AI Summit_Sept. 13 2024

Congressional Research Service

The Artificial Intelligence Research, Innovation, and Accountability Act of 2023 (S. 3312) was introduced on November 15, 2023. Title I of the bill focuses on AI R&D; Title II focuses on AI accountability. Regarding the Title II provisions, the bill would require that x covered internet platforms using generative $, SURYLGH QRWLFH LQ D ³FOHDU DQG conspicuous PDQQHU ´ to users about the use of a generative AI system to generate content that users see; x deployers of high-impact AI systems submit reports to DOC on the design and safety plan of the AI system, and both deployers and developers of such systems consider best practices of the NIST AI Risk Management Framework; 3 x NIST develop sector-specific recommendations for individual federal agencies to conduct oversight of high-impact AI systems, with oversight on implementation lead by OMB. The bill would also require non-government organizations deploying critical-impact AI systems 4 to perform a risk management assessment and provide it to DOC for review. Developers of such systems would also be required to provide information to deployers so that they may perform the assessment. Additionally, the bill would require DOC to establish a three-year implementation plan for the certification of critical-impact AI systems and issue testing, evaluation, validation, and verification (TEVV) standards for critical-impact AI systems. Subsequently, the bill would require each critical- impact AI organization to self-certify to DOC that their system complies with applicable TEVV standards, and the bill would authorize civil penalties for noncompliance. The Federal Artificial Intelligence Risk Management Act of 2023 (S. 3205) was introduced on November 2, 2023, and the Federal Artificial Intelligence Risk Management Act of 2024 (H.R. 6936) was introduced on January 10, 2024 (the text of the bills are identical). The bills would require NIST to issue guidance for federal agencies to incorporate the AI Risk Management Framework released by NIST in January 2023 (or any successor document) into their AI risk management efforts, and require OMB to subsequently issue guidance requiring federal agencies to incorporate the framework and guidelines into their AI risk management efforts. The bill would also require the Administrator of Federal Procurement Policy, in consultation with OMB, to provide draft contract language for agency use in AI procurement, and require the Federal Acquisition Regulatory Council to promulgate regulations for the requirements of AI acquisitions to include risk-based compliance with the framework. Additionally, the bill would require OMB to establish an initiative to provide AI expertise to federal agencies, and require NIST to complete a study reviewing voluntary consensus TEVV standards for AI acquisitions. The Facial Recognition Act of 2023 (H.R. 6092) was introduced on October 26, 2023. The bill would require an investigative or law enforcement officer to obtain a court order to use or request use of facial recognition (FR) in conjunction with a reference photo database, with certain exceptions. The bill would prohibit certain investigative or law enforcement officer uses of FR, including to record individuals exercising constitutional rights, to enforce immigration laws, for images obtained with a body camera, or for face surveillance. Additionally, the bill would set forth requirements for: reporting on court orders; audits of federal law enforcement use of FR; and regarding the use of systems that have been submitted annually to NIST for accuracy and bias testing. The bill would further authorize civil penalties for certain violations of the act and require NIST to develop best practices and offer FR testing for law enforcement. 3 Created by NIST in January 2023 in response to statutory direction at 15 U.S.C. §278h-1(c). 4 A ³FULWLFDO -impact AI V\VWHP´ means an AI system used to make decisions with a legal or similarly significant effect on 1) ³UHDO -time or ex post facto collection of biometric data of natural persons by biometric identification systems without their FRQVHQW ´ 2) the direct management and operation of critical infrastructure, or 3) criminal justice, and in a manner that poses ³VLJQLILFDQW ULVN´ WR FRQVWLWXWLRQDO ULJKWV RU VDIHW\

AI Roundtable Page 191