WHAT THIS BILL REGULATES · 5 REQUIREMENT TYPES
How Is This Bill Enforced
Verbatim statutory text on the left; plain-language analysis and a per-section checklist on the right. Numbered markers cross-link to the matching checklist row.
This Act may be cited as the ''Federal Artificial Intelligence Risk Management Act of 2024''.
Establishes the short title of the Act as the Federal Artificial Intelligence Risk Management Act of 2024. No compliance obligations are created.
(a)(1) The term ''AdministratorAdministratorThe term "Administrator" means the Administrator of Federal Procurement Policy.Section 2(a)(1)'' means the Administrator of Federal Procurement Policy.
(a)(2) The term ''agencyAgencyThe term "agency" means any department, independent establishment, Government corporation, or other agency of the executive branch of the Federal Government.Section 2(a)(2)'' means any department, independent establishment, Government corporation, or other agency of the executive branch of the Federal Government.
(a)(3) The term ''artificial intelligenceArtificial intelligenceThe term "artificial intelligence" has the meaning given the term in section 5002 of the National Artificial Intelligence Initiative Act of 2020 (15 U.S.C. 9401).Section 2(a)(3)'' has the meaning given the term in section 5002 of the National Artificial IntelligenceArtificial intelligenceThe term "artificial intelligence" has the meaning given the term in section 5002 of the National Artificial Intelligence Initiative Act of 2020 (15 U.S.C. 9401).Section 2(a)(3) Initiative Act of 2020 (15 U.S.C. 9401).
(a)(4) The term ''DirectorDirectorThe term "Director" means the Director of the National Institute of Standards and Technology.Section 2(a)(4)'' means the Director of the National Institute of Standards and Technology.
(a)(5) The term ''frameworkFrameworkThe term "framework" means document number NIST AI 100–1 of the National Institute of Standards and Technology entitled "Artificial Intelligence Risk Management Framework", or any successor document.Section 2(a)(5)'' means document number NIST AI 100–1 of the National Institute of Standards and Technology entitled ''Artificial IntelligenceArtificial intelligenceThe term "artificial intelligence" has the meaning given the term in section 5002 of the National Artificial Intelligence Initiative Act of 2020 (15 U.S.C. 9401).Section 2(a)(3) Risk Management FrameworkFrameworkThe term "framework" means document number NIST AI 100–1 of the National Institute of Standards and Technology entitled "Artificial Intelligence Risk Management Framework", or any successor document.Section 2(a)(5)'', or any successor document.
(a)(6) The term ''playbookPlaybookThe term "playbook" means the AI RMF Playbook developed by the National Institute of Standards and Technology.Section 2(a)(6)'' means the AI RMF PlaybookPlaybookThe term "playbook" means the AI RMF Playbook developed by the National Institute of Standards and Technology.Section 2(a)(6) developed by the National Institute of Standards and Technology.
(a)(7) The term ''profileProfileThe term "profile" means an implementation of the artificial intelligence risk management functions, categories, and subcategories for a specific setting or application based on the requirements, risk tolerance, and resources of the framework user.Section 2(a)(7)'' means an implementation of the artificial intelligenceArtificial intelligenceThe term "artificial intelligence" has the meaning given the term in section 5002 of the National Artificial Intelligence Initiative Act of 2020 (15 U.S.C. 9401).Section 2(a)(3) risk management functions, categories, and subcategories for a specific setting or application based on the requirements, risk tolerance, and resources of the frameworkFrameworkThe term "framework" means document number NIST AI 100–1 of the National Institute of Standards and Technology entitled "Artificial Intelligence Risk Management Framework", or any successor document.Section 2(a)(5) user.
Defines seven key terms used throughout the bill, including the covered entity (Agency), the NIST AI Risk Management Framework, the AI RMF Playbook, and the concept of a Profile as a tailored implementation of the framework. The definition of artificial intelligence is incorporated by reference from the National Artificial Intelligence Initiative Act of 2020.
(b)(1) 1 Not later than 180 days after the date on which the Director of the National Institute of Standards and Technology issues guidelines under paragraph (2), the Director of the Office of Management and Budget shall issue guidance requiring agencies to incorporate the frameworkFrameworkThe term "framework" means document number NIST AI 100–1 of the National Institute of Standards and Technology entitled "Artificial Intelligence Risk Management Framework", or any successor document.Section 2(a)(5) and the guidelines into their artificial intelligenceArtificial intelligenceThe term "artificial intelligence" has the meaning given the term in section 5002 of the National Artificial Intelligence Initiative Act of 2020 (15 U.S.C. 9401).Section 2(a)(3) risk management efforts, consistent with such guidelines.
(b)(2) 2 Not later than 1 year after the date of the enactment of this Act, the Director of the National Institute of Standards and Technology shall, in consultation with the AdministratorAdministratorThe term "Administrator" means the Administrator of Federal Procurement Policy.Section 2(a)(1), issue guidance for agencies to incorporate the frameworkFrameworkThe term "framework" means document number NIST AI 100–1 of the National Institute of Standards and Technology entitled "Artificial Intelligence Risk Management Framework", or any successor document.Section 2(a)(5) into the artificial intelligenceArtificial intelligenceThe term "artificial intelligence" has the meaning given the term in section 5002 of the National Artificial Intelligence Initiative Act of 2020 (15 U.S.C. 9401).Section 2(a)(3) risk management efforts of the agencyAgencyThe term "agency" means any department, independent establishment, Government corporation, or other agency of the executive branch of the Federal Government.Section 2(a)(2), which shall— (A) provide standards, practices, and tools consistent with the frameworkFrameworkThe term "framework" means document number NIST AI 100–1 of the National Institute of Standards and Technology entitled "Artificial Intelligence Risk Management Framework", or any successor document.Section 2(a)(5) and how they can leverage the frameworkFrameworkThe term "framework" means document number NIST AI 100–1 of the National Institute of Standards and Technology entitled "Artificial Intelligence Risk Management Framework", or any successor document.Section 2(a)(5) to reduce risks to people and the planet for agencyAgencyThe term "agency" means any department, independent establishment, Government corporation, or other agency of the executive branch of the Federal Government.Section 2(a)(2) implementation in the development, procurement, and use of artificial intelligenceArtificial intelligenceThe term "artificial intelligence" has the meaning given the term in section 5002 of the National Artificial Intelligence Initiative Act of 2020 (15 U.S.C. 9401).Section 2(a)(3); (B) specify appropriate cybersecurity strategies and the installation of effective cybersecurity tools to improve security of artificial intelligenceArtificial intelligenceThe term "artificial intelligence" has the meaning given the term in section 5002 of the National Artificial Intelligence Initiative Act of 2020 (15 U.S.C. 9401).Section 2(a)(3) systems; (C) provide standards— (i) that are consistent with the frameworkFrameworkThe term "framework" means document number NIST AI 100–1 of the National Institute of Standards and Technology entitled "Artificial Intelligence Risk Management Framework", or any successor document.Section 2(a)(5) and Circular A–119 of the Office of Management and Budget; (ii) that are tailored to risks that could endanger people and the planet; and (iii) which a supplier of artificial intelligenceArtificial intelligenceThe term "artificial intelligence" has the meaning given the term in section 5002 of the National Artificial Intelligence Initiative Act of 2020 (15 U.S.C. 9401).Section 2(a)(3) for the agencyAgencyThe term "agency" means any department, independent establishment, Government corporation, or other agency of the executive branch of the Federal Government.Section 2(a)(2) must attest to meet before the head of an agencyAgencyThe term "agency" means any department, independent establishment, Government corporation, or other agency of the executive branch of the Federal Government.Section 2(a)(2) may procure artificial intelligenceArtificial intelligenceThe term "artificial intelligence" has the meaning given the term in section 5002 of the National Artificial Intelligence Initiative Act of 2020 (15 U.S.C. 9401).Section 2(a)(3) from that supplier; (D) recommend training on the frameworkFrameworkThe term "framework" means document number NIST AI 100–1 of the National Institute of Standards and Technology entitled "Artificial Intelligence Risk Management Framework", or any successor document.Section 2(a)(5) and the guidelines for each agencyAgencyThe term "agency" means any department, independent establishment, Government corporation, or other agency of the executive branch of the Federal Government.Section 2(a)(2) responsible for procuring artificial intelligenceArtificial intelligenceThe term "artificial intelligence" has the meaning given the term in section 5002 of the National Artificial Intelligence Initiative Act of 2020 (15 U.S.C. 9401).Section 2(a)(3); (E) set minimum requirements for developing profilesProfileThe term "profile" means an implementation of the artificial intelligence risk management functions, categories, and subcategories for a specific setting or application based on the requirements, risk tolerance, and resources of the framework user.Section 2(a)(7) for agencyAgencyThe term "agency" means any department, independent establishment, Government corporation, or other agency of the executive branch of the Federal Government.Section 2(a)(2) use of artificial intelligenceArtificial intelligenceThe term "artificial intelligence" has the meaning given the term in section 5002 of the National Artificial Intelligence Initiative Act of 2020 (15 U.S.C. 9401).Section 2(a)(3) consistent with the frameworkFrameworkThe term "framework" means document number NIST AI 100–1 of the National Institute of Standards and Technology entitled "Artificial Intelligence Risk Management Framework", or any successor document.Section 2(a)(5); and (F) develop profilesProfileThe term "profile" means an implementation of the artificial intelligence risk management functions, categories, and subcategories for a specific setting or application based on the requirements, risk tolerance, and resources of the framework user.Section 2(a)(7) for frameworkFrameworkThe term "framework" means document number NIST AI 100–1 of the National Institute of Standards and Technology entitled "Artificial Intelligence Risk Management Framework", or any successor document.Section 2(a)(5) use for an entity that is a small business concern (as defined in section 3 of the Small Business Act (15 U.S.C. 632)).
(b)(3)(A) 3 The AdministratorAdministratorThe term "Administrator" means the Administrator of Federal Procurement Policy.Section 2(a)(1) shall, in consultation with the DirectorDirectorThe term "Director" means the Director of the National Institute of Standards and Technology.Section 2(a)(4), provide draft contract language for each agencyAgencyThe term "agency" means any department, independent establishment, Government corporation, or other agency of the executive branch of the Federal Government.Section 2(a)(2) to use in procurement that requires a supplier of artificial intelligenceArtificial intelligenceThe term "artificial intelligence" has the meaning given the term in section 5002 of the National Artificial Intelligence Initiative Act of 2020 (15 U.S.C. 9401).Section 2(a)(3)— (i) to adhere to certain actions that are consistent with the frameworkFrameworkThe term "framework" means document number NIST AI 100–1 of the National Institute of Standards and Technology entitled "Artificial Intelligence Risk Management Framework", or any successor document.Section 2(a)(5); and (ii) to provide appropriate access to data, models, and parameters, as defined by the DirectorDirectorThe term "Director" means the Director of the National Institute of Standards and Technology.Section 2(a)(4), to enable sufficient test and evaluation, verification, and validation.
(b)(3)(B) 4 The Director of the Office of Management and Budget shall, in consultation with the DirectorDirectorThe term "Director" means the Director of the National Institute of Standards and Technology.Section 2(a)(4), provide a template for agencyAgencyThe term "agency" means any department, independent establishment, Government corporation, or other agency of the executive branch of the Federal Government.Section 2(a)(2) use on the guidance issued under paragraph (1) that includes recommended procedures for implementation.
(b)(4) 5 The head of each agencyAgencyThe term "agency" means any department, independent establishment, Government corporation, or other agency of the executive branch of the Federal Government.Section 2(a)(2) shall conform any policy, principle, practice, procedure, or guideline governing the design, development, implementation, deployment, use, or evaluation of an artificial intelligenceArtificial intelligenceThe term "artificial intelligence" has the meaning given the term in section 5002 of the National Artificial Intelligence Initiative Act of 2020 (15 U.S.C. 9401).Section 2(a)(3) system by the agencyAgencyThe term "agency" means any department, independent establishment, Government corporation, or other agency of the executive branch of the Federal Government.Section 2(a)(2) to the frameworkFrameworkThe term "framework" means document number NIST AI 100–1 of the National Institute of Standards and Technology entitled "Artificial Intelligence Risk Management Framework", or any successor document.Section 2(a)(5) and to the guidance issued under paragraph (1).
(b)(5) In carrying out paragraph (4), the head of each agencyAgencyThe term "agency" means any department, independent establishment, Government corporation, or other agency of the executive branch of the Federal Government.Section 2(a)(2) may use the supporting materials of the frameworkFrameworkThe term "framework" means document number NIST AI 100–1 of the National Institute of Standards and Technology entitled "Artificial Intelligence Risk Management Framework", or any successor document.Section 2(a)(5), including the playbookPlaybookThe term "playbook" means the AI RMF Playbook developed by the National Institute of Standards and Technology.Section 2(a)(6).
(b)(6) 6 Not later than 1 year after the date of enactment of this Act, the Comptroller General of the United States shall conduct a study on the impact of the application of the frameworkFrameworkThe term "framework" means document number NIST AI 100–1 of the National Institute of Standards and Technology entitled "Artificial Intelligence Risk Management Framework", or any successor document.Section 2(a)(5) on agencyAgencyThe term "agency" means any department, independent establishment, Government corporation, or other agency of the executive branch of the Federal Government.Section 2(a)(2) use of artificial intelligenceArtificial intelligenceThe term "artificial intelligence" has the meaning given the term in section 5002 of the National Artificial Intelligence Initiative Act of 2020 (15 U.S.C. 9401).Section 2(a)(3).
(b)(7) 7 Not later than 1 year after the date of the enactment of this Act, and not less frequently than once every 3 years thereafter, the Director of the Office of Management and Budget shall submit to Congress a report on agencyAgencyThe term "agency" means any department, independent establishment, Government corporation, or other agency of the executive branch of the Federal Government.Section 2(a)(2) implementation of and conformity to the frameworkFrameworkThe term "framework" means document number NIST AI 100–1 of the National Institute of Standards and Technology entitled "Artificial Intelligence Risk Management Framework", or any successor document.Section 2(a)(5).
(b)(8) Nothing in this subsection shall apply to a national security system (as defined in section 3552 of title 44, United States Code).
This subsection is the core of the bill. It establishes a cascading obligation structure: NIST must issue guidelines for agencies to incorporate the AI Risk Management Framework within one year of enactment; OMB must then issue conforming guidance within 180 days of the NIST guidelines. The Administrator of Federal Procurement Policy must provide draft contract language requiring AI suppliers to adhere to the framework and provide access to data, models, and parameters for testing. OMB must also provide implementation templates.
Each agency head must then conform all AI-related policies, principles, practices, procedures, and guidelines to the framework and OMB guidance. A national security system exception carves out classified and intelligence community systems. The GAO must study the framework's impact on agency AI use within one year, and OMB must report to Congress on agency conformity within one year and every three years thereafter.
(c) 8 Not later than 1 year after the issuance of guidance pursuant to subsection (b)(1), the Federal Acquisition Regulatory Council shall promulgate regulations that provide for— (1) the requirements for the acquisition of artificial intelligenceArtificial intelligenceThe term "artificial intelligence" has the meaning given the term in section 5002 of the National Artificial Intelligence Initiative Act of 2020 (15 U.S.C. 9401).Section 2(a)(3) products, services, tools, and systems, to include risk-based compliance with the frameworkFrameworkThe term "framework" means document number NIST AI 100–1 of the National Institute of Standards and Technology entitled "Artificial Intelligence Risk Management Framework", or any successor document.Section 2(a)(5); and (2) solicitation provisions and contract clauses that include references to the requirements described in paragraph (1) and the frameworkFrameworkThe term "framework" means document number NIST AI 100–1 of the National Institute of Standards and Technology entitled "Artificial Intelligence Risk Management Framework", or any successor document.Section 2(a)(5) for use in artificial intelligenceArtificial intelligenceThe term "artificial intelligence" has the meaning given the term in section 5002 of the National Artificial Intelligence Initiative Act of 2020 (15 U.S.C. 9401).Section 2(a)(3) acquisitions.
Directs the Federal Acquisition Regulatory Council to promulgate procurement regulations within one year after OMB issues its guidance under subsection (b)(1). The regulations must establish requirements for acquiring AI products, services, tools, and systems with risk-based compliance to the NIST AI Risk Management Framework, and must include solicitation provisions and contract clauses referencing those requirements.
(d)(1)–(2) 9 Not later than 180 days after the date of the enactment of this Act, the Director of the Office of Management and Budget shall, in consultation with the Administrator of the General Services Administration, establish an initiative to provide to agencies expertise on artificial intelligenceArtificial intelligenceThe term "artificial intelligence" has the meaning given the term in section 5002 of the National Artificial Intelligence Initiative Act of 2020 (15 U.S.C. 9401).Section 2(a)(3) pursuant to requests for such expertise by the heads of such agencies. The initiative established pursuant to paragraph (1) shall include the following: (A) The recruitment and hiring of interdisciplinary experts who can assist agencies in the development, procurement, use, and assessment of artificial intelligenceArtificial intelligenceThe term "artificial intelligence" has the meaning given the term in section 5002 of the National Artificial Intelligence Initiative Act of 2020 (15 U.S.C. 9401).Section 2(a)(3) tools. (B) A process for establishing development and deployment guidelines and tools for managing artificial intelligenceArtificial intelligenceThe term "artificial intelligence" has the meaning given the term in section 5002 of the National Artificial Intelligence Initiative Act of 2020 (15 U.S.C. 9401).Section 2(a)(3) risks under which the initiative can assist agencies. (C) Consultation with existing initiatives, including United States Digital Service and the technology transformation services of the General Services Administration, to incorporate best practices for assisting agencies in the development, procurement, use, and assessment of artificial intelligenceArtificial intelligenceThe term "artificial intelligence" has the meaning given the term in section 5002 of the National Artificial Intelligence Initiative Act of 2020 (15 U.S.C. 9401).Section 2(a)(3) tools.
Directs OMB, in consultation with GSA, to establish an AI workforce initiative within 180 days of enactment. The initiative must recruit interdisciplinary AI experts to assist agencies with AI development, procurement, use, and assessment. It must also establish processes for development and deployment guidelines and risk management tools, and consult with existing programs like the U.S. Digital Service and GSA's Technology Transformation Services.
(e)(1) 10 Not later than 90 days after the date of the enactment of this Act, the Director of the National Institute of Standards and Technology shall complete a study to review the existing and forthcoming voluntary consensus standards for the test, evaluation, verification, and validation of artificial intelligenceArtificial intelligenceThe term "artificial intelligence" has the meaning given the term in section 5002 of the National Artificial Intelligence Initiative Act of 2020 (15 U.S.C. 9401).Section 2(a)(3) acquisitions.
(e)(2) 11 Not later than 90 days after the date of the completion of the study required by paragraph (1), the DirectorDirectorThe term "Director" means the Director of the National Institute of Standards and Technology.Section 2(a)(4) shall— (A) convene relevant stakeholders to develop voluntary consensus standards for the test, evaluation, verification, and validation of artificial intelligenceArtificial intelligenceThe term "artificial intelligence" has the meaning given the term in section 5002 of the National Artificial Intelligence Initiative Act of 2020 (15 U.S.C. 9401).Section 2(a)(3) acquisitions; (B) upon completion of the standards described in subparagraph (A) or within 1 year, whichever is sooner— (i) develop methods and principles, based on the standards described in subparagraph (A), for the conduct of test, evaluation, verification, and validation of artificial intelligenceArtificial intelligenceThe term "artificial intelligence" has the meaning given the term in section 5002 of the National Artificial Intelligence Initiative Act of 2020 (15 U.S.C. 9401).Section 2(a)(3) acquisitions; (ii) establish the resources for the conduct of test, evaluation, verification, and validation of artificial intelligenceArtificial intelligenceThe term "artificial intelligence" has the meaning given the term in section 5002 of the National Artificial Intelligence Initiative Act of 2020 (15 U.S.C. 9401).Section 2(a)(3) acquisitions; (iii) monitor and review all test, evaluation, verification, and validation of artificial intelligenceArtificial intelligenceThe term "artificial intelligence" has the meaning given the term in section 5002 of the National Artificial Intelligence Initiative Act of 2020 (15 U.S.C. 9401).Section 2(a)(3) acquisitions; and (iv) review and make recommendations to the head of each agency of risks to people and the plant on relevant artificial intelligenceArtificial intelligenceThe term "artificial intelligence" has the meaning given the term in section 5002 of the National Artificial Intelligence Initiative Act of 2020 (15 U.S.C. 9401).Section 2(a)(3) acquisitions; and (C) continuously update the methods and principles described in subparagraph (B)(i) based on evolving voluntary consensus standards.
Establishes a two-phase obligation for NIST. First, NIST must complete a study within 90 days of enactment reviewing existing and forthcoming voluntary consensus standards for AI testing, evaluation, verification, and validation. Second, within 90 days of completing the study, NIST must convene stakeholders to develop consensus standards, then develop methods and principles for AI test and evaluation, establish resources, monitor all testing and evaluation activities, and make risk recommendations to agency heads. NIST must also continuously update these methods based on evolving standards.