Regulon — US-HR-6356 · US HR 6356 (AI Civil Rights Act)

WHAT THIS BILL REGULATES · 8 REQUIREMENT TYPES

How Is This Bill Enforced

Enforcement Authority

Federal Trade Commission enforcement as unfair or deceptive acts or practices under the FTC Act. State attorneys general and State data protection authorities may bring parens patriae actions in federal court. Private right of action available to any individual or class of individuals alleging a violation. Individual must notify the FTC and state attorney general 60 days before filing suit.

Private Right of Action

may bring parens patriae actions in federal court.

Penalties

Private plaintiffs may recover treble damages or $15,000 per violation (whichever is greater), nominal damages, punitive damages, reasonable attorney's fees and litigation costs, and equitable or declaratory relief. State AG actions may obtain civil penalties of $15,000 per violation or 4% of defendant's average gross annual revenue over the preceding 3 years (whichever is greater), plus damages, restitution, injunctive relief, and attorney's fees. FTC enforcement under FTC Act penalty provisions. Pre-dispute arbitration agreements and joint action waivers are invalid and unenforceable.

Verbatim statutory text on the left; plain-language analysis and a per-section checklist on the right. Numbered markers cross-link to the matching checklist row.

Statutory Text

Analysis & Obligations

Sec. 101

Discrimination

DeployerDeveloper

(a) 1 A developer or deployer shall not offer, license, promote, sell, or use a covered algorithm in a manner that— (1) causes or contributes to a disparate impact in a manner that prevents; (2) otherwise discriminates in a manner that prevents; or (3) otherwise makes unavailable, the equal enjoyment of goods, services, or other activities or opportunities, related to a consequential action, on the basis of a protected characteristic.

(b) 1 This section shall not apply to— (1) the offer, licensing, or use of a covered algorithm for the sole purpose of— (A) a developer's or deployer's self-testing (or auditing by an independent auditor at a developer's or deployer's request) to identify, prevent, or mitigate discrimination, or otherwise to ensure compliance with obligations, under Federal law; (B) expanding an applicant, participant, or customer pool to raise the likelihood of increasing diversity or redressing historic discrimination; or (C) conducting— (i) good faith security research; or (ii) other research, if conducting the research is not part or all of a commercial act; or (2) any private club or other establishment not in fact open to the public, as described in section 201(e) of the Civil Rights Act of 1964 (42 U.S.C. 2000a(e)).

Section 101 establishes the bill's core anti-discrimination prohibition. Developers and deployers may not offer, license, promote, sell, or use a covered algorithm in a manner that causes or contributes to disparate impact, otherwise discriminates, or makes unavailable the equal enjoyment of goods, services, or opportunities related to a consequential action on the basis of a protected characteristic. The prohibition covers both intentional discrimination and disparate impact under a burden-shifting framework borrowed from employment discrimination law.

Exceptions are carved out for self-testing to identify or mitigate discrimination, diversity-expanding uses, good faith security research, non-commercial research, and private clubs under the Civil Rights Act of 1964.

Compliance actions 1 item

Developers and deployers must not offer, license, promote, sell, or use a covered algorithm in a manner that causes or contributes to disparate impact, otherwise discriminates, or makes unavailable the equal enjoyment of goods, services, or opportunities related to a consequential action on the basis of a protected characteristic. Exceptions apply for self-testing to mitigate discrimination, diversity expansion, good-faith security research, non-commercial research, and private clubs.

H-02.11

Sec. 102

Pre-deployment evaluations and post-deployment impact assessments

DeployerDeveloper

(a)(1) 2 PRELIMINARY EVALUATION.— (A) PLAUSIBILITY OF HARM.— (i) DEVELOPERS.—The developer shall conduct a preliminary evaluation of the plausibility that any expected use of the covered algorithm may result in a harm. (ii) DEPLOYERS.—The deployer shall conduct a preliminary evaluation of the plausibility that any intended use of the covered algorithm may result in a harm. (B) RESULTS.—Based on the results of the preliminary evaluation, the developer or deployer shall— (i) in the event that a harm is not plausible, record a finding of no plausible harm, including a description of the developer's expected use or the deployer's intended use of the covered algorithm, how the preliminary evaluation was conducted, and an explanation for the finding, and submit such record to the Commission; and (ii) in the event that a harm is plausible, conduct a full pre-deployment evaluation as described in paragraph (2). (C) PREVIOUSLY-DEPLOYED COVERED ALGORITHMS.—When conducting a preliminary evaluation of a material change to, or new use of, a previously-deployed covered algorithm, the developer or deployer may limit the scope of the evaluation to whether use of the covered algorithm may result in a harm as a result of the material change or new use.

(a)(2) 3 FULL PRE-DEPLOYMENT EVALUATION.— (A) FOR DEVELOPERS.— (i) INDEPENDENT AUDITOR EVALUATION.—If a developer determines a harm is plausible during the preliminary evaluation described in paragraph (1), the developer shall engage an independent auditor to conduct a pre-deployment evaluation. (ii) PRE-DEPLOYMENT EVALUATION REQUIREMENTS.—The evaluation required under clause (i) shall include a detailed review and description, sufficient for an individual having ordinary skill in the art to understand the functioning, risks, uses, benefits, limitations, and other pertinent attributes of the covered algorithm, including— (I) the covered algorithm's design and methodology, including the inputs the covered algorithm is designed to use to produce an output and the outputs the covered algorithm is designed to produce; (II) how the covered algorithm was created, trained, and tested, including— (aa) any metric used to test the performance of the covered algorithm; (bb) defined benchmarks and goals that correspond to such metrics, including whether there was sufficient representation of demographic groups that are reasonably likely to use or be affected by the covered algorithm in the data used to create or train the algorithm, and whether there was reasonable testing, if any, across such demographic groups; (cc) the outputs the covered algorithm actually produces in testing; (dd) a description of any consultation with relevant stakeholders, including any communities that will be impacted by the covered algorithm, regarding the development of the covered algorithm, or a disclosure that no such consultation occurred; (ee) a description of which protected characteristics, if any, were used for testing and evaluation, and how and why such characteristics were used, including— (AA) whether the testing occurred in comparable contextual conditions to the conditions in which the covered algorithm is expected to be used; and (BB) if protected characteristics were not available to conduct such testing, a description of alternative methods the developer used to conduct the required assessment; (ff) any other computational algorithm incorporated into the development of the covered algorithm, regardless of whether such precursor computational algorithm involves a consequential action; (gg) a description of the data and information used to develop, test, maintain, or update the covered algorithm, including— (AA) each type of personal data used, each source from which the personal data was collected, and how each type of personal data was inferred and processed; (BB) the legal authorization for collecting and processing the personal data; and (CC) an explanation of how the data (including personal data) used is representative, proportional, and appropriate to the development and intended uses of the covered algorithm; and (hh) a description of the training process for the covered algorithm which includes the training, validation, and test data utilized to confirm the intended outputs; (III) the potential for the covered algorithm to produce a harm or to have a disparate impact in the equal enjoyment of goods, services, or other activities or opportunities, and a description of such potential harm or disparate impact; (IV) alternative practices and recommendations to prevent or mitigate harm and recommendations for how the developer could monitor for harm after offering, licensing, or deploying the covered algorithm; and (V) any other information the Commission deems pertinent to prevent the covered algorithm from causing harm or having a disparate impact in the equal enjoyment of goods, services, or other activities or opportunities, as prescribed by rules promulgated by the Commission pursuant to section 553 of title 5, United States Code. (iii) REPORT.—The independent auditor shall submit to the developer a report on the evaluation conducted under this subparagraph, including the findings and recommendations of such independent auditor. (B) FOR DEPLOYERS.— (i) INDEPENDENT AUDITOR EVALUATION.—If a deployer determines a harm is plausible during the preliminary evaluation described in paragraph (1), the deployer shall engage an independent auditor to conduct a pre-deployment evaluation. (ii) PRE-DEPLOYMENT EVALUATION REQUIREMENTS.—[similar detailed requirements for deployer context] (iii) REPORT.—The independent auditor shall submit to the deployer a report on the evaluation conducted under this subparagraph, including the findings and recommendations of such independent auditor.

(b) 4 DEPLOYER ANNUAL IMPACT ASSESSMENT.—After the deployment of a covered algorithm, a deployer shall, on an annual basis, conduct an impact assessment in accordance with the following: (1) PRELIMINARY IMPACT ASSESSMENT.—The deployer shall conduct a preliminary impact assessment of the covered algorithm to identify any harm that resulted from the covered algorithm during the reporting period and— (A) if no resulting harm is identified by such assessment, shall record a finding of no harm, including a description of the developer's expected use or the deployer's intended use of the covered algorithm, how the preliminary evaluation was conducted, and an explanation for such finding, and submit such finding to the Commission; and (B) if a resulting harm is identified by such assessment, shall conduct a full impact assessment as described in paragraph (2). (2) FULL IMPACT ASSESSMENT.—In the event that the covered algorithm resulted in harm during the reporting period, the deployer shall engage an independent auditor to conduct a full impact assessment with respect to the reporting period, including— (A) an assessment of the harm that resulted or was reasonably likely to have been produced during the reporting period; (B) a description of the extent to which the covered algorithm produced a disparate impact in the equal enjoyment of goods, services, or other activities or opportunities, including the methodology for such evaluation, of how the covered algorithm produced or likely produced such disparity; (C) a description of the types of data input into the covered algorithm during the reporting period to produce an output; (D) whether and to what extent the covered algorithm produced the outputs it was expected to produce; (E) a detailed description of how the covered algorithm was used to make a consequential action; (F) any action taken to prevent or mitigate harms; and (G) any other information the Commission deems pertinent. (3) REPORTS.— (A) TO THE DEPLOYER.—The independent auditor shall submit to the deployer a report on the impact assessment conducted under paragraph (2). (B) TO THE DEVELOPER.—Not later than 30 days after the submission of a report on an impact assessment under subparagraph (A), a deployer shall submit to the developer of the covered algorithm a summary of such report, subject to the trade secret and privacy protections described in subsection (e)(3).

(c) 5 DEVELOPER ANNUAL REVIEW OF ASSESSMENTS.—A developer shall, on an annual basis, review each impact assessment summary submitted by a deployer of its covered algorithm under subsection (b)(3)(B) for the following purposes: (1) To assess how the deployer is using the covered algorithm. (2) To assess the type of data the deployer is inputting into the covered algorithm. (3) To assess whether the deployer is complying with any relevant contractual agreement with the developer and whether any remedial action is necessary. (4) To compare the covered algorithm's performance in real-world conditions versus pre-deployment testing. (5) To assess whether the covered algorithm is causing harm or is reasonably likely to be causing harm. (6) To assess whether the covered algorithm is causing, or is reasonably likely to be causing, a disparate impact. (7) To determine whether the covered algorithm needs modification. (8) To determine whether any other action is appropriate to ensure that the covered algorithm remains safe and effective. (9) To undertake any other assessment or responsive action the Commission deems pertinent.

(e) 6 REPORTING AND RETENTION REQUIREMENTS.— (1) REPORTING.—A developer or deployer that conducts a full pre-deployment evaluation, full impact assessment, or developer annual review of assessments shall— (A) not later than 30 days after completion, submit the evaluation, assessment, or review to the Commission; (B) upon request, make the evaluation, assessment, or review available to Congress; and (C) not later than 30 days after completion— (i) publish a summary of the evaluation, assessment, or review on the website of the developer or deployer in a manner that is easily accessible to individuals; and (ii) submit such summary to the Commission. (2) RETENTION.—A developer or deployer shall retain all evaluations, assessments, and reviews described in this section for a period of not fewer than 10 years. (3) TRADE SECRETS AND PRIVACY.—A developer or deployer— (A) may redact and segregate any trade secret from public disclosure under this subsection; and (B) shall redact and segregate personal data from public disclosure under this subsection.

Section 102 establishes a two-phase assessment framework. Before deploying, licensing, or offering a covered algorithm for a consequential action, both developers and deployers must conduct a preliminary evaluation of the plausibility that use could result in harm. If harm is not plausible, a finding of no plausible harm is recorded and submitted to the FTC. If harm is plausible, a full pre-deployment evaluation must be conducted by an independent auditor.

The full evaluation for developers requires detailed review of the algorithm's design, methodology, training data, testing across demographic groups, potential for harm or disparate impact, and mitigation recommendations. For deployers, the evaluation focuses on the deployment context — intended use, necessity and proportionality, data inputs, stakeholder consultation, and context-specific harm potential. After deployment, deployers must conduct annual impact assessments that identify any harm during the reporting period and, if harm is found, engage an independent auditor for a full assessment. Developers must annually review deployer impact assessment summaries.

All full evaluations, assessments, and reviews must be submitted to the FTC within 30 days, made available to Congress on request, and published in summary on the entity's website. Records must be retained for at least 10 years. Trade secrets may be redacted; personal data must be redacted from public disclosures.

Compliance actions 5 items

Developers and deployers must conduct a preliminary evaluation of the plausibility that any expected or intended use of a covered algorithm for a consequential action may result in harm before deploying, licensing, or offering it. If harm is not plausible, a finding must be recorded and submitted to the FTC. If harm is plausible, a full pre-deployment evaluation must be conducted.

H-02.3

Developers and deployers must, when harm is plausible, engage an independent auditor to conduct a full pre-deployment evaluation covering the algorithm's design, methodology, training data, testing across demographic groups, potential for disparate impact, and mitigation recommendations, and receive a written report from the auditor.

H-02.2

Deployers must conduct annual post-deployment impact assessments to identify any harm caused by the covered algorithm during the reporting period. If harm is identified, the deployer must engage an independent auditor to conduct a full impact assessment and share a summary with the developer within 30 days.

H-02.8

Developers must annually review each deployer impact assessment summary to assess deployer usage, data inputs, contractual compliance, real-world performance versus testing, whether harm or disparate impact is occurring, and whether the algorithm needs modification.

H-02.8

Developers and deployers must submit full pre-deployment evaluations, impact assessments, and annual reviews to the FTC within 30 days of completion, make them available to Congress on request, publish summaries on their websites, and retain all records for at least 10 years. Trade secrets may be redacted; personal data must be redacted from public disclosures.

R-02.1

Sec. 201

Covered algorithm standards

DeployerDeveloper

(a)(1)–(7) 7 COVERED ALGORITHM USE.—A developer or deployer shall do the following: (1) Take reasonable measures to prevent and mitigate any harm identified by a pre-deployment evaluation described in section 102(a) or an impact assessment described in section 102(b). (2) Take reasonable measures to ensure that an independent auditor has all necessary information to complete an accurate and effective pre-deployment evaluation described in section 102(a) or an impact assessment described in section 102(b). (3) With respect to a covered algorithm, consult stakeholders, including any communities that will be impacted by the covered algorithm, regarding the development or deployment of the covered algorithm prior to the deploying, licensing, or offering the covered algorithm. (4) With respect to a covered algorithm, certify that, based on the results of a pre-deployment evaluation described in section 102(a) or an impact assessment described in section 102(b)— (A) use of the covered algorithm is not likely to result in harm or disparate impact in the equal enjoyment of goods, services, or other activities or opportunities; (B) the benefits from the use of the covered algorithm to individuals affected by the covered algorithm likely outweigh the harms from the use of the covered algorithm to such individuals; and (C) use of the covered algorithm is not likely to result in a deceptive act or practice. (5) Ensure that any covered algorithm of the developer or deployer functions— (A) at a level that would be considered reasonable performance by an individual with ordinary skill in the art; and (B) in a manner that is consistent with its expected and publicly-advertised performance, purpose, or use. (6) Ensure any data used in the design, development, deployment, or use of the covered algorithm is relevant and appropriate to the deployment context and the publicly-advertised purpose or use. (7) Ensure use of the covered algorithm as intended is not likely to result in a violation of this Act.

(b) 8 DECEPTIVE MARKETING OF A PRODUCT OR SERVICE.—It shall be unlawful for a developer or deployer to engage in false, deceptive, or misleading advertising, marketing, or publicizing of a covered algorithm of the developer or deployer.

(c) 9 OFF-LABEL USE.— (1) DEVELOPERS.—It shall be unlawful for a developer to knowingly offer or license a covered algorithm for any consequential action other than those evaluated in the pre-deployment evaluation described in section 102(a). (2) DEPLOYERS.—It shall be unlawful for a deployer to knowingly use a covered algorithm for any consequential action other than a use evaluated in the pre-deployment evaluation described in section 102(a), unless the deployer agrees to assume the responsibilities of a developer required by this Act.

Section 201 imposes affirmative operational standards on developers and deployers. They must take reasonable measures to prevent and mitigate identified harms, ensure independent auditors have all necessary information, consult stakeholders prior to deployment, and certify that the algorithm is not likely to result in harm, that benefits outweigh harms, and that use is not likely to be deceptive. The algorithm must function at a level of reasonable professional performance and consistent with its publicly-advertised purpose. Data used must be relevant and appropriate. Deceptive marketing is prohibited. Off-label use — deploying or licensing a covered algorithm for consequential actions not evaluated in the pre-deployment evaluation — is unlawful.

Compliance actions 3 items

Developers and deployers must (1) take reasonable measures to prevent and mitigate identified harms, (2) ensure auditors have all necessary information, (3) consult affected communities before deployment, (4) certify that the algorithm is not likely to cause harm or disparate impact, that benefits outweigh harms, and that use is not deceptive, (5) ensure the algorithm performs at a reasonable professional level consistent with its advertised purpose, (6) ensure data used is relevant and appropriate, and (7) ensure intended use is not likely to violate the Act.

S-01.5

Developers and deployers must not engage in false, deceptive, or misleading advertising, marketing, or publicizing of a covered algorithm.

CP-01

Developers must not knowingly offer or license a covered algorithm for any consequential action not evaluated in the pre-deployment evaluation. Deployers must not knowingly use a covered algorithm for any unevaluated consequential action unless the deployer assumes developer responsibilities under the Act.

S-01

Sec. 202

Relationships between developers and deployers

DeployerDeveloper

(a)–(b) 10 DEVELOPER RESPONSIBILITIES.—A developer shall do the following: (1) Upon the reasonable request of the deployer, make available to the deployer information necessary to demonstrate the compliance of the deployer with the requirements of this Act, including— (A) making available a report of the pre-deployment evaluation described in section 102(a) or the annual review of assessments conducted by the developer under section 102(c); and (B) providing information necessary to enable the deployer to conduct and document a pre-deployment evaluation under section 102(a) or an impact assessment under section 102(b). (2) Either— (A) allow and cooperate with reasonable assessments conducted by the deployer or the deployer's designated independent auditor; or (B) arrange for an independent auditor to conduct an assessment of the developer's policies and practices in support of the obligations under this Act using an appropriate and accepted control standard or framework and assessment procedure for such assessments, and provide a report of such assessment to the deployer upon request. (b) CONTRACTS BETWEEN DEVELOPERS AND DEPLOYERS.— (1) REQUIREMENTS.—A developer may offer or license a covered algorithm to a deployer pursuant to a written contract between the developer and deployer, provided that the contract— (A) clearly sets forth the data processing procedures of the developer with respect to any collection, processing, or transfer of data performed on behalf of the deployer; (B) clearly sets forth— (i) instructions for collecting, processing, transferring, or disposing of data by the developer or deployer in the context of the use of the covered algorithm; (ii) instructions for deploying the covered algorithm as intended; (iii) the nature and purpose of any collection, processing, or transferring of data; (iv) the type of data subject to such collection, processing, or transferring; (v) the duration of such processing of data; and (vi) the rights and obligations of both parties, including a method by which the developer shall notify the deployer of material changes to its covered algorithm; (C) shall not relieve a developer or deployer of any requirement or liability imposed on such developer or deployer under this Act; (D) prohibits both the developer and deployer from combining data received from or collected on behalf of the other party with data the developer or deployer received from or collected on behalf of another party; and (E) shall not prohibit a developer or deployer from raising concerns to any relevant enforcement agency with respect to the other party. (2) RETENTION OF CONTRACT.—Each developer shall retain for a period of 10 years a copy of each contract entered into with a deployer to which it provides requested products or services.

Section 202 structures the developer-deployer relationship. Developers must make compliance information available to deployers on reasonable request, including pre-deployment evaluation reports and annual reviews. Developers must either allow deployer audits or arrange for an independent auditor assessment of developer practices. Licensing contracts must specify data processing procedures, deployment instructions, data types, processing duration, and party obligations including material change notification. Contracts may not relieve either party of statutory liability, must prohibit data commingling across counterparties, and must preserve each party's right to report concerns to enforcement agencies. Contracts must be retained for 10 years.

Compliance actions 1 item

Developers must make compliance information (including pre-deployment evaluation reports and annual reviews) available to deployers on request, and must cooperate with deployer audits or arrange independent auditor assessments. Developer-deployer contracts must specify data processing procedures, deployment instructions, data types, processing duration, and party obligations; must not relieve either party of liability; must prohibit data commingling; and must preserve enforcement reporting rights. Developers must retain contracts for 10 years.

G-01.3

Sec. 203

Human alternatives and other protections

DeployerDeveloper

(a) 11 RIGHT TO HUMAN ALTERNATIVES.— (1) RULEMAKING.—Not later than 2 years after the date of enactment of this Act, the Commission shall promulgate regulations in accordance with section 553 of title 5, United States Code, specifying the circumstances and manner in which a deployer shall provide to an individual a means to opt-out of the use of a covered algorithm for a consequential action and to elect to have the consequential action concerning the individual undertaken by a human without the use of a covered algorithm.

(b) 12 INDIVIDUAL AUTONOMY.—A developer or deployer may not condition, effectively condition, attempt to condition, or attempt to effectively condition the exercise of any individual right under this Act or individual choice through— (1) the use of any false, fictitious, fraudulent, or materially misleading statement or representation; or (2) the design, modification, or manipulation of any user interface with the purpose or substantial effect of obscuring, subverting, or impairing a reasonable individual's autonomy, decision making, or choice to exercise any such right.

(c) 13 RIGHT TO APPEAL.— (1) RULEMAKING.—Not later than 2 years after the date of enactment of this Act, the Commission shall promulgate regulations in accordance with section 553 of title 5, United States Code, specifying the circumstances and manner in which a deployer shall provide to an individual a mechanism to appeal to a human a consequential action resulting from the deployer's use of a covered algorithm.

Section 203 directs the FTC to promulgate regulations within two years specifying when deployers must offer individuals the right to opt out of covered algorithm use and elect a human alternative for a consequential action, and when deployers must provide a right to appeal automated consequential actions to a human. The FTC must consider clarity, cost, proportionality, feasibility, and the risk of harm. The section also prohibits developers and deployers from using deceptive statements, dark patterns, or manipulative interfaces to condition or impair the exercise of individual rights under the Act.

Compliance actions 3 items

Deployers must, once FTC regulations are promulgated (within 2 years of enactment), provide individuals a means to opt out of covered algorithm use for a consequential action and elect to have the action undertaken by a human without algorithm involvement.

H-01.4

Developers and deployers must not use false or misleading statements, or design, modify, or manipulate user interfaces with the purpose or substantial effect of obscuring, subverting, or impairing an individual's autonomy, decision making, or ability to exercise any right under the Act.

CP-01.3

Deployers must, once FTC regulations are promulgated (within 2 years of enactment), provide individuals a mechanism to appeal to a human any consequential action resulting from the deployer's use of a covered algorithm, including the ability to identify and correct personal data used by the algorithm.

H-01.5

Sec. 204

Prohibition on retaliation; whistleblower protections

DeployerDeveloper

(a)–(b) 14 PROHIBITION ON RETALIATION.— (1) IN GENERAL.—A developer or deployer may not discriminate or retaliate against an individual (including by denying or threatening to deny the equal enjoyment of goods, services, or other activities or opportunities in relation to a consequential action) because the individual exercised any right, refused to waive any such right, raised a concern about a consequential action under this Act, or assisted in any investigation or proceeding under this Act. (2) RULES OF CONSTRUCTION.— (A) DIFFERENTIAL IN SERVICE OR GOODS.—Nothing in this Act shall prohibit a developer or deployer from denying service to an individual, charging an individual a different price or rate, or providing a different level or quality of goods or services to an individual if the differential in service is necessary and directly related to the value provided to the developer or deployer by the covered algorithm. (B) LOYALTY PROGRAMS.—Nothing in this Act shall prohibit a developer or deployer from offering loyalty, rewards, premium features, discounts, or club card programs that provide benefits or rewards based on frequency of patronizing, or the amount of money spent at, a business consistent with this Act. (b) WHISTLEBLOWER PROTECTION.—A developer or deployer may not, directly or indirectly, discharge, demote, suspend, threaten, harass, or otherwise discriminate or retaliate against an individual for raising a concern, reporting or attempting to report a violation of this Act, or cooperating in any investigation or proceeding under this Act.

Section 204 prohibits developers and deployers from discriminating or retaliating against individuals who exercise rights under the Act, refuse to waive rights, raise concerns about consequential actions, or assist in investigations. A separate whistleblower provision protects employees from discharge, demotion, suspension, threats, harassment, or other discrimination for raising concerns, reporting violations, or cooperating in investigations. Narrow carve-outs preserve differential pricing based on value provided by the algorithm and loyalty/rewards programs.

Compliance actions 1 item

Developers and deployers must not retaliate against individuals for exercising rights under the Act, raising concerns, or assisting investigations, and must not discharge, demote, suspend, threaten, harass, or otherwise discriminate against employees or individuals for reporting or attempting to report violations of the Act.

G-03.3

Sec. 301

Notice and disclosure

DeployerDeveloper

(a)–(d) 15 IN GENERAL.—Each developer or deployer shall make publicly available, in plain language and in a clear, conspicuous, not misleading, easy-to-read, and readily accessible manner, a disclosure that provides a detailed and accurate representation of the developer or deployer's practices regarding the requirements under this Act. (b) CONTENT OF DISCLOSURE.—The disclosure required under subsection (a) shall include, at a minimum, the following: (1) The identity and the contact information of— (A) the developer or deployer to which the disclosure applies; and (B) any other entity within the same corporate structure as the developer or deployer to which personal data is transferred by the developer or deployer. (2) A link to the website containing the developer or deployer's summaries of pre-deployment evaluations, impact assessments, and annual review of assessments, as applicable. (3) The categories of personal data the developer or deployer collects or processes in the development or deployment of a covered algorithm and the processing purpose for each such category. (4) Whether the developer or deployer transfers personal data, and, if so, each third party to which the developer or deployer transfers such data and the purpose for which such data is transferred. (5) A prominent description of how an individual can exercise the rights described in this Act. (6) A general description of the developer or deployer's practices for compliance with the requirements described in sections 102 and 201. (7) The following disclosure: "The audit of this algorithm was conducted to comply with the Artificial Intelligence Civil Rights Act of 2025, which seeks to avoid the use of any algorithm that has a disparate impact on certain protected classes of individuals. The audit does not guarantee that this algorithm is safe or in compliance with all applicable laws." (8) The effective date of the disclosure. (c) LANGUAGES.—The disclosure required under subsection (a) shall be made available in each covered language in which the developer or deployer operates or provides a good or service. (d) ACCESSIBILITY.—Any disclosure provided under this section shall be made available in a manner that is reasonably accessible to and usable by individuals with disabilities.

(e)–(f) 16 MATERIAL CHANGES.— (1) NOTIFICATION.—If a developer or deployer makes a material change to the disclosure required under subsection (a), the developer or deployer shall notify each individual affected by such material change prior to implementing the material change. (2) REQUIREMENTS.—Each developer or deployer shall take all reasonable measures to provide to each affected individual a direct electronic notification regarding any material change to the disclosure, in each covered language in which the disclosure is made available, and taking into account available technology and the nature of the relationship with such individual. (3) LOG OF MATERIAL CHANGES.— (A) RETENTION PERIOD.—Beginning after the date of enactment of this Act, each developer or deployer shall retain a copy of each previous version of the disclosure required under subsection (a) for a period of at least 10 years after the last day on which such version was effective and publish each such version on its website. (B) LOG OF MATERIAL CHANGES.—Each developer or deployer shall make publicly available, in a clear, conspicuous, and readily accessible manner, a log describing the date and nature of each material change to its disclosure during the retention period described in subparagraph (A), and such descriptions shall be sufficient for a reasonable individual to understand the material effect of each material change. (f) SHORT-FORM NOTICE.— (1) IN GENERAL.—A deployer shall provide a short-form notice regarding a covered algorithm it develops, offers, licenses, or uses in a manner that— (A) is concise, clear, conspicuous, in plain language, and not misleading; (B) is readily accessible to individuals with disabilities; (C) is based on what is reasonably anticipated within the context of the relationship between the individual and the deployer; (D) includes an overview of each applicable individual right and disclosure in a manner that draws attention to any practice that may be unexpected to a reasonable individual or that involves a consequential action; (E) is not more than 500 words in length; and (F) is available to the public at no cost.

(g) 17 REPORTING MECHANISM.—Each developer or deployer shall make publicly available, in a clear, conspicuous, and readily accessible manner, a mechanism for an individual impacted by a covered algorithm to report to the developer or deployer potential violations of this Act.

Section 301 requires developers and deployers to publish a detailed public disclosure of their practices under the Act, covering identity and contact information, links to evaluation summaries, categories of personal data collected, third-party data transfers, description of individual rights, general compliance practices, a mandated audit disclaimer, and the effective date. Disclosures must be in plain language, in all covered languages (the 10 most spoken in the U.S.), and accessible to individuals with disabilities. Material changes require pre-implementation notice to affected individuals, a log of all changes retained for 10 years, and publication of prior versions. Deployers must additionally provide a short-form notice (max 500 words) at first interaction with the algorithm, and all entities must publish a publicly accessible mechanism for reporting potential violations.

Compliance actions 3 items

Developers and deployers must publicly disclose a detailed, plain-language summary of their practices under the Act, including contact information, links to evaluation summaries, categories of personal data collected and their purposes, third-party data transfers, how individuals can exercise their rights, general compliance practices, a mandated audit disclaimer, and the effective date. The disclosure must be available in each covered language and accessible to individuals with disabilities.

G-02.4

Developers and deployers must notify affected individuals before implementing material changes to disclosures, provide direct electronic notification in all covered languages, retain previous disclosure versions for at least 10 years and publish them on their website, and maintain a public log of material changes. Deployers must additionally provide a short-form notice (max 500 words) at first interaction with the covered algorithm, summarizing individual rights and drawing attention to unexpected practices or consequential actions.

G-02.4

Developers and deployers must make publicly available a clear and accessible mechanism for individuals impacted by a covered algorithm to report potential violations of the Act.

G-02

Sec. 302

Study on explanations regarding the use of covered algorithms

(a)–(b) STUDY.— (1) IN GENERAL.—The Commission shall conduct a study, with notice and public comment, on the feasibility of requiring deployers to provide a clear, conspicuous, easy-to-use, no-cost mechanism that is accessible for individuals with disabilities and allows an individual to receive an explanation as to whether and how a covered algorithm used by the deployer affects or affected an individual. (b) REPORT.—Not later than 18 months after the date of enactment of this Act, the Commission shall submit to the Committee on Commerce, Science, and Transportation of the Senate and the Committee on Energy and Commerce of the House of Representatives a report that includes the findings of the study conducted under subsection (a), together with recommendations for such legislation and administrative action as the Commission determines appropriate.

Section 302 directs the FTC to conduct a study — with notice and public comment — on the feasibility of requiring deployers to provide individuals with an explanation of whether and how a covered algorithm affected them. The study must assess the purposes of explanations, how to make them accessible and effective, technical feasibility, identity verification, and recommendations for Congress. A report is due within 18 months of enactment. This section imposes no direct compliance obligation on developers or deployers.

Sec. 303

Consumer awareness

(a)–(c) NOTICE OF CONSUMER RIGHTS.— (1) IN GENERAL.—Not later than 90 days after the date of enactment of this Act, the Commission shall publish, on the internet website of the Commission, a web page that describes each provision, right, obligation, and requirement of this Act (categorized with respect to individuals, deployers, and developers) and the remedies, exemptions, and protections associated with this Act, in plain and concise language, in each covered language, and in an easy-to-understand, accessible manner. (b) ANNUAL REPORT.—Not later than 2 years after the date of enactment of this Act, and annually thereafter, the Commission shall publish on the internet website of the Commission a report that— (1) describes and summarizes the information contained in any pre-deployment evaluation, impact assessment, and developer review submitted to the Commission in accordance with this Act; (2) describes broad trends, aggregated statistics, and anonymized information about performing impact assessments of covered algorithms; and (3) is accessible and machine readable. (c) PUBLICLY ACCESSIBLE REPOSITORY.— (1) ESTABLISHMENT.— (A) IN GENERAL.—Not later than 180 days after the Commission publishes the first annual report under subsection (b), the Commission shall develop a publicly accessible repository to publish each pre-deployment evaluation, impact assessment, and developer review submitted to the Commission in accordance with section 102.

Section 303 directs the FTC to publish a consumer-facing web page within 90 days of enactment describing all provisions, rights, obligations, and remedies under the Act, in plain language and in all covered languages. Beginning two years after enactment, the FTC must publish an annual report summarizing all submitted evaluations, assessments, and reviews, describing broad trends, and making the report machine-readable. Within 180 days after the first annual report, the FTC must create a publicly accessible, searchable, downloadable repository of all submitted evaluations, assessments, and reviews. This section imposes obligations on the FTC, not on developers or deployers.

Sec. 401

Enforcement by the Commission

(a)–(c) UNFAIR OR DECEPTIVE ACTS OR PRACTICES.—A violation of title I, II, or III or a regulation promulgated thereunder shall be treated as a violation of a rule defining an unfair or deceptive act or practice under section 18(a)(1)(B) of the Federal Trade Commission Act (15 U.S.C. 57a(a)(1)(B)). (b) POWERS OF THE COMMISSION.— (1) IN GENERAL.—Except as provided in subsection (c), the Commission shall enforce this Act and the regulations promulgated under this Act in the same manner, by the same means, and with the same jurisdiction, powers, and duties as though all applicable terms and provisions of the Federal Trade Commission Act (15 U.S.C. 41 et seq.) were incorporated into and made a part of this Act. (c) JURISDICTION.—Notwithstanding section 4, 5(a)(2), or 6 of the Federal Trade Commission Act (15 U.S.C. 44, 45(a)(2), 46) or any jurisdictional limitation of the Commission, the Commission shall also enforce this Act and the regulations promulgated under this Act, in the same manner provided in subsections (a) and (b), with respect to— (1) organizations not organized to carry on business for their own profit or that of their members; (2) common carriers subject to the Communications Act of 1934; (3) a bank, savings and loan institution, or Federal credit union; (4) an air carrier or foreign air carrier; or (5) a person, partnership, or corporation subject to the Packers and Stockyards Act, 1921.

Section 401 establishes that a violation of Titles I, II, or III is treated as a violation of an FTC rule defining an unfair or deceptive act or practice, giving the FTC full enforcement authority including civil penalties. The FTC's jurisdiction is expanded beyond its normal limits to cover nonprofits, common carriers, banks, savings institutions, Federal credit unions, air carriers, and entities subject to the Packers and Stockyards Act. The FTC may promulgate rules under APA notice-and-comment rulemaking. This section imposes no direct compliance obligation on developers or deployers.

Sec. 402

Enforcement by States

(a)–(d) IN GENERAL.—In any case in which the attorney general of a State or a State data protection authority has reason to believe that an interest of the residents of the State has been or is threatened or adversely affected by the engagement of a person in a practice that violates title I, II, or III, or a regulation promulgated thereunder, the attorney general may, as parens patriae, bring a civil action on behalf of the residents of the State in an appropriate Federal district court of the United States to— (1) enjoin any such violation by the person; (2) enforce compliance with the requirements of this Act; (3) obtain a permanent, temporary, or preliminary injunction or other appropriate equitable relief; (4) obtain civil penalties in the amount of $15,000 per violation, or 4 percent of the defendant's average gross annual revenue over the preceding 3 years, whichever is greater; (5) obtain damages, restitution, or other compensation on behalf of the residents of such State; (6) obtain reasonable attorneys' fees and litigation costs; and (7) obtain such other relief as the court may consider to be appropriate.

Section 402 authorizes state attorneys general and state data protection authorities to bring parens patriae civil actions in federal court on behalf of state residents for violations of the Act. Available remedies include injunctive relief, civil penalties of $15,000 per violation or 4% of the defendant's average gross annual revenue over 3 years (whichever is greater), damages, restitution, and attorney's fees. The attorney general must generally notify the FTC before filing; the FTC may intervene within 180 days. This section also requires the FTC to coordinate with relevant federal agencies via memoranda of understanding within 180 days. This section imposes enforcement mechanisms, not new compliance obligations on developers or deployers.

Sec. 403

Private right of action

(a)–(b) ENFORCEMENT BY INDIVIDUALS.— (1) IN GENERAL.—Any individual or class of individuals alleging a violation of title I, II, or III, or a regulation promulgated thereunder, may bring a civil action in any court of competent jurisdiction. (2) RELIEF.—In a civil action brought under paragraph (1) in which the plaintiff prevails, the court may award— (A) treble damages or $15,000 per violation, whichever is greater; (B) nominal damages; (C) punitive damages; (D) reasonable attorney's fees and litigation costs; and (E) any other relief, including equitable or declaratory relief, that the court determines appropriate. (b) INVALIDITY OF PRE-DISPUTE ARBITRATION AGREEMENTS AND PRE-DISPUTE JOINT ACTION WAIVERS.— (1) IN GENERAL.—Notwithstanding any other provision of law, no pre-dispute arbitration agreement or pre-dispute joint action waiver shall be valid or enforceable with regard to a dispute arising under this Act.

Section 403 creates a private right of action for any individual or class of individuals alleging a violation of Titles I, II, or III. Prevailing plaintiffs may recover treble damages or $15,000 per violation (whichever is greater), nominal damages, punitive damages, reasonable attorney's fees, and equitable or declaratory relief. Plaintiffs must notify the FTC and state attorney general 60 days before filing, and both may intervene. Pre-dispute arbitration agreements and pre-dispute joint action waivers are declared invalid and unenforceable for disputes arising under the Act. This section establishes enforcement rights, not new compliance obligations.

Sec. 404

Severability

If any provision of this Act, or the application thereof to any person or circumstance, is held invalid, the remainder of this Act, and the application of such provision to other persons not similarly situated or to other circumstances, shall not be affected by the invalidation.

Standard severability clause providing that if any provision is held invalid, the remainder of the Act is not affected.

Sec. 405

Rules of construction

(a)–(b) IN GENERAL.—Nothing in this Act shall be construed to— (1) waive or otherwise limit any requirement under the National Labor Relations Act for an employer to bargain collectively regarding the deployment or effects of a covered algorithm; (2) absolve an employer of any obligation to ensure a covered algorithm and its effects comply with health and safety laws; (3) allow an employer to deploy a covered algorithm that interferes with the rights of employees under any Federal, State, or local law; or (4) absolve any other duty or requirement under any other Federal, State, or local law. (b) OTHERWISE APPLICABLE REQUIREMENTS AND AUTHORITY.—No regulation or standard imposed under this Act may be construed in a manner that would lessen the stringency of the requirements of any applicable Federal or State agency that are otherwise applicable. This Act does not divest any such agency of any authority derived from any other applicable law.

Section 405 preserves existing labor, health and safety, and other federal, state, and local law obligations. The Act does not waive collective bargaining requirements, absolve employers of health and safety obligations, permit algorithm deployment that interferes with employee rights, or reduce the stringency of other applicable requirements. This is a savings clause that creates no new compliance obligations.

Sec. 501

Occupational series relating to algorithm auditing

Not later than 270 days after the date of enactment of this Act, the Director of the Office of Personnel Management shall exercise the authority of the Director under section 5105 of title 5, United States Code, to establish a new occupational series and associated policies covering Federal Government positions in the field of algorithm auditing.

Section 501 directs the Director of the Office of Personnel Management to establish a new federal occupational series for algorithm auditing positions within 270 days of enactment. This is an administrative directive to OPM, not a compliance obligation on developers or deployers.

Sec. 502

Additional Federal resources

(a)–(b) AUTHORIZATION OF APPROPRIATIONS.—There is authorized to be appropriated to the Commission and other Federal agencies enumerated in this Act such sums as may be necessary to carry out this Act. (b) COMMISSION PERSONNEL.—Notwithstanding any other provision of law, the Commission may hire not more than 500 additional personnel to accomplish the work of the Commission with respect to unfair or deceptive acts or practices relating to the development or deployment of covered algorithms in accordance with this Act.

Section 502 authorizes appropriations as necessary to carry out the Act and permits the FTC to hire up to 500 additional personnel for enforcement. This is an appropriations and staffing authorization, not a compliance obligation on regulated entities.

Safety Harmful content prevention · self-harm escalation

2 items

S-01.5

S-01

Deceptive Conduct AI-generated likeness · consent requirements

2 items

CP-01

Developers and deployers must not engage in false, deceptive, or misleading advertising, marketing, or publicizing of a covered algorithm.

CP-01.3

Human Oversight Decision review · appeal pathways

7 items

H-02.11

H-02.3

H-02.2

H-02.8

H-01.4

H-01.5

Governance Risk management · accountability programs

5 items

G-01.3

G-03.3

G-02.4

G-02

Developers and deployers must make publicly available a clear and accessible mechanism for individuals impacted by a covered algorithm to report potential violations of the Act.

Regulatory Reporting · disclosure · audit

1 item

R-02.1

Passage Likelihood

Low

Status Introduced

Chamber No passage

Committee No action

Majority party (No data)

Bipartisan No

Prior session None

Legislative History

2025-12-02 Introduced in House

2025-12-02 Referred to the Committee on Energy and Commerce, and in addition to the Committee on Oversight and Government Reform, for a period to be subsequently determined by the Speaker, in each case for consideration of such provisions as fall within the jurisdiction of the committee concerned.

Sources

Full Text ↗

Entry Last Reviewed

2026-05-20

AI generated