S4495-118

1. Short title This Act may be cited as the Promoting Responsible Evaluation and Procurement to Advance Readiness for Enterprise-wide Deployment for Artificial Intelligence Act or the PREPARED for AI Act.

2. Definitions In this Act: The term adverse incident means any incident or malfunction of artificial intelligence that directly or indirectly leads to— harm impacting rights or safety, as described in section 7(a)(2)(D); the death of an individual or damage to the health of an individual; material or irreversible disruption of the management and operation of critical infrastructure, as described in section 7(a)(2)(D)(i)(II)(cc); material damage to property or the environment; loss of a mission-critical system or equipment; failure of the mission of an agency; the denial of a benefit, payment, or other service to an individual or group of individuals who would have otherwise been eligible; the denial of an employment, contract, grant, or similar opportunity that would have otherwise been offered; or another consequence, as determined by the Director with public notice. The term agency— has the meaning given that term in section 3502(1) of title 44, United States Code; and includes each of the independent regulatory agencies described in section 3502(5) of title 44, United States Code. The term artificial intelligence— has the meaning given that term in section 5002 of the National Artificial Intelligence Initiative Act of 2020 (15 U.S.C. 9401); and includes the artificial systems and techniques described in paragraphs (1) through (5) of section 238(g) of the John S. McCain National Defense Authorization Act for Fiscal Year 2019 (Public Law 115–232; 10 U.S.C. 4061 note prec.). The term biometric data means data resulting from specific technical processing relating to the unique physical, physiological, or behavioral characteristics of an individual, including facial images, dactyloscopic data, physical movement and gait, breath, voice, DNA, blood type, and expression of emotion, thought, or feeling. The term commercial technology— means a technology, process, or method, including research or development; and includes commercial products, commercial services, and other commercial items, as defined in the Federal Acquisition Regulation, including any addition or update thereto by the Federal Acquisition Regulatory Council. The term Council means the Chief Artificial Intelligence Officers Council established under section 5(a). The term deployer means an entity that operates or provides artificial intelligence, whether developed internally or by a third-party developer. The term developer means an entity that designs, codes, produces, or owns artificial intelligence. The term Director means the Director of the Office of Management and Budget. The term impact assessment means a structured process for considering the implications of a proposed artificial intelligence use case. The term operational design domain means a set of operating conditions for an automated system. The term procure or obtain means— to acquire through contract actions awarded pursuant to the Federal Acquisition Regulation, including through interagency agreements, multi-agency use, and purchase card transactions; to acquire through contracts and agreements awarded through other special procurement authorities, including through other transactions and commercial solutions opening authorities; or to obtain through other means, including through open source platforms or freeware. The term relevant congressional committees means the Committee on Homeland Security and Governmental Affairs of the Senate and the Committee on Oversight and Accountability of the House of Representatives. The term risk means the combination of the probability of an occurrence of harm and the potential severity of that harm. The term use case means the ways and context in which artificial intelligence is operated to perform a specific function.

3. Implementation of requirements Not later than 1 year after the date of enactment of this Act, the Director shall ensure that agencies have implemented the requirements of this Act. Not later than 180 days after the date of enactment of this Act, and annually thereafter, the Director shall brief the appropriate Congressional committees on implementation of this Act and related considerations.

4. Procurement of artificial intelligence Not later than 1 year after the date of enactment of this Act, the Federal Acquisition Regulatory Council shall review Federal Acquisition Regulation acquisition planning, source selection, and other requirements and update the Federal Acquisition Regulation as needed to ensure that agency procurement of artificial intelligence includes— a requirement to address the outcomes of the risk evaluation and impact assessments required under section 8(a); a requirement for consultation with an interdisciplinary team of agency experts prior to, and throughout, as necessary, procuring or obtaining artificial intelligence; and any other considerations determined relevant by the Federal Acquisition Regulatory Council. The interdisciplinary team of experts described in paragraph (1)(B) may— vary depending on the use case and the risks determined to be associated with the use case; and include technologists, information security personnel, domain experts, privacy officers, data officers, civil rights and civil liberties officers, contracting officials, legal counsel, customer experience professionals, and others. The acquisition planning updates described in paragraph (1) shall include considerations for, at minimum, as appropriate depending on the use case— data ownership and privacy; data information security; interoperability requirements; data and model assessment processes; scope of use; ongoing monitoring techniques; type and scope of artificial intelligence audits; environmental impact; and safety and security risk mitigation techniques, including a plan for how adverse event reporting can be incorporated, pursuant to section 5(g). Beginning on the date that is 1 year after the date of enactment of this Act, the head of an agency may not procure or obtain artificial intelligence for a high risk use case, as defined in section 7(a)(2)(D), prior to establishing and incorporating certain terms into relevant contracts, agreements, and employee guidelines for artificial intelligence, including— a requirement that the use of the artificial intelligence be limited to its operational design domain; requirements for safety, security, and trustworthiness, including— a reporting mechanism through which agency personnel are notified by the deployer of any adverse incident; a requirement, in accordance with section 5(g), that agency personnel receive from the deployer a notification of any adverse incident, an explanation of the cause of the adverse incident, and any data directly connected to the adverse incident in order to address and mitigate the harm; and that the agency has the right to temporarily or permanently suspend use of the artificial intelligence if— the risks of the artificial intelligence to rights or safety become unacceptable, as determined under the agency risk classification system pursuant to section 7; or on or after the date that is 180 days after the publication of the most recently updated version of the framework developed and updated pursuant to section 22(A)(c) of the National Institute of Standards and Technology Act (15 U.S.C. 278h–1(c)), the deployer is found not to comply with such most recent update; requirements for quality, relevance, sourcing and ownership of data, as appropriate by use case, and applicable unless the head of the agency waives such requirements in writing, including— retention of rights to Government data and any modification to the data including to protect the data from unauthorized disclosure and use to subsequently train or improve the functionality of commercial products offered by the deployer, any relevant developers, or others; and a requirement that the deployer and any relevant developers or other parties isolate Government data from all other data, through physical separation, electronic separation via secure copies with strict access controls, or other computational isolation mechanisms; requirements for evaluation and testing of artificial intelligence based on use case, to be performed on an ongoing basis; and requirements that the deployer and any relevant developers provide documentation, as determined necessary and requested by the agency, in accordance with section 8(b). The Senior Procurement Executive, in coordination with the Chief Artificial Intelligence Officer, shall consult with technologists, information security personnel, domain experts, privacy officers, data officers, civil rights and civil liberties officers, contracting officials, legal counsel, customer experience professionals, and other relevant agency officials to review the requirements described in clauses (i) through (v) of subparagraph (A) and determine whether it may be necessary to incorporate additional requirements into relevant contracts or agreements. The Federal Acquisition Regulatory Council shall revise the Federal Acquisition Regulation as necessary to implement the requirements of this subsection. This Act shall supersede any requirements that conflict with this Act under the guidance required to be produced by the Director pursuant to section 7224(d) of the Advancing American AI Act (40 U.S.C. 11301 note).

5. Interagency governance of artificial intelligence Not later than 60 days after the date of enactment of this Act, the Director shall establish a Chief Artificial Intelligence Officers Council. The duties of the Council shall include— coordinating agency development and use of artificial intelligence in agency programs and operations, including practices relating to the design, operation, risk management, and performance of artificial intelligence; sharing experiences, ideas, best practices, and innovative approaches relating to artificial intelligence; and assisting the Director, as necessary, with respect to— the identification, development, and coordination of multi-agency projects and other initiatives, including initiatives to improve Government performance; the management of risks relating to developing, obtaining, or using artificial intelligence, including by developing a common template to guide agency Chief Artificial Intelligence Officers in implementing a risk classification system that may incorporate best practices, such as those from— the most recently updated version of the framework developed and updated pursuant to section 22A(c) of the National Institute of Standards and Technology Act (15 U.S.C. 278h–1(c)); and the report published by the Government Accountability Office entitled Artificial Intelligence: An Accountability Framework for Federal Agencies and Other Entities (GAO–21–519SP), published on June 30, 2021; promoting the development and use of efficient, effective, common, shared, or other approaches to key processes that improve the delivery of services for the public; and soliciting and providing perspectives on matters of concern, including from and to— interagency councils; Federal Government entities; private sector, public sector, nonprofit, and academic experts; State, local, Tribal, territorial, and international governments; and other individuals and entities, as determined relevant by the Council. The Council shall have 2 co-chairs, which shall be— the Director; and an individual selected by a majority of the members of the Council. Other members of the Council shall include— the Chief Artificial Intelligence Officer of each agency; and the senior official for artificial intelligence of the Office of Management and Budget. The Council shall have the authority to establish standing committees, including an executive committee, and working groups. The Council may enter into an interagency agreement with the Administrator of General Services for shared services for the purpose of staffing the Council. Not later than 90 days after the date of enactment of this Act, the Director, in consultation with the Council, shall issue guidance relating to— developments in artificial intelligence and implications for management of agency programs; the agency impact assessments described in section 8(a) and other relevant impact assessments as determined appropriate by the Director, including the appropriateness of substituting pre-existing assessments, including privacy impact assessments, for purposes of an artificial intelligence impact assessment; documentation for agencies to require from deployers of artificial intelligence; a model template for the explanations for use case risk classifications that each agency must provide under section 8(a)(4); and other matters, as determined relevant by the Director. The Director, in consultation with the Council, shall periodically, but not less frequently than annually, review and update, as needed, the guidelines issued under paragraph (1). Not later than 180 days after the date of enactment of this Act, the Director, in consultation with the Council, shall develop procedures for ensuring that— adverse incidents involving artificial intelligence procured, obtained, or used by agencies are reported promptly to the agency by the developer or deployer, or to the developer or deployer by the agency, whichever first becomes aware of the adverse incident; and information relating to an adverse incident described in subparagraph (A) is appropriately shared among agencies. Adverse incidents also qualifying for incident reporting under section 3554 of title 44, United States Code, or other relevant laws or policies, may be reported under such other reporting requirement and are not required to be additionally reported under this subsection. If an adverse incident is discovered by an agency, the agency shall report the adverse incident to the deployer and the deployer, in consultation with any relevant developers, shall take immediate action to resolve the adverse incident and mitigate the potential for future adverse incidents. Unless otherwise required by law, the head of an agency may issue a written waiver that waives the applicability of some or all of the requirements under subparagraph (A), with respect to a specific adverse incident. A written waiver under clause (i) shall include justification for the waiver. The head of an agency shall forward advance notice of any waiver under this subparagraph to the Director, or the designee of the Director.

6. Agency governance of artificial intelligence The head of an agency shall— ensure the responsible adoption of artificial intelligence, including by— articulating a clear vision of what the head of the agency wants to achieve by developing, procuring or obtaining, or using artificial intelligence; ensuring the agency develops, procures, obtains, or uses artificial intelligence that follows the principles of trustworthy artificial intelligence in government set forth under Executive Order 13960 (85 Fed. Reg. 78939; relating to promoting the use of trustworthy artificial intelligence in Federal Government) and the principles for safe, secure, and trustworthy artificial intelligence in government set forth under section 2 of Executive Order 14110 (88 Fed. Reg. 75191; relating to the safe, secure, and trustworthy development and use of artificial intelligence); testing, validating, and monitoring artificial intelligence and the use case-specific performance of artificial intelligence, among others, to— ensure all use of artificial intelligence is appropriate to and improves the effectiveness of the mission of the agency; guard against bias in data collection, use, and dissemination; ensure reliability, fairness, and transparency; and protect against impermissible discrimination; developing, adopting, and applying a suitable enterprise risk management framework approach to artificial intelligence, incorporating the requirements under this Act; continuing to develop a workforce that— understands the strengths and weaknesses of artificial intelligence, including artificial intelligence embedded in agency data systems and operations; is aware of the benefits and risk of artificial intelligence; is able to provide human oversight for the design, implementation, and end uses of artificial intelligence; and is able to review and provide redress for erroneous decisions made in the course of artificial intelligence-assisted processes; and ensuring implementation of the requirements under section 8(a) for the identification and evaluation of risks posed by the deployment of artificial intelligence in agency use cases; designate a Chief Artificial Intelligence Officer, whose duties shall include— ensuring appropriate use of artificial intelligence; coordinating agency use of artificial intelligence; promoting artificial intelligence innovation; managing the risks of use of artificial intelligence; supporting the head of the agency with developing the risk classification system required under section 7(a) and complying with other requirements of this Act; and supporting agency personnel leading the procurement and deployment of artificial intelligence to comply with the requirements under this Act; and form and convene an Artificial Intelligence Governance Board, as described in subsection (b), which shall coordinate and govern artificial intelligence issues across the agency. Each Artificial Intelligence Governance Board (referred to in this subsection as Board) of an agency shall be chaired by the Deputy Secretary of the agency or equivalent official and vice-chaired by the Chief Artificial Intelligence Officer of the agency. Neither the chair nor the vice-chair may assign or delegate these roles to other officials. The Board shall, at a minimum, include representatives comprised of senior agency officials from operational components, if relevant, program officials responsible for implementing artificial intelligence, and officials responsible for information technology, data, privacy, civil rights and civil liberties, human capital, procurement, finance, legal counsel, and customer experience. An agency may rely on an existing governance body to fulfill the requirements of this subsection if the body satisfies or is adjusted to satisfy the leadership and representation requirements of paragraphs (1) and (2). The head of an agency may designate as Chief Artificial Intelligence Officer an existing official within the agency, including the Chief Technology Officer, Chief Data Officer, Chief Information Officer, or other official with relevant or complementary authorities and responsibilities, if such existing official has expertise in artificial intelligence and meets the requirements of this section. Beginning on the date that is 120 days after the date of enactment of this Act, an agency shall not develop or procure or obtain artificial intelligence prior to completing the requirements under paragraphs (2) and (3) of subsection (a).

7. Agency risk classification of artificial intelligence use cases for procurement and use The head of each agency shall be responsible for developing, not later than 1 year after the date of enactment of this Act, a risk classification system for agency use cases of artificial intelligence, without respect to whether artificial intelligence is embedded in a commercial product. The risk classification system under paragraph (1) shall, at a minimum, include unacceptable, high, medium, and low risk classifications. In developing the risk classifications under subparagraph (A), the head of the agency shall consider the following: The mission and operations of the agency. The seriousness and probability of adverse impacts. The breadth of application, such as the number of individuals affected. The degree of choice that an individual, group, or entity has as to whether to be subject to the effects of artificial intelligence. Standards and frameworks for risk classification of use cases that support democratic values, such as the standards and frameworks developed by the National Institute of Standards and Technology, the International Standards Organization, and the Institute of Electrical and Electronics Engineers. The risk classification system may allow for an operational use case to be categorized under a lower risk classification, even if the use case is a part of a larger area of the mission of the agency that is categorized under a higher risk classification. The risk classification system may allow for changes to the risk classification of an artificial intelligence use case based on the results from procurement process testing or other information that becomes available. High risk classification shall, at a minimum, apply to use cases for which the outputs of the system— are presumed to serve as a principal basis for a decision or action that has a legal, material, binding, or similarly significant effect, with respect to an individual or community, on— civil rights, civil liberties, or privacy; equal opportunities, including in access to education, housing, insurance, credit, employment, and other programs where civil rights and equal opportunity protections apply; or access to or the ability to apply for critical government resources or services, including healthcare, financial services, public housing, social services, transportation, and essential goods and services; or are presumed to serve as a principal basis for a decision that substantially impacts the safety of, or has the potential to substantially impact the safety of— the well-being of an individual or community, including loss of life, serious injury, bodily harm, biological or chemical harms, occupational hazards, harassment or abuse, or mental health; the environment, including irreversible or significant environmental damage; critical infrastructure, including the critical infrastructure sectors defined in Presidential Policy Directive 21, entitled Critical Infrastructure Security and Resilience (dated February 12, 2013) (or any successor directive) and the infrastructure for voting and protecting the integrity of elections; or strategic assets or resources, including high-value property and information marked as sensitive or classified by the Federal Government and controlled unclassified information. The head of each agency shall add other use cases to the high risk category, as appropriate. If a use case is not high risk, as described in subparagraph (D), the head of an agency shall have the discretion to define the risk classification. If an agency identifies, through testing, adverse incident, or other means or information available to the agency, that a use or outcome of an artificial intelligence use case is a clear threat to human safety or rights that cannot be adequately or practicably mitigated, the agency shall identify the risk classification of that use case as unacceptable risk. The risk classification system under paragraph (1) shall be published on a public-facing website, with the methodology used to determine different risk levels and examples of particular use cases for each category in language that is easy to understand to the people affected by the decisions and outcomes of artificial intelligence. This section shall take effect on the date that is 180 days after the date of enactment of this Act, on and after which an agency that has not complied with the requirements of this section may not develop, procure or obtain, or use artificial intelligence until the agency complies with such requirements.

8. Agency requirements for use of artificial intelligence Not later than 180 days after the effective date in section 7(b), the Chief Artificial Intelligence Officer of each agency, in coordination with the Artificial Intelligence Governance Board of the agency, shall develop and implement a process for the identification and evaluation of risks posed by the deployment of artificial intelligence in agency use cases to ensure an interdisciplinary and comprehensive evaluation of potential risks and determination of risk classifications under such section. The risk evaluation process described in paragraph (1), shall include, for each artificial intelligence use case— identification of the risks and benefits of the artificial intelligence use case; a plan to periodically review the artificial intelligence use case to examine whether risks have changed or evolved and to update the corresponding risk classification as necessary; a determination of the need for targeted impact assessments to further evaluate specific risks of the artificial intelligence use case within certain impact areas, which shall include privacy, security, civil rights and civil liberties, accessibility, environmental impact, health and safety, and any other impact area relating to high risk classification under section 7(a)(2)(D) as determined appropriate by the Chief Artificial Intelligence Officer; and if appropriate, consultation with and feedback from affected communities and the public on the design, development, and use of the artificial intelligence use case. With respect to each use case that an agency is planning, developing, or using on the date of enactment of this Act, not later than 1 year after such date, the Chief Artificial Intelligence Officer of the agency shall identify and review the use case to determine the risk classification of the use case, pursuant to the risk evaluation process under paragraphs (1) and (2). Beginning on the date of enactment of this Act, the Chief Artificial Intelligence Officer of an agency shall identify and review any artificial intelligence use case that the agency will plan, develop, or use and determine the risk classification of the use case, pursuant to the risk evaluation process under paragraphs (1) and (2), before procuring or obtaining, developing, or using the use case. For any use case described in clause (i) that is developed by the agency, the agency shall perform an additional risk evaluation prior to deployment in a production or operational environment. Risk classification of an artificial intelligence use case shall be accompanied by an explanation from the agency of how the risk classification was determined, which shall be included in the artificial intelligence use case inventory of the agency, and written referencing the model template developed by the Director under section 5(f)(1)(D). Beginning on the date that is 180 days after the date of enactment of this Act, any time during developing, procuring or obtaining, or using artificial intelligence, an agency shall require, as determined necessary by the Chief Artificial Intelligence Officer, that the deployer and any relevant developer submit documentation about the artificial intelligence, including— a description of the architecture of the artificial intelligence, highlighting key parameters, design choices, and the machine learning techniques employed; information on the training of the artificial intelligence, including computational resources utilized; an account of the source of the data, size of the data, any licenses under which the data is used, collection methods and dates of the data, and any preprocessing of the data undertaken, including human or automated refinement, review, or feedback; information on the management and collection of personal data, outlining data protection and privacy measures adhered to in compliance with applicable laws; a description of the methodologies used to evaluate the performance of the artificial intelligence, including key metrics and outcomes; and an estimate of the energy consumed by the artificial intelligence during training and inference. Beginning on the date that is 270 days after the date of enactment of this Act, with respect to use cases categorized as medium risk or higher, an agency shall require that the deployer of artificial intelligence, in consultation with any relevant developers, submit (including proactively, as material updates of the artificial intelligence occur) the following documentation: Detailed information on the model or models used in the artificial intelligence, including model date, model version, model type, key parameters (including number of parameters), interpretability measures, and maintenance and updating policies. A detailed description of training algorithms, methodologies, optimization techniques, computational resources, and the environmental impact of the training process. A detailed description of the training and testing data, including the origins, collection methods, preprocessing steps, and demographic distribution of the data, and known discriminatory impacts and mitigation measures with respect to the data. Detailed information on data handling practices, including compliance with legal standards, anonymization techniques, data security measures, and whether and how permission for use of data is obtained. A comprehensive disclosure of performance evaluation metrics, including accuracy, precision, recall, and fairness metrics, and test dataset results. Documentation demonstrating compliance with the most recently updated version of the framework developed and updated pursuant to section 22A(c) of the National Institute of Standards and Technology Act (15 U.S.C. 278h–1(c)). Not later than 1 year after the date of enactment of this Act, the Comptroller General shall conduct a review of the documentation requirements under paragraphs (1) and (2) to— examine whether agencies and deployers are complying with the requirements under those paragraphs; and make findings and recommendations to further assist in ensuring safe, responsible, and efficient artificial intelligence. The head of each agency shall ensure that appropriate security measures and access controls are in place to protect documentation provided pursuant to this section. Information provided to an agency under subsection (b)(3) is exempt from disclosure under section 552 of title 5, United States Code (commonly known as the Freedom of Information Act) and may be used by the agency, consistent with otherwise applicable provisions of Federal law, solely for— assessing the ability of artificial intelligence to achieve the requirements and objectives of the agency and the requirements of this Act; and identifying— adverse effects of artificial intelligence on the rights or safety factors identified in section 7(a)(2)(D); cyber threats, including the sources of the cyber threats; and security vulnerabilities. Beginning on the date that is 1 year after the date of enactment of this Act, the head of an agency shall not deploy or use artificial intelligence for a high risk use case prior to— collecting documentation of the artificial intelligence, source, and use case in agency software and use case inventories; testing of the artificial intelligence in an operational, real-world setting with privacy, civil rights, and civil liberty safeguards to ensure the artificial intelligence is capable of meeting its objectives; establishing appropriate agency rules of behavior for the use case, including required human involvement in, and user-facing explainability of, decisions made in whole or part by the artificial intelligence, as determined by the Chief Artificial Intelligence Officer in coordination with the program manager or equivalent agency personnel; and establishing appropriate agency training programs, including documentation of completion of training prior to use of artificial intelligence, that educate agency personnel involved with the application of artificial intelligence in high risk use cases on the capacities and limitations of artificial intelligence, including training on— monitoring the operation of artificial intelligence in high risk use cases to detect and address anomalies, dysfunctions, and unexpected performance in a timely manner to mitigate harm; lessening reliance or over-reliance on the output produced by artificial intelligence in a high risk use case, particularly if artificial intelligence is used to make decisions impacting individuals; accurately interpreting the output of artificial intelligence, particularly considering the characteristics of the system and the interpretation tools and methods available; when to not use, disregard, override, or reverse the output of artificial intelligence; how to intervene or interrupt the operation of artificial intelligence; limiting the use of artificial intelligence to its operational design domain; and procedures for reporting incidents involving misuse, faulty results, safety and security issues, and other problems with use of artificial intelligence that does not function as intended. The Chief Artificial Intelligence Officer of each agency shall— establish a reporting system, consistent with section 5(g), and suspension and shut-down protocols for defects or adverse impacts of artificial intelligence, and conduct ongoing monitoring, as determined necessary by use case; oversee the development and implementation of ongoing testing and evaluation processes for artificial intelligence in high risk use cases to ensure continued mitigation of the potential risks identified in the risk evaluation process; implement a process to ensure that risk mitigation efforts for artificial intelligence are reviewed not less than annually and updated as necessary to account for the development of new versions of artificial intelligence and changes to the risk profile; and adhere to pre-deployment requirements under subsection (d) in each case in which a low or medium risk artificial intelligence use case becomes a high risk artificial intelligence use case. The Chief Artificial Intelligence Officer of each agency— may designate select, low risk use cases, including current and future use cases, that do not have to comply with all or some of the requirements in this Act; and shall publicly disclose all use cases exempted under paragraph (1) with a justification for each exempted use case. The requirements under subsections (a) and (b) shall not apply to an algorithm software update, enhancement, derivative, correction, defect, or fix for artificial intelligence that does not materially change the compliance of the deployer with the requirements of those subsections, unless determined otherwise by the agency Chief Artificial Intelligence Officer. The head of an agency, on a case by case basis, may waive 1 or more requirements under subsection (d) for a specific use case after making a written determination, based upon a risk assessment conducted by a human with respect to the specific use case, that fulfilling the requirement or requirements prior to procuring or obtaining, developing, or using artificial intelligence would increase risks to safety or rights overall or would create an unacceptable impediment to critical agency operations. A waiver under this subsection shall be— in the national security interests of the United States, as determined by the head of the agency; submitted to the relevant congressional committees not later than 15 days after the head of the agency grants the waiver; and limited to a duration of 1 year, at which time the head of the agency may renew the waiver and submit the renewed waiver to the relevant congressional committees. The head of an agency, in consultation with the agency Chief Artificial Intelligence Officer, Chief Information Officer, Chief Data Officer, and other relevant agency officials, shall reevaluate infrastructure security protocols based on the artificial intelligence use cases and associated risks to infrastructure security of the agency. Not later than 270 days after the date of enactment of this Act, the requirements of subsections (a) through (i) of this section shall apply with respect to artificial intelligence that is already in use on the date of enactment of this Act.

9. Prohibition on select artificial intelligence use cases No agency may develop, procure or obtain, or use artificial intelligence for— mapping facial biometric features of an individual to assign corresponding emotion and potentially take action against the individual; categorizing and taking action against an individual based on biometric data of the individual to deduce or infer race, political opinion, religious or philosophical beliefs, trade union status, sexual orientation, or other personal trait; evaluating, classifying, rating, or scoring the trustworthiness or social standing of an individual based on multiple data points and time occurrences related to the social behavior of the individual in multiple contexts or known or predicted personal or personality characteristics in a manner that may lead to discriminatory outcomes; or any other use found by the agency to pose an unacceptable risk under the risk classification system of the agency, pursuant to section 7.

10. Agency procurement innovation labs An agency subject to the Chief Financial Officers Act of 1990 (31 U.S.C. 901 note; Public Law 101–576) that does not have a Procurement Innovation Lab on the date of enactment of this Act should consider establishing a lab or similar mechanism to test new approaches, share lessons learned, and promote best practices in procurement, including for commercial technology, such as artificial intelligence, that is trustworthy and best-suited for the needs of the agency. The functions of the Procurement Innovation Lab or similar mechanism should include— providing leadership support as well as capability and capacity to test, document, and help agency programs adopt new and better practices through all stages of the acquisition lifecycle, beginning with project definition and requirements development; providing the workforce of the agency with a clear pathway to test and document new acquisition practices and facilitate fresh perspectives on existing practices; helping programs and integrated project teams successfully execute emerging and well-established acquisition practices to achieve better results; and promoting meaningful collaboration among offices that are responsible for requirements development, contracting officers, and others, including financial and legal experts, that share in the responsibility for making a successful procurement. An agency should consider placing the Procurement Innovation Lab or similar mechanism as a supporting arm of the Chief Acquisition Officer or Senior Procurement Executive of the agency and shall have wide latitude in structuring the Procurement Innovation Lab or similar mechanism and in addressing associated personnel staffing issues.

13. Development of tools and guidance for testing and evaluating artificial intelligence In a manner specified by the Director, the Chief Artificial Intelligence Officer shall identify and annually submit to the Council a report on obstacles encountered in the testing and evaluation of artificial intelligence, specifying— the nature of the obstacles; the impact of the obstacles on agency operations, mission achievement, and artificial intelligence adoption; recommendations for addressing the identified obstacles, including the need for particular resources or guidance to address certain obstacles; and a timeline that would be needed to implement proposed solutions. Not less frequently than annually, the Council shall conduct a review of agency reports under subsection (a) to identify common challenges and opportunities for cross-agency collaboration. Not later than 2 years after the date of enactment of this Act, the Director, in consultation with the Council, shall convene a working group to— develop tools and guidance to assist agencies in addressing the obstacles that agencies identify in the reports under subsection (a); support interagency coordination to facilitate the identification and use of relevant voluntary standards, guidelines, and other consensus-based approaches for testing and evaluation and other relevant areas; and address any additional matters determined appropriate by the Director. The working group described in subparagraph (A) shall include Federal interdisciplinary personnel, such as technologists, information security personnel, domain experts, privacy officers, data officers, civil rights and civil liberties officers, contracting officials, legal counsel, customer experience professionals, and others, as determined by the Director. The Director, in consultation with the Council, shall establish a mechanism for sharing tools and guidance developed under paragraph (2) across agencies. Each agency shall submit the annual report under subsection (a) to relevant congressional committees. The Director, in consultation with the Council, may suspend the requirement under paragraph (1) and submit to the relevant congressional committees a consolidated report that conveys government-wide testing and evaluation challenges, recommended solutions, and progress toward implementing recommendations from prior reports developed in fulfillment of this subsection. The requirements under this section shall terminate on the date that is 10 years after the date of enactment of this Act.

14. Updates to artificial intelligence use case inventories The Advancing American AI Act (Public Law 117–263; 40 U.S.C. 11301 note) is amended— in section 7223(3), by striking the period and inserting and in section 5002 of the National Artificial Intelligence Initiative Act of 2020 (15 U.S.C. 9401).; and in section 7225, by striking subsection (d). The provisions of section 5 of Executive Order 13960 (85 Fed. Reg. 78939; relating to promoting the use of trustworthy artificial intelligence in Federal Government) that exempt classified and sensitive use cases from agency inventories of artificial intelligence use cases shall cease to have legal effect. The Director shall ensure that agencies submit artificial intelligence use case inventories and that the inventories comply with applicable artificial intelligence inventory guidance. The Director shall submit to the relevant congressional committees an annual report on agency compliance with artificial intelligence inventory guidance. The artificial intelligence inventory of each agency shall publicly disclose— whether artificial intelligence was developed internally by the agency or procured externally, without excluding any use case on basis that the use case is sensitive solely because it was externally procured; data provenance information, including identifying the source of the training data of the artificial intelligence, including internal government data, public data, commercially held data, or similar data; the level of risk at which the agency has classified the artificial intelligence use case and a brief explanation for how the determination was made; a list of targeted impact assessments conducted pursuant to section 7(a)(2)(C); and the number of artificial intelligence use cases excluded from public reporting as being sensitive. When an agency updates the public artificial intelligence use case inventory of the agency, the agency shall disclose the date of the modification and make change logs publicly available and accessible. The Director shall issue guidance to agencies that describes how to appropriately update artificial intelligence use case inventories and clarifies how sub-agencies and regulatory agencies should participate in the artificial intelligence use case inventorying process. The head of each agency shall submit to the relevant congressional committees a copy of the annual artificial intelligence use case inventory of the agency, including— the use cases that have been identified as sensitive and not for public disclosure; and a classified annex of classified use cases. Beginning 1 year after the date of enactment of this Act, and annually thereafter, the Director, in coordination with the Council, shall issue a report, based on the artificial intelligence use cases reported in use case inventories, that describes trends in the use of artificial intelligence in the Federal Government. Not later than 1 year after the date of enactment of this Act, and annually thereafter, the Comptroller General of the United States shall submit to relevant congressional committees a report on whether agencies are appropriately classifying use cases. The Comptroller General of the United States shall examine whether the appropriate level of disclosure of artificial intelligence use cases by agencies should be included on the High Risk List of the Government Accountability Office.

1. Short title This Act may be cited as the Promoting Responsible Evaluation and Procurement to Advance Readiness for Enterprise-wide Deployment for Artificial Intelligence Act or the PREPARED for AI Act.

2. Definitions In this Act: The term adverse outcome means any behavior or malfunction, such as a hallucination, algorithmic bias, or inconsistent output, of artificial intelligence that leads to— harm impacting rights or safety, as described in section 7(a)(3); the death of an individual or damage to the health of an individual; material or irreversible disruption of the management and operation of critical infrastructure, as described in section 7(a)(3)(A)(ii)(III); material damage to property or the environment; loss of a mission-critical system or equipment; failure of the mission of an agency; the wrongful denial of a benefit, payment, or other service to an individual or group of individuals who would have otherwise been eligible; the denial of an employment, contract, grant, or similar opportunity that would have otherwise been offered; or another consequence, as determined by the Director with public notice. The term agency— means each agency described in section 3502(1) of title 44, United States Code; and does not include each of the independent regulatory agencies described in section 3502(5) of title 44, United States Code. The term artificial intelligence— has the meaning given that term in section 5002 of the National Artificial Intelligence Initiative Act of 2020 (15 U.S.C. 9401); and includes the artificial systems and techniques described in paragraphs (1) through (5) of section 238(g) of the John S. McCain National Defense Authorization Act for Fiscal Year 2019 (Public Law 115–232; 10 U.S.C. 4061 note prec.). The term biometric data means data resulting from specific technical processing relating to the unique physical, physiological, or behavioral characteristics of an individual, including facial images, dactyloscopic data, physical movement and gait, breath, voice, DNA, blood type, and expression of emotion, thought, or feeling. The term commercial technology— means a technology, process, or method, including research or development; and includes commercial products, commercial services, and other commercial items, as defined in the Federal Acquisition Regulation, including any addition or update thereto by the Federal Acquisition Regulatory Council. The term Council means the Chief Artificial Intelligence Officers Council established under section 5(a). The term deployer means an entity that operates, whether for the entity itself or on behalf of a third party, artificial intelligence, whether developed internally or by a third-party developer. The term developer means an entity that designs, codes, or produces artificial intelligence, including materially modifying artificial intelligence designed, coded, or produced by another entity. The term Director means the Director of the Office of Management and Budget. The term Government data means data collected, processed, maintained, disseminated, or managed by an agency, including data reported to an agency. The term impact assessment means a structured process for considering and evaluating the implications of a proposed artificial intelligence use case. The term relevant congressional committees means the Committee on Homeland Security and Governmental Affairs of the Senate and the Committee on Oversight and Accountability of the House of Representatives. The term risk means the combination of the probability of an occurrence of harm and the potential severity of that harm. The term use case means the ways and context in which artificial intelligence is deployed to achieve a specific objective.

3. Implementation of requirements The Director shall facilitate the implementation of the requirements of this Act, including through the issuance of binding or nonbinding guidance, as the Director determines appropriate. Not later than 180 days after the date of enactment of this Act, and annually thereafter, the Director shall brief the appropriate Congressional committees on implementation of this Act and related considerations.

4. Procurement of artificial intelligence Not later than 15 months after the date of enactment of this Act, the Federal Acquisition Regulatory Council shall review Federal Acquisition Regulation acquisition planning, source selection, and other requirements and update the Federal Acquisition Regulation as needed for agency procurement of artificial intelligence, including— a requirement to address the outcomes of the risk evaluation and impact assessments required under section 7(a); a requirement for an interdisciplinary approach that includes consultation with agency experts prior to, and throughout, as necessary, procuring or obtaining artificial intelligence; and any other considerations determined relevant by the Federal Acquisition Regulatory Council. The Federal Acquisition Regulation review described in paragraph (1) shall determine the extent to which existing requirements and procedures need to be revised or supplemented to address risks and opportunities specific to procurement of artificial intelligence. The interdisciplinary approach described in paragraph (1)(B) may— vary depending on the use case and the risks determined to be associated with the use case; and include, as practicable, technologists, information security personnel, domain experts, privacy officers, data officers, civil rights and civil liberties officers, contracting officials, legal counsel, customer experience professionals, and others. The updates described in paragraph (1) shall, at a minimum, include— data ownership and privacy; data information security; interoperability requirements; data and model assessment processes; scope of use; ongoing monitoring and evaluation techniques; environmental impact; cybersecurity minimum standards, including regular vulnerability testing and patching and cybersecurity monitoring; risk mitigation techniques, including a plan for minimizing the likelihood of adverse outcomes and reporting adverse outcomes, pursuant to section 5(h); and developer and deployer disclosure requirements necessary to comply with the requirements of this Act. Beginning on the date that is 1 year after the date of enactment of this Act, the head of an agency may not procure or obtain artificial intelligence for a high risk use case, as described in section 7(a)(3), prior to establishing and incorporating certain terms into relevant contracts and agreements for an artificial intelligence use case, including— a requirement to disclose to the agency the purpose for which the artificial intelligence was intended to be used and any potential risks from the use of the artificial intelligence; requirements for safety, security, privacy, and trustworthiness, including— a reporting mechanism through which agency personnel are notified of an adverse outcome involving artificial intelligence procured or obtained by the agency; a requirement, in accordance with section 5(h), that agency personnel receive a notification of an adverse outcome involving artificial intelligence procured or obtained by the agency, and, at a minimum, an explanation of the cause of the adverse outcome and any data directly connected to the adverse outcome; that the agency may consider temporarily or permanently suspending use of the artificial intelligence, with minimal impact on unrelated services, if the risks of the artificial intelligence to rights or safety outweigh the benefits of the use case; and a requirement that the deployer and any relevant developer utilize the most recently updated version of the framework developed and updated pursuant to section 22(A)(c) of the National Institute of Standards and Technology Act (15 U.S.C. 278h-1(c)); requirements to disclose to the agency sufficient descriptive information relating to the ownership of data, as appropriate by use case, including— requirements for retention of rights to Government data and any modification to Government data, including to protect Government data from unauthorized disclosure and use to subsequently train or improve the functionality of commercial products offered by the deployer, any relevant developers, or others; and a requirement that the deployer, if the deployer is not the agency, and any relevant developers or other parties isolate non-public Government data from all other data through methods, such as physical separation, electronic separation via secure copies with strict access controls, or other computational isolation mechanisms; requirements for evaluation and testing of artificial intelligence based on use case, to be performed on an ongoing basis; and requirements to provide documentation, as determined necessary and requested by the agency, in accordance with section 7(b). The Senior Procurement Executive, in coordination with the Chief Artificial Intelligence Officer, shall, as practicable, consult with technologists, information security and cybersecurity personnel, domain experts, privacy officers, data officers, civil rights and civil liberties officers, contracting officials, legal counsel, customer experience professionals, program evaluation officers, and other relevant agency officials to review the requirements described in subparagraphs (A) through (E) of paragraph (1) and determine whether it may be necessary to incorporate additional requirements into relevant contracts or agreements. The Federal Acquisition Regulatory Council shall revise the Federal Acquisition Regulation as necessary to implement the requirements of this subsection.

5. Interagency governance of artificial intelligence Not later than 60 days after the date of enactment of this Act, the Director shall establish a Chief Artificial Intelligence Officers Council. The duties of the Council shall include— coordinating agency development and use of artificial intelligence in agency programs and operations, including practices relating to the design, operation, risk management, and performance of artificial intelligence; sharing experiences, ideas, best practices, and innovative approaches relating to artificial intelligence; identifying, developing, and coordinating multi-agency projects and other initiatives; harmonizing agency management of risks relating to developing, obtaining, or using artificial intelligence, including by developing a common template to guide agency Chief Artificial Intelligence Officers in implementing a risk evaluation process that may incorporate best practices, such as those from— the most recently updated version of the framework developed and updated pursuant to section 22A(c) of the National Institute of Standards and Technology Act (15 U.S.C. 278h–1(c)); and the report published by the Government Accountability Office entitled Artificial Intelligence: An Accountability Framework for Federal Agencies and Other Entities (GAO-21-519SP), published on June 30, 2021; promoting the development and use of secure, common, shared, or other approaches to key processes that improve the delivery of services for the public; soliciting and providing perspectives on matters of concern, including from and to— interagency councils; Federal Government entities; private sector, public sector, nonprofit, and academic experts; State, local, Tribal, territorial, and international governments; and other individuals and entities, as determined relevant by the Council; working with the Chief Acquisition Officers Council— to ensure contractors, including small businesses, have the benefit of integrity, fairness, competition, openness, and efficiency in accordance with the statutory functions of the Chief Acquisition Officers Council, as described in section 1312 of title 41, United States Code; and which shall establish a working group for the purpose described in subparagraph (A) and related purposes; and any other matters determined by the Council to be relevant. The Director shall serve as Chair of the Council. The Council shall have a Vice Chair, who shall be an individual selected by a majority of the members of the Council. The Council may establish additional leadership roles, at the discretion of the Council. Other members of the Council shall include— the Chief Artificial Intelligence Officer of each agency; and the senior official for artificial intelligence of the Office of Management and Budget. The Council shall have the authority to establish standing committees, including an executive committee, and working groups. The Council may enter into an interagency agreement with the Administrator of General Services for shared services for the purpose of staffing the Council. Not later than 3 years after the date of enactment of this Act, the Comptroller General of the United States shall submit to the relevant congressional committees a report that— identifies, to the extent practicable, ways to improve coordination with other councils throughout the Federal Government; and recommends ways to improve the utility of the Council for the public and other agencies. In fulfilling the requirement under paragraph (1), the Comptroller General of the United States may, if desired, consolidate the report under that paragraph with another report concerning interagency coordination. Not later than 1 year after the date of enactment of this Act, the Director shall issue guidance on— how to conduct the agency impact assessments described in section 7(a) and other relevant impact assessments as determined appropriate by the Director, including the appropriateness of adapting pre-existing assessments, including privacy and security impact assessments, for purposes of an artificial intelligence impact assessment; development of a model template for the risk classification explanations that each agency must provide under section 7(a)(6); development of a model template for procurement of artificial intelligence intended to help agencies use consistent terms, definitions, and documentation requirements; and additional matters relating to the implementation of this Act, as determined relevant by the Director. The Director shall periodically, but not less frequently than biennially, review and update, as needed, the guidance issued under paragraph (1). Not later than 1 year after the date of enactment of this Act, the Director shall develop procedures for ensuring that, at a minimum— adverse outcomes involving artificial intelligence procured or obtained or used by agencies are reported promptly to the relevant agency or agencies by the developer or deployer, if the deployer is not the agency, or to the developer or deployer by the relevant agency, whichever first becomes aware of the adverse outcome; and information relating to an adverse outcome described in subparagraph (A) is appropriately shared among agencies. Adverse outcomes also qualifying for incident reporting under section 3554 of title 44, United States Code, or other relevant laws or policies, may be reported under such other reporting requirement and are not required to be additionally reported under this subsection. If and upon discovery of an adverse outcome by an agency, the agency shall— report the adverse outcome to the deployer, if the deployer is not the agency, and any relevant developers; and in consultation with any relevant deployers and developers, take action to resolve the adverse outcome and mitigate the potential for future adverse outcomes. Unless otherwise required by law, the head of an agency may issue a written waiver that waives the applicability of some or all of the requirements under subparagraph (A), with respect to a specific adverse outcome. A written waiver under clause (i) shall include justification for the waiver. The head of an agency shall forward advance notice of any waiver under this subparagraph to the Director.

6. Agency governance of artificial intelligence The head of an agency shall— ensure the responsible adoption of artificial intelligence, including by— requiring the development or revision of relevant agency policies and directives; testing, verifying, validating, and monitoring artificial intelligence and the use case-specific performance of artificial intelligence, proportionate to risk level, to minimize the likelihood of adverse outcomes by— ensuring the use of artificial intelligence is appropriate to and improves the effectiveness of the mission of the agency; guarding against bias in data collection, use, and dissemination; ensuring reliability, fairness, and transparency; and protecting against impermissible discrimination; continuing to hire, train, and develop a workforce that— understands the risks and benefits of artificial intelligence, including artificial intelligence embedded in agency systems and operations; is able to provide human oversight for the design, implementation, and end uses of artificial intelligence; and is able to review and provide redress for erroneous decisions made in the course of artificial intelligence-assisted processes; and ensuring implementation of the agency requirements under this Act; designate a Chief Artificial Intelligence Officer, whose duties shall include— ensuring appropriate use of artificial intelligence; coordinating agency use of artificial intelligence; promoting artificial intelligence innovation; managing the risks of use of artificial intelligence; minimizing the likelihood of adverse outcomes; supporting the head of the agency with developing the risk evaluation process required under section 7(a) and complying with other requirements of this Act; supporting agency personnel leading the procurement and deployment of artificial intelligence to comply with the requirements under this Act; and coordinating with other responsible officials and appropriate stakeholders with respect to the duties described in subparagraphs (A) through (G), as appropriate; and form and convene an Artificial Intelligence Governance Board, if required by subsection (c), which shall coordinate and govern artificial intelligence issues across the agency. The head of an agency may designate as Chief Artificial Intelligence Officer an existing official within the agency, including the Chief Technology Officer, Chief Data Officer, Chief Information Officer, or other official with relevant or complementary authorities and responsibilities, if such existing official has expertise in artificial intelligence and meets the requirements of this section. Each agency identified in section 901(b) of title 31, United States Code, shall establish an Artificial Intelligence Governance Board (referred to in this subsection as Board) that shall be chaired by the deputy head of the agency or equivalent official and vice-chaired by the Chief Artificial Intelligence Officer of the agency. Neither the chair nor the vice-chair may assign or delegate these roles to other officials. The Board shall, at a minimum, include representatives consisting of— senior agency officials from operational components, if relevant; program officials responsible for implementing artificial intelligence; and officials responsible for information technology, data, cybersecurity, privacy, statistics, civil rights and civil liberties, human capital, procurement, finance, legal counsel, agency management, program evaluation, and customer experience. An agency may rely on an existing governance body to fulfill the requirements of this subsection if the body satisfies or is adjusted to satisfy the leadership and representation requirements of paragraphs (1) and (2). Beginning on the date that is 120 days after the date of enactment of this Act, an agency shall not develop, procure, or obtain artificial intelligence prior to completing the requirements under paragraphs (2) and (3) of subsection (a).

7. Agency requirements for use of artificial intelligence Not later than 180 days after the date of enactment of this Act, the Chief Artificial Intelligence Officer of each agency, in coordination with the Artificial Intelligence Governance Board of the agency, shall develop and implement a process for identifying when the use of artificial intelligence by the agency meets the classification of high risk, as described in paragraph (3). The risk evaluation process described in paragraph (1), shall include, for each artificial intelligence use case— identification of the purpose, expected benefits, and potential risks of the artificial intelligence use case; a plan to periodically review the artificial intelligence use case to examine whether the expected benefits and potential risks identified under subparagraph (A) have changed or evolved; and if a high risk determination has been made, the need for targeted impact assessments, beyond those required under any other provision of law, to further evaluate specific risks of the artificial intelligence use case in coordination with other responsible officials within certain impact areas, which shall include privacy, security, civil rights and civil liberties, accessibility, environmental impact, health and safety, and any other impact area relating to high risk classification under paragraph (3) as determined appropriate by the Chief Artificial Intelligence Officer. High risk classification shall, at a minimum, apply to use cases for which the outputs serve as a principal basis for— a decision or action that has a legal, material, binding, or similarly significant effect, with respect to an individual or community, on— civil rights, civil liberties, or privacy; access to education, housing, insurance, credit, employment, and other programs where civil rights and equal opportunity protections apply; or access to or the ability to apply for critical government resources or services, including healthcare, financial services, public housing, social services, transportation, and essential goods and services; or a decision that substantially impacts the safety of, or has the potential to substantially impact the safety of— an individual or community, including loss of life, serious injury, bodily harm, biological or chemical harms, occupational hazards, harassment or abuse, or mental health; the environment, including irreversible or significant environmental damage; critical infrastructure, including the critical infrastructure sectors defined in National Security Memorandum 22 (NSM-22) (dated April 30, 2024) (or any successor directive) and the infrastructure for voting and protecting the integrity of elections; or strategic assets or resources, including high-value property and information marked as sensitive or classified by the Federal Government. The risk evaluation process under this paragraph may allow for a particular operational use case to not be classified as high risk, even if the use case is a part of a larger area of the mission of the agency that is thought to be high risk, if the operational use case is determined not to be high risk based on the required risk evaluation under paragraph (1). The risk evaluation process under this paragraph may allow for changes to the risk classification of an artificial intelligence use case based on the results from testing during the procurement process or other information that becomes available. Not later than 1 year after the date of enactment of this Act, the Chief Artificial Intelligence Officer of the agency shall— certify whether each existing use case presents a high risk; and identify and review any use cases the agency is planning, developing, procuring, or obtaining to determine whether each such use cases presents a high risk. For any artificial intelligence that is developed by the agency, the agency shall ensure a risk evaluation is conducted prior to deployment in a production or operational environment that is fit for the intended use. A high risk classification of an artificial intelligence use case shall be accompanied by an explanation from the agency, that a reasonable person would consider sufficient to understand, of how the classification was determined, which shall be included in the artificial intelligence use case inventory of the agency. A risk classification explanation under subparagraph (A) shall utilize the model template developed by the Director under section 5(g)(1)(B) if the explanation is written after the date that such model template has become available. Beginning on the date that is 1 year after the date of enactment of this Act, prior to developing, procuring or obtaining, or using artificial intelligence to be used in a high risk use case, an agency shall require the deployer, if the deployer is not the agency, in consultation with any relevant developers, to submit the following documentation: A description of the types of data sources used to train the artificial intelligence, whether the data is from licensed material, and an identification of the specific issues related to safety, bias, and fairness, that may be expected to arise from the use of the data, and any mitigation techniques used, if applicable. A description of the methodologies used to evaluate the performance of the artificial intelligence for its intended use. Documentation demonstrating implementation of risk evaluation and management measures, including the evaluation and management of safety, bias, and fairness risks, as appropriate. Information on the collection, management, and protection of data, in compliance with applicable laws. Documentation of the known limitations of the artificial intelligence, and if applicable, supplementary guidelines on how the artificial intelligence is intended to be used. The Chief Artificial Intelligence Officer of an agency shall determine the sufficiency of the documentation provided in meeting the requirements under paragraph (1). An agency shall require that a deployer, if the deployer is not the agency, in consultation with any relevant developers, submit updates to the documentation required under paragraph (1), if and when there are any material changes to the information in such documentation. Not later than 2 years after the date of enactment of this Act, the Comptroller General of the United States shall conduct a review of the documentation requirements under paragraphs (1) and (3) to— examine whether agencies, third-party deployers, and developers are complying with the requirements under those paragraphs, and make associated findings and recommendations; and make general findings and recommendations to further assist in ensuring safe, responsible, and efficient agency procurement and use of artificial intelligence. The head of each agency shall ensure that appropriate security measures and access controls are in place to protect documentation provided pursuant to this section. Information provided to an agency under subsection (b) may be used by the agency, consistent with otherwise applicable provisions of Federal law, solely for— assessing the ability of artificial intelligence to achieve the requirements and objectives of the agency and the requirements of this Act; and identifying— adverse effects of artificial intelligence on the rights or safety factors identified in subsection (a)(3); cyber threats, including the sources of the cyber threats; and security vulnerabilities. Beginning on the date that is 18 months after the date of enactment of this Act, the head of an agency shall not deploy or use artificial intelligence for a high risk use case prior to— complying with the requirements of subsection (a); obtaining documentation of the artificial intelligence described in subsection (b)(2), source, and use case in agency software and use case inventories; testing the artificial intelligence in an operational, real-world setting with privacy, security, civil rights, and civil liberty safeguards to ensure the artificial intelligence is capable of meeting its objectives, and to determine, to the maximum extent practicable, the likelihood and impact of adverse outcomes occurring during use; establishing appropriate agency rules of behavior for the use case, including required human involvement in, and reasonable plain-language notice about, decisions made in whole or part by the artificial intelligence, as determined by the Chief Artificial Intelligence Officer in coordination with the program manager or equivalent agency personnel; if appropriate, consultation with and collection of feedback from affected communities and the public on the design, development, and use of the high risk use case; establishing appropriate agency training programs, including documentation of completion of training prior to use of artificial intelligence, that educate agency personnel involved with the application of artificial intelligence in high risk use cases on the capacities and limitations of artificial intelligence, including training on— monitoring, detecting, and reporting anomalies, dysfunctions, and unexpected performance in a timely manner; reducing over-reliance on the output produced by artificial intelligence in a high risk use case, particularly if artificial intelligence is used to make decisions impacting individuals; accurately interpreting the output of artificial intelligence, particularly considering the characteristics of the system and the interpretation tools and methods available; when to not use, disregard, override, or reverse the output of artificial intelligence; how to intervene or interrupt the operation of artificial intelligence; limiting the use of artificial intelligence to its intended purpose; and procedures for reporting adverse outcomes, as determined under section 5(h), and other problems that may arise with artificial intelligence that does not function as intended; and determining whether the benefits of the use case outweigh the risks by— evaluating the information learned from completing the requirements under paragraphs (2) and (3); and assessing whether the requirements under paragraphs (2) through (6) have been accomplished and known risks have been effectively mitigated. The head of an agency shall make available to the relevant congressional committees or the Director, upon request, a determination under subsection (d)(7) and the respective supporting documentation. If it is determined under subsection (d)(7) that the benefits of a use case do not outweigh the risks and the risks cannot be effectively mitigated, the agency may decide to reevaluate the use case indefinitely or until appropriate measures under the requirements in paragraphs (2) through (6) of that subsection are established. Beginning on the date that is 1 year after the date of enactment of this Act, the Chief Artificial Intelligence Officer of each agency shall— establish a reporting system, consistent with section 5(h), and suspension and shut-down protocols for defects or adverse outcomes of artificial intelligence, and conduct ongoing monitoring, as determined necessary by use case; oversee the development and implementation of ongoing testing and evaluation processes for artificial intelligence in high risk use cases to ensure continued mitigation of the potential risks identified in the risk evaluation process; and implement a process to ensure that risk mitigation efforts for artificial intelligence are reviewed not less than annually and updated as necessary to account for the development of new versions of artificial intelligence and changes to the risk profile. In the process of complying with subsections (d) and (f), an agency shall determine whether an intended use case should be paused, stopped permanently, or continued if new information changes the risks associated with the use case or requires new testing and monitoring procedures under those subsections. The requirements under subsections (a) and (b) shall not apply to an algorithm software update, enhancement, derivative, correction, defect, or fix for artificial intelligence that does not materially change the compliance of the deployer with the requirements of those subsections, unless determined otherwise by the agency Chief Artificial Intelligence Officer. The head of an agency, or 1 or more deputy heads of an agency designated by the head of the agency, may waive 1 or more requirements under subsection (d) for a specific use case after making a written determination, based upon a risk assessment conducted by a human, that fulfilling the requirement or requirements would increase risks to safety or rights overall, would create an unacceptable impediment to critical agency operations, or would not be in the national security interests of the United States. A waiver under paragraph (1) shall— include, at a minimum, the reasons for the waiver and a plan to bring the specific use case into compliance with subsection (d) before the end of the waiver, pursuant to paragraph (4); and be submitted to the relevant congressional committees and the Director not later than 15 days after the head of the agency grants the waiver. The Director shall review the waiver and relevant documentation to determine whether the waiver was improperly granted. A waiver under paragraph (1) shall be limited to a duration of 1 year, at which time, if the agency is unable to bring the specific use case into compliance with subsection (d), the agency shall cease use or deployment of the use case until the use case can be brought into compliance with that subsection. The head of an agency, in consultation with the agency Chief Artificial Intelligence Officer, Chief Information Officer, Chief Data Officer, and other relevant agency officials, shall reevaluate infrastructure security protocols based on the artificial intelligence use cases and associated risks to infrastructure security of the agency. Not later than 270 days after the date of enactment of this Act, the requirements of subsections (a) through (j) of this section shall apply with respect to artificial intelligence that is already in use on the date of enactment of this Act.

8. Prohibition on select artificial intelligence use cases No agency may develop, procure, obtain, or use artificial intelligence for— mapping facial biometric features of an individual to assign corresponding emotion and potentially take action against the individual; categorizing and taking action against an individual based on biometric data of the individual to deduce or infer race, political opinion, religious or philosophical beliefs, trade union status, sexual orientation, or other personal trait, with the exception of deducing or inferring age in the context of investigating child sexual abuse; or evaluating, classifying, rating, or scoring the trustworthiness or social standing of an individual based on multiple data points and time occurrences related to the social behavior of the individual in multiple contexts or known or predicted personal or personality characteristics in a manner that may lead to discriminatory outcomes.

9. Agency procurement innovation labs Each agency identified in 901(b) of title 31, United States Code, that does not have a Procurement Innovation Lab on the date of enactment of this Act should consider establishing a lab or similar mechanism to test new approaches, share lessons learned, and promote best practices in procurement, including for commercial technology, such as artificial intelligence, that is trustworthy and best-suited for the needs of the agency. The functions of the Procurement Innovation Lab or similar mechanism should include— providing leadership support as well as capability and capacity to test, document, and help agency programs adopt new and better practices through all stages of the acquisition lifecycle, beginning with project definition and requirements development; providing the workforce of the agency with a clear pathway to test and document new acquisition practices and facilitate fresh perspectives on existing practices; helping programs and integrated project teams successfully execute emerging and well-established acquisition practices to achieve better results; and promoting meaningful collaboration among offices that are responsible for requirements development, contracting officers, and others, including financial and legal experts, that share in the responsibility for making a successful procurement. An agency should consider placing the Procurement Innovation Lab or similar mechanism as a supporting arm of the Chief Acquisition Officer or Senior Procurement Executive of the agency and shall have wide latitude in structuring the Procurement Innovation Lab or similar mechanism and in addressing associated personnel staffing issues.

10. Multi-phase commercial technology test program The head of an agency may, if desired, procure commercial technology through a multi-phase test program of contracts in accordance with this section. A test program established under this section shall— provide a means by which an agency may post a solicitation, including for a general need or area of interest, for which the agency intends to explore commercial technology solutions and for which an offeror may submit a bid based on existing commercial capabilities of the offeror with minimal modifications or a technology that the offeror is developing for commercial purposes; and use phases, as described in subsection (c), to minimize government risk and incentivize competition. Under a test program established under this section, the head of an agency may acquire commercial technology through a competitive evaluation of proposals resulting from general solicitation in the following phases: Selectees may be awarded a portion of the total contract award and have a period of performance of not longer than 1 year to prove the merits, feasibility, and technological benefit the proposal would achieve for the agency. Selectees may be awarded a portion of the total contract award and have a period of performance of not longer than 1 year to create a detailed timeline, establish an agreeable intellectual property ownership agreement, and implement the proposal on a small scale. Following successful performance on phase 1 and 2, selectees may be awarded up to the full remainder of the total contract award to implement the proposal, depending on the agreed upon costs and the number of contractors selected. If no selectees are found suitable for phase 3, the agency head may determine not to make any selections for phase 3, terminate the solicitation and utilize any remaining funds to issue a modified general solicitation for the same area of interest. The use of general solicitation competitive procedures for a test program under this section shall be considered to be use of competitive procedures as defined in section 152 of title 41, United States Code. The head of an agency shall not enter into a contract under the test program for an amount in excess of $25,000,000. The Federal Acquisition Regulatory Council shall revise the Federal Acquisition Regulation as necessary to implement this section, including requirements for each general solicitation under a test program to be made publicly available through a means that provides access to the notice of the general solicitation through the System for Award Management or subsequent government-wide point of entry, with classified solicitations posted to the appropriate government portal. The head of an agency may not award contracts under a test program until the agency issues guidance with procedures for use of the authority. The guidance shall be issued in consultation with the relevant Acquisition Regulatory Council and shall be publicly available. The authority for a test program under this section shall terminate on the date that is 5 years after the date the Federal Acquisition Regulation is revised pursuant to subsection (f)(1) to implement the program.

11. Research and development project pilot program The head of an agency may, if desired, carry out research and prototype projects in accordance with this section. A pilot program established under this section shall provide a means by which an agency may— carry out basic, applied, and advanced research and development projects; and carry out prototype projects that address— a proof of concept, model, or process, including a business process; reverse engineering to address obsolescence; a pilot or novel application of commercial technologies for agency mission purposes; agile development activity; the creation, design, development, or demonstration of operational utility; or any combination of items described in subparagraphs (A) through (E). Under a pilot program established under this section, the head of an agency may carry out research and prototype projects— using small businesses to the maximum extent practicable; using cost sharing arrangements where practicable; tailoring intellectual property terms and conditions relevant to the project and commercialization opportunities; and ensuring that such projects do not duplicate research being conducted under existing agency programs. The use of research and development contracting procedures under this section shall be considered to be use of competitive procedures, as defined in section 152 of title 41, United States Code. The use of research and development contracting procedures under this section shall be considered to be use of commercial technology. A follow-on contract provided for in a contract opportunity announced under this section may, at the discretion of the head of the agency, be awarded to a participant in the original project or phase if the original project or phase was successfully completed. The head of an agency shall not enter into a contract under the pilot program under this section for an amount in excess of $10,000,000. The Federal Acquisition Regulatory Council shall revise the Federal Acquisition Regulation research and development contracting procedures as necessary to implement this section, including requirements for each research and development project under a pilot program to be made publicly available through a means that provides access to the notice of the opportunity through the System for Award Management or subsequent government-wide point of entry, with classified solicitations posted to the appropriate government portal. The head of an agency may not award contracts under a pilot program until the agency, in consultation with the relevant Acquisition Regulatory Council issues and makes publicly available guidance on procedures for use of the authority. Contract actions entered into under this section shall be reported to the Federal Procurement Data System, or any successor system. The authority for a pilot program under this section shall terminate on the date that is 5 years from the date the Federal Acquisition Regulation is revised pursuant to subsection (h)(1) to implement the program.

12. Development of tools and guidance for testing and evaluating artificial intelligence In a manner specified by the Director, the Chief Artificial Intelligence Officer of each agency shall identify and annually submit to the Council a report on obstacles encountered in the testing and evaluation of artificial intelligence, specifying— the nature of the obstacles; the impact of the obstacles on agency operations, mission achievement, and artificial intelligence adoption; recommendations for addressing the identified obstacles, including the need for particular resources or guidance to address certain obstacles; and a timeline that would be needed to implement proposed solutions. Not less frequently than annually, the Council shall conduct a review of agency reports under subsection (a) to identify common challenges and opportunities for cross-agency collaboration. Not later than 2 years after the date of enactment of this Act, the Director, in consultation with the Council, shall convene a working group to— develop tools and guidance to assist agencies in addressing the obstacles that agencies identify in the reports under subsection (a); support interagency coordination to facilitate the identification and use of relevant voluntary standards, guidelines, and other consensus-based approaches for testing and evaluation and other relevant areas; and address any additional matters determined appropriate by the Director. The working group described in subparagraph (A) shall include Federal interdisciplinary personnel, such as technologists, information security and cybersecurity personnel, domain experts, privacy officers, data officers, civil rights and civil liberties officers, contracting officials, legal counsel, customer experience professionals, program evaluation officers, and others, as determined by the Director. The Director, in consultation with the Council, shall establish a mechanism for sharing tools and guidance developed under paragraph (2) across agencies. Each agency shall submit the annual report under subsection (a) to the relevant congressional committees. The Director, in consultation with the Council, may suspend the requirement under paragraph (1) and submit to the relevant congressional committees a consolidated report that conveys government-wide testing and evaluation challenges, recommended solutions, and progress toward implementing recommendations from prior reports developed in fulfillment of this subsection. Not later than 2 years after the date of enactment of this Act, the Chief Artificial Intelligence Officers Council shall submit to the Director and the relevant congressional committees a report outlining— a proposed framework for identifying extremely low risk artificial intelligence use cases; and opportunities to facilitate the deployment and use of extremely low risk artificial intelligence. The requirements under this section shall terminate on the date that is 10 years after the date of enactment of this Act.

13. Updates to artificial intelligence use case inventories The Advancing American AI Act (Public Law 117–263; 40 U.S.C. 11301 note) is amended— in section 7223(3), by striking the period and inserting and in section 5002 of the National Artificial Intelligence Initiative Act of 2020 (15 U.S.C. 9401).; and in section 7225, by striking subsection (d). The provisions of section 5 of Executive Order 13960 (85 Fed. Reg. 78939; relating to promoting the use of trustworthy artificial intelligence in Federal Government) that exempt classified and sensitive use cases from agency inventories of artificial intelligence use cases shall cease to have legal effect. The artificial intelligence inventory of each agency shall publicly disclose, subject to applicable laws and policies relating to the protection of privacy and classified and sensitive information— whether artificial intelligence was developed internally by the agency or procured externally, without excluding any use case on basis that the use case is sensitive solely because it was externally procured; data provenance information for high risk artificial intelligence use cases to identify the types of sources of the training data of the artificial intelligence, including internal government data, public data, commercially held data, or similar data; the level of risk at which the agency has classified the artificial intelligence use case and a brief explanation for how the determination was made; and the number of artificial intelligence use cases excluded from public reporting as being classified or sensitive, and an unclassified summary of each of these use cases. When an agency updates the public artificial intelligence use case inventory of the agency, the agency shall disclose the date of the modification and make change logs publicly available and accessible. The Director shall issue guidance to agencies that describes how to appropriately update artificial intelligence use case inventories and clarifies how sub-agencies and regulatory agencies should participate in the artificial intelligence use case inventorying process. The head of each agency shall, upon request, submit to the relevant congressional committees a copy of the annual artificial intelligence use case inventory of the agency, including— the use cases that have been identified as sensitive and not for public disclosure; and a classified annex of classified use cases. Not later than 1 year after the date of enactment of this Act, and annually thereafter for a period of 5 years, the Comptroller General of the United States shall submit to relevant congressional committees a report on whether agencies are appropriately classifying use cases. Beginning 2 years after the date of enactment of this Act, and annually thereafter, the Comptroller General of the United States, shall issue a report, based on the artificial intelligence use cases reported in use case inventories and other relevant information, that describes trends in the use of artificial intelligence by agencies and the impact of— such use on the Federal workforce and any cost savings; and this Act on Federal contractors that are small business concerns, including— small business concerns owned and controlled by service-disabled veterans (as defined in section 3 of the Small Business Act (15 U.S.C. 632)); qualified HUBZone small business concerns (as defined in section 31(b) of the Small Business Act (15 U.S.C. 657(b)(1))); socially and economically disadvantaged small business concerns (as defined in section 8(a)(4) of the Small Business Act (15 U.S.C. 637(a)(4))), and small business concerns owned and controlled by women (as defined in section 3 of the Small Business Act (15 U.S.C. 632)). The Comptroller General of the United States shall determine whether the appropriate level of disclosure of artificial intelligence use cases by agencies should be included on the High Risk List of the Government Accountability Office.