Editorial note. This is a working draft published for comment. Section 501 takes a deliberate position against federal preemption of stronger state law; it is the provision most likely to be contested in committee, and the reasoning is set out in the note following it.
A BILL
To require disclosure of the use of artificial intelligence systems in consequential decisions, to provide for independent evaluation of such systems, and for other purposes.
Be it enacted by the Senate and House of Representatives of the United States of America in Congress assembled,
Section 1. Short Title
This Act may be cited as the “Artificial Intelligence Transparency and Accountability Act”.
Title I — Definitions and Scope
Sec. 101. Definitions
In this Act:
a. ARTIFICIAL INTELLIGENCE SYSTEM. The term “artificial intelligence system” means a machine-based system that, for a given set of objectives, generates outputs such as predictions, classifications, recommendations, or decisions on the basis of inference from input data.
b. CONSEQUENTIAL DECISION. The term “consequential decision” means a decision that materially affects a natural person’s access to, cost of, or terms of —
- employment, including recruitment, promotion, discipline, scheduling, and termination;
- credit, insurance, or other financial services;
- housing;
- education or vocational training;
- health care, including coverage determinations and clinical triage;
- government benefits or services;
- criminal justice determinations, including pretrial release, charging support, sentencing support, and parole; or
- any other domain designated by the Commission by rule under section 404.
c. COVERED ENTITY. The term “covered entity” means a person that deploys an artificial intelligence system to make, or to substantially inform, a consequential decision.
d. DEVELOPER. The term “developer” means a person that designs, trains, or materially modifies an artificial intelligence system that is offered to another person for use in a consequential decision.
e. SUBSTANTIALLY INFORM. An artificial intelligence system “substantially informs” a decision where its output is a principal basis for the decision, without regard to whether a natural person formally issues the decision.
f. COMMISSION. The term “Commission” means the Federal Trade Commission.
Sec. 102. Application
a. IN GENERAL. This Act applies to a covered entity that, in the preceding calendar year, used an artificial intelligence system in respect of more than 1,000 consequential decisions.
b. NO EXEMPTION FOR INTERMEDIARIES. A covered entity may not avoid an obligation under this Act by reason of having obtained the system, or the decision output, from another person. A covered entity that relies on a developer’s representations remains responsible for compliance and shall have a right of contribution against the developer.
c. GOVERNMENT ENTITIES. For purposes of this Act, an agency of the Federal Government is a covered entity, and the Commission’s enforcement authority under section 401 is exercised in respect of such an agency by the Office of Management and Budget.
Title II — Disclosure
Sec. 201. Notice of Automated Decision-Making
a. IN GENERAL. A covered entity shall provide to each natural person subject to a consequential decision, at or before the time the decision is communicated, a clear and conspicuous notice stating —
- that an artificial intelligence system was used to make or substantially inform the decision;
- the categories of information about the person that the system used;
- the identity of the developer, where the system was not developed by the covered entity; and
- how to exercise the rights provided by section 202.
b. FORM. Notice shall be provided in the same manner and language as the decision itself. Notice buried in terms of service, or provided only on request, does not satisfy this section.
Sec. 202. Explanation and Human Review
a. EXPLANATION. On request by a person subject to a consequential decision, a covered entity shall provide, within 30 days and without charge —
- the principal factors that contributed to the outcome, ranked by significance and stated with enough specificity that the person can identify what would have to change;
- the source of the information about the person that the system used; and
- a statement of any known limitation of the system material to the decision.
b. HUMAN REVIEW. On request, a covered entity shall provide review of the decision by a natural person who —
- was not responsible for the original decision;
- has authority to reverse it; and
- considers the person’s submissions independently of the system’s output.
c. RULE OF CONSTRUCTION. Review that records agreement with the system’s output without independent consideration of the case does not satisfy subsection (b).
d. TRADE SECRETS. A covered entity may not withhold information required by subsection (a) on the ground that it constitutes a trade secret. Information disclosed under this section to a natural person is not thereby rendered public, and a covered entity may require reasonable confidentiality undertakings in respect of information beyond that required by subsection (a).
Sec. 203. System Documentation
a. IN GENERAL. A developer shall provide to each covered entity to which it supplies a system documentation sufficient to permit that entity to comply with this Act, including the intended uses of the system, the population on which it was evaluated, its known failure modes, and its measured performance disaggregated by race, ethnicity, sex, age, and disability status where such measurement is lawful.
b. RETENTION. A covered entity shall retain the documentation, and records of decisions made using the system, for not less than 5 years.
Title III — Evaluation and Audit
Sec. 301. Pre-Deployment Impact Assessment
a. IN GENERAL. Before deploying an artificial intelligence system to make or substantially inform a consequential decision, a covered entity shall complete a written impact assessment describing —
- the purpose of the system and the decision it informs;
- the data used to train and evaluate it;
- its measured performance, disaggregated as provided in section 203(a);
- the foreseeable harms of an erroneous output, and the measures adopted to mitigate them; and
- the less intrusive alternatives considered and the reasons for rejecting them.
b. REVIEW. The assessment shall be reviewed and updated not less than annually, and on any material modification of the system or its use.
c. AVAILABILITY. A covered entity shall make the assessment available to the Commission on request, and shall publish a summary sufficient to inform the public of the system’s purpose and measured performance.
Sec. 302. Independent Audit
a. REQUIREMENT. A covered entity that uses an artificial intelligence system in respect of more than 100,000 consequential decisions in a calendar year shall obtain an independent audit of that system not less than every 2 years.
b. INDEPENDENCE. An auditor may not —
- have a financial interest in the covered entity or the developer;
- have provided the system, or consulting services in respect of its design, to the covered entity within the preceding 3 years; or
- be compensated on terms contingent on the outcome of the audit.
c. SCOPE. The audit shall verify the accuracy of the impact assessment, the adequacy of the disclosures made under title II, and the system’s measured performance.
d. REPORTING. The auditor shall report directly to the Commission, and shall report to the covered entity’s governing body. A covered entity may not condition an auditor’s engagement or compensation on the content of the report.
Sec. 303. Safe Harbor for Good-Faith Research
a. IN GENERAL. A person is not liable under the Computer Fraud and Abuse Act (18 U.S.C. 1030), under section 1201 of title 17, United States Code, or under any contract term purporting to restrict evaluation, for conduct undertaken in good faith to evaluate an artificial intelligence system used in consequential decisions, where that conduct —
- is reasonably necessary to the evaluation;
- does not cause substantial harm to the system’s operation or to any natural person; and
- does not result in disclosure of personal information about a natural person other than the researcher.
b. UNENFORCEABILITY. A contract term that purports to waive or restrict the protection of subsection (a) is void as contrary to public policy.
Note. Section 303 is doing more work than its length suggests. Most independent evaluation of deployed systems is presently conducted in legal jeopardy, under statutes drafted for computer intrusion and applied to researchers who create an account and measure what the system does. A transparency statute that leaves that exposure in place will produce disclosure documents that nobody is permitted to check.
Title IV — Enforcement
Sec. 401. Enforcement by the Commission
a. UNFAIR OR DECEPTIVE ACTS. A violation of this Act shall be treated as a violation of a rule defining an unfair or deceptive act or practice under section 18(a)(1)(B) of the Federal Trade Commission Act (15 U.S.C. 57a(a)(1)(B)).
b. POWERS. The Commission shall enforce this Act in the same manner, by the same means, and with the same jurisdiction, powers, and duties as though all applicable terms of the Federal Trade Commission Act were incorporated into this Act.
c. CIVIL PENALTIES. The Commission may obtain a civil penalty of not more than $50,000 for each violation. Each consequential decision made in violation of this Act is a separate violation, except that the total penalty in respect of a single system in a single calendar year may not exceed the greater of $25,000,000 or 4 percent of the covered entity’s annual gross revenue.
Sec. 402. Enforcement by States
a. IN GENERAL. The attorney general of a State may bring a civil action on behalf of the residents of that State to enjoin a violation of this Act, to obtain damages on behalf of residents, or to obtain civil penalties under section 401(c).
b. NOTICE. A State shall notify the Commission before filing, or as soon as practicable thereafter, and the Commission may intervene.
Sec. 403. Private Right of Action
a. IN GENERAL. A natural person aggrieved by a violation of section 201, 202, or 203 may bring a civil action in an appropriate district court.
b. RELIEF. A prevailing plaintiff may recover actual damages or statutory damages of not less than $500 and not more than $5,000 per violation, punitive damages for a willful violation, reasonable attorney’s fees, and injunctive relief.
c. ARBITRATION. A predispute arbitration agreement, and a predispute waiver of the right to participate in a joint, class, or collective action, is invalid and unenforceable in respect of a claim under this section.
Sec. 404. Rulemaking
The Commission shall, not later than 18 months after the date of enactment, issue rules under section 553 of title 5, United States Code, to carry out this Act, including rules designating additional domains under section 101(b)(8) and prescribing the form of the summary required by section 301(c).
Title V — Miscellaneous
Sec. 501. Relationship to Other Law
a. NO PREEMPTION. Nothing in this Act preempts, supersedes, or limits a law of a State or political subdivision that affords a natural person protection equal to or greater than that afforded by this Act.
b. NO EFFECT ON OTHER REMEDIES. The rights and remedies provided by this Act are in addition to, and not in substitution for, any other right or remedy available under Federal or State law, including the Civil Rights Act of 1964, the Fair Credit Reporting Act, the Americans with Disabilities Act, and the Fair Housing Act.
Note on section 501. This is a policy choice, and the one most likely to be traded away. Industry support for a federal AI statute is generally conditioned on preemption, on the argument that fifty regimes are unworkable. The argument has real force for compliance cost and none at all for the floor of protection: a federal standard that displaces stronger state law leaves some people with fewer rights than they had the day before it passed. A transparency statute is a poor vehicle for that trade, because its obligations are cheap to comply with in any jurisdiction — telling a person a machine decided their case does not vary meaningfully from state to state.
Sec. 502. Severability
If a provision of this Act, or its application to a person or circumstance, is held invalid, the remainder of this Act and the application of that provision to other persons or circumstances shall not be affected.
Sec. 503. Effective Date
a. IN GENERAL. This Act takes effect 18 months after the date of enactment.
b. AUDIT REQUIREMENT. Section 302 takes effect 30 months after the date of enactment.