 

2 critical-impact artificial intelligence system that agrees 

3 through a contract or license to provide technology or serv4 ices to a deployer of the critical-impact artificial intel5 ligence system shall provide to the deployer of the critical6 impact artificial intelligence system the information rea7 sonably necessary for the deployer to comply with the re8 quirements under subsection (a), including— 

9 (1) an overview of the data used in training the 

10 baseline artificial intelligence system provided by the 

11 developer, including— 

12 (A) data size; 

13 (B) data sources; 

14 (C) copyrighted data; and 

15 (D) personal identifiable information; 

16 (2) documentation outlining the structure and 

17 context of the baseline artificial intelligence system 

18 of the developer, including— 

19 (A) input modality; 

20 (B) output modality; 

21 (C) model size; and 

22 (D) model architecture; 

23 (3) known capabilities, limitations, and risks of 

24 the baseline artificial intelligence system of the deVerDate Sep 11 2014 06:32 Dec 19, 2024 Jkt 059200 PO 00000 Frm 00036 Fmt 6652 Sfmt 6401 E:\BILLS\S3312.RS S3312

kjohnson on DSK7ZCZBW3PROD with $$_JOB
37 

•S 3312 RS

1 veloper at the time of the development of the artifi2 cial intelligence system; and 

3 (4) documentation for downstream use, includ4 ing— 

5 (A) a statement of intended purpose; 

6 (B) guidelines for the intended use of the 

7 artificial intelligence system, including a list of 

8 permitted, restricted, and prohibited uses and 

9 users; and 

10 (C) a statement of the potential for devi11 ation from the intended purpose of the baseline 

12 artificial intelligence system. 

13 (d) TERMINATION OF OBLIGATION TO DISCLOSE IN14 FORMATION.— 

15 (1) IN GENERAL.—The obligation of a critical16 impact AI organization to provide information, upon 

17 request of the Secretary, relating to a specific as18 sessment category under subsection (b) shall end on 

19 the date of issuance of a relevant standard applica20 ble to the same category of a critical-impact artifi21 cial intelligence system by— 

22 (A) the Secretary under section 207(c) 

23 with respect to a critical-impact artificial intel24 ligence system; 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
38 

•S 3312 RS

1 (B) another department or agency of the 

2 Federal Government, as determined applicable 

3 by the Secretary; or 

4 (C) a non-governmental standards organi5 zation, as determined appropriate by the Sec6 retary. 

7 (2) EFFECT OF NEW STANDARD.—In adopting 

8 any standard applicable to critical-impact artificial 

9 intelligence systems under section 207(c), the Sec10 retary shall— 

11 (A) identify the category under subsection 

12 (b) to which the standard relates, if any; and 

13 (B) specify the information that is no 

14 longer required to be included in a report re15 quired under subsection (a) as a result of the 

16 new standard. 

17 (e) RULE OF CONSTRUCTION.—Nothing in this sec18 tion shall be construed to require a critical-impact AI or19 ganization, or permit the Secretary, to disclose any infor20 mation, including data or algorithms— 

21 (1) relating to a trade secret or other protected 

22 intellectual property right; 

23 (2) that is confidential business information; or 

24 (3) that is privileged. 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
39 

•S 3312 RS

1 SEC. 207. CERTIFICATION OF CRITICAL-IMPACT ARTIFICIAL 

2 INTELLIGENCE SYSTEMS. 

3 (a) ESTABLISHMENT OF ARTIFICIAL INTELLIGENCE

4 CERTIFICATION ADVISORY COMMITTEE.— 

5 (1) IN GENERAL.—Not later than 180 days 

6 after the date of enactment of this Act, the Sec7 retary shall establish an advisory committee to pro8 vide advice and recommendations on TEVV stand9 ards and the certification of critical-impact artificial 

10 intelligence systems. 

11 (2) DUTIES.—The advisory committee estab12 lished under this section shall advise the Secretary 

13 on matters relating to the testing and certification 

14 of critical-impact artificial intelligence systems, in15 cluding by— 

16 (A) providing recommendations to the Sec17 retary on proposed TEVV standards to ensure 

18 such standards— 

19 (i) maximize alignment and interoper20 ability with standards issued by nongovern21 mental standards organizations and inter22 national standards bodies; 

23 (ii) are performance-based and im24 pact-based; and 

25 (iii) are applicable or necessary to fa26 cilitate the deployment of critical-impact 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
40 

•S 3312 RS

1 artificial intelligence systems in a trans2 parent, secure, and safe manner; 

3 (B) reviewing prospective TEVV standards 

4 submitted by the Secretary to ensure such 

5 standards align with recommendations under 

6 subparagraph (A); 

7 (C) upon completion of the review under 

8 subparagraph (B), providing consensus rec9 ommendations to the Secretary on— 

10 (i) whether a TEVV standard should 

11 be issued, modified, revoked, or added; and 

12 (ii) if such a standard should be 

13 issued, how best to align the standard with 

14 the considerations described in subsection 

15 (c)(2) and recommendations described in 

16 subparagraph (A); and 

17 (D) reviewing and providing advice and 

18 recommendations on the plan and subsequent 

19 updates to the plan submitted under subsection 

20 (b). 

21 (3) COMPOSITION.—The advisory committee es22 tablished under this subsection shall be composed of 

23 not more than 15 members with a balanced composi24 tion of representatives of the private sector, instituVerDate Sep 11 2014 06:32 Dec 19, 2024 Jkt 059200 PO 00000 Frm 00040 Fmt 6652 Sfmt 6401 E:\BILLS\S3312.RS S3312

kjohnson on DSK7ZCZBW3PROD with $$_JOB
41 

•S 3312 RS

1 tions of higher education, and non-profit organiza2 tions, including— 

3 (A) representatives of— 

4 (i) institutions of higher education; 

5 (ii) companies developing or operating 

6 artificial intelligence systems; 

7 (iii) consumers or consumer advocacy 

8 groups; and 

9 (iv) enabling technology companies; 

10 and 

11 (B) any other members the Secretary con12 siders to be appropriate. 

13 (b) ARTIFICIAL INTELLIGENCE CERTIFICATION

14 PLAN.— 

15 (1) IN GENERAL.—Not later than 1 year after 

16 the date of enactment of this Act, the Secretary 

17 shall establish a 3-year implementation plan for the 

18 certification of critical-impact artificial intelligence 

19 systems. 

20 (2) PERIODIC UPDATE.—The Secretary shall 

21 periodically update the plan established under para22 graph (1). 

23 (3) CONTENTS.—The plan established under 

24 paragraph (1) shall include— 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
42 

•S 3312 RS

1 (A) a methodology for gathering and using 

2 relevant, objective, and available information re3 lating to TEVV; 

4 (B) a process for considering whether pre5 scribing certain TEVV standards under sub6 section (c) for critical-impact artificial intel7 ligence systems is appropriate, necessary, or du8 plicative of existing international standards; 

9 (C) if TEVV standards are considered ap10 propriate, a process for prescribing such stand11 ards for critical-impact artificial intelligence 

12 systems; and 

13 (D) an outline of standards proposed to be 

14 issued, including an estimation of the timeline 

15 and sequencing of such standards. 

16 (4) CONSULTATION.—In developing the plan re17 quired under paragraph (1), the Secretary shall con18 sult the following: 

19 (A) The National Artificial Intelligence 

20 Initiative Office. 

21 (B) The interagency committee established 

22 under section 5103 of the National Artificial 

23 Intelligence Initiative Act of 2020 (15 U.S.C. 

24 9413). 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
43 

•S 3312 RS

1 (C) The National Artificial Intelligence Ad2 visory Committee. 

3 (D) Industry consensus standards issued 

4 by non-governmental standards organizations. 

5 (E) Other departments, agencies, and in6 strumentalities of the Federal Government, as 

7 considered appropriate by the Secretary. 

8 (5) SUBMISSION TO CERTIFICATION ADVISORY

9 COMMITTEE.—Upon completing the initial plan re10 quired under this subsection and upon completing 

11 periodic updates to the plan under paragraph (2), 

12 the Secretary shall submit the plan to the advisory 

13 committee established under subsection (a) for re14 view. 

15 (6) SUBMISSION TO COMMITTEES OF CON16 GRESS.—Upon completing the plan required under 

17 this subsection, the Secretary shall submit to the rel18 evant committees of Congress a report containing 

19 the plan. 

20 (7) LIMITATION.—The Secretary may not issue 

21 TEVV standards under subsection (c) until the date 

22 of the submission of the plan under paragraphs (5) 

23 and (6). 

24 (c) STANDARDS.— 

25 (1) STANDARDS.— 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
44 

•S 3312 RS

1 (A) IN GENERAL.—The Secretary shall 

2 issue TEVV standards for critical-impact artifi3 cial intelligence systems. 

4 (B) REQUIREMENTS.—Each standard 

5 issued under this subsection shall— 

6 (i) be practicable; 

7 (ii) meet the need for safe, secure, 

8 and transparent operations of critical-im9 pact artificial intelligence systems; 

10 (iii) with respect to a relevant stand11 ard issued by a non-governmental stand12 ards organization that is already in place, 

13 align with and be interoperable with that 

14 standard; 

15 (iv) provide for a mechanism to, not 

16 less frequently than once every 2 years, so17 licit public comment and update the stand18 ard to reflect advancements in technology 

19 and system architecture; and 

20 (v) be stated in objective terms. 

21 (2) CONSIDERATIONS.—In issuing TEVV 

22 standards for critical-impact artificial intelligence 

23 systems under this subsection, the Secretary shall— 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
45 

•S 3312 RS

1 (A) consider relevant available information 

2 concerning critical-impact artificial intelligence 

3 systems, including— 

4 (i) transparency reports submitted 

5 under section 203(a); 

6 (ii) risk management assessments con7 ducted under section 206(a); and 

8 (iii) any additional information pro9 vided to the Secretary pursuant to section 

10 203(a)(1)(B); 

11 (B) consider whether a proposed standard 

12 is reasonable, practicable, and appropriate for 

13 the particular type of critical-impact artificial 

14 intelligence system for which the standard is 

15 proposed; 

16 (C) consult with relevant artificial intel17 ligence stakeholders and review industry stand18 ards issued by nongovernmental standards or19 ganizations; 

20 (D) pursuant to paragraph (1)(B)(iii), con21 sider whether adoption of a relevant standard 

22 issued by a nongovernmental standards organi23 zation as a TEVV standard is the most appro24 priate action; and 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
46 

•S 3312 RS

1 (E) consider whether the standard takes 

2 into account— 

3 (i) transparent, replicable, and objec4 tive assessments of critical-impact artificial 

5 intelligence system risk, structure, capabili6 ties, and design; 

7 (ii) the risk posed to the public by an 

8 applicable critical-impact artificial intel9 ligence system; and 

10 (iii) the diversity of methodologies and 

11 innovative technologies and approaches 

12 available to meet the objectives of the 

13 standard. 

14 (3) CONSULTATION.—Before finalizing a TEVV 

15 standard issued under this subsection, the Secretary 

16 shall submit the TEVV standard to the advisory 

17 committee established under subsection (a) for re18 view. 

19 (4) PUBLIC COMMENT.—Before issuing any 

20 TEVV standard under this subsection, the Secretary 

21 shall provide an opportunity for public comment. 

22 (5) COOPERATION.—In developing a TEVV 

23 standard under this subsection, the Secretary may, 

24 as determined appropriate, advise, assist, and co25 operate with departments, agencies, and instrumenVerDate Sep 11 2014 06:32 Dec 19, 2024 Jkt 059200 PO 00000 Frm 00046 Fmt 6652 Sfmt 6401 E:\BILLS\S3312.RS S3312

kjohnson on DSK7ZCZBW3PROD with $$_JOB
47 

•S 3312 RS

1 talities of the Federal Government, States, and other 

2 public and private agencies. 

3 (6) EFFECTIVE DATE OF STANDARDS.— 

4 (A) IN GENERAL.—The Secretary shall 

5 specify the effective date of a TEVV standard 

6 issued under this subsection in the order 

7 issuing the standard. 

8 (B) LIMITATION.—Subject to subpara9 graph (C), a TEVV standard issued under this 

10 subsection may not become effective— 

11 (i) during the 180-day period fol12 lowing the date on which the TEVV stand13 ard is issued; and 

14 (ii) more than 1 year after the date 

15 on which the TEVV standard is issued. 

16 (C) EXCEPTION.—Subparagraph (B) shall 

17 not apply to the effective date of a TEVV 

18 standard issued under this section if the Sec19 retary— 

20 (i) finds, for good cause shown, that 

21 a different effective date is in the public 

22 interest; and 

23 (ii) publishes the reasons for the find24 ing under clause (i). 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
48 

•S 3312 RS

1 (7) RULE OF CONSTRUCTION.—Nothing in this 

2 subsection shall be construed to authorize the Sec3 retary to impose any requirements on or take any 

4 enforcement actions under this section or section 

5 208 relating to a critical-impact AI organization be6 fore a TEVV standard relating to those require7 ments is prescribed. 

8 (d) EXEMPTIONS.— 

9 (1) AUTHORITY TO EXEMPT AND PROCE10 DURES.— 

11 (A) IN GENERAL.—The Secretary may ex12 empt, on a temporary basis, a critical-impact 

13 artificial intelligence system from a TEVV 

14 standard issued under subsection (c) on terms 

15 the Secretary considers appropriate. 

16 (B) RENEWAL.—An exemption under sub17 paragraph (A)— 

18 (i) may be renewed only on reapplica19 tion; and 

20 (ii) shall conform to the requirements 

21 of this paragraph. 

22 (C) PROCEEDINGS.— 

23 (i) IN GENERAL.—The Secretary may 

24 begin a proceeding to grant an exemption 

25 to a critical-impact artificial intelligence 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
49 

•S 3312 RS

1 system under this paragraph if the critical2 impact AI organization that deployed the 

3 critical-impact artificial intelligence sys4 tems applies for an exemption or a renewal 

5 of an exemption. 

6 (ii) NOTICE AND COMMENT.—The 

7 Secretary shall publish notice of the appli8 cation under clause (i) and provide an op9 portunity to comment. 

10 (iii) FILING.—An application for an 

11 exemption or for a renewal of an exemp12 tion under this paragraph shall be filed at 

13 such time and in such manner and contain 

14 such information as the Secretary may re15 quire. 

16 (D) ACTIONS.—The Secretary may grant 

17 an exemption under this paragraph upon find18 ing that— 

19 (i) the exemption is consistent with 

20 the public interest and this section; and 

21 (ii) the exemption would facilitate the 

22 development or evaluation of a feature or 

23 characteristic of a critical-impact artificial 

24 intelligence system providing a safety and 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
50 

•S 3312 RS

1 security level that is not less than the 

2 TEVV standard level. 

3 (2) DISCLOSURE.—Not later than 30 days after 

4 the date on which an application is filed under this 

5 subsection, the Secretary may make public informa6 tion contained in the application or relevant to the 

7 application, unless the information concerns or is re8 lated to a trade secret or other confidential informa9 tion not relevant to the application. 

10 (3) NOTICE OF DECISION.—The Secretary shall 

11 publish in the Federal Register a notice of each deci12 sion granting or denying an exemption under this 

13 subsection and the reasons for granting or denying 

14 that exemption, including a justification with sup15 porting information for the selected approach. 

16 (e) SELF-CERTIFICATION OF COMPLIANCE.— 

17 (1) IN GENERAL.—Subject to paragraph (2), 

18 with respect to each critical-impact artificial intel19 ligence system of a critical-impact AI organization, 

20 the critical-impact AI organization shall certify to 

21 the Secretary that the critical-impact artificial intel22 ligence system complies with applicable TEVV 

23 standards issued under this section. 

24 (2) EXCEPTION.—A critical-impact AI organi25 zation may not issue a certificate under paragraph 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
51 

•S 3312 RS

1 (1) if, in exercising reasonable care, the critical-im2 pact AI organization has constructive knowledge 

3 that the certificate is false or misleading in a mate4 rial respect. 

5 (f) NONCOMPLIANCE FINDINGS AND ENFORCEMENT

6 ACTION.— 

7 (1) FINDING OF NONCOMPLIANCE BY SEC8 RETARY.—Upon learning that a critical-impact arti9 ficial intelligence system deployed by a critical-im10 pact AI organization does not comply with the re11 quirements under this section, the Secretary shall— 

12 (A) immediately— 

13 (i) notify the critical-impact AI orga14 nization of the finding; and 

15 (ii) order the critical-impact AI orga16 nization to take remedial action to address 

17 the noncompliance of the artificial intel18 ligence system; and 

19 (B) may, as determined appropriate or 

20 necessary by the Secretary, and if the Secretary 

21 determines that actions taken by a critical-im22 pact AI organization are insufficient to remedy 

23 the noncompliance of the critical-impact AI or24 ganization with this section, take enforcement 

25 action under section 208. 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
52 

•S 3312 RS

1 (2) ACTIONS BY CRITICAL-IMPACT AI ORGANIZA2 TION.—If a critical-impact AI organization finds 

3 that a critical-impact artificial intelligence system 

4 deployed by the critical-impact AI organization is 

5 noncompliant with an applicable TEVV standard 

6 issued under this section or the critical-impact AI 

7 organization is notified of noncompliance by the Sec8 retary under paragraph (1)(A)(i), the critical-impact 

9 AI organization shall— 

10 (A) without undue delay, notify the Sec11 retary by certified mail or electronic mail of the 

12 noncompliance or receipt of the notification of 

13 noncompliance; 

14 (B) take remedial action to address the 

15 noncompliance; and 

16 (C) not later than 10 days after the date 

17 of the notification or receipt under subpara18 graph (A), submit to the Secretary a report 

19 containing information on— 

20 (i) the nature and discovery of the 

21 noncompliant aspect of the critical-impact 

22 artificial intelligence system; 

23 (ii) measures taken to remedy such 

24 noncompliance; and 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
53 

•S 3312 RS

1 (iii) actions taken by the critical-im2 pact AI organization to address stake3 holders affected by such noncompliance. 

4 SEC. 208. ENFORCEMENT. 

5 (a) IN GENERAL.—Upon discovering noncompliance 

6 with a provision of this Act by a deployer of a high-impact 

7 artificial intelligence system or a critical-impact AI organi8 zation if the Secretary determines that actions taken by 

9 the critical-impact AI organization are insufficient to rem10 edy the noncompliance, the Secretary shall take an action 

11 described in this section. 

12 (b) CIVIL PENALTIES.— 

13 (1) IN GENERAL.—The Secretary may impose a 

14 penalty described in paragraph (2) on deployer of a 

15 high-impact artificial intelligence system or a crit16 ical-impact AI organization for each violation by 

17 that entity of this Act or any regulation or order 

18 issued under this Act. 

19 (2) PENALTY DESCRIBED.—The penalty de20 scribed in this paragraph is the greater of— 

21 (A) an amount not to exceed $300,000; or 

22 (B) an amount that is twice the value of 

23 the transaction that is the basis of the violation 

24 with respect to which the penalty is imposed. 

25 (c) VIOLATION WITH INTENT.— 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
54 

•S 3312 RS

1 (1) IN GENERAL.—If the Secretary determines 

2 that a deployer of a high-impact artificial intel3 ligence system or a critical-impact AI organization 

4 intentionally violates this Act or any regulation or 

5 order issued under this Act, the Secretary may pro6 hibit the critical-impact AI organization from de7 ploying a critical-impact artificial intelligence sys8 tem. 

9 (2) IN ADDITION.—A prohibition imposed under 

10 paragraph (1) shall be in addition to any other civil 

11 penalties provided under this Act. 

12 (d) FACTORS.—The Secretary may by regulation pro13 vide standards for establishing levels of civil penalty under 

14 this section based upon factors such as the seriousness of 

15 the violation, the culpability of the violator, and such miti16 gating factors as the violator’s record of cooperation with 

17 the Secretary in disclosing the violation. 

18 (e) CIVIL ACTION.— 

19 (1) IN GENERAL.—Upon referral by the Sec20 retary, the Attorney General may bring a civil action 

21 in a United States district court to— 

22 (A) enjoin a violation of section 207; or 

23 (B) collect a civil penalty upon a finding of 

24 noncompliance with this Act. 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
55 

•S 3312 RS

1 (2) VENUE.—A civil action may be brought 

2 under paragraph (1) in the judicial district in which 

3 the violation occurred or the defendant is found, re4 sides, or does business. 

5 (3) PROCESS.—Process in a civil action under 

6 paragraph (1) may be served in any judicial district 

7 in which the defendant resides or is found. 

8 (f) RULE OF CONSTRUCTION.—Nothing in this sec9 tion shall be construed to require a developer of a critical10 impact artificial intelligence system to disclose any infor11 mation, including data or algorithms— 

12 (1) relating to a trade secret or other protected 

13 intellectual property right; 

14 (2) that is confidential business information; or 

15 (3) that is privileged. 

16 SEC. 209. ARTIFICIAL INTELLIGENCE CONSUMER EDU17 CATION. 

18 (a) ESTABLISHMENT.—Not later than 180 days after 

19 the date of enactment of this Act, the Secretary shall es20 tablish a working group relating to responsible education 

21 efforts for artificial intelligence systems. 

22 (b) MEMBERSHIP.— 

23 (1) IN GENERAL.—The Secretary shall appoint 

24 to serve as members of the working group estab25 lished under this section not more than 15 individVerDate Sep 11 2014 06:32 Dec 19, 2024 Jkt 059200 PO 00000 Frm 00055 Fmt 6652 Sfmt 6401 E:\BILLS\S3312.RS S3312

kjohnson on DSK7ZCZBW3PROD with $$_JOB
56 

•S 3312 RS

1 uals with expertise relating to artificial intelligence 

2 systems, including— 

3 (A) representatives of— 

4 (i) institutions of higher education; 

5 (ii) companies developing or operating 

6 artificial intelligence systems; 

7 (iii) consumers or consumer advocacy 

8 groups; 

9 (iv) public health organizations; 

10 (v) marketing professionals; 

11 (vi) entities with national experience 

12 relating to consumer education, including 

13 technology education; 

14 (vii) public safety organizations; 

15 (viii) rural workforce development ad16 vocates; 

17 (ix) enabling technology companies; 

18 and 

19 (x) nonprofit technology industry 

20 trade associations; and 

21 (B) any other members the Secretary con22 siders to be appropriate. 

23 (2) COMPENSATION.—A member of the working 

24 group established under this section shall serve with25 out compensation. 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
57 

•S 3312 RS

1 (c) DUTIES.— 

2 (1) IN GENERAL.—The working group estab3 lished under this section shall— 

4 (A) identify recommended education and 

5 programs that may be voluntarily employed by 

6 industry to inform— 

7 (i) consumers and other stakeholders 

8 with respect to artificial intelligence sys9 tems as those systems— 

10 (I) become available; or 

11 (II) are soon to be made widely 

12 available for public use or consump13 tion; and 

14 (B) submit to Congress, and make avail15 able to the public, a report containing the find16 ings and recommendations under subparagraph 

17 (A). 

18 (2) FACTORS FOR CONSIDERATION.—The work19 ing group established under this section shall take 

20 into consideration topics relating to— 

21 (A) the intent, capabilities, and limitations 

22 of artificial intelligence systems; 

23 (B) use cases of artificial intelligence appli24 cations that improve lives of the people of the 

25 United States, such as improving government 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
58 

•S 3312 RS

1 efficiency, filling critical roles, and reducing 

2 mundane work tasks; 

3 (C) artificial intelligence research break4 throughs; 

5 (D) engagement and interaction methods, 

6 including how to adequately inform consumers 

7 of interaction with an artificial intelligence sys8 tem; 

9 (E) human-machine interfaces; 

10 (F) emergency fallback scenarios; 

11 (G) operational boundary responsibilities; 

12 (H) potential mechanisms that could 

13 change function behavior in service; and 

14 (I) consistent nomenclature and taxonomy 

15 for safety features and systems. 

16 (3) CONSULTATION.—The Secretary shall con17 sult with the Chair of the Federal Trade Commis18 sion with respect to the recommendations of the 

19 working group established under this section, as ap20 propriate. 

21 (d) TERMINATION.—The working group established 

22 under this section shall terminate on the date that is 2 

23 years after the date of enactment of this Act. 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
59 

•S 3312 RS

1 SECTION 1. SHORT TITLE. 

2 This Act may be cited as the ‘‘Artificial Intelligence 

3 Research, Innovation, and Accountability Act of 2024’’. 

4 SEC. 2. TABLE OF CONTENTS. 

5 The table of contents for this Act is as follows: 

Sec. 1. Short title. 

Sec. 2. Table of contents. 

TITLE I—ARTIFICIAL INTELLIGENCE RESEARCH AND INNOVATION 

Sec. 101. Open data policy amendments. 

Sec. 102. Online content authenticity and provenance standards research and development. 

Sec. 103. Standards for detection of anomalous behavior and artificial intelligence-generated media. 

Sec. 104. Comptroller general study on barriers and best practices to usage of AI 

in government. 

TITLE II—ARTIFICIAL INTELLIGENCE ACCOUNTABILITY 

Sec. 201. Definitions. 

Sec. 202. Generative artificial intelligence transparency. 

Sec. 203. Transparency reports for high-impact artificial intelligence systems. 

Sec. 204. Guidelines for Federal agencies and plans for oversight of high-impact 

artificial intelligence systems. 

Sec. 205. Office of Management and Budget Oversight guidelines and agency 

oversight plans. 

Sec. 206. Risk management assessment for critical-impact artificial intelligence 

systems. 

Sec. 207. Certification of critical-impact artificial intelligence systems. 

Sec. 208. Enforcement. 

Sec. 209. Developer and deployer overlap. 

Sec. 210. Artificial intelligence consumer education. 

Sec. 211. Severability. 

6 TITLE I—ARTIFICIAL INTEL7 LIGENCE RESEARCH AND IN8 NOVATION 

9 SEC. 101. OPEN DATA POLICY AMENDMENTS. 

10 Section 3502 of title 44, United States Code, is amend11 ed— 

12 (1) in paragraph (22)— 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
60 

•S 3312 RS

1 (A) by inserting ‘‘or data model’’ after ‘‘a 

2 data asset’’; and 

3 (B) by striking ‘‘and’’ at the end; 

4 (2) in paragraph (23), by striking the period at 

5 the end and inserting a semicolon; and 

6 (3) by adding at the end the following: 

7 ‘‘(24) the term ‘data model’ means a mathe8 matical, economic, or statistical representation of a 

9 system or process used to assist in making calcula10 tions and predictions, including through the use of al11 gorithms, computer programs, or artificial intel12 ligence systems; and 

13 ‘‘(25) the term ‘artificial intelligence system’ 

14 means a machine-based system that, for explicit or 

15 implicit objectives, infers from the input the system 

16 receives how to generate outputs, such as predictions, 

17 content, recommendations, or decisions that can influ18 ence physical or virtual environments.’’. 

19 SEC. 102. ONLINE CONTENT AUTHENTICITY AND PROVE20 NANCE STANDARDS RESEARCH AND DEVEL21 OPMENT. 

22 (a) RESEARCH.— 

23 (1) IN GENERAL.—Not later than 180 days after 

24 the date of the enactment of this Act, the Under Sec25 retary of Commerce for Standards and Technology 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
61 

•S 3312 RS

1 shall carry out research to facilitate the development 

2 and promote the standardization of means to provide 

3 authenticity and provenance information for digital 

4 content generated by human authors and artificial 

5 intelligence systems. 

6 (2) ELEMENTS.—The research carried out pursu7 ant to paragraph (1) shall cover the following: 

8 (A) Secure and mandatory methods for 

9 human content to append statements of prove10 nance information through the use of unique cre11 dentials, watermarking, or other data or 

12 metadata-based approaches. 

13 (B) Methods for the verification of state14 ments of digital content provenance to ensure au15 thenticity such as watermarking or classifiers, 

16 which are trained models that distinguish artifi17 cial intelligence-generated content. 

18 (C) Methods for displaying clear and con19 spicuous labels of digital content provenance to 

20 users. 

21 (D) Technologies, applications, or infra22 structure needed to facilitate the creation and 

23 verification of digital content provenance infor24 mation. 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
62 

•S 3312 RS

1 (E) Mechanisms to ensure that any tech2 nologies and methods developed under this sub3 section are minimally burdensome on content 

4 producers to implement. 

5 (F) Use of digital content transparency 

6 technologies to enable attribution for human-cre7 ated content. 

8 (G) Such other related processes, tech9 nologies, or applications as the Under Secretary 

10 considers appropriate. 

11 (3) IMPLEMENTATION.—The Under Secretary 

12 shall carry out the research required by paragraph 

13 (1) as part of the research directives pursuant to sec14 tion 22A(b)(1) of the National Institute of Standards 

15 and Technology Act (15 U.S.C. 278h–1(b)(1)). 

16 (b) TECHNICAL ASSISTANCE ON THE DEVELOPMENT

17 OF STANDARDS.— 

18 (1) IN GENERAL.—For methodologies and appli19 cations related to content provenance and authen20 ticity deemed by the Under Secretary to be at a read21 iness level sufficient for standardization, the Under 

22 Secretary shall provide technical review and assist23 ance to such other Federal agencies and nongovern24 mental standards organizations as the Under Sec25 retary considers appropriate. 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
63 

•S 3312 RS

1 (2) CONSIDERATIONS.—In providing any tech2 nical review and assistance related to the development 

3 of digital content provenance and authenticity stand4 ards under this subsection, the Under Secretary 

5 may— 

6 (A) consider whether a proposed standard is 

7 reasonable, practicable, and appropriate for the 

8 particular type of media and media environment 

9 for which the standard is proposed; 

10 (B) consult with relevant stakeholders; and 

11 (C) review industry standards issued by 

12 nongovernmental standards organizations. 

13 (c) PILOT PROGRAM.— 

14 (1) IN GENERAL.—The Under Secretary shall 

15 carry out a pilot program to assess the feasibility and 

16 advisability of using available technologies and cre17 ating guidelines to facilitate the creation and 

18 verification of digital content provenance informa19 tion. 

20 (2) LOCATIONS.—The pilot program required by 

21 paragraph (1) shall be carried out at not more than 

22 2 Federal agencies the Under Secretary shall select for 

23 purposes of the pilot program required by paragraph 

24 (1). 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
64 

•S 3312 RS

1 (3) REQUIREMENTS.—In carrying out the pilot 

2 program required by paragraph (1), the Under Sec3 retary shall— 

4 (A) apply and evaluate methods for authen5 ticating the origin of and modifications to gov6 ernment-produced digital content, either by Fed7 eral Government employees or a private entity 

8 under the terms of a government contract, using 

9 technology and guidelines described in para10 graph (1); and 

11 (B) make available to the public digital 

12 content embedded with provenance data or other 

13 authentication provided by the heads of the Fed14 eral agencies selected pursuant to paragraph (2) 

15 for the purposes of the pilot program. 

16 (4) BRIEFING REQUIRED.—Not later than 1 year 

17 after the date of the enactment of this Act, and annu18 ally thereafter until the date described in paragraph 

19 (5), the Under Secretary shall brief the Committee on 

20 Commerce, Science, and Transportation of the Senate 

21 and the Committee on Science, Space, and Technology 

22 of the House of Representatives on the findings of the 

23 Under Secretary with respect to the pilot program 

24 carried out under this subsection. 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
65 

•S 3312 RS

1 (5) TERMINATION.—The pilot program shall ter2 minate on the date that is 10 years after the date of 

3 the enactment of this Act. 

4 (d) REPORT TO CONGRESS.—Not later than 1 year 

5 after the date of the enactment of this Act, the Under Sec6 retary shall submit to the Committee on Commerce, Science, 

7 and Transportation of the Senate and the Committee on 

8 Science, Space, and Technology of the House of Representa9 tives a report outlining the progress of standardization ini10 tiatives relating to requirements under this section, as well 

11 as recommendations for legislative or administrative action 

12 to encourage or require the widespread adoption of such ini13 tiatives in the United States. 

14 SEC. 103. STANDARDS FOR DETECTION OF ANOMALOUS BE15 HAVIOR AND ARTIFICIAL INTELLIGENCE-GEN16 ERATED MEDIA. 

17 Section 22A(b)(1) of the National Institute of Stand18 ards and Technology Act (15 U.S.C. 278h–1(b)(1)) is 

19 amended— 

20 (1) by redesignating subparagraph (I) as sub21 paragraph (K); 

22 (2) in subparagraph (H), by striking ‘‘; and’’ 

23 and inserting a semicolon; and 

24 (3) by inserting after subparagraph (H) the fol25 lowing: 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
66 

•S 3312 RS

1 ‘‘(I) best practices for detecting outputs gen2 erated by artificial intelligence systems, includ3 ing content such as text, audio, images, and vid4 eos; 

5 ‘‘(J) methods to detect and mitigate anoma6 lous behavior of artificial intelligence systems 

7 and safeguards to mitigate potentially adver8 sarial or compromising anomalous behavior; 

9 and’’. 

10 SEC. 104. COMPTROLLER GENERAL STUDY ON BARRIERS 

11 AND BEST PRACTICES TO USAGE OF AI IN 

12 GOVERNMENT. 

13 (a) IN GENERAL.—Not later than 1 year after the date 

14 of enactment of this Act, the Comptroller General of the 

15 United States shall— 

16 (1) conduct a review of statutory, regulatory, 

17 and other policy barriers to the use of artificial intel18 ligence systems to improve the functionality of the 

19 Federal Government; and 

20 (2) identify best practices for the adoption and 

21 responsible use of artificial intelligence systems by the 

22 Federal Government, including— 

23 (A) ensuring that an artificial intelligence 

24 system is proportional to the need of the Federal 

25 Government; 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
67 

•S 3312 RS

1 (B) restrictions on access to and use of an 

2 artificial intelligence system based on the capa3 bilities and risks of the artificial intelligence sys4 tem; and 

5 (C) safety measures that ensure that an ar6 tificial intelligence system is appropriately lim7 ited to necessary data and compartmentalized 

8 from other assets of the Federal Government. 

9 (b) REPORT.—Not later than 2 years after the date 

10 of enactment of this Act, the Comptroller General of the 

11 United States shall submit to the Committee on Commerce, 

12 Science, and Transportation of the Senate and the Com13 mittee on Science, Space, and Technology of the House of 

14 Representatives a report that— 

15 (1) summarizes the results of the review con16 ducted under subsection (a)(1) and the best practices 

17 identified under subsection (a)(2), including rec18 ommendations, as the Comptroller General of the 

19 United States considers appropriate; 

20 (2) describes any laws, regulations, guidance 

21 documents, or other policies that may prevent the 

22 adoption of artificial intelligence systems by the Fed23 eral Government to improve certain functions of the 

24 Federal Government, including— 

25 (A) data analysis and processing; 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
68 

•S 3312 RS

1 (B) paperwork reduction; 

2 (C) contracting and procurement practices; 

3 and 

4 (D) other Federal Government services; and 

5 (3) includes, as the Comptroller General of the 

6 United States considers appropriate, recommenda7 tions to modify or eliminate barriers to the use of ar8 tificial intelligence systems by the Federal Govern9 ment. 

10 TITLE II—ARTIFICIAL INTEL11 LIGENCE ACCOUNTABILITY 

12 SEC. 201. DEFINITIONS. 

13 In this title: 

14 (1) APPROPRIATE CONGRESSIONAL COMMIT15 TEES.—The term ‘‘appropriate congressional commit16 tees’’ means— 

17 (A) the Committee on Energy and Natural 

18 Resources and the Committee on Commerce, 

19 Science, and Transportation of the Senate; 

20 (B) the Committee on Energy and Com21 merce of the House of Representatives; and 

22 (C) each congressional committee with juris23 diction over an applicable covered agency. 

24 (2) ARTIFICIAL INTELLIGENCE SYSTEM.—The 

25 term ‘‘artificial intelligence system’’ means a maVerDate Sep 11 2014 06:32 Dec 19, 2024 Jkt 059200 PO 00000 Frm 00068 Fmt 6652 Sfmt 6203 E:\BILLS\S3312.RS S3312

kjohnson on DSK7ZCZBW3PROD with $$_JOB
69 

•S 3312 RS

1 chine-based system that, for explicit and implicit ob2 jectives, infers from the input the system receives how 

3 to generate outputs such as predictions, content, rec4 ommendations, or decisions that can influence phys5 ical or virtual environments. 

6 (3) COVERED AGENCY.—The term ‘‘covered agen7 cy’’ means an agency for which a guideline is devel8 oped under section 22B(b)(1) of the National Institute 

9 of Standards and Technology Act, as added by section 

10 204 of this Act, including— 

11 (A) the Department of Commerce; 

12 (B) the Department of State; 

13 (C) the Department of Homeland Security; 

14 (D) the Department of Health and Human 

15 Services; 

16 (E) the Department of Agriculture; 

17 (F) the Department of Housing and Urban 

18 Development; 

19 (G) the Department of the Interior; 

20 (H) the Department of Education; 

21 (I) the Department of Energy; 

22 (J) the Department of Labor; 

23 (K) the Department of Transportation; 

24 (L) the Department of Justice; 

25 (M) the Department of the Treasury; 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
70 

•S 3312 RS

1 (N) the Department of Veterans Affairs; and 

2 (O) any other agency the Secretary deter3 mines appropriate. 

4 (4) CRITICAL-IMPACT AI ORGANIZATION.—The 

5 term ‘‘critical-impact AI organization’’ means a non6 governmental organization that serves as the deployer 

7 of a critical-impact artificial intelligence system. 

8 (5) CRITICAL-IMPACT ARTIFICIAL INTELLIGENCE

9 SYSTEM.—The term ‘‘critical-impact artificial intel10 ligence system’’ means an artificial intelligence sys11 tem that— 

12 (A) is deployed for a purpose other than 

13 solely for use by the Department of Defense or an 

14 intelligence agency (as defined in section 504(e) 

15 of the National Security Act of 1947 (50 U.S.C. 

16 3094(3))); and 

17 (B) is used or intended to be used— 

18 (i) to make a decision or substantially 

19 replace or facilitate the discretionary 

20 human decisionmaking process regarding— 

21 (I) the real-time or ex post facto 

22 collection or analysis of biometric data 

23 of a natural person by biometric iden24 tification systems without the consent 

25 of the natural person; 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
71 

•S 3312 RS

1 (II) an operational component in2 volved in the direct management of in3 frastructure determined by the Sec4 retary of Homeland Security to be crit5 ical infrastructure (as defined in sec6 tion 1016(e) of the USA PATRIOT Act 

7 (42 U.S.C. 5195c(e))) that is— 

8 (aa) transportation infra9 structure; 

10 (bb) energy infrastructure; 

11 (cc) electrical infrastructure; 

12 (dd) communications infra13 structure; 

14 (ee) manufacturing infra15 structure; or 

16 (ff) infrastructure used in the 

17 supply and production of water 

18 and hazardous materials; or 

19 (III) a government or government 

20 contractor’s actions pertaining to 

21 criminal justice (as defined in section 

22 901 of title I of the Omnibus Crime 

23 Control and Safe Streets Act of 1968 

24 (34 U.S.C. 10251)); and 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
72 

•S 3312 RS

1 (ii) in a manner that poses a signifi2 cant risk to safety or violates rights afforded 

3 under the Constitution of the United States. 

4 (6) DEPLOYER.—The term ‘‘deployer’’— 

5 (A) means an entity that— 

6 (i) uses or operates an artificial intel7 ligence system for internal use or for use by 

8 a third party; 

9 (ii) substantially modifies an artificial 

10 intelligence system, or trains an artificial 

11 intelligence system using new data, for in12 ternal use or for use by a third party; or 

13 (iii) performs the functions described 

14 in clauses (i) and (ii); and 

15 (B) does not include an entity that is solely 

16 an end user of a system. 

17 (7) DEVELOPER.—The term ‘‘developer’’ means 

18 an entity that— 

19 (A) initially designs, codes, produces, or 

20 owns an artificial intelligence system for inter21 nal use or for use by a third party as a baseline 

22 model; and 

23 (B) is not a deployer of the artificial intel24 ligence system described in subparagraph (A). 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
73 

•S 3312 RS

1 (8) END USER.—The term ‘‘end user’’ means an 

2 entity that, with respect to an artificial intelligence 

3 system procured from a deployer for which the 

4 deployer submits a transparency report under section 

5 203 or a risk management assessment under section 

6 206— 

7 (A) uses or operates the artificial intel8 ligence system; and 

9 (B) does not substantially edit or modify 

10 the artificial intelligence system. 

11 (9) GENERATIVE ARTIFICIAL INTELLIGENCE SYS12 TEM.—The term ‘‘generative artificial intelligence 

13 system’’ means an artificial intelligence system that 

14 generates output, such as data or content in a writ15 ten, audio, or visual format. 

16 (10) HIGH-IMPACT ARTIFICIAL INTELLIGENCE

17 SYSTEM.—The term ‘‘high-impact artificial intel18 ligence system’’ means an artificial intelligence sys19 tem— 

20 (A) deployed for a purpose other than solely 

21 for use by the Department of Defense or an intel22 ligence agency (as defined in section 3094(e) of 

23 the National Security Act of 1947 (50 U.S.C. 

24 3094(3))); and 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
74 

•S 3312 RS

1 (B) that is specifically deployed to make a 

2 decision or substantially replace the discre3 tionary human decisionmaking process regard4 ing the access of an individual to housing, em5 ployment, credit, education, healthcare, govern6 ment services, or insurance in a manner that 

7 poses a significant risk to safety or violates 

8 rights afforded under the Constitution of the 

9 United States or Federal law. 

10 (11) ONLINE PLATFORM.—The term ‘‘online 

11 platform’’ means any public-facing website, online 

12 service, online application, or mobile application that 

13 predominantly provides a community forum for user14 generated content, such as sharing videos, images, 

15 games, audio files, or other content, including a social 

16 media service, social network, or virtual reality envi17 ronment. 

18 (12) SECRETARY.—The term ‘‘Secretary’’ means 

19 the Secretary of Commerce. 

20 (13) SIGNIFICANT RISK.—The term ‘‘significant 

21 risk’’ means the risk of— 

22 (A) high-impact, severe, high-intensity, or 

23 long-duration harm to individuals; or 

24 (B) a high probability of substantial harm 

25 to individuals. 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
75 

•S 3312 RS

1 (14) TEVV.—The term ‘‘TEVV’’ means the test2 ing, evaluation, validation, and verification of any 

3 artificial intelligence system that includes— 

4 (A) open, transparent, testable, and 

5 verifiable specifications that characterize real6 istic operational performance, such as validity 

7 and reliability for relevant tasks; 

8 (B) testing methodologies and metrics that 

9 enable the evaluation of system trustworthiness, 

10 including robustness and resilience; 

11 (C) data quality standards for training and 

12 testing datasets; 

13 (D) requirements for system validation and 

14 integration into production environments, auto15 mated testing, and compliance with existing 

16 legal and regulatory specifications; 

17 (E) methods and tools for— 

18 (i) the monitoring of system behavior; 

19 (ii) the tracking of incidents or errors 

20 reported and their management; and 

21 (iii) the detection of emergent prop22 erties and related impacts; and 

23 (F) processes for redress and response. 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
76 

•S 3312 RS

1 (15) UNDER SECRETARY.—The term ‘‘Under 

2 Secretary’’ means the Director of the National Insti3 tute of Standards and Technology. 

4 SEC. 202. GENERATIVE ARTIFICIAL INTELLIGENCE TRANS5 PARENCY. 

6 (a) PROHIBITION.— 

7 (1) DISCLOSURE OF USE OF GENERATIVE ARTIFI8 CIAL INTELLIGENCE SYSTEMS.— 

9 (A) IN GENERAL.—A person operating an 

10 online platform that uses a generative artificial 

11 intelligence system shall provide notice to each 

12 user of the online platform that the online plat13 form uses a generative artificial intelligence sys14 tem to generate content the user sees. 

15 (B) REQUIREMENTS.—A person providing 

16 the notice described in subparagraph (A) to a 

17 user— 

18 (i) subject to clause (ii), shall provide 

19 the notice in a clear and conspicuous man20 ner on the online platform before the user 

21 interacts with content produced by a gen22 erative artificial intelligence system used by 

23 the online platform; and 

24 (ii) may provide an option for the user 

25 to choose to see the notice described in 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
77 

•S 3312 RS

1 clause (i) only upon the first interaction of 

2 the user with content produced by a genera3 tive artificial intelligence system. 

4 (b) ENFORCEMENT ACTION.—Upon learning that a 

5 person operating an online platform violates this section 

6 after receiving a report of noncompliance or pursuant to 

7 an investigation conducted under section 208(f), the Sec8 retary— 

9 (1) shall immediately— 

10 (A) notify the person operating the online 

11 platform of the finding; and 

12 (B) order the person operating the online 

13 platform to take remedial action to address the 

14 noncompliance of the generative artificial intel15 ligence system operated by the online platform; 

16 and 

17 (2) may, as determined appropriate or necessary 

18 by the Secretary, take enforcement action under sec19 tion 208 if the person operating the online platform 

20 does not take sufficient action to remedy the non21 compliance by the date that is 15 days after the noti22 fication issued under paragraph (1)(A). 

23 (c) EFFECTIVE DATE.—This section shall take effect 

24 on the date that is 180 days after the date of enactment 

25 of this Act. 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
78 

•S 3312 RS

1 SEC. 203. TRANSPARENCY REPORTS FOR HIGH-IMPACT AR2 TIFICIAL INTELLIGENCE SYSTEMS. 

3 (a) TRANSPARENCY REPORTING.— 

4 (1) IN GENERAL.—Each deployer of a high-im5 pact artificial intelligence system shall— 

6 (A) before deploying the high-impact artifi7 cial intelligence system, and annually thereafter, 

8 submit to the Secretary a transparency report 

9 for the high-impact artificial intelligence system; 

10 and 

11 (B) submit to the Secretary an updated 

12 transparency report on the high-impact artificial 

13 intelligence system if the deployer makes a mate14 rial change to— 

15 (i) the purpose for which the high-im16 pact artificial intelligence system is used; or 

17 (ii) the type of data or content the 

18 high-impact artificial intelligence system 

19 processes or uses for training purposes. 

20 (2) CONTENTS.—Each transparency report sub21 mitted under paragraph (1) by a deployer of a high22 impact artificial intelligence system shall include— 

23 (A) with respect to the organization of the 

24 deployer— 

25 (i) policies, processes, procedures, and 

26 practices across the organization relating to 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
79 

•S 3312 RS

1 transparent and effective mapping, meas2 uring, and managing of artificial intel3 ligence risks, including— 

4 (I) how the organization under5 stands, manages, and documents legal 

6 and regulatory requirements involving 

7 artificial intelligence; 

8 (II) how the organization inte9 grates characteristics of trustworthy 

10 artificial intelligence, which include 

11 valid, reliable, safe, secure, resilient, 

12 accountable, transparent, globally and 

13 locally explainable, interpretable, pri14 vacy-enhanced, and protecting of rights 

15 under the Constitution of the United 

16 States, and compliant with all relevant 

17 Federal laws, into organizational poli18 cies, processes, procedures, and prac19 tices; 

20 (III) a methodology to determine 

21 the needed level of risk management ac22 tivities based on the risk tolerance of 

23 the organization; and 

24 (IV) how the organization estab25 lishes risk management processes and 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
80 

•S 3312 RS

1 outcomes through transparent policies, 

2 procedures, and other controls based on 

3 organizational risk priorities; 

4 (B) the structure, context, and capabilities 

5 of the high-impact artificial intelligence system, 

6 including— 

7 (i) how the context was established and 

8 understood; 

9 (ii) capabilities, targeted uses, goals, 

10 and expected costs and benefits; and 

11 (iii) how risks and benefits are 

12 mapped for each system component; 

13 (C) a description of how the organization of 

14 the deployer employs quantitative, qualitative, or 

15 mixed-method tools, techniques, and methodolo16 gies to analyze, assess, benchmark, and monitor 

17 artificial intelligence risk, including— 

18 (i) identification of appropriate meth19 ods and metrics; 

20 (ii) how artificial intelligence systems 

21 are evaluated for characteristics of trust22 worthy artificial intelligence; 

23 (iii) mechanisms for tracking artificial 

24 intelligence system risks over time; and 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
81 

•S 3312 RS

1 (iv) processes for gathering and assess2 ing feedback relating to the efficacy of meas3 urement; and 

4 (D) a description of allocation of risk re5 sources to map and measure risks on a regular 

6 basis, including— 

7 (i) how artificial intelligence risks 

8 based on assessments and other analytical 

9 outputs are prioritized, responded to, and 

10 managed; 

11 (ii) how strategies to maximize artifi12 cial intelligence benefits and minimize neg13 ative impacts were planned, prepared, im14 plemented, documented, and informed by 

15 input from relevant artificial intelligence 

16 deployers; 

17 (iii) management of artificial intel18 ligence system risks and benefits; and 

19 (iv) regular monitoring of risk treat20 ments, including response and recovery, and 

21 communication plans for the identified and 

22 measured artificial intelligence risks, as ap23 plicable. 

24 (3) DEVELOPER OBLIGATIONS.—The developer of 

25 a high-impact artificial intelligence system that 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
82 

•S 3312 RS

1 agrees to provide technologies or services to a deployer 

2 of the high-impact artificial intelligence system shall 

3 provide to the deployer of the high-impact artificial 

4 intelligence system the information reasonably nec5 essary for compliance with paragraph (1), includ6 ing— 

7 (A) an overview of the data used in train8 ing the baseline artificial intelligence system 

9 provided by the developer, including— 

10 (i) size of datasets used; 

11 (ii) content and data sources and types 

12 of data used; 

13 (iii) content and data that may be sub14 ject to copyright protection and any steps 

15 taken to remove such content and data 

16 prior to training or other uses; and 

17 (iv) whether and to what extent per18 sonal identifiable information makes up a 

19 portion of the training dataset, and what 

20 risk mitigation measures have been taken to 

21 prevent the disclosure of that personal iden22 tifiable information; 

23 (B) documentation outlining the structure 

24 and context of the baseline artificial intelligence 

25 system of the developer, including— 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
83 

•S 3312 RS

1 (i) input modality; 

2 (ii) system output and modality; 

3 (iii) model size; and 

4 (iv) model architecture; 

5 (C) known or reasonably foreseeable capa6 bilities, limitations, and risks of the baseline ar7 tificial intelligence system at the time of the de8 velopment of the artificial intelligence system; 

9 and 

10 (D) documentation for downstream use, in11 cluding— 

12 (i) a statement of intended purpose; 

13 (ii) guidelines for the intended use of 

14 the artificial intelligence system, including 

15 a list of permitted, restricted, and prohib16 ited uses and users; and 

17 (iii) a description of the potential for 

18 and risk of deviation from the intended 

19 purpose of the baseline artificial intelligence 

20 system, including recommended safeguards 

21 to mitigate and prevent risks to safety or to 

22 rights afforded under the Constitution of the 

23 United States or Federal law. 

24 (4) CONSIDERATIONS.—In carrying out this sub25 section, a deployer or developer of a high-impact artiVerDate Sep 11 2014 06:32 Dec 19, 2024 Jkt 059200 PO 00000 Frm 00083 Fmt 6652 Sfmt 6203 E:\BILLS\S3312.RS S3312

kjohnson on DSK7ZCZBW3PROD with $$_JOB
84 

•S 3312 RS

1 ficial intelligence system shall consider the best prac2 tices outlined in the most recent version of the risk 

3 management framework developed pursuant to section 

4 22A(c) of the National Institute of Standards and 

5 Technology Act (15 U.S.C. 278h–1(c)). 

6 (b) NONCOMPLIANCE AND ENFORCEMENT ACTION.— 

7 Upon learning that a deployer of a high-impact artificial 

8 intelligence system violates this section with respect to a 

9 high-impact artificial intelligence system after receiving a 

10 report of noncompliance or pursuant to an investigation 

11 conducted under section 208(f), the Secretary— 

12 (1) shall immediately— 

13 (A) notify the deployer of the finding; and 

14 (B) order the deployer to immediately sub15 mit to the Secretary the report required under 

16 subsection (a)(1); and 

17 (2) if the deployer fails to submit the report by 

18 the date that is 15 days after the date of the notifica19 tion under paragraph (1)(A), may take enforcement 

20 action under section 208. 

21 (c) AVOIDANCE OF DUPLICATION.—With respect to a 

22 developer or deployer of a high-impact artificial intelligence 

23 system that maintains policies and procedures for risk 

24 management in accordance with any applicable rules, regu25 lations, or supervisory guidance promulgated by a relevant 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
85 

•S 3312 RS

1 Federal agency, the Secretary shall deem the developer or 

2 deployer to be in compliance with this section. 

3 (d) RULE OF CONSTRUCTION.—Nothing in this section 

4 shall be construed to require a deployer of a high-impact 

5 artificial intelligence system to disclose any information, 

6 including data, content, or algorithms— 

7 (1) constituting a trade secret or other intellec8 tual property right; or 

9 (2) that is confidential business information. 

10 (e) CONSOLIDATION.—With respect to an instance in 

11 which multiple deployers participate in the deployment of 

12 a high-impact artificial intelligence system, the Secretary 

13 may establish through regulation a process under which the 

14 deployers may submit a single transparency report under 

15 subsection (a). 

16 SEC. 204. GUIDELINES FOR FEDERAL AGENCIES AND PLANS 

17 FOR OVERSIGHT OF HIGH-IMPACT ARTIFI18 CIAL INTELLIGENCE SYSTEMS. 

19 (a) GUIDELINES FOR FEDERAL AGENCIES FOR OVER20 SIGHT OF ARTIFICIAL INTELLIGENCE.—The National Insti21 tute of Standards and Technology Act (15 U.S.C. 271 et 

22 seq.) is amended by inserting after section 22A (15 U.S.C. 

23 278h–1) the following: 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
86 

•S 3312 RS

1 ‘‘SEC. 22B. GUIDELINES FOR FEDERAL AGENCIES FOR 

2 OVERSIGHT OF ARTIFICIAL INTELLIGENCE. 

3 ‘‘(a) DEFINITION OF HIGH-IMPACT ARTIFICIAL INTEL4 LIGENCE SYSTEM.—In this section, the term ‘high-impact 

5 artificial intelligence system’ means an artificial intel6 ligence system— 

7 ‘‘(1) deployed for purposes other than those solely 

8 for use by the Department of Defense or an element 

9 of the intelligence community (as defined in section 3 

10 of the National Security Act of 1947 (50 U.S.C. 

11 3003)); and 

12 ‘‘(2) that is specifically deployed to make a deci13 sion or substantially replace the discretionary human 

14 decisionmaking process regarding the access of an in15 dividual to housing, employment, credit, education, 

16 health care, government services, or insurance in a 

17 manner that poses a significant risk to safety or vio18 lates rights afforded under the Constitution of the 

19 United States. 

20 ‘‘(b) GUIDELINES FOR OVERSIGHT OF HIGH-IMPACT

21 ARTIFICIAL INTELLIGENCE SYSTEMS.—Not later than 1 

22 year after the date of the enactment of the Artificial Intel23 ligence Research, Innovation, and Accountability Act of 

24 2024, the Director shall— 

25 ‘‘(1) develop guidelines for Federal agencies to 

26 conduct oversight of the non-Federal and, as may be 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
87 

•S 3312 RS

1 appropriate, Federal use of high-impact artificial in2 telligence systems to improve the safe and responsible 

3 use of such systems; and 

4 ‘‘(2) not less frequently than biennially, update 

5 the guidelines to account for changes in technological 

6 capabilities or artificial intelligence use cases. 

7 ‘‘(c) USE OF VOLUNTARY RISK MANAGEMENT FRAME8 WORK.—In developing guidelines under subsection (b), the 

9 Director shall use the voluntary risk management frame10 work required by section 22A(c) to identify and provide 

11 guidelines for Federal agencies on establishing regulations, 

12 standards, guidelines, best practices, methodologies, proce13 dures, or processes— 

14 ‘‘(1) to facilitate oversight of non-Federal use of 

15 high-impact artificial intelligence systems; and 

16 ‘‘(2) to mitigate risks from such high-impact ar17 tificial intelligence systems. 

18 ‘‘(d) AUTHORIZED ELEMENTS.—In developing guide19 lines under subsection (b), the Director may include the fol20 lowing: 

21 ‘‘(1) Key design choices made during high-im22 pact artificial intelligence model development, includ23 ing rationale and assumptions made. 

24 ‘‘(2) Intended use and users, other possible use 

25 cases, including any anticipated undesirable or potenVerDate Sep 11 2014 06:32 Dec 19, 2024 Jkt 059200 PO 00000 Frm 00087 Fmt 6652 Sfmt 6203 E:\BILLS\S3312.RS S3312

kjohnson on DSK7ZCZBW3PROD with $$_JOB
88 

•S 3312 RS

1 tially harmful use cases, and what good faith efforts 

2 model developers can take to mitigate the harms 

3 caused by the use of the system. 

4 ‘‘(3) Methods for evaluating the safety of high5 impact artificial intelligence systems and approaches 

6 for responsible use. 

7 ‘‘(e) CONSULTATION.—In developing guidelines under 

8 subsection (b), the Director may consult with such stake9 holders representing perspectives from civil society, aca10 demia, technologists, engineers, and creators as the Director 

11 considers applicable, practicable, and relevant.’’. 

12 (b) AGENCY-SPECIFIC PLANS FOR OVERSIGHT OF

13 HIGH-IMPACT ARTIFICIAL INTELLIGENCE SYSTEMS.— 

14 (1) PLANS REQUIRED.—Not later than 2 years 

15 after the date of the enactment of this Act, the head 

16 of each covered agency shall— 

17 (A) develop sector-specific plans for the cov18 ered agency to conduct oversight of the non-Fed19 eral and, as may be appropriate, Federal use of 

20 high-impact artificial intelligence systems to im21 prove the safe and responsible use of such sys22 tems; and 

23 (B) not less frequently than biennially, up24 date the sector-specific recommendations to acVerDate Sep 11 2014 06:32 Dec 19, 2024 Jkt 059200 PO 00000 Frm 00088 Fmt 6652 Sfmt 6203 E:\BILLS\S3312.RS S3312

kjohnson on DSK7ZCZBW3PROD with $$_JOB
89 

•S 3312 RS

1 count for changes in technological capabilities or 

2 artificial intelligence use cases. 

3 (2) REQUIREMENTS.—In developing plans under 

4 paragraph (1), the head of each covered agency shall 

5 follow the guidelines established under section 22B(b) 

6 of the National Institute of Standards and Technology 

7 Act, as added by subsection (a), to develop plans to 

8 mitigate risks from such high-impact artificial intel9 ligence systems. 

10 (3) AUTHORIZED ELEMENTS.—In developing 

11 plans under paragraph (1), the head of a covered 

12 agency may include the following: 

13 (A) Intended use and users, other possible 

14 use cases, including any anticipated undesirable 

15 or potentially harmful use cases, and what good 

16 faith efforts model developers can take to miti17 gate the use of the system in harmful ways. 

18 (B) Methods for evaluating the safety of 

19 high-impact artificial intelligence systems and 

20 approaches for responsible use. 

21 (C) Sector-specific differences in what con22 stitutes acceptable high-impact artificial intel23 ligence model functionality and trustworthiness, 

24 metrics used to determine high-impact artificial 

25 intelligence model performance, and any test reVerDate Sep 11 2014 06:32 Dec 19, 2024 Jkt 059200 PO 00000 Frm 00089 Fmt 6652 Sfmt 6203 E:\BILLS\S3312.RS S3312

kjohnson on DSK7ZCZBW3PROD with $$_JOB
90 

•S 3312 RS

1 sults reflecting application of these metrics to 

2 evaluate high-impact artificial intelligence model 

3 performance across different sectors. 

4 (D) Recommendations to support iterative 

5 development of subsequent recommendations 

6 under paragraph (1). 

7 (4) CONSULTATION.—In developing plans under 

8 paragraph (1), the head of each covered agency shall 

9 consult with— 

10 (A) the Under Secretary; and 

11 (B) such stakeholders representing perspec12 tives from civil society, academia, technologists, 

13 engineers, and creators as the head of the agency 

14 considers applicable, practicable, and relevant. 

15 SEC. 205. OFFICE OF MANAGEMENT AND BUDGET OVER16 SIGHT GUIDELINES AND AGENCY OVERSIGHT 

17 PLANS. 

18 (a) AGENCY OVERSIGHT PLAN.—In this section, the 

19 term ‘‘agency oversight plan’’ means a guideline developed 

20 under section 22B(b)(1) of the National Institute of Stand21 ards and Technology Act, as added by section 204 of this 

22 Act. 

23 (b) RECOMMENDATIONS.—Not later than 2 years after 

24 the date of enactment of this Act, the Under Secretary and 

25 the head of each covered agency shall submit to the Director 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
91 

•S 3312 RS

1 of the Office of Management and Budget and the appro2 priate congressional committees each agency oversight plan. 

3 (c) REPORTING REQUIREMENTS.— 

4 (1) ANNUAL AGENCY OVERSIGHT STATUS RE5 PORTS.— 

6 (A) IN GENERAL.—On the first February 1 

7 occurring after the date that is 2 years after the 

8 date of enactment of this Act, and annually 

9 thereafter until the date described in subpara10 graph (B), the head of each covered agency shall 

11 submit to the Director of the Office of Manage12 ment and Budget a report containing the imple13 mentation status of each agency oversight plan. 

14 (B) CONTINUED REPORTING.—The date de15 scribed in this subparagraph is the date on 

16 which the head of a covered agency— 

17 (i) takes final implementation action 

18 with respect to an agency oversight plan; 

19 and 

20 (ii) determines and states in a report 

21 required under subparagraph (A) that no 

22 further implementation action should be 

23 taken with respect to an agency oversight 

24 plan. 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
92 

•S 3312 RS

1 (2) COMPLIANCE REPORT TO CONGRESS.—On 

2 April 1 of each year occurring after the date that is 

3 2 years after the date of enactment of this Act, the Di4 rector of the Office of Management and Budget shall 

5 transmit comments on the reports required under 

6 paragraph (1) to the heads of covered agencies and 

7 the appropriate congressional committees. 

8 (3) FAILURE TO REPORT.—If, on March 1 of 

9 each year occurring after the date that is 2 years 

10 after the date of enactment of this Act, the Director 

11 of the Office of Management and Budget has not re12 ceived a report required from the head of a covered 

13 agency under paragraph (1), the Director shall notify 

14 the appropriate congressional committees of the fail15 ure. 

16 (d) TECHNICAL ASSISTANCE IN CARRYING OUT AGEN17 CY OVERSIGHT PLANS.—The Under Secretary shall provide 

18 assistance to the heads of covered agencies relating to the 

19 implementation of the agency oversight plan the heads of 

20 covered agencies intend to carry out. 

21 (e) REGULATION REVIEW AND IMPROVEMENT.—The 

22 Administrator of the Office of Information and Regulatory 

23 Affairs of the Office of Management and Budget, in con24 sultation with the Under Secretary, shall develop and periVerDate Sep 11 2014 06:32 Dec 19, 2024 Jkt 059200 PO 00000 Frm 00092 Fmt 6652 Sfmt 6203 E:\BILLS\S3312.RS S3312

kjohnson on DSK7ZCZBW3PROD with $$_JOB
93 

•S 3312 RS

1 odically revise performance indicators and measures for sec2 tor-specific regulation of artificial intelligence. 

3 SEC. 206. RISK MANAGEMENT ASSESSMENT FOR CRITICAL4 IMPACT ARTIFICIAL INTELLIGENCE SYSTEMS. 

5 (a) REQUIREMENT.— 

6 (1) IN GENERAL.—Each critical-impact AI orga7 nization shall perform a risk management assessment 

8 in accordance with this section. 

9 (2) ASSESSMENT.—Each critical-impact AI or10 ganization shall— 

11 (A) not later than 30 days before the date 

12 on which a critical-impact artificial intelligence 

13 system is deployed or made publicly available by 

14 the critical-impact AI organization, perform a 

15 risk management assessment; and 

16 (B) not less frequently than biennially dur17 ing the period beginning on the date of enact18 ment of this Act and ending on the date on 

19 which the applicable critical-impact artificial 

20 intelligence system is no longer being deployed or 

21 made publicly available by the critical-impact 

22 AI organization, as applicable, conduct an up23 dated risk management assessment that— 

24 (i) if no significant changes were made 

25 to the critical-impact artificial intelligence 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
94 

•S 3312 RS

1 system, may find that no significant 

2 changes were made to the critical-impact 

3 artificial intelligence system; and 

4 (ii) provides, to the extent practicable, 

5 aggregate results of any significant devi6 ation from expected performance detailed in 

7 the assessment performed under subpara8 graph (A) or the most recent assessment 

9 performed under this subparagraph. 

10 (3) REVIEW.— 

11 (A) IN GENERAL.—Not later than 90 days 

12 after the date of completion of a risk manage13 ment assessment by a critical-impact AI organi14 zation under this section, the critical-impact AI 

15 organization shall submit to the Secretary a re16 port— 

17 (i) outlining the assessment performed 

18 under this section; and 

19 (ii) that is in a consistent format, as 

20 determined by the Secretary. 

21 (B) ADDITIONAL INFORMATION.—Subject to 

22 subsection (d), the Secretary may request that a 

23 critical-impact AI organization submit to the 

24 Secretary any related additional or clarifying 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
95 

•S 3312 RS

1 information with respect to a risk management 

2 assessment performed under this section. 

3 (4) LIMITATION.—The Secretary may not pro4 hibit a critical-impact AI organization from making 

5 a critical-impact artificial intelligence system avail6 able to the public based on the review by the Sec7 retary of a report submitted under paragraph (3)(A) 

8 or additional or clarifying information submitted 

9 under paragraph (3)(B). 

10 (b) ASSESSMENT SUBJECT AREAS.—Each assessment 

11 performed by a critical-impact AI organization under sub12 section (a) shall describe the means by which the critical13 impact AI organization is addressing, through a docu14 mented TEVV process, the following categories: 

15 (1) Policies, processes, procedures, and practices 

16 across the organization relating to transparent and 

17 effective mapping, measuring, and managing of arti18 ficial intelligence risks, including— 

19 (A) how the organization understands, 

20 manages, and documents legal and regulatory re21 quirements involving critical-impact artificial 

22 intelligence systems; 

23 (B) how the organization integrates the 

24 characteristics of trustworthy artificial intel25 ligence, which include valid, reliable, safe, secure, 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
96 

•S 3312 RS

1 resilient, accountable, transparent, globally and 

2 locally explainable, interpretable, privacy-en3 hanced, protecting of rights under the Constitu4 tion of the United States, and compliant with all 

5 relevant Federal laws, into organizational poli6 cies, processes, procedures, and practices for de7 ploying critical-impact artificial intelligence sys8 tems; 

9 (C) a methodology to determine the needed 

10 level of risk management activities for critical11 impact artificial intelligence systems based on 

12 the organization’s risk tolerance; and 

13 (D) how the organization establishes risk 

14 management processes and outcomes through 

15 transparent policies, procedures, and other con16 trols based on organizational risk priorities. 

17 (2) The structure, context, and capabilities of the 

18 critical-impact artificial intelligence system, includ19 ing— 

20 (A) how the context was established and un21 derstood; 

22 (B) capabilities, targeted uses, goals, and 

23 expected costs and benefits; and 

24 (C) how risks and benefits are mapped for 

25 each system component. 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
97 

•S 3312 RS

1 (3) A description of how the organization em2 ploys quantitative, qualitative, or mixed-method tools, 

3 techniques, and methodologies to analyze, assess, 

4 benchmark, and monitor artificial intelligence risk, 

5 including— 

6 (A) identification of appropriate methods 

7 and metrics; 

8 (B) how artificial intelligence systems are 

9 evaluated for characteristics of trustworthy arti10 ficial intelligence; 

11 (C) mechanisms for tracking artificial intel12 ligence system risks over time; and 

13 (D) processes for gathering and assessing 

14 feedback relating to the efficacy of measurement. 

15 (4) A description of allocation of risk resources 

16 to map and measure risks on a regular basis as de17 scribed in paragraph (1), including— 

18 (A) how artificial intelligence risks based on 

19 assessments and other analytical outputs de20 scribed in paragraphs (2) and (3) are 

21 prioritized, responded to, and managed; 

22 (B) how strategies to maximize artificial 

23 intelligence benefits and minimize negative im24 pacts were planned, prepared, implemented, docVerDate Sep 11 2014 06:32 Dec 19, 2024 Jkt 059200 PO 00000 Frm 00097 Fmt 6652 Sfmt 6203 E:\BILLS\S3312.RS S3312

kjohnson on DSK7ZCZBW3PROD with $$_JOB
98 

•S 3312 RS

1 umented, and informed by input from relevant 

2 artificial intelligence deployers; 

3 (C) management of artificial intelligence 

4 system risks and benefits; and 

5 (D) regular monitoring of risk treatments, 

6 including response and recovery, and commu7 nication plans for the identified and measured 

8 artificial intelligence risks, as applicable. 

9 (c) DEVELOPER OBLIGATIONS.—The developer of a 

10 critical-impact artificial intelligence system that agrees to 

11 provide technologies or services to a deployer of the critical12 impact artificial intelligence system shall provide to the 

13 deployer of the critical-impact artificial intelligence system 

14 the information reasonably necessary for the deployer to 

15 comply with the requirements under subsection (a), includ16 ing— 

17 (1) an overview of the data used in training the 

18 baseline artificial intelligence system provided by the 

19 developer, including— 

20 (A) content and size of datasets used; 

21 (B) content and types of data used; 

22 (C) content and data that may be subject to 

23 copyright protection, and any steps taken to re24 move such content and data prior to training; 

25 and 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
99 

•S 3312 RS

1 (D) whether and to what extent personal 

2 identifiable information makes up a portion of 

3 the training dataset, and what risk mitigation 

4 measures have been taken to prevent the disclo5 sure of that personal identifiable information; 

6 (2) documentation outlining the structure and 

7 context of the baseline artificial intelligence system of 

8 the developer, including— 

9 (A) input modality; 

10 (B) system output and modality; 

11 (C) model size; and 

12 (D) model architecture; 

13 (3) known or reasonably foreseeable capabilities, 

14 limitations, and risks of the baseline artificial intel15 ligence system at the time of the development of the 

16 artificial intelligence system; and 

17 (4) documentation for downstream use, includ18 ing— 

19 (A) a statement of intended purpose; 

20 (B) guidelines for the intended use of the 

21 artificial intelligence system, including a list of 

22 permitted, restricted, and prohibited uses and 

23 users; and 

24 (C) a description of the potential for and 

25 risk of deviation from the intended purpose of 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
100 

•S 3312 RS

1 the baseline artificial intelligence system, includ2 ing recommended safeguards to mitigate and 

3 prevent risks to safety or to rights afforded under 

4 the Constitution of the United States or Federal 

5 law. 

6 (d) TERMINATION OF OBLIGATION TO DISCLOSE IN7 FORMATION.— 

8 (1) IN GENERAL.—The obligation of a critical9 impact AI organization to provide information, upon 

10 a request of the Secretary, relating to a specific as11 sessment category under subsection (b) shall end on 

12 the date of issuance of a relevant standard applicable 

13 to the same category of a critical -impact artificial 

14 intelligence system by— 

15 (A) the Secretary under section 207(c) with 

16 respect to a critical-impact artificial intelligence 

17 system; 

18 (B) another department or agency of the 

19 Federal Government, as determined applicable 

20 by the Secretary; or 

21 (C) a nongovernmental standards organiza22 tion, as determined appropriate by the Sec23 retary. 

24 (2) EFFECT OF NEW STANDARD.—In adopting 

25 any standard applicable to critical-impact artificial 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
101 

•S 3312 RS

1 intelligence systems under section 207(c), the Sec2 retary shall— 

3 (A) identify the category under subsection 

4 (b) to which the standard relates, if any; and 

5 (B) specify the information that is no 

6 longer required to be included in a report re7 quired under subsection (a) as a result of the 

8 new standard. 

9 (e) RULE OF CONSTRUCTION.—Nothing in this section 

10 shall be construed to require a critical-impact AI organiza11 tion or permit the Secretary to disclose any information, 

12 including data or algorithms— 

13 (1) constituting a trade secret or other intellec14 tual property right; or 

15 (2) that is confidential business information. 

16 (f) CONSOLIDATION.—With respect to an instance in 

17 which multiple critical-impact AI organizations partici18 pate in the deployment of a high-impact artificial intel19 ligence system, the Secretary may establish through regula20 tion a process under which the critical-impact AI organiza21 tions may submit a single risk management assessment 

22 under subsection (a). 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
102 

•S 3312 RS

1 SEC. 207. CERTIFICATION OF CRITICAL-IMPACT ARTIFICIAL 

2 INTELLIGENCE SYSTEMS. 

3 (a) ESTABLISHMENT OF ARTIFICIAL INTELLIGENCE

4 CERTIFICATION ADVISORY COMMITTEE.— 

5 (1) IN GENERAL.—Not later than 180 days after 

6 the date of enactment of this Act, the Secretary shall 

7 establish an advisory committee to provide advice and 

8 recommendations on TEVV standards and the certifi9 cation of critical-impact artificial intelligence sys10 tems. 

11 (2) DUTIES.—The advisory committee estab12 lished under this section shall advise the Secretary on 

13 matters relating to the testing and certification of 

14 critical-impact artificial intelligence systems, includ15 ing by— 

16 (A) providing recommendations to the Sec17 retary on proposed TEVV standards to ensure 

18 such standards— 

19 (i) maximize alignment and interoper20 ability with standards issued by nongovern21 mental standards organizations and inter22 national standards bodies; and 

23 (ii) are performance-based, impact24 based, and risk-based; 

25 (B) reviewing prospective TEVV standards 

26 submitted by the Secretary to ensure such standVerDate Sep 11 2014 06:32 Dec 19, 2024 Jkt 059200 PO 00000 Frm 00102 Fmt 6652 Sfmt 6203 E:\BILLS\S3312.RS S3312

kjohnson on DSK7ZCZBW3PROD with $$_JOB
103 

•S 3312 RS

1 ards align with recommendations under sub2 paragraph (A); 

3 (C) upon completion of the review under 

4 subparagraph (B), providing consensus rec5 ommendations to the Secretary on— 

6 (i) whether a TEVV standard should be 

7 issued, modified, revoked, or added; and 

8 (ii) if such a standard should be 

9 issued, how best to align the standard with 

10 the considerations described in subsection 

11 (c)(2) and recommendations described in 

12 subparagraph (A); and 

13 (D) reviewing and providing advice and 

14 recommendations on the plan and subsequent 

15 updates to the plan submitted under subsection 

16 (b). 

17 (3) COMPOSITION.—The advisory committee es18 tablished under this subsection shall be appointed by 

19 the Secretary and composed of not more than 15 

20 members with a balanced composition of representa21 tives of the private sector, institutions of higher edu22 cation, and nonprofit organizations, including— 

23 (A) representatives of— 

24 (i) institutions of higher education; 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
104 

•S 3312 RS

1 (ii) companies developing or operating 

2 artificial intelligence systems; 

3 (iii) consumers or consumer advocacy 

4 groups; 

5 (iv) enabling technology companies; 

6 and 

7 (v) labor organizations representing 

8 the technology sector; and 

9 (B) any other members the Secretary con10 siders to be appropriate. 

11 (b) ARTIFICIAL INTELLIGENCE CERTIFICATION

12 PLAN.— 

13 (1) IN GENERAL.—Not later than 1 year after 

14 the date of enactment of this Act, the Secretary shall 

15 establish a 3-year implementation plan for the certifi16 cation of critical-impact artificial intelligence sys17 tems. 

18 (2) PERIODIC UPDATE.—As the Secretary deter19 mines appropriate, the Secretary shall update the 

20 plan established under paragraph (1). 

21 (3) CONTENTS.—The plan established under 

22 paragraph (1) shall include— 

23 (A) a methodology for gathering and using 

24 relevant, objective, and available information re25 lating to TEVV; 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
105 

•S 3312 RS

1 (B) a process for considering whether pre2 scribing certain TEVV standards under sub3 section (c) for critical-impact artificial intel4 ligence systems is appropriate, necessary, or du5 plicative of existing international standards; 

6 (C) if TEVV standards are considered ap7 propriate, a process for prescribing such stand8 ards for critical-impact artificial intelligence 

9 systems; 

10 (D) a mechanism for determining compli11 ance with TEVV standards; and 

12 (E) an outline of standards proposed to be 

13 issued, including an estimation of the timeline 

14 and sequencing of such standards. 

15 (4) CONSULTATION.—In developing the plan re16 quired under paragraph (1), the Secretary shall con17 sult the following: 

18 (A) The National Artificial Intelligence Ini19 tiative Office. 

20 (B) The interagency committee established 

21 under section 5103 of the National Artificial In22 telligence Initiative Act of 2020 (15 U.S.C. 

23 9413). 

24 (C) The National Artificial Intelligence Ad25 visory Committee. 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
106 

•S 3312 RS

1 (D) Consensus standards issued by non2 governmental standards organizations. 

3 (E) The Cybersecurity and Infrastructure 

4 Security Agency. 

5 (F) Other departments, agencies, and in6 strumentalities of the Federal Government, as 

7 considered appropriate by the Secretary. 

8 (5) SUBMISSION TO CERTIFICATION ADVISORY

9 COMMITTEE.—Upon completing the initial plan re10 quired under this subsection and upon completing 

11 periodic updates to the plan under paragraph (2), the 

12 Secretary shall submit the plan to the advisory com13 mittee established under subsection (a) for review. 

14 (6) SUBMISSION TO COMMITTEES OF CON15 GRESS.—Upon completing the plan required under 

16 this subsection, the Secretary shall submit to the ap17 propriate congressional committees a report con18 taining the plan. 

19 (7) LIMITATION.—The Secretary may not issue 

20 TEVV standards under subsection (c) until the date 

21 of the submission of the plan under paragraphs (5) 

22 and (6). 

23 (c) STANDARDS.— 

24 (1) STANDARDS.— 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
107 

•S 3312 RS

1 (A) IN GENERAL.—The Secretary shall issue 

2 TEVV standards for critical-impact artificial in3 telligence systems. 

4 (B) REQUIREMENTS.—Each standard 

5 issued under this subsection shall— 

6 (i) be practicable; 

7 (ii) meet the need for safe, secure, and 

8 transparent operations of critical-impact 

9 artificial intelligence systems; 

10 (iii) with respect to a relevant stand11 ard issued by a nongovernmental standards 

12 organization that is already in place, not 

13 unintentionally contradict that standard; 

14 (iv) provide for a mechanism to, not 

15 less frequently than once every 2 years, so16 licit public comment and update the stand17 ard to reflect evidence about the utility of 

18 risk mitigation approaches and advance19 ments in technology and system architec20 ture; and 

21 (v) be stated in objective terms. 

22 (2) CONSIDERATIONS.—In issuing TEVV stand23 ards for critical-impact artificial intelligence systems 

24 under this subsection, the Secretary shall— 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
108 

•S 3312 RS

1 (A) consider relevant available information 

2 concerning critical-impact artificial intelligence 

3 systems, including— 

4 (i) transparency reports submitted 

5 under section 203(a); 

6 (ii) risk management assessments con7 ducted under section 206(a); and 

8 (iii) any additional information pro9 vided to the Secretary pursuant to section 

10 203(a)(1)(B); 

11 (B) consider whether a proposed standard is 

12 reasonable, practicable, and appropriate for the 

13 particular type of critical-impact artificial intel14 ligence system for which the standard is pro15 posed; 

16 (C) consult with stakeholders with expertise 

17 in addressing risks and design of artificial intel18 ligence systems and review standards issued by 

19 nongovernmental standards organizations; 

20 (D) pursuant to paragraph (1)(B)(iii), con21 sider whether adoption of a relevant standard 

22 issued by a nongovernmental standards organi23 zation as a TEVV standard is the most appro24 priate action; and 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
109 

•S 3312 RS

1 (E) consider whether the standard takes 

2 into account— 

3 (i) transparent, replicable, and objec4 tive assessments of critical-impact artificial 

5 intelligence system risk, structure, capabili6 ties, and design; 

7 (ii) the risk posed to the public by an 

8 applicable critical-impact artificial intel9 ligence system; and 

10 (iii) the diversity of methodologies and 

11 innovative technologies and approaches 

12 available to meet the objectives of the stand13 ard. 

14 (3) CONSULTATION.—Before finalizing a TEVV 

15 standard issued under this subsection, the Secretary 

16 shall submit the TEVV standard to the advisory com17 mittee established under subsection (a) for review. 

18 (4) PUBLIC COMMENT.—Before issuing any 

19 TEVV standard under this subsection, the Secretary 

20 shall— 

21 (A) publish a notice describing the TEVV 

22 standard; and 

23 (B) provide an opportunity for public com24 ment pursuant to section 553 of title 5, United 

25 States Code. 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
110 

•S 3312 RS

1 (5) COOPERATION.—In developing a TEVV 

2 standard under this subsection, the Secretary may, as 

3 determined appropriate, advise, assist, and cooperate 

4 with departments, agencies, and instrumentalities of 

5 the Federal Government, States, and other public and 

6 private agencies. 

7 (6) EFFECTIVE DATE OF STANDARDS.— 

8 (A) IN GENERAL.—The Secretary shall 

9 specify the effective date of a TEVV standard 

10 issued under this subsection in the order issuing 

11 the standard. 

12 (B) LIMITATION.—Subject to subparagraph 

13 (C), a TEVV standard issued under this sub14 section may not become effective— 

15 (i) during the 180-day period following 

16 the date on which the TEVV standard is 

17 issued; and 

18 (ii) more than 1 year after the date on 

19 which the TEVV standard is issued. 

20 (C) EXCEPTION.—Subparagraph (B) shall 

21 not apply to the effective date of a TEVV stand22 ard issued under this section if the Secretary— 

23 (i) finds, for good cause shown, that a 

24 different effective date is in the public inter25 est; and 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
111 

•S 3312 RS

1 (ii) publishes the reasons for the find2 ing under clause (i). 

3 (7) RULE OF CONSTRUCTION.—Nothing in this 

4 subsection shall be construed to authorize the Sec5 retary to impose any requirements on or take any en6 forcement actions under this section or section 208 re7 lating to a critical-impact AI organization before a 

8 TEVV standard relating to those requirements is pre9 scribed. 

10 (d) EXEMPTIONS.— 

11 (1) AUTHORITY TO EXEMPT AND PROCEDURES.— 

12 (A) IN GENERAL.—The Secretary may ex13 empt, on a temporary basis, a critical-impact 

14 artificial intelligence system from a TEVV 

15 standard issued under subsection (c) on terms 

16 the Secretary considers appropriate. 

17 (B) RENEWAL.—An exemption under sub18 paragraph (A)— 

19 (i) may be renewed only on reapplica20 tion; and 

21 (ii) shall conform to the requirements 

22 of this paragraph. 

23 (C) PROCEEDINGS.— 

24 (i) IN GENERAL.—The Secretary may 

25 begin a proceeding to grant an exemption to 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
112 

•S 3312 RS

1 a critical-impact artificial intelligence sys2 tem under this paragraph if the critical-im3 pact AI organization that deployed the crit4 ical-impact artificial intelligence system 

5 applies for an exemption or a renewal of an 

6 exemption. 

7 (ii) NOTICE AND COMMENT.—The Sec8 retary shall publish notice of the applica9 tion under clause (i) and provide an oppor10 tunity for public comment under section 

11 553 of title 5, United States Code. 

12 (iii) FILING.—An application for an 

13 exemption or for a renewal of an exemption 

14 under this paragraph shall be filed at such 

15 time and in such manner and contain such 

16 information as the Secretary may require. 

17 (D) ACTIONS.—The Secretary may grant 

18 an exemption under this paragraph upon find19 ing that— 

20 (i) the exemption is consistent with the 

21 public interest and this section; and 

22 (ii) the exemption would facilitate the 

23 development or evaluation of a feature or 

24 characteristic of a critical-impact artificial 

25 intelligence system providing a safety and 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
113 

•S 3312 RS

1 security level that is not less than the TEVV 

2 standard level. 

3 (2) DISCLOSURE.—Not later than 30 days after 

4 the date on which an application is filed under this 

5 subsection, the Secretary may make public informa6 tion contained in the application or relevant to the 

7 application, unless the information concerns or con8 stitutes a trade secret or other confidential informa9 tion not relevant to the application. 

10 (3) NOTICE OF DECISION.—The Secretary shall 

11 publish in the Federal Register a notice of each deci12 sion granting or denying an exemption under this 

13 subsection and the reasons for granting or denying 

14 that exemption, including a justification with sup15 porting information for the selected approach. 

16 (e) CERTIFICATION OF COMPLIANCE.— 

17 (1) IN GENERAL.—Subject to paragraph (2), 

18 with respect to each critical-impact artificial intel19 ligence system of a critical-impact AI organization, 

20 the critical-impact AI organization shall certify to the 

21 Secretary that the critical-impact artificial intel22 ligence system complies with applicable TEVV stand23 ards issued under this section. 

24 (2) EXCEPTION.—A critical-impact AI organiza25 tion may not issue a certification under paragraph 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
114 

•S 3312 RS

1 (1) if, in exercising reasonable care, the critical-im2 pact AI organization has constructive knowledge that 

3 the certification is false or misleading in a material 

4 respect. 

5 (3) DEVELOPER OBLIGATIONS.—The developer of 

6 a critical-impact artificial intelligence system that 

7 enters into a contractual or licensing agreement with 

8 a critical impact AI organization shall be subject to 

9 the same disclosure obligations as a developer of a 

10 critical impact artificial intelligence system under 

11 section 206(c). 

12 (f) NONCOMPLIANCE FINDINGS AND ENFORCEMENT

13 ACTION.— 

14 (1) FINDING OF NONCOMPLIANCE BY SEC15 RETARY.—Upon learning that a critical-impact arti16 ficial intelligence system deployed by a critical-im17 pact AI organization violates this section upon receiv18 ing a report of noncompliance pursuant to an inves19 tigation conducted under section 208(f) or through 

20 other means established through TEVV standards pur21 suant to this section, the Secretary shall— 

22 (A) immediately— 

23 (i) notify the critical-impact AI orga24 nization of the finding; and 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
115 

•S 3312 RS

1 (ii) order the critical-impact AI orga2 nization to take remedial action to address 

3 the noncompliance of the artificial intel4 ligence system; and 

5 (B) may, as determined appropriate or nec6 essary by the Secretary, and if the Secretary de7 termines that actions taken by a critical-impact 

8 AI organization are insufficient to remedy the 

9 noncompliance of the critical-impact AI organi10 zation with this section, take enforcement action 

11 under section 208. 

12 (2) ACTIONS BY CRITICAL-IMPACT AI ORGANIZA13 TION.—If a critical-impact AI organization finds that 

14 a critical-impact artificial intelligence system de15 ployed by the critical-impact AI organization is non16 compliant with an applicable TEVV standard issued 

17 under this section or the critical-impact AI organiza18 tion is notified of noncompliance by the Secretary 

19 under paragraph (1)(A)(i), the critical-impact AI or20 ganization shall— 

21 (A) without undue delay, notify the Sec22 retary by certified mail or electronic mail of the 

23 noncompliance or receipt of the notification of 

24 noncompliance; 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
116 

•S 3312 RS

1 (B) take remedial action to address the non2 compliance; and 

3 (C) not later than 10 days after the date of 

4 the notification or receipt under subparagraph 

5 (A), submit to the Secretary a report containing 

6 information on— 

7 (i) the nature and discovery of the 

8 noncompliant aspect of the critical-impact 

9 artificial intelligence system; 

10 (ii) measures taken to remedy such 

11 noncompliance; and 

12 (iii) actions taken by the critical-im13 pact AI organization to address stakeholders 

14 affected by such noncompliance. 

15 SEC. 208. ENFORCEMENT. 

16 (a) IN GENERAL.—The Secretary shall take an action 

17 described in this section— 

18 (1) upon discovering noncompliance with a pro19 vision of this Act by a deployer of a high-impact arti20 ficial intelligence system, a critical-impact AI organi21 zation, or a developer of a critical-impact artificial 

22 intelligence system; and 

23 (2) if the Secretary determines that actions taken 

24 by the deployer of a high-impact artificial intelligence 

25 system, a critical-impact AI organization, or the deVerDate Sep 11 2014 06:32 Dec 19, 2024 Jkt 059200 PO 00000 Frm 00116 Fmt 6652 Sfmt 6203 E:\BILLS\S3312.RS S3312

kjohnson on DSK7ZCZBW3PROD with $$_JOB
117 

•S 3312 RS

1 veloper of a critical-impact artificial intelligence sys2 tem are insufficient to remedy the noncompliance. 

3 (b) CIVIL PENALTIES.— 

4 (1) IN GENERAL.—The Secretary may impose a 

5 penalty described in paragraph (2) on a deployer of 

6 a high-impact artificial intelligence system or a crit7 ical-impact AI organization for each violation by that 

8 entity of this Act or any regulation or order issued 

9 under this Act. 

10 (2) PENALTY DESCRIBED.—The penalty de11 scribed in this paragraph is the greater of— 

12 (A) an amount not to exceed $300,000; or 

13 (B) an amount that is twice the value of the 

14 artificial intelligence system product deployed 

15 that is the basis of the violation with respect to 

16 which the penalty is imposed. 

17 (c) VIOLATION WITH INTENT.— 

18 (1) IN GENERAL.—If the Secretary determines 

19 that a deployer of a high-impact artificial intelligence 

20 system or a critical-impact AI organization inten21 tionally violates this Act or any regulation or order 

22 issued under this Act, the Secretary may prohibit the 

23 critical-impact AI organization or deployer, as appli24 cable, from deploying a critical-impact artificial inVerDate Sep 11 2014 06:32 Dec 19, 2024 Jkt 059200 PO 00000 Frm 00117 Fmt 6652 Sfmt 6203 E:\BILLS\S3312.RS S3312

kjohnson on DSK7ZCZBW3PROD with $$_JOB
118 

•S 3312 RS

1 telligence system or a high-impact artificial intel2 ligence system. 

3 (2) IN ADDITION .—A prohibition imposed under 

4 paragraph (1) shall be in addition to any other civil 

5 penalties provided under this Act. 

6 (d) FACTORS.—The Secretary may by regulation pro7 vide standards for establishing levels of civil penalty under 

8 this section based upon factors, such as the seriousness of 

9 the violation, the culpability of the violator, and such miti10 gating factors as the violator’s record of cooperation with 

11 the Secretary in disclosing the violation. 

12 (e) CIVIL ACTION.— 

13 (1) IN GENERAL.—Upon referral by the Sec14 retary, the Attorney General may bring a civil action 

15 in a United States district court to— 

16 (A) enjoin a violation of section 207; or 

17 (B) collect a civil penalty upon a finding of 

18 noncompliance with this Act. 

19 (2) VENUE.—A civil action may be brought 

20 under paragraph (1) in the judicial district in which 

21 the violation occurred or the defendant is found, re22 sides, or does business. 

23 (3) PROCESS.—Process in a civil action under 

24 paragraph (1) may be served in any judicial district 

25 in which the defendant resides or is found. 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
119 

•S 3312 RS

1 (f) AUTHORITY TO INVESTIGATE.—The Secretary may 

2 conduct an investigation— 

3 (1) that may be necessary to enforce this Act or 

4 a TEVV standard or regulation prescribed pursuant 

5 to this Act; or 

6 (2) related to a report of noncompliance with 

7 this Act from a third party, a deployer or developer 

8 of an artificial intelligence system subject to the re9 quirements of this Act, or discovered by the Secretary. 

10 (g) RULE OF CONSTRUCTION.—Nothing in this section 

11 shall be construed to require a deployer of a critical-impact 

12 artificial intelligence system to disclose any information, 

13 including data or algorithms— 

14 (1) constituting a trade secret or other protected 

15 intellectual property right; or 

16 (2) that is confidential business information. 

17 SEC. 209. DEVELOPER AND DEPLOYER OVERLAP. 

18 With respect to an entity that is a deployer and a de19 veloper, the entity shall be subject to the requirements of 

20 deployers and developers under this Act. 

21 SEC. 210. ARTIFICIAL INTELLIGENCE CONSUMER EDU22 CATION. 

23 (a) ESTABLISHMENT.—Not later than 180 days after 

24 the date of enactment of this Act, the Secretary shall estabVerDate Sep 11 2014 06:32 Dec 19, 2024 Jkt 059200 PO 00000 Frm 00119 Fmt 6652 Sfmt 6203 E:\BILLS\S3312.RS S3312

kjohnson on DSK7ZCZBW3PROD with $$_JOB
120 

•S 3312 RS

1 lish a working group relating to responsible education ef2 forts for artificial intelligence systems. 

3 (b) MEMBERSHIP.— 

4 (1) IN GENERAL.—The Secretary shall appoint 

5 to serve as members of the working group established 

6 under this section not more than 15 individuals with 

7 expertise relating to artificial intelligence systems, in8 cluding— 

9 (A) representatives of— 

10 (i) institutions of higher education; 

11 (ii) companies developing or operating 

12 artificial intelligence systems; 

13 (iii) consumers or consumer advocacy 

14 groups; 

15 (iv) public health organizations; 

16 (v) marketing professionals; 

17 (vi) entities with national experience 

18 relating to consumer education, including 

19 technology education; 

20 (vii) public safety organizations; 

21 (viii) rural workforce development ad22 vocates; 

23 (ix) enabling technology companies; 

24 and 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
121 

•S 3312 RS

1 (x) nonprofit technology industry trade 

2 associations; and 

3 (B) any other members the Secretary con4 siders to be appropriate. 

5 (2) COMPENSATION.—A member of the working 

6 group established under this section shall serve with7 out compensation. 

8 (c) DUTIES.— 

9 (1) IN GENERAL.—The working group established 

10 under this section shall— 

11 (A) identify recommended education and 

12 programs that may be voluntarily employed by 

13 industry to inform— 

14 (i) consumers and other stakeholders 

15 with respect to artificial intelligence sys16 tems as those systems— 

17 (I) become available; or 

18 (II) are soon to be made widely 

19 available for public use or consump20 tion; and 

21 (B) submit to Congress, and make available 

22 to the public, a report containing the findings 

23 and recommendations under subparagraph (A). 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
122 

•S 3312 RS

1 (2) FACTORS FOR CONSIDERATION.—The work2 ing group established under this section shall take 

3 into consideration topics relating to— 

4 (A) the intent, capabilities, and limitations 

5 of artificial intelligence systems; 

6 (B) use cases of artificial intelligence appli7 cations that improve lives of the people of the 

8 United States, such as improving government ef9 ficiency, filling critical roles, and reducing mun10 dane work tasks; 

11 (C) artificial intelligence research break12 throughs; 

13 (D) engagement and interaction methods, 

14 including how to adequately inform consumers of 

15 interaction with an artificial intelligence system; 

16 (E) human-machine interfaces; 

17 (F) emergency fallback scenarios; 

18 (G) operational boundary responsibilities; 

19 (H) potential mechanisms that could change 

20 function behavior in service; 

21 (I) consistent nomenclature and taxonomy 

22 for safety features and systems; and 

23 (J) digital literacy. 

24 (3) CONSULTATION.—The Secretary shall consult 

25 with the Chair of the Federal Trade Commission with 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
123 

•S 3312 RS

1 respect to the recommendations of the working group 

2 established under this section, as appropriate. 

3 (d) TERMINATION.—The working group established 

4 under this section shall terminate on the date that is 2 years 

5 after the date of enactment of this Act. 

6 SEC. 211. SEVERABILITY. 

7 If any provision of this title, or an amendment made 

8 by this title, or the application of such provision to any 

9 person or circumstance is held to be unconstitutional, the 

10 remainder of this title, or an amendment made by this title, 

11 and the application of the provisions of such to all other 

12 persons or circumstances shall not be affected thereby. 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
Calendar No. 723 

118TH CONGRESS 

2D SESSION S. 3312 

A BILL 

To provide a framework for artificial intelligence inDposes. novation and accountability, and for other pur- ECEMBER 18 (legislative day, DECEMBER 16), 2024 

Reported with an amendment 


kjohnson on DSK7ZCZBW3PROD with $$_JOB