[Congressional Record Volume 169, Number 125 (Thursday, July 20, 2023)]
[Senate]
[Pages S3495-S3496]
From the Congressional Record Online through the Government Publishing Office [www.gpo.gov]

  SA 1011. Mr. MORAN submitted an amendment intended to be proposed by 
him to the bill S. 2226, to authorize appropriations for fiscal year 
2024 for military activities of the Department of Defense, for military 
construction, and for defense activities of the Department of Energy, 
to prescribe military personnel strengths for such fiscal year, and for 
other purposes; which was ordered to lie on the table; as follows:

       At the appropriate place, insert the following:

     SEC. ___. AGENCY USE OF ARTIFICIAL INTELLIGENCE.

       (a) Definitions.--In this section:
       (1) Administrator.--The term ``Administrator'' means the 
     Administrator of Federal Procurement Policy.
       (2) Agency.--The term ``agency'' means any department, 
     independent establishment, Government corporation, or other 
     agency of the executive branch of the Federal Government.
       (3) Artificial intelligence.--The term ``artificial 
     intelligence'' has the meaning given the term in section 5002 
     of the National Artificial Intelligence Initiative Act of 
     2020 (15 U.S.C. 9401).
       (4) Director.--The term ``Director'' means the Director of 
     the National Institute of Standards and Technology.
       (5) Framework.--The term ``framework'' means document 
     number NIST AI 100-1 of the National Institute of Standards 
     and Technology entitled ``Artificial Intelligence Risk 
     Management Framework'', or any successor document.
       (6) Playbook.--The term ``playbook'' means the AI RMF 
     Playbook developed by the National Institute of Standards and 
     Technology.
       (7) Profile.--The term ``profile'' means an implementation 
     of the artificial intelligence risk management functions, 
     categories, and subcategories for a specific setting or 
     application based on the requirements, risk tolerance, and 
     resources of the framework user.
       (b) Requirements for Agency Use of Artificial 
     Intelligence.--
       (1) OMB guidance.--Not later than 180 days after the date 
     on which the Director of the National Institute of Standards 
     and Technology issues guidelines under paragraph (2), the 
     Director of the Office of Management and Budget shall issue 
     guidance requiring agencies to incorporate the framework into 
     their artificial intelligence risk management efforts, 
     consistent with such guidelines.
       (2) NIST guidelines.--Not later than 180 days after the 
     date of enactment of this Act, the Director of the National 
     Institute of Standards and Technology shall, in consultation 
     with the Administrator, issue guidelines for each agency to 
     incorporate the framework into the artificial intelligence 
     risk management efforts of the agency, which shall--
       (A) provide standards consistent with the framework and 
     tailored to risks that could endanger human life, health, 
     property, or the environment for agency implementation in the 
     development, procurement, and use of artificial intelligence;
       (B) specify appropriate cybersecurity strategies and the 
     installation of effective cybersecurity tools;
       (C) provide standards--

[[Page S3496]]

       (i) that are consistent with the framework and Circular A-
     119 of the Office of Management and Budget;
       (ii) that are tailored to risks that could endanger human 
     life, health, property, or the environment; and
       (iii) which a supplier of artificial intelligence for the 
     agency must attest to meet before the head of an agency may 
     procure artificial intelligence from that supplier;
       (D) recommend training on the framework and the guidelines 
     for each agency responsible for procuring artificial 
     intelligence;
       (E) develop profiles for agency use of artificial 
     intelligence consistent with the framework; and
       (F) develop profiles for framework use for an entity that 
     is a small business concern (as defined in section 3 of the 
     Small Business Act (15 U.S.C. 632)).
       (3) Additional requirements.--
       (A) Draft contract language.--The Administrator shall, in 
     consultation with the Director, provide draft contract 
     language for each agency to use in procurement that requires 
     a supplier of artificial intelligence to adhere to certain 
     actions that are consistent with the framework.
       (B) Templates.--The Director of the Office of Management 
     and Budget shall, in consultation with the Director, provide 
     a template for agency use on the guidance issued under 
     paragraph (1) that includes recommended procedures for 
     implementation.
       (4) Conforming requirement.--The head of each agency shall 
     conform any policy, principle, practice, procedure, or 
     guideline governing the design, development, implementation, 
     deployment, use, or evaluation of an artificial intelligence 
     system by the agency to the guidance issued under paragraph 
     (1).
       (5) Supporting material.--In carrying out paragraph (4), 
     the head of each agency may use the supporting materials of 
     the framework, including the playbook.
       (6) Study.--Not later than 1 year after the date of 
     enactment of this Act, the Comptroller General of the United 
     States shall conduct a study on the impact of the application 
     of the framework on agency use of artificial intelligence.
       (7) Reporting requirement.--Not later than 1 year after the 
     date of the enactment of this Act, and not less frequently 
     than once every 3 years thereafter, the Director of the 
     Office of Management and Budget shall submit to Congress a 
     report on agency implementation of and conformity to the 
     framework.
       (c) REQUIREMENTS FOR AGENCY PROCUREMENT OF ARTIFICIAL 
     INTELLIGENCE.--Not later than 180 days after the issuance of 
     guidance pursuant to subsection (b)(1), the Federal 
     Acquisition Regulatory Council shall promulgate regulations 
     that provide for--
       (1) the requirements for the acquisition of artificial 
     intelligence products, services, tools, and systems, to 
     include risk-based compliance with the framework; and
       (2) solicitation provisions and contract clauses that 
     include references to the requirements described in paragraph 
     (1) and the framework for use in artificial intelligence 
     acquisitions.
                                 ______