119 HR 6356 IH: Artificial Intelligence Civil Rights Act of 2025
U.S. House of Representatives
2025-12-02
text/xml
EN
Pursuant to Title 17 Section 105 of the United States Code, this file is not subject to copyright protection and is in the public domain.
1.Short title; table of contents(a)This Act may be cited as the Artificial Intelligence Civil Rights Act of 2025
.(b)The table of contents for this Act is as follows:Sec. 1. Short title; table of contents.Sec. 2. Definitions.TITLE I—Civil rightsSec. 101. Discrimination.Sec. 102. Pre-deployment evaluations and post-deployment impact assessments.TITLE II—Covered algorithm and contract standardsSec. 201. Covered algorithm standards.Sec. 202. Relationships between developers and deployers.Sec. 203. Human alternatives and other protections.Sec. 204. Prohibition on retaliation; whistleblower protections.TITLE III—TransparencySec. 301. Notice and disclosure.Sec. 302. Study on explanations regarding the use of covered algorithms.Sec. 303. Consumer awareness.TITLE IV—EnforcementSec. 401. Enforcement by the Commission.Sec. 402. Enforcement by States.Sec. 403. Private right of action.Sec. 404. Severability.Sec. 405. Rules of construction.TITLE V—Federal resourcesSec. 501. Occupational series relating to algorithm auditing.Sec. 502. Additional Federal resources.2.In this Act:(1)The terms collect and collection, with respect to personal data, mean buying, renting, gathering, obtaining, receiving, accessing, or otherwise acquiring such data by any means.(2)The term commercial act, with respect to a covered algorithm, means an act conducted for monetary or other valuable consideration, including conducting an activity in furtherance of obtaining such consideration.(3)The term Commission means the Federal Trade Commission.(4)The term consequential action means an act that is likely to have a material effect on, or to materially contribute to, access to, security and authentication relating to, eligibility for, cost of, terms of, or conditions related to any of the following:(A)Employment, including hiring, pay, independent contracting, worker management, promotion, and termination.(B)Education and career and technical education, including assessment, proctoring, promotion of academic integrity, accreditation, certification, admissions, enrollment, disciplinary actions including suspension, expulsion, or referral to law enforcement, eligibility for graduation, grade promotion or degree conferral, academic performance evaluation, and provision of financial aid and scholarships.(C)Housing and lodging, including rental and short-term housing and lodging, home appraisals, rental subsidies, publicly supported housing, and mortgage lending.(D)Essential utilities, including electricity, heat, water, municipal trash or sewage services, internet and telecommunications service, and public transportation.(E)Health care, including mental health care, and dental, vision, and adoption services, and other health care-related services, treatment options, trials, and studies.(F)Credit, banking, and other financial services.(G)Insurance, including insurance claim determinations.(H)Actions of the criminal justice system, law enforcement or intelligence operations, immigration determinations or enforcement, border control (vetting, screening, and inspection), child protective services, child welfare, and family services, including risk and threat assessments, situational awareness and threat detection, investigations, watchlisting, bail determinations, sentencing, administration of parole, surveillance, use of unmanned vehicles and machines, and predictive policing.(I)Justice and determinations concerning guilt or liability, including assignment of cases or counsel, bail determinations, pre-detention risk assessments, case intake, sequencing, and processing, awards of actual or punitive damages, and binding and nonbinding determinations in arbitration, mediation, or other alternative dispute resolution.(J)Elections, including voting, requirements for documentation or proof of identity to vote or register to vote (and determinations about whether an individual meets those requirements), redistricting, polling place resources, reduction or alteration of multilingual or English language voting materials, alteration of the manner in which voting materials are provided or distributed, reduction, consolidation, or relocation of voting locations in elections for Federal, State, or local office (including early, absentee, and election-day voting locations), reduction in days or hours of in-person voting during a period occurring prior to the date of an election for Federal, State, or local office during which voters may cast ballots in such election, election security, and election administration, including maintenance processes for voter registration lists that add a new basis for removal from the list of active voters registered to vote in elections for Federal, State, or local office, or that incorporate a new source of information in determining a voter’s eligibility to vote in elections for Federal, State, or local office.(K)Government benefits and services, as well as verification of identity, citizenship, and immigration status, fraud prevention, and assignment of penalties.(L)A public accommodation.(M)Any other service, program, product, or opportunity which has a comparable legal, material, or similarly significant effect on an individual’s life as determined by the Commission through rules promulgated pursuant to section 553 of title 5, United States Code.(5)The term covered algorithm means—(A)a computational process derived from machine learning, natural language processing, artificial intelligence techniques, or other computational processing techniques of similar or greater complexity, that, with respect to a consequential action—(i)creates or facilitates the creation of a product or information that is used as an integral part of the consequential action;(ii)promotes, recommends, ranks, or otherwise affects the display or delivery of information that is used as an integral part of the consequential action;(iii)makes a decision; or(iv)facilitates human decision making; or(B)any other computational process deemed appropriate by the Commission through rules promulgated pursuant to section 553 of title 5, United States Code.(6)The term covered language means the 10 languages with the most speakers in the United States, according to the most recent data collected by the United States Census Bureau.(7)The term de-identified data means information—(A)that does not identify and is not linked or reasonably linkable to an individual or a device, regardless of whether the information is aggregated; and(B)with respect to which any developer or deployer using such information—(i)takes reasonable technical measures to ensure that the information cannot, at any point, be used to re-identify any individual or device that identifies or is linked or reasonably linkable to an individual;(ii)publicly commits in a clear and conspicuous manner—(I)to process and transfer the information solely in a de-identified form without any reasonable means for re-identification; and(II)to not attempt to re-identify the information with any individual or device that identifies or is linked or reasonably linkable to an individual; and(iii)contractually obligates any person that receives the information from the developer or deployer—(I)to comply with all of the provisions of this paragraph with respect to such information; and(II)to require that such contractual obligations be included in all subsequent instances for which the information may be received.(8)(A)The term deployer means any person that uses a covered algorithm for a commercial act.(B)The terms deployer and developer shall not be interpreted to be mutually exclusive.(9)(A)The term developer means any person that designs, codes, customizes, produces, or substantially modifies an algorithm that is intended or reasonably likely to be used as a covered algorithm—(i)for such person's own use, or use by a third party, in connection with a commercial act; or(ii)for use by a government entity.(B)Assumption of developer responsibilitiesIn the event that a deployer uses an algorithm as a covered algorithm, and no person is considered the developer of the algorithm for purposes of subparagraph (A), the deployer shall be considered the developer of the covered algorithm for the purposes of this Act.(C)The terms developer and deployer shall not be interpreted to be mutually exclusive.(10)(A)The term disparate impact means an unjustified differential effect on an individual or group of individuals on the basis of an actual or perceived protected characteristic.(B)Unjustified differential effectFor purposes of subparagraph (A), with respect to the action, policy, or practice of a developer or deployer, a differential effect is unjustified if—(i)the developer or deployer fails to demonstrate that such action, policy, or practice causing the differential effect is necessary to achieve a substantial, legitimate, and nondiscriminatory interest; or(ii)in the event the developer or deployer demonstrates such interest, an alternative action, policy, or practice could serve such interest with less differential effect.(C)Application to covered algorithmsWith respect to demonstrating that a covered algorithm causes or contributes to a differential effect, the covered algorithm is presumed to be not separable for analysis and may be analyzed holistically as a single action, policy, or practice, unless the developer or deployer proves that the covered algorithm is separable by a preponderance of the evidence.(11)The term harm, with respect to a consequential action, means a non-de minimis adverse effect on an individual or group of individuals—(A)on the basis of a protected characteristic;(B)that involves the use of force, coercion, harassment, intimidation, or detention; or(C)that involves the infringement of a right protected under the Constitution of the United States.(12)(A)The term independent auditor means an individual that conducts a pre-deployment evaluation or impact assessment of a covered algorithm in a manner that exercises objective and impartial judgment on all issues within the scope of such evaluation or assessment.(B)An individual is not an independent auditor of a covered algorithm if such individual—(i)is or was involved in using, developing, offering, licensing, or deploying the covered algorithm for a commercial act;(ii)at any point during the pre-deployment evaluation or impact assessment, has an employment relationship (including a contractor relationship, but not including a contractor relationship for the auditing service described in subparagraph (A)) with a developer or deployer that uses, offers, or licenses the covered algorithm; or(iii)at any point during the pre-deployment evaluation or impact assessment, has a direct financial interest, a reasonably foreseeable future financial interest, or a material indirect financial interest in a developer or deployer that uses, offers, or licenses a covered algorithm, not including routine payment for the auditing services described in subparagraph (A).(13)The term individual means a natural person in the United States.(14)(A)The term personal data—(i)means information that identifies or is linked or reasonably linkable, alone or in combination with other information, to an individual or an individual's device; and(ii)shall include derived data and unique persistent identifiers.(B)The term personal data does not include de-identified data.(15)The term process, with respect to personal data, means to conduct or direct any operation or set of operations performed on such data, including analyzing, organizing, structuring, retaining, storing, using, or otherwise handling such data.(16)The term protected characteristic means any of the following actual or perceived traits of an individual or group of individuals:(A)Race.(B)Color.(C)Ethnicity.(D)National origin, nationality, or immigration status.(E)Religion.(F)Sex (including a sex stereotype, pregnancy, childbirth, or a related medical condition, sexual orientation or gender identity, and sex characteristics, including intersex traits).(G)Disability.(H)Limited English proficiency.(I)Biometric information.(J)Familial or marital status.(K)Source of income.(L)Income level (not including the ability to pay for a specific good or service being offered).(M)Age.(N)Veteran status.(O)Genetic information or medical conditions.(P)Any other classification protected by Federal law.(17)(A)The term public accommodation means—(i)a business that offers goods or services to the general public, regardless of whether the business is operated for profit or operates from a physical facility;(ii)a park, road, or pedestrian pathway open to the general public;(iii)a means of public transportation; or(iv)a publicly owned or operated facility open to the general public.(B)The term public accommodation does not include a private club or establishment described in section 101(b)(2).(18)The term State means each of the 50 States, the District of Columbia, Puerto Rico, the United States Virgin Islands, Guam, American Samoa, and the Commonwealth of the Northern Mariana Islands.(19)State data protection authorityThe term State data protection authority means an independent public authority of a State that supervises, investigates, and regulates data protection and security law in the State, including handling complaints lodged against persons for violations of State and relevant Federal laws.(20)The term transfer, with respect to personal data, means to disclose, release, disseminate, make available, license, rent, or share such data orally, in writing, electronically, or by any other means.<enum>I</enum><header>Civil rights</header><section id="H500E7A11BA95442D951E20353F081142"><enum>101.</enum><header>Discrimination</header><subsection id="HF492EC8774414A3387897730E276E616"><enum>(a)</enum><header>In general</header><text>A developer or deployer shall not offer, license, promote, sell, or use a covered algorithm in a manner that—</text><paragraph commented="no" display-inline="no-display-inline" id="HF9ACC6AB9A3B4B238F31B42872D4CB3C"><enum>(1)</enum><text display-inline="yes-display-inline">causes or contributes to a disparate impact in a manner that prevents;</text></paragraph><paragraph commented="no" display-inline="no-display-inline" id="H29D8916BD1EC47B4BCC123D32D542466"><enum>(2)</enum><text display-inline="yes-display-inline">otherwise discriminates in a manner that prevents; or</text></paragraph><paragraph commented="no" display-inline="no-display-inline" id="H38A7BB28079A409081CAC98DD1CEA501"><enum>(3)</enum><text display-inline="yes-display-inline">otherwise makes unavailable,</text></paragraph><continuation-text commented="no" continuation-text-level="subsection">the equal enjoyment of goods, services, or other activities or opportunities, related to a consequential action, on the basis of a protected characteristic.</continuation-text></subsection><subsection id="HDAB237CA0CDD4010ADD71289D4F8C68A"><enum>(b)</enum><header>Exceptions</header><text>This section shall not apply to—</text><paragraph id="H335D87632AE84127AE21695B4BD98220"><enum>(1)</enum><text>the offer, licensing, or use of a covered algorithm for the sole purpose of—</text><subparagraph id="H9A2F9577A913490DB2597FB6C75DE8DA"><enum>(A)</enum><text>a developer’s or deployer’s self-testing (or auditing by an independent auditor at a developer’s or deployer’s request) to identify, prevent, or mitigate discrimination, or otherwise to ensure compliance with obligations, under Federal law;</text></subparagraph><subparagraph id="H018EA462B9624541AE302D5FF5D0AEA8"><enum>(B)</enum><text>expanding an applicant, participant, or customer pool to raise the likelihood of increasing diversity or redressing historic discrimination; or</text></subparagraph><subparagraph id="H6C81945E64444A46B5D1662A134F145E"><enum>(C)</enum><text>conducting—</text><clause commented="no" display-inline="no-display-inline" id="H57B405F842CE43BAA02AD6861BA63409"><enum>(i)</enum><text display-inline="yes-display-inline">good faith security research; or</text></clause><clause commented="no" display-inline="no-display-inline" id="H7356711D0C1A45AAB84D22273541C909"><enum>(ii)</enum><text display-inline="yes-display-inline">other research, if conducting the research is not part or all of a commercial act; or</text></clause></subparagraph></paragraph><paragraph id="H4E5123DBAE8948A69DBFB8BFBD8DDB15"><enum>(2)</enum><text>any private club or other establishment not in fact open to the public, as described in section 201(e) of the Civil Rights Act of 1964 (<external-xref legal-doc="usc" parsable-cite="usc/42/2000a">42 U.S.C. 2000a(e)</external-xref>).</text></paragraph></subsection></section><section id="H33854E7B53FC49D7A0F81E2C4E70543A"><enum>102.</enum><header>Pre-deployment evaluations and post-deployment impact assessments</header><subsection id="H7AAAABC3D4AD49698B5439CD6359C34E"><enum>(a)</enum><header>Pre-Deployment evaluations</header><text>Prior to deploying, licensing, or offering a covered algorithm (including deploying a material change to a previously-deployed covered algorithm or a material change made prior to deployment) for a consequential action, a developer or deployer shall conduct a pre-deployment evaluation in accordance with the following:</text><paragraph id="HD4B85C0D8663460084ABA80CF230C7C7"><enum>(1)</enum><header>Preliminary evaluation</header><subparagraph commented="no" display-inline="no-display-inline" id="H8BF3EB27CA8C47918276CCAC1D5083D2"><enum>(A)</enum><header>Plausibility of harm</header><clause commented="no" display-inline="no-display-inline" id="H093A8E670CD6499285E4BCF52D17EE6E"><enum>(i)</enum><header>Developers</header><text display-inline="yes-display-inline">The developer shall conduct a preliminary evaluation of the plausibility that any expected use of the covered algorithm may result in a harm.</text></clause><clause commented="no" display-inline="no-display-inline" id="H483ABE56E00D427094662347B56347D1"><enum>(ii)</enum><header>Deployers</header><text>The deployer shall conduct a preliminary evaluation of the plausibility that any intended use of the covered algorithm may result in a harm.</text></clause></subparagraph><subparagraph commented="no" display-inline="no-display-inline" id="H43419C233F354150BF09781AD4CA8547"><enum>(B)</enum><header>Results</header><text display-inline="yes-display-inline">Based on the results of the preliminary evaluation, the developer or deployer shall—</text><clause commented="no" display-inline="no-display-inline" id="H68D3F04268274D6A9F827482F65B30CB"><enum>(i)</enum><text display-inline="yes-display-inline">in the event that a harm is not plausible, record a finding of no plausible harm, including a description of the developer’s expected use or the deployer’s intended use of the covered algorithm, how the preliminary evaluation was conducted, and an explanation for the finding, and submit such record to the Commission; and</text></clause><clause commented="no" display-inline="no-display-inline" id="H5A75D2843A7344DF8AF238497FC0A9FC"><enum>(ii)</enum><text display-inline="yes-display-inline">in the event that a harm is plausible, conduct a full pre-deployment evaluation as described in paragraph (2).</text></clause></subparagraph><subparagraph commented="no" display-inline="no-display-inline" id="H3B56594CF6AE496AB7EA00F08A4F5C82"><enum>(C)</enum><header>Previously-deployed covered algorithms</header><text display-inline="yes-display-inline">When conducting a preliminary evaluation of a material change to, or new use of, a previously-deployed covered algorithm, the developer or deployer may limit the scope of the evaluation to whether use of the covered algorithm may result in a harm as a result of the material change or new use.</text></subparagraph></paragraph><paragraph id="H37D2CAE60E474707BD674F1A1FAE5A60"><enum>(2)</enum><header>Full pre-deployment evaluation</header><subparagraph commented="no" display-inline="no-display-inline" id="H740681E344814D8CA3845E5BE3E7389A"><enum>(A)</enum><header display-inline="yes-display-inline">For developers</header><clause id="H92E74C4911F64D39B4C70784C0A03552"><enum>(i)</enum><header>Independent auditor evaluation</header><text>If a developer determines a harm is plausible during the preliminary evaluation described in paragraph (1), the developer shall engage an independent auditor to conduct a pre-deployment evaluation.</text></clause><clause commented="no" display-inline="no-display-inline" id="H071E37CDAF2E41E9A579FADAF2E729BF"><enum>(ii)</enum><header>Pre-deployment evaluation requirements</header><text>The evaluation required under clause (i) shall include a detailed review and description, sufficient for an individual having ordinary skill in the art to understand the functioning, risks, uses, benefits, limitations, and other pertinent attributes of the covered algorithm, including—</text><subclause id="HA54281AA6F38424C98873F60D9813516"><enum>(I)</enum><text>the covered algorithm’s design and methodology, including the inputs the covered algorithm is designed to use to produce an output and the outputs the covered algorithm is designed to produce;</text></subclause><subclause id="H693A66B2E3774163B35A5C6304908E57"><enum>(II)</enum><text>how the covered algorithm was created, trained, and tested, including—</text><item id="HF21B42695ABE484C97C9750F9D932833"><enum>(aa)</enum><text>any metric used to test the performance of the covered algorithm;</text></item><item id="HA2A78B3CB4B94118BFCB45ADB09D0D2D"><enum>(bb)</enum><text>defined benchmarks and goals that correspond to such metrics, including whether there was sufficient representation of demographic groups that are reasonably likely to use or be affected by the covered algorithm in the data used to create or train the algorithm, and whether there was reasonable testing, if any, across such demographic groups;</text></item><item id="H813C4E842C0241288E4A83D5275786A9"><enum>(cc)</enum><text>the outputs the covered algorithm actually produces in testing;</text></item><item id="H26065B10DA5E43929FDACE98D0D961C6"><enum>(dd)</enum><text>a description of any consultation with relevant stakeholders, including any communities that will be impacted by the covered algorithm, regarding the development of the covered algorithm, or a disclosure that no such consultation occurred;</text></item><item id="H1B77C106D33B47C5A90CA7DEB52D4FA5"><enum>(ee)</enum><text>a description of which protected characteristics, if any, were used for testing and evaluation, and how and why such characteristics were used, including—</text><subitem id="H07C4C9E715F3450681D35304B5C6FFF7"><enum>(AA)</enum><text>whether the testing occurred in comparable contextual conditions to the conditions in which the covered algorithm is expected to be used; and</text></subitem><subitem id="H1228CE82E4CE4F5DA3B0C258E271BEAB"><enum>(BB)</enum><text>if protected characteristics were not available to conduct such testing, a description of alternative methods the developer used to conduct the required assessment;</text></subitem></item><item id="HD565A170EFFD419AA6B34F7B3F9B3464"><enum>(ff)</enum><text>any other computational algorithm incorporated into the development of the covered algorithm, regardless of whether such precursor computational algorithm involves a consequential action;</text></item><item id="H1F9F2474752A43F9978BA92877B96E13"><enum>(gg)</enum><text>a description of the data and information used to develop, test, maintain, or update the covered algorithm, including—</text><subitem id="H84621EFD78DC4A89BB4058B964228298"><enum>(AA)</enum><text>each type of personal data used, each source from which the personal data was collected, and how each type of personal data was inferred and processed;</text></subitem><subitem id="HA7678608D07A4E08896081EABCFF6A90"><enum>(BB)</enum><text>the legal authorization for collecting and processing the personal data; and</text></subitem><subitem id="H3046972A7D6046F5BD267907D744BF70"><enum>(CC)</enum><text>an explanation of how the data (including personal data) used is representative, proportional, and appropriate to the development and intended uses of the covered algorithm; and</text></subitem></item><item id="H6722D8C3702347BA90B6456B8E535C06"><enum>(hh)</enum><text>a description of the training process for the covered algorithm which includes the training, validation, and test data utilized to confirm the intended outputs;</text></item></subclause><subclause id="H3F5F243070E84631B4EAF8E2992DBCEA"><enum>(III)</enum><text>the potential for the covered algorithm to produce a harm or to have a disparate impact in the equal enjoyment of goods, services, or other activities or opportunities, and a description of such potential harm or disparate impact;</text></subclause><subclause id="HA508A456F99F4532921F99724B93FEC1"><enum>(IV)</enum><text>alternative practices and recommendations to prevent or mitigate harm and recommendations for how the developer could monitor for harm after offering, licensing, or deploying the covered algorithm; and</text></subclause><subclause id="H70DBF1518BE94BECB01CCEEEF47F36D8"><enum>(V)</enum><text>any other information the Commission deems pertinent to prevent the covered algorithm from causing harm or having a disparate impact in the equal enjoyment of goods, services, or other activities or opportunities, as prescribed by rules promulgated by the Commission pursuant to section 553 of title 5, United States Code.</text></subclause></clause><clause id="H13BAB6094EA140FA960339B65B143C13"><enum>(iii)</enum><header>Report</header><text>The independent auditor shall submit to the developer a report on the evaluation conducted under this subparagraph, including the findings and recommendations of such independent auditor.</text></clause></subparagraph><subparagraph id="HDF9DC49158F944CEAF1733D0D7F255BE"><enum>(B)</enum><header>For deployers</header><clause id="HF49AEE389DCE4AB6A8E6A4C9C1DEA3D4"><enum>(i)</enum><header>Independent auditor evaluation</header><text>If a deployer determines a harm is plausible during the preliminary evaluation described in paragraph (1), the deployer shall engage an independent auditor to conduct a pre-deployment evaluation.</text></clause><clause id="HB8D55E54FC7748CF9F9602B79A08D9A7"><enum>(ii)</enum><header>Pre-deployment evaluation requirements</header><text>The evaluation required under clause (i) shall include a detailed review and description, sufficient for an individual having ordinary skill in the art to understand the functioning, risks, uses, benefits, limitations, and other pertinent attributes of the covered algorithm, including—</text><subclause id="HE006C969037A4172B3036A586B4485D4"><enum>(I)</enum><text>the manner in which the covered algorithm makes or contributes to a consequential action and the purpose for which the covered algorithm will be deployed;</text></subclause><subclause id="H0A3C374C028148FCBA5490F828F712E2"><enum>(II)</enum><text>the necessity and proportionality of the covered algorithm in relation to its planned use, including the intended benefits and limitations of the covered algorithm and a description of the baseline process being enhanced or replaced by the covered algorithm, if applicable;</text></subclause><subclause id="H9B9696FBF98045F78934ADB50658D16C"><enum>(III)</enum><text>the inputs that the deployer plans to use to produce an output, including—</text><item id="HBB2D1F5592314DBA8DB2F0E1F39E5EFF"><enum>(aa)</enum><text>the type of personal data and information used and how the personal data and information will be collected, inferred, and processed;</text></item><item id="HB970622A0C8E431499EA7ECEFA58F482"><enum>(bb)</enum><text>the legal authorization for collecting and processing the personal data; and</text></item><item id="HC5F72F010DD1454E9AB2AD29554C146B"><enum>(cc)</enum><text>an explanation of how the data used is representative, proportional, and appropriate to the deployment of the covered algorithm;</text></item></subclause><subclause id="H7B37FDA163B6441A93271D735AC6C7C8"><enum>(IV)</enum><text>the outputs the covered algorithm is expected to produce and the outputs the covered algorithm actually produces in testing;</text></subclause><subclause id="H291DDF14014F4E5C9B249E08A7517B82"><enum>(V)</enum><text>a description of any additional testing or training completed by the deployer for the context in which the covered algorithm will be deployed;</text></subclause><subclause id="H2CFC926E69024464851285588E23BB63"><enum>(VI)</enum><text>a description of any consultation with relevant stakeholders, including any communities that will be impacted by the covered algorithm, regarding the deployment of the covered algorithm;</text></subclause><subclause id="H69035A86B36749938E364CF58F8F83F1"><enum>(VII)</enum><text>the potential for the covered algorithm to produce a harm or to have a disparate impact in the equal enjoyment of goods, services, or other activities or opportunities in the context in which the covered algorithm will be deployed and a description of such potential harm or disparate impact;</text></subclause><subclause id="H9CDB94910BD640CE9BE08C26C1CE5B8A"><enum>(VIII)</enum><text>alternative practices and recommendations to prevent or mitigate harm in the context in which the covered algorithm will be deployed and recommendations for how the deployer could monitor for harm after offering, licensing, or deploying the covered algorithm; and</text></subclause><subclause id="H45447046FBC9428EBDC767240A766DA3"><enum>(IX)</enum><text>any other information the Commission deems pertinent to prevent the covered algorithm from causing harm or having a disparate impact in the equal enjoyment of goods, services, or other activities or opportunities as prescribed by rules promulgated by the Commission pursuant to section 553 of title 5, United States Code.</text></subclause></clause><clause id="H5F0CC790FA5F4B739A286678B2607733"><enum>(iii)</enum><header>Report</header><text>The independent auditor shall submit to the deployer a report on the evaluation conducted under this subparagraph, including the findings and recommendations of such independent auditor.</text></clause></subparagraph></paragraph></subsection><subsection id="HB061E0AA54BE46E594B8DE9524E1F396"><enum>(b)</enum><header>Deployer annual impact assessment</header><text>After the deployment of a covered algorithm, a deployer shall, on an annual basis, conduct an impact assessment in accordance with the following:</text><paragraph id="HE54EA4C5214B4736A9D2B544BFE34CEA"><enum>(1)</enum><header>Preliminary impact assessment</header><text>The deployer shall conduct a preliminary impact assessment of the covered algorithm to identify any harm that resulted from the covered algorithm during the reporting period and—</text><subparagraph commented="no" display-inline="no-display-inline" id="H5657ADA842674D7BBF1BCF36402E055B"><enum>(A)</enum><text>if no resulting harm is identified by such assessment, shall record a finding of no harm, including a description of the developer's expected use or the deployer's intended use of the covered algorithm, how the preliminary evaluation was conducted, and an explanation for such finding, and submit such finding to the Commission; and</text></subparagraph><subparagraph commented="no" display-inline="no-display-inline" id="HB74BB0AB5C3C4F5E94685F818814CE44"><enum>(B)</enum><text>if a resulting harm is identified by such assessment, shall conduct a full impact assessment as described in paragraph (2).</text></subparagraph></paragraph><paragraph id="HF9F778C9004740F1AD9EE42316496A94"><enum>(2)</enum><header>Full impact assessment</header><text>In the event that the covered algorithm resulted in harm during the reporting period, the deployer shall engage an independent auditor to conduct a full impact assessment with respect to the reporting period, including—</text><subparagraph id="H9073A345BC2845C2B008A0D1D32702C1"><enum>(A)</enum><text>an assessment of the harm that resulted or was reasonably likely to have been produced during the reporting period;</text></subparagraph><subparagraph id="HAA269CB330C14DD5AE5204ADE0D5A39D"><enum>(B)</enum><text>a description of the extent to which the covered algorithm produced a disparate impact in the equal enjoyment of goods, services, or other activities or opportunities, including the methodology for such evaluation, of how the covered algorithm produced or likely produced such disparity;</text></subparagraph><subparagraph id="H2DECF20FAB7D4C939395D7BB3F5F2B96"><enum>(C)</enum><text>a description of the types of data input into the covered algorithm during the reporting period to produce an output, including—</text><clause id="H6246C28BECCF4C7EB048A365C9E6494A"><enum>(i)</enum><text>documentation of how data input into the covered algorithm to produce an output is represented and complete descriptions of each field of data; and</text></clause><clause id="H4DD966F49F564E04A0151A6401A16BF5"><enum>(ii)</enum><text>whether and to what extent the data input into the covered algorithm to produce an output was used to train or otherwise modify the covered algorithm;</text></clause></subparagraph><subparagraph id="H50971F1FDBEC437CA6A202AD85787E0B"><enum>(D)</enum><text>whether and to what extent the covered algorithm produced the outputs it was expected to produce;</text></subparagraph><subparagraph id="H6E948E0826D94E0981BCCA33856A2D0E"><enum>(E)</enum><text>a detailed description of how the covered algorithm was used to make a consequential action;</text></subparagraph><subparagraph id="HCF35F5A2058B4D58A425CA79313AB955"><enum>(F)</enum><text>any action taken to prevent or mitigate harms, including how relevant staff are informed of, trained about, and implement harm mitigation policies and practices, and recommendations for how the deployer could monitor for and prevent harm after offering, licensing, or deploying the covered algorithm; and</text></subparagraph><subparagraph id="HA138C93F094F4C379E51F105F26B1929"><enum>(G)</enum><text>any other information the Commission deems pertinent to prevent the covered algorithm from causing harm or having a disparate impact in the equal enjoyment of goods, services, or other activities or opportunities as prescribed by rules promulgated by the Commission pursuant to section 553 of title 5, United States Code.</text></subparagraph></paragraph><paragraph id="H34A90F35636D4D0CAC752E8F6BC46D15" commented="no" display-inline="no-display-inline"><enum>(3)</enum><header>Reports</header><subparagraph commented="no" display-inline="no-display-inline" id="H98CFB5E40B334636BB58E0043093714A"><enum>(A)</enum><header>To the deployer</header><text display-inline="yes-display-inline">After the engagement of the independent auditor, the independent auditor shall submit to the deployer a report on the impact assessment conducted under paragraph (2), including the findings and recommendations of such independent auditor.</text></subparagraph><subparagraph commented="no" display-inline="no-display-inline" id="H6119259D7C8C4DAF86F2174352CB24F1"><enum>(B)</enum><header>To the developer</header><text display-inline="yes-display-inline">Not later than 30 days after the submission of a report on an impact assessment under subparagraph (A), a deployer shall submit to the developer of the covered algorithm a summary of such report, subject to the trade secret and privacy protections described in subsection (e)(3).</text></subparagraph></paragraph></subsection><subsection id="H71E48F012DE843369D7AF3F9308CD6B2"><enum>(c)</enum><header>Developer annual review of assessments</header><text>A developer shall, on an annual basis, review each impact assessment summary submitted by a deployer of its covered algorithm under subsection (b)(3)(B) for the following purposes:</text><paragraph id="HA9283EB417B74CF8AA2073FCA249B7FE"><enum>(1)</enum><text>To assess how the deployer is using the covered algorithm, including the methodology for assessing such use.</text></paragraph><paragraph id="H6203A74EFF1F41138FFAEE4B47E1E429"><enum>(2)</enum><text>To assess the type of data the deployer is inputting into the covered algorithm to produce an output and the types of outputs the covered algorithm is producing.</text></paragraph><paragraph id="H9D9305FE4154410D8709228280598408"><enum>(3)</enum><text>To assess whether the deployer is complying with any relevant contractual agreement with the developer and whether any remedial action is necessary.</text></paragraph><paragraph id="H8C7CF4E7ABAB4E9A8E25CB1618830242"><enum>(4)</enum><text>To compare the covered algorithm’s performance in real-world conditions versus pre-deployment testing, including the methodology used to evaluate such performance.</text></paragraph><paragraph id="HE81B603CDC8745FEA73E485A45C7672B"><enum>(5)</enum><text>To assess whether the covered algorithm is causing harm or is reasonably likely to be causing harm.</text></paragraph><paragraph id="HCE5845E92FCB4DF8917D5AC8426167A9"><enum>(6)</enum><text>To assess whether the covered algorithm is causing, or is reasonably likely to be causing, a disparate impact in the equal enjoyment of goods, services, or other activities or opportunities, and, if so, how and with respect to which protected characteristic.</text></paragraph><paragraph id="H1CEB1731C30C40F8A94C2D3342FA06F7"><enum>(7)</enum><text>To determine whether the covered algorithm needs modification.</text></paragraph><paragraph id="HF3A706A5C62A47E4B0E0DD738B61937F"><enum>(8)</enum><text>To determine whether any other action is appropriate to ensure that the covered algorithm remains safe and effective.</text></paragraph><paragraph id="HADA43FCA8FB546AAA85DBF1C3598CADB"><enum>(9)</enum><text>To undertake any other assessment or responsive action the Commission deems pertinent to prevent the covered algorithm from causing harm or having a disparate impact in the equal enjoyment of goods, services, or other activities or opportunities, as prescribed by rules promulgated by the Commission pursuant to section 553 of title 5, United States Code.</text></paragraph></subsection><subsection id="H48F870F1733A4D43927AAF34A269F122"><enum>(d)</enum><header>Joint developer and deployer obligations</header><text>If a person is both the developer and deployer of a covered algorithm, the person may conduct combined pre-deployment evaluations and annual assessments, provided that each combined evaluation or assessment satisfies all requirements for both developers and deployers.</text></subsection><subsection id="HB971C14D18CF479DBD0F7344A8B734AA"><enum>(e)</enum><header>Reporting and retention requirements</header><paragraph id="HDC98CD41B4AC40AE89EB1F03A2A56855"><enum>(1)</enum><header>Reporting</header><text>A developer or deployer that conducts a full pre-deployment evaluation, full impact assessment, or developer annual review of assessments shall—</text><subparagraph id="HF8CD3ED9097E46B3A777E46FEC2178B3"><enum>(A)</enum><text>not later than 30 days after completion, submit the evaluation, assessment, or review to the Commission;</text></subparagraph><subparagraph id="HB476829D25C048B09A362C1BC0E78565"><enum>(B)</enum><text>upon request, make the evaluation, assessment, or review available to Congress; and</text></subparagraph><subparagraph id="H97BF1280ED9142159B58D37CE72FEC00"><enum>(C)</enum><text>not later than 30 days after completion—</text><clause commented="no" display-inline="no-display-inline" id="H285EE54DB1444C1FAAA54C280E6A324B"><enum>(i)</enum><text display-inline="yes-display-inline">publish a summary of the evaluation, assessment, or review on the website of the developer or deployer in a manner that is easily accessible to individuals; and</text></clause><clause commented="no" display-inline="no-display-inline" id="H44C4F3132D194D5184D4F5A8957335F5"><enum>(ii)</enum><text display-inline="yes-display-inline">submit such summary to the Commission.</text></clause></subparagraph></paragraph><paragraph id="HAC14248966F04C42B32B002C20F421D9"><enum>(2)</enum><header>Retention</header><text>A developer or deployer shall retain all evaluations, assessments, and reviews described in this section for a period of not fewer than 10 years.</text></paragraph><paragraph id="H5F1AA59D0863438CBF66F18C06E49E93"><enum>(3)</enum><header>Trade secrets and privacy</header><text>A developer or deployer—</text><subparagraph commented="no" display-inline="no-display-inline" id="H7A2E5F21BF9043CA8AD1E01463D0175C"><enum>(A)</enum><text display-inline="yes-display-inline">may redact and segregate any trade secret (as defined in section 1839 of title 18, United States Code) from public disclosure under this subsection; and</text></subparagraph><subparagraph commented="no" display-inline="no-display-inline" id="H164939E63C1245F7B31E81D35B44D5F9"><enum>(B)</enum><text display-inline="yes-display-inline">shall redact and segregate personal data from public disclosure under this subsection.</text></subparagraph></paragraph></subsection><subsection id="H94B79519BB844AE7A21DB2411C057C84"><enum>(f)</enum><header>Rulemaking</header><paragraph id="H4E6010C891674FF8B184A26F7D78F3A5"><enum>(1)</enum><header>Authority</header><text>The Commission may, in accordance with section 553 of title 5, United States Code, promulgate such rules as may be necessary to carry out this section.</text></paragraph><paragraph id="H3FFAE4407DBB4DCC8FE9B9C39C0035FD"><enum>(2)</enum><header>Additional regulations</header><text>Not later than 2 years after the date of enactment of this Act, the Commission shall—</text><subparagraph commented="no" display-inline="no-display-inline" id="HDB1CF55F3D8745119605995465FA86E5"><enum>(A)</enum><text display-inline="yes-display-inline">promulgate rules, pursuant to section 553 of title 5, United States Code, specifying—</text><clause id="HFB8E9ECE8C4E4F56B623243806C907A0"><enum>(i)</enum><text>what information and factors a developer or deployer shall consider in making the preliminary evaluation or preliminary impact assessment described in subsections (a)(1) and (b)(1), respectively;</text></clause><clause commented="no" display-inline="no-display-inline" id="H93ECA2E6E22C4AC98A705A4A80C8B123"><enum>(ii)</enum><text display-inline="yes-display-inline">what information a developer or deployer shall include in a summary of an evaluation, assessment, or developer review described in subsection (e)(1)(C); and</text></clause><clause commented="no" display-inline="no-display-inline" id="H6CF9CCD638DA46AB8C51D5A67D9B9D31"><enum>(iii)</enum><text>the extent to and process by which a developer may request additional information from a deployer, including the purposes for which a developer is permitted to use such additional information; and</text></clause></subparagraph><subparagraph commented="no" display-inline="no-display-inline" id="HDD181F2908DB47EA9B8011492AD573B3"><enum>(B)</enum><text display-inline="yes-display-inline">in promulgating such rules, consider the need to protect the privacy of personal data, as well as the need for information sharing by developers and deployers to comply with this section and inform the public.</text></subparagraph></paragraph></subsection></section><enum>II</enum><header>Covered algorithm and contract standards</header><section id="H5D124EBB53E1480FB1E2BB045AEB3D53"><enum>201.</enum><header>Covered algorithm standards</header><subsection id="H1815ECBB985641DF8021BF881AA5A74A"><enum>(a)</enum><header>Covered algorithm use</header><text>A developer or deployer shall do the following:</text><paragraph commented="no" display-inline="no-display-inline" id="H66530BD8191049FD974F3748B6ADEC7B"><enum>(1)</enum><text>Take reasonable measures to prevent and mitigate any harm identified by a pre-deployment evaluation described in section 102(a) or an impact assessment described in section 102(b).</text></paragraph><paragraph commented="no" display-inline="no-display-inline" id="HDA02331C8F3548C8A4CC248612F379A8"><enum>(2)</enum><text>Take reasonable measures to ensure that an independent auditor has all necessary information to complete an accurate and effective pre-deployment evaluation described in section 102(a) or an impact assessment described in section 102(b).</text></paragraph><paragraph commented="no" display-inline="no-display-inline" id="HF2E8072296C74425B6331FC42FFC8E3D"><enum>(3)</enum><text>With respect to a covered algorithm, consult stakeholders, including any communities that will be impacted by the covered algorithm, regarding the development or deployment of the covered algorithm prior to the deploying, licensing, or offering the covered algorithm.</text></paragraph><paragraph commented="no" display-inline="no-display-inline" id="H58B58A8C585043E79930277D71652F34"><enum>(4)</enum><text>With respect to a covered algorithm, certify that, based on the results of a pre-deployment evaluation described in section 102(a) or an impact assessment described in section 102(b)—</text><subparagraph id="H64D753A4B8444E4B963DCB92479A31ED"><enum>(A)</enum><text>use of the covered algorithm is not likely to result in harm or disparate impact in the equal enjoyment of goods, services, or other activities or opportunities;</text></subparagraph><subparagraph id="H96A3275A356E435983075ADAFFD68653"><enum>(B)</enum><text>the benefits from the use of the covered algorithm to individuals affected by the covered algorithm likely outweigh the harms from the use of the covered algorithm to such individuals; and</text></subparagraph><subparagraph id="HCACD3793085042CBAC8180F8544DBE61"><enum>(C)</enum><text>use of the covered algorithm is not likely to result in a deceptive act or practice.</text></subparagraph></paragraph><paragraph id="HB68ABFC390B544F4AB53A4311AD9C39C"><enum>(5)</enum><text>Ensure that any covered algorithm of the developer or deployer functions—</text><subparagraph id="H7979672363A24257B812E9F7D485D193"><enum>(A)</enum><text>at a level that would be considered reasonable performance by an individual with ordinary skill in the art; and</text></subparagraph><subparagraph id="H616E59A1FEAC4D0AB414EDD34399DF77"><enum>(B)</enum><text>in a manner that is consistent with its expected and publicly-advertised performance, purpose, or use.</text></subparagraph></paragraph><paragraph id="H1EF176CC3F2F4CE6A2B17BB407C01586"><enum>(6)</enum><text>Ensure any data used in the design, development, deployment, or use of the covered algorithm is relevant and appropriate to the deployment context and the publicly-advertised purpose or use.</text></paragraph><paragraph id="H6593D2064F2145B4A428CA4285A42232"><enum>(7)</enum><text>Ensure use of the covered algorithm as intended is not likely to result in a violation of this Act.</text></paragraph></subsection><subsection id="H493961B6D733457AB0AA805E1DB63250"><enum>(b)</enum><header>Deceptive marketing of a product or service</header><text>It shall be unlawful for a developer or deployer to engage in false, deceptive, or misleading advertising, marketing, or publicizing of a covered algorithm of the developer or deployer.</text></subsection><subsection id="HF34C4CC364A14F658116E589E91C0A66"><enum>(c)</enum><header>Off-Label use</header><paragraph commented="no" display-inline="no-display-inline" id="H67ABD346FA6E446CB513319AA9CD9718"><enum>(1)</enum><header display-inline="yes-display-inline">Developers</header><text>It shall be unlawful for a developer to knowingly offer or license a covered algorithm for any consequential action other than those evaluated in the pre-deployment evaluation described in section 102(a).</text></paragraph><paragraph commented="no" display-inline="no-display-inline" id="H2803235D1A2B48AEA36BE056A83BD946"><enum>(2)</enum><header>Deployers</header><text>It shall be unlawful for a deployer to knowingly use a covered algorithm for any consequential action other than a use evaluated in the pre-deployment evaluation described in section 102(a), unless the deployer agrees to assume the responsibilities of a developer required by this Act.</text></paragraph></subsection></section><section id="HF59DD96D9DAA47DDB58BC11B9B1A7DE2"><enum>202.</enum><header>Relationships between developers and deployers</header><subsection id="H843206B90BAC42099312523ABBD76EF5"><enum>(a)</enum><header>Developer responsibilities</header><text>A developer shall do the following:</text><paragraph id="H01F12E1A2A0F4E2BB47C1C7A4245BE93"><enum>(1)</enum><text>Upon the reasonable request of the deployer, make available to the deployer information necessary to demonstrate the compliance of the deployer with the requirements of this Act, including—</text><subparagraph commented="no" display-inline="no-display-inline" id="HBF9F5B6442A441FD8AA3024F4B535D9E"><enum>(A)</enum><text display-inline="yes-display-inline">making available a report of the pre-deployment evaluation described in section 102(a) or the annual review of assessments conducted by the developer under section 102(c); and</text></subparagraph><subparagraph commented="no" display-inline="no-display-inline" id="HD2A47FF645064419AC99522A03B95D49"><enum>(B)</enum><text display-inline="yes-display-inline">providing information necessary to enable the deployer to conduct and document a pre-deployment evaluation under section 102 (a) or an impact assessment under section 102(b).</text></subparagraph></paragraph><paragraph id="H3308A4ABADC242679039861204DCD84F" commented="no"><enum>(2)</enum><text>Either—</text><subparagraph commented="no" display-inline="no-display-inline" id="H1C261AEF3CB94D6F8ECC0111EC1BF4E2"><enum>(A)</enum><text display-inline="yes-display-inline">allow and cooperate with reasonable assessments conducted by the deployer or the deployer’s designated independent auditor; or</text></subparagraph><subparagraph commented="no" display-inline="no-display-inline" id="H5DFE9074554D49D98C715092AF81DA08"><enum>(B)</enum><text display-inline="yes-display-inline">arrange for an independent auditor to conduct an assessment of the developer’s policies and practices in support of the obligations under this Act using an appropriate and accepted control standard or framework and assessment procedure for such assessments, and provide a report of such assessment to the deployer upon request.</text></subparagraph></paragraph></subsection><subsection id="HA9689FE8E0224C7681D7B64E18BB3873"><enum>(b)</enum><header>Contracts between developers and deployers</header><paragraph id="H042ADEEAF72648719B8974BF06021A4D"><enum>(1)</enum><header>Requirements</header><text>A developer may offer or license a covered algorithm to a deployer pursuant to a written contract between the developer and deployer, provided that the contract—</text><subparagraph id="H2E27BEE3408A4F269852D1295CD63519"><enum>(A)</enum><text>clearly sets forth the data processing procedures of the developer with respect to any collection, processing, or transfer of data performed on behalf of the deployer;</text></subparagraph><subparagraph id="H8976B4573489403EAABBD5FF84CE628F"><enum>(B)</enum><text>clearly sets forth—</text><clause id="H8EE865853A524F45A2F92D9F3BF63E4E"><enum>(i)</enum><text>instructions for collecting, processing, transferring, or disposing of data by the developer or deployer in the context of the use of the covered algorithm;</text></clause><clause id="H49DE087684384D82A6391D0C02CAC82F"><enum>(ii)</enum><text>instructions for deploying the covered algorithm as intended;</text></clause><clause id="H383D271F94F246538B4368EDDE44BD04"><enum>(iii)</enum><text>the nature and purpose of any collection, processing, or transferring of data;</text></clause><clause id="HBFB237F9D2354F27AD69BD0E275892FA"><enum>(iv)</enum><text>the type of data subject to such collection, processing, or transferring;</text></clause><clause id="HDF8CDAA4D7584DC08EFD68C7EB032F26"><enum>(v)</enum><text>the duration of such processing of data; and</text></clause><clause id="H9D43B7B56D9A40529C7AE21E222804DA"><enum>(vi)</enum><text>the rights and obligations of both parties, including a method by which the developer shall notify the deployer of material changes to its covered algorithm;</text></clause></subparagraph><subparagraph id="HED3BB8EE287E4E518990C4F7620B580E"><enum>(C)</enum><text>shall not relieve a developer or deployer of any requirement or liability imposed on such developer or deployer under this Act;</text></subparagraph><subparagraph id="H0FD2146906CE4C7998C119E3273ECFD6"><enum>(D)</enum><text>prohibits both the developer and deployer from combining data received from or collected on behalf of the other party with data the developer or deployer received from or collected on behalf of another party; and</text></subparagraph><subparagraph id="HFB4DDD138F584F549A1DF559D4DD20E9"><enum>(E)</enum><text>shall not prohibit a developer or deployer from raising concerns to any relevant enforcement agency with respect to the other party.</text></subparagraph></paragraph><paragraph id="HAEE0B2ECD39A47C1BD9982F553BCBA84"><enum>(2)</enum><header>Retention of contract</header><text>Each developer shall retain for a period of 10 years a copy of each contract entered into with a deployer to which it provides requested products or services.</text></paragraph></subsection><subsection id="H84B5BBEDFAFC4015903D7C75246C699D"><enum>(c)</enum><header>Rule of construction</header><text>For purposes of this section, any requirement for a developer to contract with, assist, and follow the instructions of a deployer shall be read to include a requirement to contract with, assist, and follow the instructions of a government entity if the developer is providing a service to a government entity.</text></subsection></section><section id="HF4829497B1B541A589BAB8D2305FA367"><enum>203.</enum><header>Human alternatives and other protections</header><subsection id="H45C3551E57D4494A8A54663782625B14"><enum>(a)</enum><header>Right to human alternatives</header><paragraph id="H8CAEC1A8BF884A3BA93E6EB4598E2830"><enum>(1)</enum><header>Rulemaking</header><text>Not later than 2 years after the date of enactment of this Act, the Commission shall promulgate regulations in accordance with section 553 of title 5, United States Code, specifying the circumstances and manner in which a deployer shall provide to an individual a means to opt-out of the use of a covered algorithm for a consequential action and to elect to have the consequential action concerning the individual undertaken by a human without the use of a covered algorithm.</text></paragraph><paragraph id="HD07CA99994EB4A4CB8B0F54A7A4191BF"><enum>(2)</enum><header>Considerations</header><text>In promulgating the regulations under paragraph (1), the Commission shall consider the following:</text><subparagraph id="HF200826079DB407FAEE0523FA4BACAA7"><enum>(A)</enum><text>How to ensure that any notice or request from a deployer regarding the right to a human alternative is clear and conspicuous, in plain language, easy to execute, and at no cost to an individual.</text></subparagraph><subparagraph commented="no" display-inline="no-display-inline" id="H83EF28261EA142ED96CE5471DABC31D9"><enum>(B)</enum><text display-inline="yes-display-inline">How to ensure that any such notice to individuals is effective, timely, and useful.</text></subparagraph><subparagraph commented="no" display-inline="no-display-inline" id="H5128EF90EEBF410D858EFF0236F9B115"><enum>(C)</enum><text>The specific types of consequential actions for which a human alternative is appropriate, considering the magnitude of the action and risk of harm.</text></subparagraph><subparagraph id="H2F70C2A9E70244EABD119826C27F0AD7"><enum>(D)</enum><text>The extent to which a human alternative would be beneficial to individuals and the public interest.</text></subparagraph><subparagraph id="HFF853C11CB4042C39ABF3690F7E05B87"><enum>(E)</enum><text>The extent to which a human alternative can prevent or mitigate harm.</text></subparagraph><subparagraph id="H5D699145485D4771BC2F44519B28B3E6"><enum>(F)</enum><text>The risk of harm to individuals beyond the requestor if a human alternative is available or not available.</text></subparagraph><subparagraph id="H0A7DFDF65A8B41C0BC2E5783DF216F89"><enum>(G)</enum><text>The feasibility of providing a human alternative in different circumstances.</text></subparagraph><subparagraph id="HD2244D4AB98A48F48E55B5FC4B9267C6"><enum>(H)</enum><text>Any other considerations the Commission deems appropriate to balance the need to give an individual control over a consequential action related to such individual with the practical feasibility and effectiveness of granting such control.</text></subparagraph></paragraph></subsection><subsection id="H0D13F94B25BF46DE8932D502A415C6EE"><enum>(b)</enum><header>Individual autonomy</header><text>A developer or deployer may not condition, effectively condition, attempt to condition, or attempt to effectively condition the exercise of any individual right under this Act or individual choice through—</text><paragraph id="HC79363D5E04C4DE687BD575210C100FB"><enum>(1)</enum><text>the use of any false, fictitious, fraudulent, or materially misleading statement or representation; or</text></paragraph><paragraph id="H2CE31DCCAB834A938666192FB8FDC4BC"><enum>(2)</enum><text>the design, modification, or manipulation of any user interface with the purpose or substantial effect of obscuring, subverting, or impairing a reasonable individual’s autonomy, decision making, or choice to exercise any such right.</text></paragraph></subsection><subsection id="H7B6A25935E07433A9075E2F3255E12C8"><enum>(c)</enum><header>Right To appeal</header><paragraph id="H4BE159D689BF40AF9A14D7AB3B1A2D37"><enum>(1)</enum><header>Rulemaking</header><text>Not later than 2 years after the date of enactment of this Act, the Commission shall promulgate regulations in accordance with section 553 of title 5, United States Code, specifying the circumstances and manner in which a deployer shall provide to an individual a mechanism to appeal to a human a consequential action resulting from the deployer’s use of a covered algorithm.</text></paragraph><paragraph id="H6881275FE4CC47338C547D1465E16D41"><enum>(2)</enum><header>Considerations</header><text>In promulgating the regulations under paragraph (1), the Commission shall do the following:</text><subparagraph id="HD24A825453914C04B2495007F31EAB39"><enum>(A)</enum><text>Ensure that the appeal mechanism is clear and conspicuous, in plain language, easy-to-execute, and at no cost to individuals.</text></subparagraph><subparagraph id="H6881EB35133D42B6811452E53E8F612A"><enum>(B)</enum><text>Ensure that the appeal mechanism is proportionate to the consequential action.</text></subparagraph><subparagraph id="H340D8A804DF54804AB769DF969A37307"><enum>(C)</enum><text>Ensure that the appeal mechanism is reasonably accessible to individuals with disabilities, timely, usable, effective, and non-discriminatory.</text></subparagraph><subparagraph id="H12A47C4971D3451697D0106EB484F090"><enum>(D)</enum><text>Require, where appropriate, a mechanism for individuals to identify and correct any personal data used by the covered algorithm.</text></subparagraph><subparagraph id="H4FD6176AD56743A6B1E383253521EE6E"><enum>(E)</enum><text>Specify training requirements for human reviewers with respect to a consequential action.</text></subparagraph><subparagraph id="H028D6EC1F9F84911818D8241D93B1D0B"><enum>(F)</enum><text>Consider any other circumstances, procedures, or matters the Commission deems appropriate to balance the need to give an individual a right to appeal a consequential action related to such individual with the practical feasibility and effectiveness of granting such right.</text></subparagraph></paragraph></subsection></section><section id="HFD129A9FDEB04A2591FB75F79FA9F622"><enum>204.</enum><header>Prohibition on retaliation; whistleblower protections</header><subsection commented="no" display-inline="no-display-inline" id="HE35B8FB8375B4A36B0450A16C6BAB1B0"><enum>(a)</enum><header display-inline="yes-display-inline">Prohibition on retaliation</header><paragraph id="H60A77F66481349CDBE9A621C40441B95"><enum>(1)</enum><header>In general</header><text>A developer or deployer may not discriminate or retaliate against an individual (including by denying or threatening to deny the equal enjoyment of goods, services, or other activities or opportunities in relation to a consequential action) because the individual exercised any right, refused to waive any such right, raised a concern about a consequential action under this Act, or assisted in any investigation or proceeding under this Act.</text></paragraph><paragraph id="HF9F2A519336A45D28AE29C61D96B157A"><enum>(2)</enum><header>Rules of construction</header><subparagraph commented="no" display-inline="no-display-inline" id="HE982E04ACFCE43ECAE63AE62C2AF2781"><enum>(A)</enum><header display-inline="yes-display-inline">Differential in service or goods</header><text>Nothing in this Act shall prohibit a developer or deployer from denying service to an individual, charging an individual a different price or rate, or providing a different level or quality of goods or services to an individual if the differential in service is necessary and directly related to the value provided to the developer or deployer by the covered algorithm.</text></subparagraph><subparagraph id="H7E369574AB3B410F9B14B1B4CA7F104B"><enum>(B)</enum><header>Loyalty programs</header><text>Nothing in this Act shall prohibit a developer or deployer from offering loyalty, rewards, premium features, discounts, or club card programs that provide benefits or rewards based on frequency of patronizing, or the amount of money spent at, a business consistent with this Act.</text></subparagraph></paragraph></subsection><subsection id="HECFC4A123187417B851C959167F7C3F6"><enum>(b)</enum><header>Whistleblower protection</header><text display-inline="yes-display-inline">A developer or deployer may not, directly or indirectly, discharge, demote, suspend, threaten, harass, or otherwise discriminate or retaliate against an individual for raising a concern, reporting or attempting to report a violation of this Act, or cooperating in any investigation or proceeding under this Act.</text></subsection></section><enum>III</enum><header>Transparency</header><section commented="no" display-inline="no-display-inline" section-type="subsequent-section" id="H0E1A340EEA284318AAD2D60CC1617192"><enum>301.</enum><header display-inline="yes-display-inline">Notice and disclosure</header><subsection id="HC6172DE2672A428F94165617F2CDD09C"><enum>(a)</enum><header>In general</header><text>Each developer or deployer shall make publicly available, in plain language and in a clear, conspicuous, not misleading, easy-to-read, and readily accessible manner, a disclosure that provides a detailed and accurate representation of the developer or deployer's practices regarding the requirements under this Act.</text></subsection><subsection id="H09A25B16F4EC4E25AA6A61A08509C6C4"><enum>(b)</enum><header>Content of disclosure</header><text>The disclosure required under subsection (a) shall include, at a minimum, the following:</text><paragraph id="H16D8E03614E44F0585A596567A2D68FF"><enum>(1)</enum><text>The identity and the contact information of—</text><subparagraph id="H1FFD8199C76543B59ACCC2AD053EB78E"><enum>(A)</enum><text>the developer or deployer to which the disclosure applies (including the developer or deployer’s point of contact and electronic and physical mail address, as applicable for any inquiry concerning a covered algorithm or individual rights under this Act); and</text></subparagraph><subparagraph id="H6137BF38CBD7414CA7A7944C351634AD"><enum>(B)</enum><text>any other entity within the same corporate structure as the developer or deployer to which personal data is transferred by the developer or deployer.</text></subparagraph></paragraph><paragraph id="H0A418C7353A842CAB55F9729D4CB52AB"><enum>(2)</enum><text>A link to the website containing the developer or deployer’s summaries of pre-deployment evaluations, impact assessments, and annual review of assessments, as applicable.</text></paragraph><paragraph id="H75F5CAF251F347A8AEBB199DD953B520"><enum>(3)</enum><text>The categories of personal data the developer or deployer collects or processes in the development or deployment of a covered algorithm and the processing purpose for each such category.</text></paragraph><paragraph id="HB365E87CEDE543CDAA40E25F2CCD5CA9"><enum>(4)</enum><text>Whether the developer or deployer transfers personal data, and, if so, each third party to which the developer or deployer transfers such data and the purpose for which such data is transferred, except with respect to a transfer to a governmental entity pursuant to a court order or law that prohibits the developer or deployer from disclosing such transfer.</text></paragraph><paragraph id="H471A265AACC5490CA48DB00C55BEC71A"><enum>(5)</enum><text>A prominent description of how an individual can exercise the rights described in this Act.</text></paragraph><paragraph id="H931C580ED16A4444A208E629877CB090"><enum>(6)</enum><text>A general description of the developer or deployer’s practices for compliance with the requirements described in sections 102 and 201.</text></paragraph><paragraph id="H6296EA99988746B999066E3BA9FB83E9"><enum>(7)</enum><text>The following disclosure:</text><quoted-block style="OLC" display-inline="no-display-inline" id="H3D0C656CF69A4BDB8B4AF4FD7B8AC742"><paragraph id="H1B629EB4271943778843AD495DEAFE63"><enum/><text>The audit of this algorithm was conducted to comply with the <short-title>Artificial Intelligence Civil Rights Act of 2025</short-title>, which seeks to avoid the use of any algorithm that has a disparate impact on certain protected classes of individuals. The audit does not guarantee that this algorithm is safe or in compliance with all applicable laws.</text></paragraph><after-quoted-block>.</after-quoted-block></quoted-block></paragraph><paragraph id="HCC97ED63674A40CA88FFD1B1C0F9A3A1"><enum>(8)</enum><text>The effective date of the disclosure.</text></paragraph></subsection><subsection id="H9876A210B8CD4639871E295940AFE3A1"><enum>(c)</enum><header>Languages</header><text>The disclosure required under subsection (a) shall be made available in each covered language in which the developer or deployer operates or provides a good or service.</text></subsection><subsection id="H49238231D14741DB8E9DCB2D753EC146"><enum>(d)</enum><header>Accessibility</header><text>Any disclosure provided under this section shall be made available in a manner that is reasonably accessible to and usable by individuals with disabilities.</text></subsection><subsection id="H46E930D8903546D68CB3AC0E7E966488"><enum>(e)</enum><header>Material changes</header><paragraph id="H815CAF724F8F4920ADE02EADF40B2940"><enum>(1)</enum><header>Notification</header><text>If a developer or deployer makes a material change to the disclosure required under subsection (a), the developer or deployer shall notify each individual affected by such material change prior to implementing the material change.</text></paragraph><paragraph id="HBF21BEC514604FEEBA83EF04A585F3D3"><enum>(2)</enum><header>Requirements</header><text>Each developer or deployer shall take all reasonable measures to provide to each affected individual a direct electronic notification regarding any material change to the disclosure, in each covered language in which the disclosure is made available, and taking into account available technology and the nature of the relationship with such individual.</text></paragraph><paragraph id="H627F9407E3FA479CB17D2DC73A2EF5AC"><enum>(3)</enum><header>Log of material changes</header><subparagraph commented="no" display-inline="no-display-inline" id="HFDA3A405F4074D908965F962BC9B9351"><enum>(A)</enum><header>Retention period</header><text display-inline="yes-display-inline">Beginning after the date of enactment of this Act, each developer or deployer shall retain a copy of each previous version of the disclosure required under subsection (a) for a period of at least 10 years after the last day on which such version was effective and publish each such version on its website.</text></subparagraph><subparagraph commented="no" display-inline="no-display-inline" id="H9339EB8FCB064BAE9E9F6B2388D3B6ED"><enum>(B)</enum><header>Log of material changes</header><text display-inline="yes-display-inline">Each developer or deployer shall make publicly available, in a clear, conspicuous, and readily accessible manner, a log describing the date and nature of each material change to its disclosure during the retention period described in subparagraph (A), and such descriptions shall be sufficient for a reasonable individual to understand the material effect of each material change.</text></subparagraph><subparagraph commented="no" display-inline="no-display-inline" id="HC073EF406C9C42CEA6B593820915B5C6"><enum>(C)</enum><header>Clarification</header><text display-inline="yes-display-inline">The obligations described in this paragraph shall not apply to any previous version of a developer or deployer’s disclosure of practices regarding the collection, processing, and transfer of personal data, or any material change to such disclosure, that precedes the date of enactment of this Act.</text></subparagraph></paragraph></subsection><subsection id="H821E7895C187475E90F7015BAABECBBC"><enum>(f)</enum><header>Short-Form notice</header><paragraph id="H8DBEA833E63C490986112B4E9A6B4960"><enum>(1)</enum><header>In general</header><text>A deployer shall provide a short-form notice regarding a covered algorithm it develops, offers, licenses, or uses in a manner that—</text><subparagraph id="H3B75D2B6E29141A88123038B06FD6D43"><enum>(A)</enum><text>is concise, clear, conspicuous, in plain language, and not misleading;</text></subparagraph><subparagraph id="H7A68299268814D68A1462EEB31AC3942"><enum>(B)</enum><text>is readily accessible to individuals with disabilities;</text></subparagraph><subparagraph commented="no" display-inline="no-display-inline" id="HE5BA2DE91D0546F1AC0C99A67D3E73C3"><enum>(C)</enum><text display-inline="yes-display-inline">is based on what is reasonably anticipated within the context of the relationship between the individual and the deployer;</text></subparagraph><subparagraph id="H318E3FD885AA4F0D9F794D5A8E1B63F3"><enum>(D)</enum><text>includes an overview of each applicable individual right and disclosure in a manner that draws attention to any practice that may be unexpected to a reasonable individual or that involves a consequential action;</text></subparagraph><subparagraph id="HB48C008CCC2748829A71F414DAAA9DFE"><enum>(E)</enum><text>is not more than 500 words in length; and</text></subparagraph><subparagraph commented="no" display-inline="no-display-inline" id="HE7283F55476D4535A293BEEBEA066A3F"><enum>(F)</enum><text>is available to the public at no cost.</text></subparagraph></paragraph><paragraph id="H7ED2DC83D8484B52B9E585455E2FCFD6"><enum>(2)</enum><header>Timing of notice</header><subparagraph commented="no" display-inline="no-display-inline" id="HE8F2D382B8A64C04BCC3734C3B2151D7"><enum>(A)</enum><header>Existing relationship</header><text display-inline="yes-display-inline">If a deployer has a relationship with an individual, the deployer shall provide an electronic version of the short-form notice directly to the individual upon the individual’s first interaction with the covered algorithm.</text></subparagraph><subparagraph commented="no" display-inline="no-display-inline" id="HA5F3F14D106E4199821B9FF6854FD6DE"><enum>(B)</enum><header>No relationship</header><text display-inline="yes-display-inline">If a deployer does not have a relationship with an individual, the deployer shall provide the short-form notice in a clear, conspicuous, accessible, and not misleading manner on their website.</text></subparagraph></paragraph><paragraph id="HCC441BD5BC1749B1827712C87CC0A387"><enum>(3)</enum><header>Rulemaking</header><text>The Commission shall promulgate regulations in accordance with section 553 of title 5, United States Code, specifying the minimum content required to be included in the short-form notice described in paragraph (1), which—</text><subparagraph commented="no" display-inline="no-display-inline" id="HA6AA0F276ABF490DA755BBDF1016A66F"><enum>(A)</enum><text display-inline="yes-display-inline">shall not exceed the content requirements described in subsection (b); and</text></subparagraph><subparagraph commented="no" display-inline="no-display-inline" id="H2824B0B048954BB2934D06BEF11CA222"><enum>(B)</enum><text display-inline="yes-display-inline">shall include a template or model for such short-form notice.</text></subparagraph></paragraph></subsection><subsection commented="no" display-inline="no-display-inline" id="HD2DFD2A260E446BB843F7582737DC1FB"><enum>(g)</enum><header>Reporting mechanism</header><text>Each developer or deployer shall make publicly available, in a clear, conspicuous, and readily accessible manner, a mechanism for an individual impacted by a covered algorithm to report to the developer or deployer potential violations of this Act.</text></subsection></section><section id="HCAACBC85E6F9469AABAAB3F6505DC86A"><enum>302.</enum><header>Study on explanations regarding the use of covered algorithms</header><subsection id="H6FDA1531156A4B4BA19F6D2D8ECB1D25"><enum>(a)</enum><header>Study</header><paragraph id="H6A5F7E3C72FB49D1B15F3C6C9B35A667"><enum>(1)</enum><header>In general</header><text>The Commission shall conduct a study, with notice and public comment, on the feasibility of requiring deployers to provide a clear, conspicuous, easy-to-use, no-cost mechanism that is accessible for individuals with disabilities and allows an individual to receive an explanation as to whether and how a covered algorithm used by the deployer affects or affected an individual.</text></paragraph><paragraph id="HEC168BCF9C5E4C94943A4B607C8DF38C"><enum>(2)</enum><header>Requirements</header><text>The study required under paragraph (1) shall include the following:</text><subparagraph id="H3EC1735B9B6E476FA371FA350FF19CC9"><enum>(A)</enum><text>An overview of the purposes for which an explanation would be provided to an individual and the extent to which an explanation would feasibly serve such purposes.</text></subparagraph><subparagraph commented="no" display-inline="no-display-inline" id="H4AD3940EFDD8401EA15E458B753F2F4E"><enum>(B)</enum><text>How explanations can be provided in a manner that is clear, conspicuous, easy-to-use, no-cost, accessible to individuals with disabilities, effective for individuals with limited English language proficiency, and calibrated to the level of risk based on the covered algorithm.</text></subparagraph><subparagraph id="H641AAD22960F4FF2BB5FA641F3F39EA7"><enum>(C)</enum><text>An assessment of the feasibility of a requirement for deployers to provide a mechanism for individuals who may be affected or were affected by a covered algorithm to request an explanation that—</text><clause id="HF55C87F3215546898D20D70792FA4BDF"><enum>(i)</enum><text>includes information—</text><subclause commented="no" display-inline="no-display-inline" id="H754BFB35AD00493FA246A220CBE4B85A"><enum>(I)</enum><text display-inline="yes-display-inline">regarding why the covered algorithm produced the result it produced with respect to the individual making the request; and</text></subclause><subclause id="HCC64B7E3AECA468183B90C383736119C"><enum>(II)</enum><text>that is truthful, accurate, and scientifically valid;</text></subclause></clause><clause id="HD31D71D43B5E4A5EA20FA3E55D32BAF1"><enum>(ii)</enum><text>identifies at least the most significant factors used to inform the covered algorithm’s outputs; and</text></clause><clause id="H7F3E019D041D4F3F84897B20579086AB"><enum>(iii)</enum><text>includes any other information deemed relevant by the Commission to provide an explanation for an individual who may be affected or was affected by a covered algorithm.</text></clause></subparagraph><subparagraph id="H4086A94A12AA4F398E3BE69DBFF6D3E9"><enum>(D)</enum><text>An assessment of what information a developer must provide a deployer in order to ensure explanations can be provided to individuals upon request.</text></subparagraph><subparagraph id="H0669563B48AD49D0905719A4AD1B84C3"><enum>(E)</enum><text>The extent to which current technical capabilities of covered algorithms impacts the feasibility of providing explanations.</text></subparagraph><subparagraph id="H8433D3B6453145F889FD5D794D3279E9"><enum>(F)</enum><text>How a deployer can take reasonable measures to verify the identity of an individual making a request for an explanation to ensure that the deployer provides an explanation only to the affected individual, including steps a deployer should take to ensure the safe and secure storage, collection, and deletion of personal information.</text></subparagraph><subparagraph id="H34B1BD1C981942A8BB524DB4724EF89D"><enum>(G)</enum><text>Recommendations for Congress on how to implement regulations around mechanisms for explanations.</text></subparagraph></paragraph><paragraph id="H61C39FF7717F4682BB26DA0E9FB92AF1"><enum>(3)</enum><header>Consultation</header><text>In conducting the study required under this subsection, the Commission shall consult with the National Institute of Science of Technology, the National Telecommunications and Information Administration, the Office of Science and Technology Policy, and any other agency deemed relevant by the Commission.</text></paragraph></subsection><subsection id="H8F064BE73C52495C98697F1D2D9E90BF"><enum>(b)</enum><header>Report</header><text>Not later than 18 months after the date of enactment of this Act, the Commission shall submit to the Committee on Commerce, Science, and Transportation of the Senate and the Committee on Energy and Commerce of the House of Representatives a report that includes the findings of the study conducted under subsection (a), together with recommendations for such legislation and administrative action as the Commission determines appropriate.</text></subsection></section><section id="HD3612C38EFA04E50993D958FB9FCF9FE"><enum>303.</enum><header>Consumer awareness</header><subsection id="HEA307661502A47F49E4F3F9736440858"><enum>(a)</enum><header>Notice of consumer rights</header><paragraph id="H8A6D8E8FF0C24CC4ADB8CA7D8CD50B96"><enum>(1)</enum><header>In general</header><text>Not later than 90 days after the date of enactment of this Act, the Commission shall publish, on the internet website of the Commission, a web page that describes each provision, right, obligation, and requirement of this Act (categorized with respect to individuals, deployers, and developers) and the remedies, exemptions, and protections associated with this Act, in plain and concise language, in each covered language, and in an easy-to-understand, accessible manner.</text></paragraph><paragraph id="H53DC89515080417292189EEA43B7645C"><enum>(2)</enum><header>Updates</header><text>The Commission shall update the information published under paragraph (1) as necessitated by any change in law, regulation, guidance, or judicial decision. Any such update shall be published in plain and concise language, in each covered language, and in an easy-to-understand, accessible manner.</text></paragraph></subsection><subsection id="HB4F61ABC86BB4C45A198B7362F917AB1"><enum>(b)</enum><header>Annual report</header><text>Not later than 2 years after the date of enactment of this Act, and annually thereafter, the Commission shall publish on the internet website of the Commission a report that—</text><paragraph commented="no" display-inline="no-display-inline" id="H2D8F5D3619264A7086B5DFF4BD783C3F"><enum>(1)</enum><text display-inline="yes-display-inline">describes and summarizes the information contained in any pre-deployment evaluation, impact assessment, and developer review submitted to the Commission in accordance with this Act;</text></paragraph><paragraph commented="no" display-inline="no-display-inline" id="HC1ACBF28B0AE49768E33920F192153C5"><enum>(2)</enum><text display-inline="yes-display-inline">describes broad trends, aggregated statistics, and anonymized information about performing impact assessments of covered algorithms, for the purposes of updating guidance related to impact assessments and summary reporting, oversight, and making recommendations to other regulatory agencies; and</text></paragraph><paragraph commented="no" display-inline="no-display-inline" id="H54A86A25BA3741EFBD1B80749A7D42C2"><enum>(3)</enum><text display-inline="yes-display-inline">is accessible and machine readable in accordance with the 21st Century Integrated Digital Experience Act (<external-xref legal-doc="usc" parsable-cite="usc/44/3501">44 U.S.C. 3501</external-xref> note).</text></paragraph></subsection><subsection id="HF1C4866F6A68444DADB12B3207B7EC88"><enum>(c)</enum><header>Publicly accessible repository</header><paragraph id="HC310A350A3A346A8ABAB3B76B380FE9E"><enum>(1)</enum><header>Establishment</header><subparagraph commented="no" display-inline="no-display-inline" id="HFD9BA509D4294E9A91D9E6DE73479404"><enum>(A)</enum><header display-inline="yes-display-inline">In general</header><text>Not later than 180 days after the Commission publishes the first annual report under subsection (b), the Commission shall develop a publicly accessible repository to publish each pre-deployment evaluation, impact assessment, and developer review submitted to the Commission in accordance with section 102.</text></subparagraph><subparagraph id="H966812DE7248451897B6BD02BA13B4AA"><enum>(B)</enum><header>Requirements</header><text>The Commission shall design the repository established under subparagraph (A) to—</text><clause id="HAD0C6C590C5D4DD89313CDA6FDF58547"><enum>(i)</enum><text>be publicly available and easily discoverable on the internet website of the Commission;</text></clause><clause id="HCDF8E37D1D4B43B3AFFD67B5D6E82DB5"><enum>(ii)</enum><text>allow users to sort and search the repository by multiple characteristics (such as by developer or deployer and date reported) simultaneously;</text></clause><clause id="HFA83F93277BC417ABBEB6BE64FAE5D29"><enum>(iii)</enum><text>allow users to make a copy of or download the information obtained from the repository, including any subsets of information obtained by sorting or searching as described in clause (ii), in accordance with current guidance from the Office of Management and Budget, such as the Open, Public, Electronic, and Necessary Government Data Act (<external-xref legal-doc="usc" parsable-cite="usc/44/101">44 U.S.C. 101</external-xref> note);</text></clause><clause id="H23AB25484D4C4C7BA1197646BF1925F8"><enum>(iv)</enum><text>be in accordance with user experience and accessibility best practices, such as those described in the 21st Century Integrated Digital Experience Act (<external-xref legal-doc="usc" parsable-cite="usc/44/3501">44 U.S.C. 3501</external-xref> note); and</text></clause><clause id="HB75BBF72FE17414D9B83B1AFBD793E1C" commented="no" display-inline="no-display-inline"><enum>(v)</enum><text>include information about the design, use, and maintenance of the repository, including any other information determined appropriate by the Commission.</text></clause></subparagraph></paragraph><paragraph id="HF8718E5D4F304F1BA9BD111508F333D0"><enum>(2)</enum><header>Publication of additional summaries</header><text>The Commission shall publish in the repository any pre-deployment evaluation, impact assessment, and developer review not later than 30 days after receiving such evaluation, assessment, or review, except if the Commission has good cause to delay such publication.</text></paragraph><paragraph id="H919F426A46774011B2AC8E982EBB8335" commented="no"><enum>(3)</enum><header>Trade secrets and privacy</header><text>The Commission—</text><subparagraph commented="no" display-inline="no-display-inline" id="HF5ADAD31DF7D407BA5391E0AA3166105"><enum>(A)</enum><text display-inline="yes-display-inline">may redact and segregate any trade secret (as defined in section 1839 of title 18, United States Code) from public disclosure under this subsection;</text></subparagraph><subparagraph id="HAE9D7F2A9F5044B3B3760EC35055C608" commented="no" display-inline="no-display-inline"><enum>(B)</enum><text display-inline="yes-display-inline">shall redact and segregate personal data from public disclosure under this subsection; and</text></subparagraph><subparagraph commented="no" display-inline="no-display-inline" id="HB084A21B4628455FA328B8994FEBACD0"><enum>(C)</enum><text>may withhold information as permitted under section 552 of title 5, United States Code.</text></subparagraph></paragraph></subsection></section><enum>IV</enum><header>Enforcement</header><section id="H7A75EC68A7D84572B6D12BED49C36AF9"><enum>401.</enum><header>Enforcement by the Commission</header><subsection id="HF2C93B3C8261456AA16496137D3CA81C"><enum>(a)</enum><header>Unfair or deceptive acts or practices</header><text>A violation of title I, II, or III or a regulation promulgated thereunder shall be treated as a violation of a rule defining an unfair or deceptive act or practice under section 18(a)(1)(B) of the Federal Trade Commission Act (<external-xref legal-doc="usc" parsable-cite="usc/15/57a">15 U.S.C. 57a(a)(1)(B)</external-xref>).</text></subsection><subsection id="H56C7D7259D074BBDBF41A2D4EC2CDB37"><enum>(b)</enum><header>Powers of the Commission</header><paragraph id="HF616002D15174A98B6AD9E9BA77FE339"><enum>(1)</enum><header>In general</header><text>Except as provided in subsection (c), the Commission shall enforce this Act and the regulations promulgated under this Act in the same manner, by the same means, and with the same jurisdiction, powers, and duties as though all applicable terms and provisions of the Federal Trade Commission Act (<external-xref legal-doc="usc" parsable-cite="usc/15/41">15 U.S.C. 41 et seq.</external-xref>) were incorporated into and made a part of this Act.</text></paragraph><paragraph id="H85DE19CD6E164F0797EEAECAFC67D39E"><enum>(2)</enum><header>Privileges and immunities</header><text>Any person who violates title I, II, or III or a regulation promulgated thereunder shall be subject to the penalties and entitled to the privileges and immunities provided in the Federal Trade Commission Act (<external-xref legal-doc="usc" parsable-cite="usc/15/41">15 U.S.C. 41 et seq.</external-xref>).</text></paragraph><paragraph id="H9E7331BF66A6469C809B4BBCDC2DF40B" commented="no"><enum>(3)</enum><header>Authority preserved</header><text>Nothing in this Act shall be construed to limit the authority of the Commission under any other provision of law.</text></paragraph><paragraph id="HFF618AEEEE3B4CBEBC788E0C56848F6D" commented="no"><enum>(4)</enum><header>Rulemaking</header><text>The Commission may promulgate in accordance with section 553 of title 5, United States Code, such rules as may be necessary to carry out this Act.</text></paragraph></subsection><subsection id="H185C18C5CBBB4BEDAF34A389F92C9681" commented="no"><enum>(c)</enum><header>Jurisdiction</header><text>Notwithstanding section 4, 5(a)(2), or 6 of the Federal Trade Commission Act (<external-xref legal-doc="usc" parsable-cite="usc/15/44">15 U.S.C. 44</external-xref>, 45(a)(2), 46) or any jurisdictional limitation of the Commission, the Commission shall also enforce this Act and the regulations promulgated under this Act, in the same manner provided in subsections (a) and (b), with respect to—</text><paragraph id="H376FBC4AEDAB4A08B4571BD0BE77F786" commented="no"><enum>(1)</enum><text>organizations not organized to carry on business for their own profit or that of their members;</text></paragraph><paragraph id="HD999F99F897F4D42BD4383CE0E98608C" commented="no"><enum>(2)</enum><text>common carriers subject to the Communications Act of 1934 (<external-xref legal-doc="usc" parsable-cite="usc/47/151">47 U.S.C. 151 et seq.</external-xref>) and all Acts amendatory thereof and supplementary thereto;</text></paragraph><paragraph id="HBF9B5A54B88D470BB96344912D96812B" commented="no"><enum>(3)</enum><text>a bank, savings and loan institution described in section 18(f)(3) of the Federal Trade Commission Act (<external-xref legal-doc="usc" parsable-cite="usc/15/57a">15 U.S.C. 57a(f)(3)</external-xref>), or Federal credit union described in section 18(f)(4) of such Act;</text></paragraph><paragraph id="H27E972A0DEC740BC8D7222CF875D642D" commented="no"><enum>(4)</enum><text>an air carrier or foreign air carrier subject to the Federal Aviation Act of 1958 (49 U.S.C. App. 1301 et seq.); or</text></paragraph><paragraph id="H6392C9A6A19D4DC9BE91066E0F816927" commented="no"><enum>(5)</enum><text>a person, partnership, or corporation subject to the Packers and Stockyards Act, 1921 (<external-xref legal-doc="usc" parsable-cite="usc/7/181">7 U.S.C. 181 et seq.</external-xref>), as amended.</text></paragraph></subsection></section><section id="H121B20BE79684B49BC2B656D768158AE"><enum>402.</enum><header>Enforcement by States</header><subsection id="H285C103830414549AFF65B124CD2B7CF"><enum>(a)</enum><header>In general</header><text>In any case in which the attorney general of a State or a State data protection authority has reason to believe that an interest of the residents of the State has been or is threatened or adversely affected by the engagement of a person in a practice that violates title I, II, or III, or a regulation promulgated thereunder, the attorney general may, as parens patriae, bring a civil action on behalf of the residents of the State in an appropriate Federal district court of the United States that meets applicable requirements relating to venue under section 1391 of title 28, United States Code, to—</text><paragraph id="HED61DE259465439D8984201BB43DF383"><enum>(1)</enum><text>enjoin any such violation by the person;</text></paragraph><paragraph id="H300F8ED4A5A94899BABE53A869B67DEA"><enum>(2)</enum><text>enforce compliance with the requirements of this Act;</text></paragraph><paragraph id="H6ECA96C63BDE4D05BDE3A1BBB4F86655"><enum>(3)</enum><text>obtain a permanent, temporary, or preliminary injunction or other appropriate equitable relief;</text></paragraph><paragraph id="H5AC66B62DAB947B0AB68DC1FE1D7B8D4"><enum>(4)</enum><text>obtain civil penalties in the amount of $15,000 per violation, or 4 percent of the defendant’s average gross annual revenue over the preceding 3 years, whichever is greater;</text></paragraph><paragraph id="HE40760AFADFB4DAAAF86CD8911D0D438"><enum>(5)</enum><text>obtain damages, restitution, or other compensation on behalf of the residents of such State;</text></paragraph><paragraph commented="no" display-inline="no-display-inline" id="H28AFACAEC04D415EAE1C0BB9A59B6DF4"><enum>(6)</enum><text display-inline="yes-display-inline">obtain reasonable attorneys' fees and litigation costs; and</text></paragraph><paragraph commented="no" display-inline="no-display-inline" id="H8E7F29D9DEB44F22A0BFF929FA85F507"><enum>(7)</enum><text>obtain such other relief as the court may consider to be appropriate.</text></paragraph></subsection><subsection id="HDB3852F635C44027B8D933D8E5D59C40"><enum>(b)</enum><header>Rights of the Commission</header><paragraph id="HB75D2B6C251548DC82F308E5FD4975B6"><enum>(1)</enum><header>Notice to the Commission</header><subparagraph id="H262B17E26CF242C889E34950EB2D3C36"><enum>(A)</enum><header>In general</header><text>Subject to subparagraph (C), the attorney general of a State shall notify the Commission in writing that the attorney general intends to bring a civil action under subsection (a) before the filing of the civil action.</text></subparagraph><subparagraph id="H9CCE8FC7103049DB84F3371BFED9D4A4"><enum>(B)</enum><header>Contents</header><text>The notification required under subparagraph (A) with respect to a civil action shall include a copy of the complaint to be filed to initiate the civil action.</text></subparagraph><subparagraph id="H76976B3D1751406BB7A350F97427C304"><enum>(C)</enum><header>Exception</header><text>The notification described in subparagraph (A) shall not be required if the attorney general of the State determines that it is not feasible to provide such notice before filing the action.</text></subparagraph></paragraph><paragraph id="HF989F4B31C3F4CC4B7993ED24586032B"><enum>(2)</enum><header>Intervention by the Commission</header><text>Not later than 180 days after receiving notice under paragraph (1), the Commission shall have the right to intervene in the action that is the subject of the notice.</text></paragraph><paragraph id="HAAAC018AE58A426A98580D8433588FED"><enum>(3)</enum><header>Effect of intervention</header><text>If the Commission intervenes in an action under subsection (a), it shall have the right—</text><subparagraph id="HF70D86BF52DC47F6BEE40BA84D4672FA"><enum>(A)</enum><text>to be heard with respect to any matter that arises in that action; and</text></subparagraph><subparagraph id="H158E888285914994962B9EF73F1DF01C"><enum>(B)</enum><text>file a petition for appeal.</text></subparagraph></paragraph></subsection><subsection id="H9A01914CB8EE48D9B164FCE34DA83E38"><enum>(c)</enum><header>Investigatory powers</header><text>Nothing in this section may be construed to prevent the attorney general of a State from exercising the powers conferred on the attorney general by the laws of the State to—</text><paragraph id="H7197737DF0744709A6086EFD64AB6659"><enum>(1)</enum><text>conduct investigations;</text></paragraph><paragraph id="H2173ABF2E27B4E848623F39E22F19D4B"><enum>(2)</enum><text>administer oaths or affirmations; or</text></paragraph><paragraph id="HA27EF4F54ED04A7793E5FE5E85A4FC47"><enum>(3)</enum><text>compel the attendance of witnesses or the production of documentary or other evidence.</text></paragraph></subsection><subsection id="HB8853D4264134927AFF3938B6236EB3B"><enum>(d)</enum><header>Coordination with relevant agencies</header><paragraph id="H286EB071882D4B87B13A7DAD9A373D48"><enum>(1)</enum><header>Consultation</header><text>The Commission may consult with any relevant Federal agencies as necessary to carry out this Act.</text></paragraph><paragraph id="H4FA54BCA27194FF58C6C94CA66E69162"><enum>(2)</enum><header>Memorandum of understanding</header><text>Not later than 180 days after the date of enactment of this Act, the Commission, in coordination with any relevant Federal agencies, shall establish, through a memorandum of understanding—</text><subparagraph id="HBAE146EA613E4184980FF0645FD566BF"><enum>(A)</enum><text>procedures for coordinating investigations and enforcement actions;</text></subparagraph><subparagraph id="HF9937235F2B74EFA955D1F39C7C864C9"><enum>(B)</enum><text>protocols for information sharing and technical assistance;</text></subparagraph><subparagraph id="H69372B6BD7844C958934EE5D58B83D8D"><enum>(C)</enum><text>standards for determining the division of enforcement authority between the Commission and such Federal agencies; and</text></subparagraph><subparagraph id="H1EE1AF256ED34F6AA3629A2412BC35D4"><enum>(D)</enum><text>processes for referral of complaints between agencies.</text></subparagraph></paragraph></subsection></section><section id="HE145C4BE89144E22868B5DE809A6D8E9"><enum>403.</enum><header>Private right of action</header><subsection id="H6C4AB948A42843DB98994351EA30B09A"><enum>(a)</enum><header>Enforcement by individuals</header><paragraph id="HBAFE7CC93A314A82A51A4924592967A9"><enum>(1)</enum><header>In general</header><text>Any individual or class of individuals alleging a violation of title I, II, or III, or a regulation promulgated thereunder, may bring a civil action in any court of competent jurisdiction.</text></paragraph><paragraph id="HFC49866996394BE3857D5384A0A8FB90"><enum>(2)</enum><header>Relief</header><text>In a civil action brought under paragraph (1) in which the plaintiff prevails, the court may award—</text><subparagraph id="H943AD2362E9B417BAC4840B7381DE246"><enum>(A)</enum><text>treble damages or $15,000 per violation, whichever is greater;</text></subparagraph><subparagraph id="HE8B00DAA89AE4EADB5ED59FD7F3C600E"><enum>(B)</enum><text>nominal damages;</text></subparagraph><subparagraph id="H2243F256C76C41D19B3B704A236354A1"><enum>(C)</enum><text>punitive damages;</text></subparagraph><subparagraph id="H02CCBDA3BC684B0AACD5C207B664E72C"><enum>(D)</enum><text>reasonable attorney’s fees and litigation costs; and</text></subparagraph><subparagraph id="HE649CE33CEDC459EA072BB2E7D667A8F"><enum>(E)</enum><text>any other relief, including equitable or declaratory relief, that the court determines appropriate.</text></subparagraph></paragraph><paragraph id="H9722D3C34D8E40FD885FFC06519B9108"><enum>(3)</enum><header>Rights of the Commission and State attorneys general</header><subparagraph id="H2EE1B2BA20DC4CF3AAF64DE134600371"><enum>(A)</enum><header>In general</header><text>Prior to an individual bringing a civil action under paragraph (1), such individual shall notify the Commission and the attorney general of the State where such individual resides, in writing and including a description of the allegations included in the civil action, that such individual intends to bring a civil action under such paragraph. Not later than 60 days after receiving such notice, the Commission and State attorney general shall each or jointly make a determination and respond to such individual as to whether they will intervene in such action. The Commission and State attorney general shall have a right to intervene in any civil action under paragraph (1), and upon intervening, to be heard on all matters arising in such action and file petitions for appeal of a decision in such action. If a State attorney general does intervene, they shall only be heard with respect to the interests of the residents of their State.</text></subparagraph><subparagraph id="H2BBAEE33EAD14B53A5E729ED0ED79682"><enum>(B)</enum><header>Retained authority</header><text>Subparagraph (A) shall not be construed to limit the authority of the Commission or any applicable State attorney general to, at a later date, commence a civil action or intervene by motion if the Commission or State attorney general does not commence a proceeding or civil action within the 60-day period described in such subparagraph.</text></subparagraph></paragraph></subsection><subsection id="H38F723581C04437693CA9A60414ECE99"><enum>(b)</enum><header>Invalidity of pre-Dispute arbitration agreements and pre-Dispute joint action waivers</header><paragraph id="H01313615275C4537B0D1DB85FEFD4FCE"><enum>(1)</enum><header>In general</header><text>Notwithstanding any other provision of law, no pre-dispute arbitration agreement or pre-dispute joint action waiver shall be valid or enforceable with regard to a dispute arising under this Act.</text></paragraph><paragraph id="HEDEA40B2939D436594F02F85C24A00C6" commented="no"><enum>(2)</enum><header>Applicability</header><text>Any determination as to whether or how this subsection applies to any dispute shall be made by a court, rather than an arbitrator, without regard to whether such agreement purports to delegate such determination to an arbitrator.</text></paragraph><paragraph id="H9F175CF76CE04B0F9377B6387B37A9D8"><enum>(3)</enum><header>Definitions</header><text>For purposes of this subsection:</text><subparagraph id="HF10759E9485D403DAD38CF725EAB7166"><enum>(A)</enum><header>Pre-dispute arbitration agreement</header><text>The term <term>pre-dispute arbitration agreement</term> means any agreement to arbitrate a dispute that has not arisen at the time of the making of the agreement.</text></subparagraph><subparagraph id="H658802D82BC14AFFBD365D9232E3492A"><enum>(B)</enum><header>Pre-dispute joint-action waiver</header><text>The term <term>pre-dispute joint-action waiver</term> means an agreement, whether or not part of a pre-dispute arbitration agreement, that would prohibit or waive the right of 1 of the parties to the agreement to participate in a joint, class, or collective action in a judicial, arbitral, administrative, or other related forum, concerning a dispute that has not yet arisen at the time of the making of the agreement.</text></subparagraph></paragraph></subsection></section><section id="H1C0922E9969F4E4F919013E94E6328A9"><enum>404.</enum><header>Severability</header><text display-inline="no-display-inline">If any provision of this Act, or the application thereof to any person or circumstance, is held invalid, the remainder of this Act, and the application of such provision to other persons not similarly situated or to other circumstances, shall not be affected by the invalidation.</text></section><section commented="no" display-inline="no-display-inline" section-type="subsequent-section" id="H00AFD41F10D0453495EA3812076E010B"><enum>405.</enum><header>Rules of construction</header><subsection commented="no" display-inline="no-display-inline" id="H0C3CEF5B5B494EB6AA1B705ED3CBFE1C"><enum>(a)</enum><header display-inline="yes-display-inline">In general</header><text display-inline="yes-display-inline">Nothing in this Act shall be construed to—</text><paragraph commented="no" display-inline="no-display-inline" id="HF4694406B8A948FEA2EF6B8EDC3C9D0A"><enum>(1)</enum><text>waive or otherwise limit any requirement under the National Labor Relations Act (<external-xref legal-doc="usc" parsable-cite="usc/29/151">29 U.S.C. 151 et seq.</external-xref>) for an employer (as such term is defined in section 2 of such Act (<external-xref legal-doc="usc" parsable-cite="usc/29/152">29 U.S.C. 152</external-xref>)) to bargain collectively regarding the deployment or effects of a covered algorithm;</text></paragraph><paragraph commented="no" display-inline="no-display-inline" id="HA3E098BD22CF48E4A2527E1B0B909BCC"><enum>(2)</enum><text>absolve an employer of any obligation to ensure a covered algorithm and its effects comply with health and safety laws;</text></paragraph><paragraph id="H3CCB604F712F4C1AA81F9E56BECF354C"><enum>(3)</enum><text>allow an employer to deploy a covered algorithm that interferes with the rights of employees under any Federal, State, or local law; or</text></paragraph><paragraph commented="no" display-inline="no-display-inline" id="HC7454CDD718F4D89AE4938B4FAC483CD"><enum>(4)</enum><text>absolve any other duty or requirement under any other Federal, State, or local law.</text></paragraph></subsection><subsection id="H8B6BF748AE3F44099746548EE6E3897A"><enum>(b)</enum><header>Otherwise applicable requirements and authority</header><text>No regulation or standard imposed under this Act may be construed in a manner that would lessen the stringency of the requirements of any applicable Federal or State agency that are otherwise applicable. This Act does not divest any such agency of any authority derived from any other applicable law.</text></subsection></section><enum>V</enum><header>Federal resources</header><section id="HD1B2C43B855B4BEBA865CC62731DFD5C"><enum>501.</enum><header>Occupational series relating to algorithm auditing</header><text display-inline="no-display-inline">Not later than 270 days after the date of enactment of this Act, the Director of the Office of Personnel Management shall exercise the authority of the Director under section 5105 of title 5, United States Code, to establish a new occupational series and associated policies covering Federal Government positions in the field of algorithm auditing (as described in the report of the Government Accountability Office entitled <quote>Artificial Intelligence: An Accountability Framework for Federal Agencies and Other Entities</quote> (GAO–21–519SP), dated June 30, 2021), which shall include algorithm auditing practices, platform auditing, evaluation and assessment of artificial intelligence systems, computer security, independent evaluation and audits of computer systems, data science, statistics, auditing of anticompetitive practices, and related fields.</text></section><section id="H4A58216D008F4366AFCBF40AD61AF300"><enum>502.</enum><header>Additional Federal resources</header><subsection id="H1BA1B25D3D2A4E0CAD931B2267342FA7"><enum>(a)</enum><header>Authorization of appropriations</header><text>There is authorized to be appropriated to the Commission and other Federal agencies enumerated in this Act such sums as may be necessary to carry out this Act.</text></subsection><subsection id="H4CE366F130C54E7CB1F1CA85DCCCBAF8"><enum>(b)</enum><header>Commission personnel</header><text>Notwithstanding any other provision of law, the Commission may hire not more than 500 additional personnel to accomplish the work of the Commission with respect to unfair or deceptive acts or practices relating to the development or deployment of covered algorithms in accordance with this Act.</text></subsection></section>