Elements of foundation model transparency

(a)

Establishment of requirements

Not later than 1 year after the date of the enactment of this Act, the Commission, in consultation with the Director of the National Institute of Standards and Technology, the Secretary of Commerce, the Director of the Office of Science and Technology Policy, and other relevant stakeholders (including standards bodies, covered entities, academia, technology experts, and advocates for civil rights and consumers), shall do the following: (1)In accordance with section 553 of title 5, United States Code, promulgate regulations that: (A)Establish requirements for covered entities with regard to foundation models to improve transparency of training data, documentation, testing, data collection during inference, and operations of foundation models, before commercial deployment and during the lifecycle of the system. (B)Include requirements for a covered entity— (i)to submit specified information related to each foundation model provided by the entity to the Commission; and (ii)to make publicly available certain information related to each foundation model provided by the entity. (C)Specify the form and manner in which the information described in subparagraph (B)(ii) is made publicly available, including the following: (i)Information that is required to be made available on the website of a covered entity that relates to any foundation model provided by the entity. (ii)Information that is required to be displayed in a central location on a website hosted by the Commission, including, with respect to a foundation model, information that is substantially similar to the information required under clause (i). (iii)Information submitted to the Commission that is not required to be publicly displayed, including sensitive or personally identifiable data or information, or information that would compromise the cybersecurity of the foundation model. (iv)A requirement for a human-readable and consumer-friendly format to be used with respect to the information described in clause (i). (v)A requirement for a machine-readable format to be used with respect to the information described under clause (ii). (vi)The URL for the central location described in clause (ii). (D)Provide an option for a covered entity to be deemed in compliance with some or all of this Act if the covered entity publishes the information determined to be necessary by the Commission pursuant to subsection (a)(1)(A) as part of a larger document, including a system card or model card. (E)Specify a process for a covered entity to submit the information required under subparagraph (B)(i) to the Commission. (2)Issue guidance to assist covered entities to comply with the standards established under paragraph (1). (b)

Information To include

The Commission shall include in the regulations promulgated pursuant to subsection (a)(1)(A), with respect to a foundation model, the following information: (1) A sufficiently detailed summary of the sources of training data, how training data is collected, and whether and how data is collected and retained during inference. (2) A broad description of the size and composition of such training data, including types of demographic information, language information, and other attribute information, while accounting for privacy. (3) A description of data governance procedures. (4) A description of the intended purposes and foreseen limitations or risks of the foundation model, an overview of past edits to such model, the version and date of release of such model, the knowledge cutoff date of the training data of such model, and information on adverse incident monitoring and response procedures. (5) A list of or information about languages supported by the model. (6) A description of the efforts of the covered entity to align the foundation model and the transparency of such model with— (A) the AI Risk Management Framework (or any successor framework) of the National Institute of Standards and Technology; (B) a similar Federal Government-approved consensus technical standard; or (C) the model specification of any covered entity, including intended model behavior or outcomes and guardrails for the model. (7) Performance under evaluation, either self-driven or through audit, on public or industry standard benchmarks, including what precautions the foundation model takes to answer or respond to situations with higher levels of risk of providing inaccurate or harmful information, including, if such model responds to such questions, relating to the following: (A) Medical, health, or healthcare questions. (B) Biological, chemical, radiological, or nuclear weapons. (C) National security. (D) Cybersecurity. (E) Threats to critical infrastructure. (F) Elections. (G) Law enforcement. (H) Financial loan or housing decisions. (I) Education. (J) Employment or hiring decisions. (K) Public services. (L) Information relating to vulnerable populations, including minors and seniors. (8) Information on the computational power used to train and operate a foundation model. (c)

Exemptions for specific types of foundation models

A fully open-source model is exempt from the regulations promulgated by the Commission pursuant to subsection (a). (d)

Consideration of alternative provisions for downstream foundation models

In promulgating the regulations and issuing the guidance required by subsection (a), the Commission shall require that a covered entity foundation model that is derived from or built upon another covered entity foundation model, including through the use of an application programming interface— (1)shall publicly provide a URL to the transparency disclosure website of the base foundation model if the base model is in compliance with the regulations promulgated in subsection (a); and (2)shall comply with regulations promulgated in subsection (a) related to any significant change, retraining, or adaptation from such base foundation model. (e)

Alternative provisions for certain covered entities

The Commission shall establish a plan to assist small businesses and new businesses that are covered entities with compliance with the regulations promulgated pursuant to subsection (a) and to reduce the burdens imposed by such regulations, including by: (1)Publishing guidance for compliance, including sample guidance and a machine-readable template, to be jointly developed by the Commission and the Director of the National Institute for Standards and Technology, for such covered entities to use that will facilitate compliance with such regulations. (2)Providing one three-month grace period beginning on the date on which a small business or new business becomes a covered entity during which such covered entity is not subject to penalties under this Act or any regulation promulgated pursuant to this Act. (3)Providing a qualified, technically proficient representative to meet on multiple occasions during such grace period with such covered entity to provide guidance to assist the covered entity with compliance with the regulations promulgated pursuant to subsection (a). (f)

Foundation model resources page required

Not later than 1 year after the date of the enactment of this Act, the Commission shall establish a web page on the website of the Commission that includes recommendations on foundation model transparency for foundation model developers or downstream deployers of a foundation model that are not covered entities, including recommended resources such as the AI Risk Management Framework of the National Institute of Standards and Technology. (g)

Permitted redactions

(1)

In general

If a covered entity publishes documents or submits information to the Commission to comply with this Act, the covered entity may make redactions to those documents that are necessary— (A)to protect the cybersecurity and security of the covered entity or model, public safety, or the national security of the United States; or (B)to comply with any Federal law. (2)

Identification of redactions

Any redaction shall be briefly identified and justified in the publication or submission. (h)

Applicability of regulations

The regulations required by subsection (a)(1) shall apply beginning on the date that is 90 days after the date on which the Commission promulgates such regulations. (i)

Updates

Not later than 1 year after the date on which the Commission promulgates the regulations required by subsection (a)(1), and annually thereafter, the Commission, in consultation with the Director of the National Institute of Standards and Technology and the Secretary of Commerce, shall assess the requirements established by the regulations and update the regulations to incorporate any necessary update to such requirements. (j)

Enforcement by Federal Trade Commission

(1)

Unfair or deceptive acts or practices

A violation of a regulation promulgated under subsection (a)(1) shall be treated as a violation of a regulation under section 18(a)(1)(B) of the Federal Trade Commission Act (15 U.S.C. 57a(a)(1)(B)) regarding unfair or deceptive acts or practices. (2)

Powers of Commission

Except as provided in subsection (l)(3)(C)— (A)the Commission shall enforce the regulations promulgated under subsection (a)(1) in the same manner, by the same means, and with the same jurisdiction, powers, and duties as though all applicable terms and provisions of the Federal Trade Commission Act (15 U.S.C. 41 et seq.) were incorporated into and made a part of this section; (B)any covered entity that violates a regulation promulgated under subsection (a)(1) shall be subject to the penalties and entitled to the privileges and immunities provided in the Federal Trade Commission Act; and (C)the Commission shall provide covered entities with notice that they are covered entities not less than fourteen days before taking any enforcement action. (k)

Report

Not later than 1 year after the date of the enactment of this Act, the Commission shall submit to the Committee on Energy and Commerce and the Committee on Science, Space, and Technology of the House of Representatives and the Committee on Commerce, Science, and Transportation of the Senate a report on the establishment, implementation, and enforcement of the regulations issued pursuant to subsection (a)(1). (l)

Definitions

In this section: (1)

Artificial intelligence

The term artificial intelligence has the meaning given that term in section 5002 of the National Artificial Intelligence Initiative Act of 2020 (15 U.S.C. 9401; Public Law 116–283). (2)

Commission

The term Commission means the Federal Trade Commission. (3)

Covered entity

(A)

In general

The term covered entity means any person, partnership, or corporation described in subparagraph (C) that provides use of or services from a foundation model which does any of the following: (i)Exhibits, or could be easily modified to exhibit, high levels of performance at tasks that could pose a significant risk to security, national economic security, consumer protection, civil rights, national public health or safety, or any combination of those matters. (ii)Has, in aggregate, over 10,000,000 monthly users, including users of second party entities that use such model. (iii)Has in aggregate, over 10,000,000 monthly foundation model download instances if the model is typically downloaded once for use by a user. (iv)Was trained using a quantity of computing power greater than 1026 integer or floating point operations, including computing used by the entity for the original training run and for any subsequent fine-tuning, reinforcement learning, or other material modifications the entity applies. (B)

Updating of thresholds

The Commission, in consultation with the Director of the National Institute of Standards and Technology, the Secretary of Commerce, and the Director of the Office of Science and Technology Policy, may, by regulation promulgated in accordance with section 553 of title 5, United States Code, update the number of monthly output instances for purposes of subparagraph (A)(i), the number of monthly users for purposes of subparagraph (A)(ii), the number of monthly foundation model download instances for purposes of subparagraph (A)(iii), or the quantity of computing power for purposes of subparagraph (A)(iv) as the Commission considers appropriate. (C)

Persons, partnerships, and corporations described

The persons, partnerships, and corporations described in this subparagraph are— (i)any person, partnership, or corporation over which the Commission has jurisdiction under section 5(a)(2) of the Federal Trade Commission Act (15 U.S.C. 45(a)(2)); and (ii)notwithstanding section 4, 5(a)(2), or 6 of the Federal Trade Commission Act (15 U.S.C. 44; 45(a)(2); 46) or any jurisdictional limitation of the Commission— (I)any common carrier subject to the Communications Act of 1934 (47 U.S.C. 151 et seq.) and all Acts amendatory thereof and supplementary thereto; and (II)any organization not organized to carry on business for its own profit or that of its members. (4)

Critical infrastructure

The term critical infrastructure has the meaning given that term in subsection (e) of the Critical Infrastructures Protection Act of 2001 (42 U.S.C. 5195c(e)). (5)

Foundation model

(A)

In general

The term foundation model means an artificial intelligence model that meets the following requirements: (i)Is trained on broad data. (ii)Generally uses self-supervision. (iii)Generally contains at least 1,000,000,000 parameters. (iv)Is designed for generality of output. (v)Is generally applicable across a wide range of contexts, adaptable to a wide range of tasks, or can issue a wide range of outputs in response to inferences. (B)

Effect of technical safeguards

The term foundation model includes an artificial intelligence model otherwise described in subparagraph (A) even if such model is provided to users with technical safeguards that attempt to prevent users from taking advantage of any relevant capabilities that may be unsafe for consumer use. (6)

Inference

The term inference means, with respect to a foundation model, when such foundation model is operated by a user to produce a result. (7)

Minor

The term minor means any individual under the age of 18 years. (8)

New business

The term new business means a startup or other new business that has been in operation for less than 1 year. (9)

Senior

The term senior means an individual who is 65 years of age or older. (10)

Small business

The term small business has the meaning given the term small business concern in section 3(a) of the Small Business Act (15 U.S.C. 632(a)). (11)

Training data

The term training data means, with respect to a foundation model, the data on which such foundation model was trained.