August 19, 2021

Mark Przybocki

U.S. National Institute of Standards and Technology

100 Bureau Drive

Gaithersburg, Maryland 20899

RE: Comments of ACT | The App Association to the National Institute of 

Standards and Technology on an Artificial Intelligence Risk Management 

Framework

ACT | The App Association (App Association) appreciates the opportunity to submit 

views to the National Institute of Standards and Technology (NIST) on its planned 

framework addressing the management of risks to individuals, organizations, and 

society associated with artificial intelligence (AI).

1

The App Association represents thousands of small business software application 

development companies and technology firms that create the technologies that drive

internet of things (IoT) use cases across consumer and enterprise contexts. Today, the 

value of the ecosystem the App Association represents – which we call the app 

economy – is approximately $1.3 trillion and is responsible for 5.7 million American jobs.

Alongside the world’s rapid embrace of mobile technology, our members create the

innovative solutions that power IoT across modalities and segments of the economy.

NIST’s planned voluntary risk management framework (RMF)—and the efforts of 

numerous agencies with respect to AI policy and regulation—directly impacts the app 

economy. We support NIST’s goal of helping designers, developers, users, and 

evaluators of AI systems better manage risks across the AI lifecycle.

2

1 86 FR 40810.

2

Id at 40811.
2

The App Association also continues to work proactively to advance the use of AI in key 

use cases. As just one example, the App Association’s Connected Health Initiative3

(CHI) assembled a Health AI Task Force in the summer of 2018 consisting of a range of 

innovators and thought leaders. CHI unveiled its AI Task Force’s deliverables during a 

public-private multistakeholder dialogue in Washington, DC, which include a position 

piece supporting AI’s role in healthcare, policy principles addressing how policy 

frameworks should approach the role of AI in healthcare, and a terminology document 

targeted at policymakers.4 Since then, CHI has also developed Good Machine Learning 

Practices specifically for AI development and risk management of AI meeting the Food 

and Drug Administration’s definition of a medical device.5 More generally, the App 

Association continues to lead in advocating for the development of frameworks that will 

responsibly support the development, availability, and use of AI innovations.

AI is an evolving constellation of technologies that enable computers to simulate 

elements of human thinking – learning and reasoning among them. An encompassing 

term, AI entails a range of approaches and technologies, such as Machine Learning 

(ML) and deep learning, where an algorithm based on the way neurons and synapses in 

the brain change due to exposure to new inputs, allowing independent or assisted 

decision making.

AI-driven algorithmic decision tools and predictive analytics are having, and will 

continue to have, substantial direct and indirect effects on Americans. Some forms of AI 

are already in use to improve American consumers’ lives today – for example, AI is 

used to detect financial and identity theft and to protect the communications networks 

upon which Americans rely against cybersecurity threats. Moving forward, across use 

cases and sectors, AI has incredible potential to improve American consumers’ lives 

through faster and better-informed decision making, enabled by cutting-edge distributed 

cloud computing. As an example, healthcare treatments and patient outcomes stand 

poised to improve disease prevention and conditions, as well as efficiently and 

effectively treat diseases through automated analysis of x-rays and other medical 

imaging. AI will also play an essential role in self-driving vehicles and could drastically 

reduce roadway deaths and injuries. From a governance perspective, AI solutions will 

derive greater insights from infrastructure and support efficient budgeting decisions. An 

estimate states AI technological breakthroughs will represent a $126 billion market by 

2025.

6

3 See www.connectedhi.com. 

4 The CHI Health AI Task Force’s deliverables are accessible at https://actonline.org/2019/02/06/whydoes-healthcare-need-ai-connected-health-initiative-aims-to-answer-why/. 

5 The CHI’s Good Machine Learning Practices are available at https://bit.ly/3gcar1e.

6 McKinsey Global Institute, Artificial Intelligence: The Next Digital Frontier? (June 2017), available at 

https://www.mckinsey.com/~/media/McKinsey/Industries/Advanced%20Electronics/Our%20Insights/How

%20artificial%20intelligence%20can%20deliver%20real%20value%20to%20companies/MGI-ArtificialIntelligence-Discussion-paper.ashx.
3

Today, Americans encounter AI in their lives incrementally through the improvements 

they have seen in computer-based services they use, typically in the form of 

streamlined processes, image analysis, and voice recognition (we urge consideration of 

these forms of AI as “narrow” AI). The App Association notes that this “narrow” AI 

already provides great societal benefit. For example, AI-driven software products and 

services revolutionized the ability of countless Americans with disabilities to achieve 

experiences in their lives far closer to the experiences of those without disabilities.

Nonetheless, AI also has the potential to raise a variety of unique considerations for 

policymakers. The App Association appreciates the efforts to develop a policy approach 

to AI that will bring its benefits to all, balanced with necessary safeguards to protect 

consumers. To assist NIST and other policymakers, the App Association has appended 

a comprehensive set of AI policy principles for consideration.

7 The App Association 

supports NIST’s efforts to develop a voluntary prioritized, flexible, risk-based, outcomefocused, and cost-effective AI risk management framework (RMF), and strongly 

encourage NIST to align its voluntary RMF with these principles.

Noting our general support for NIST’s efforts to develop a voluntary prioritized, flexible, 

risk-based, outcome-focused, and cost-effective AI RMF, we offer the following further 

input:

• NIST’s AI RMF Should Advance Thoughtful Design Principles Across AI 

Use Cases: The RMF should emphasize that the design of AI systems be

informed by real-world workflows, human-centered design and usability 

principles, and end-user needs. AI systems solutions should facilitate a transition 

to changes in the delivery of goods and services that benefit consumers and 

businesses. The design, development, and success of AI should leverage 

collaboration and dialogue among users, AI technology developers, and other 

stakeholders in order to have all perspectives reflected in AI solutions. As this 

concept must run across sectors and AI use cases, we call on NIST to advance 

thoughtful design principles in the RMF.

• NIST’s AI RMF Should Advance Ethics in AI’s Development and Use: The 

success of AI depends on ethical use. The RMF should promote many of the 

existing and emerging ethical norms for broader adherence by AI technologists, 

innovators, computer scientists, and those who use such systems. We call on 

NIST to include a provision in its RMF providing for stakeholders’ approaches to 

AI to duly consider ethics so that policies are advanced that:

o Ensure that AI solutions align with all relevant ethical obligations, from 

design to development to use. 

o Encourage the development of new ethical guidelines to address 

emerging issues with the use of AI, as needed. 

7 See Appendix, ACT | The App Association’s Policy Principles for Artificial Intelligence (outlining our 

organization’s collective AI principles).
4

o Maintain consistency with international conventions on human rights. 

o Ensure that AI is inclusive such that AI solutions beneficial to consumers 

develop across socioeconomic, age, gender, geographic origin, and other 

groupings. 

o Reflect that AI tools may reveal extremely sensitive and private 

information about a user and ensure that laws protect such information 

from being used to discriminate against certain consumers

• NIST’s AI RMF Should Prioritize Necessary Disclosures and Transparency:

The App Association supports NIST’s RMF helping providers, technology 

developers and vendors, and other stakeholders understand the distribution of 

risk and liability in building, testing, and using AI tools. The RMF should advance 

the appropriate distribution and mitigation of AI-related risks and liabilities (i.e., 

that those in the value chain with the ability to minimize risks based on their 

knowledge and ability to mitigate should take reasonable steps, and have 

appropriate incentives, to do so). Further, the RMF should clearly state that those 

developing, offering, or testing AI systems provide truthful and easy to 

understand representations regarding intended use and risks that would be 

reasonably understood by those intended, as well as expected, to use the AI 

solution.

• NIST’s AI RMF Should Support the Development of, and Access to, Open 

Standards Needed to Drive U.S. Leadership in AI: Building on NIST’s 

longstanding leadership in supporting voluntary consensus standards, the App 

Association strongly encourages NIST to ensure that the RMF supports publicprivate collaboration on AI through standardization in standard-setting 

organizations (SSOs) (such as IEEE8) to grow and thrive. The RMF should

support pro-innovation policies that encourage private sector research and 

development of AI innovations and the development of related standards.

It is critical that the United States ensure that AI standards are accessible to 

innovators by promoting a balanced approach using those standards, including 

via to standard-essential patent (SEP) licensing. AI technical standards, built on 

contributions through an open and consensus-based process, bring immense 

value to consumers by promoting interoperability while enabling healthy 

competition between innovators; and often include patented technology. When 

an innovator gives its patented technology to a standard, this can represent a 

clear path to reward in the form of royalties from a market that likely would not 

have existed without the standard being widely adopted. To balance this potential 

with the need for access to the patents that underlie the standard, SSOs require 

holders of patents on standardized technologies to license their patents on fair, 

8 https://standards.ieee.org/initiatives/artificial-intelligence-systems/index.html. 
5

reasonable, and non-discriminatory (FRAND) terms. FRAND commitments 

prevent the owners of patents used to implement the standard from exploiting the 

unearned market power that they otherwise would gain as a consequence of the 

broad adoption of a standard. Once patented technologies incorporate into 

standards and a standard becomes increasingly adopted, AI developers will be 

compelled to use them to maintain product functionality and compatibility. In 

exchange for making a voluntary FRAND commitment with an SSO, SEP holders 

gain the ability to obtain reasonable royalties from a large number of standard 

users that might not have existed absent the standard. Without the constraint of a 

FRAND commitment, SEP holders would have the same power as a monopolist 

that faces no competition.

Unfortunately, today a number of owners of FRAND-committed SEPs are 

increasingly flagrantly abusing their unique position by reneging on those 

promises with unfair, unreasonable, or discriminatory licensing practices. These 

practices, under close examination by antitrust and other regulators in many 

jurisdictions including the United States, not only threaten healthy competition 

and unbalance the standards system but also impact the viability of new markets 

such as AI. These abuses are amplified for small businesses because they can 

neither afford years of litigation to fight for reasonable royalties nor risk facing an 

injunction if they refuse a license that is not FRAND compliant.

NIST should, in its RMF, appropriately address how patent policies developed by 

SSOs today will directly impact the way we work, live, and play for decades to 

come. SSOs vary widely in terms of their memberships, the industries and 

products they cover, and the procedures for establishing standards. In part due 

to the convergence associated with the rise of IoT, each SSO will need the ability 

to tailor its intellectual property policy for its particular requirements and 

membership. The App Association believes that some variation in patent policies 

among SSOs is necessary and that the U.S. government should not prescribe 

detailed requirements that all SSOs must implement. At the same time, however, 

as evidenced by the judicial cases and regulatory guidance, basic principles 

underlie the FRAND commitment and serve to ensure that standard setting is 

pro-competitive, and the terms of SEP licenses are in fact reasonable. Ideally, an 

SSO’s intellectual property rights policy that requires SEP owners to make a 

FRAND commitment would include all of the following principles that prevent 

patent “hold-up” and anti-competitive conduct:

o Fair and Reasonable to All – A holder of a SEP subject to a FRAND 

license such SEP on fair, reasonable, and nondiscriminatory terms to all 

companies, organizations, and individuals who implement or wish to 

implement the standard.
6

o Injunctions Available Only in Limited Circumstances –SEP holders

should not seek injunctions and other exclusionary remedies nor allowed 

these remedies except in limited circumstances. The implementer or 

licensee is always entitled to assert claims and defenses.

o FRAND Promise Extends if Transferred – If there is a transfer of a 

FRAND-encumbered SEP, the FRAND commitments follow the SEP in 

that and all subsequent transfers.

o No Forced Licensing – While some licensees may wish to get broader 

patent holder should not require implementers to take or grant licenses to 

a FRAND-encumbered SEP that is invalid, unenforceable, or not infringed, 

or a patent that is not essential to the standard.

o FRAND Royalties – A reasonable rate for a valid, infringed, and 

enforceable FRAND-encumbered SEP should be based on several 

factors, including the value of the actual patented invention apart from its 

inclusion in the standard, and cannot be assessed in a vacuum that 

ignores the portion in which the SEP is substantially practiced or royalty 

rates from other SEPs required to implement the standard.

We also note that a number of SSO intellectual property rights policies require 

SSO participants to disclose patents or patent applications that are or may be 

essential to a standard under development. Reasonable disclosure policies can 

help SSO participants evaluate whether technologies considered for 

standardization are covered by patents.

The U.S. Department of Justice (DOJ) already encouraged SSOs to define 

FRAND more clearly. For example, DOJ’s former assistant attorney general 

Christine Varney explained that “clearer rules will allow for more informed 

participation and will enable participants to make more knowledgeable decisions 

regarding implementation of the standard. Clarity alone does not eliminate the 

possibility of hold-up...but it is a step in the right direction.”9 As another example, 

Renata Hesse, a previous head of the DOJ’s Antitrust Division, provided 

important suggestions for SSOs to guard against SEP abuses.10 NIST’s planned 

9 Christine A. Varney, Assistant Att’y Gen., Antitrust Div., U.S. Dep’t of Justice, Promoting Innovation 

Through Patent and Antitrust Law and Policy, Remarks as Prepared for the Joint Workshop of the U.S. 

Patent and Trademark Office, the Federal Trade Comm’n, and the Dep’t of Justice on the Intersection of 

Patent Policy and Competition Policy: Implications for Promoting Innovation 8 (May 26, 2010), available 

at http://www.atrnet.gov/subdocs/2010/260101.htm. 

10 Renata Hess, Deputy Assistant Attorney General, Six ‘Small’ Proposals for SSOs Before Lunch, 

Prepared for the ITU-T Patent Roundtable (October 10, 2012), available at

https://www.justice.gov/atr/speech/six-smallproposals-ssos-lunch. 
7

RMF should reflect the above with respect to standards and key standards use 

issues including SEP licensing.

The App Association appreciates NIST’s consideration of the above views. AI offers 

immense potential for widespread societal benefit, which is why NIST’s voluntary RMF 

should foster investment and innovation in any way practicable. Our members both use 

and develop solutions that include AI, and those are in turn used by countless 

Americans. As society moves to adopt these technologies on a greater scale, it is 

important that the small business developers who power a $1.3 trillion app economy

can contribute to this important trend.

We urge NIST to contact the undersigned with any questions or ways that we can assist 

moving forward.

Sincerely,

Brian Scarpelli

Senior Global Policy Counsel

Leanna Wade

Policy Associate

ACT | The App Association

1401 K St NW (Ste 501)

Washington, DC 20005

202-331-2130