How Is This Bill Enforced
Verbatim statutory text on the left; plain-language analysis and a per-section checklist on the right. Numbered markers cross-link to the matching checklist row.
This Act may be cited as the ''Validation and Evaluation for Trustworthy (VET) Artificial Intelligence Act'' or the ''VET Artificial Intelligence Act''.
Establishes the short title of the Act as the Validation and Evaluation for Trustworthy (VET) Artificial Intelligence Act or the VET Artificial Intelligence Act. This section creates no compliance obligations.
(1)–(3) The purposes of this Act are— (1) to develop consensus-driven, evidence-based voluntary technical guidelines and specifications for internal and external assurances through the testing, evaluation, validation, and verification of artificial intelligence systemsArtificial intelligence systemThe term "artificial intelligence system" means a machine-based system that, for explicit or implicit objectives, infers, from the input the system receives, how to generate outputs, such as predictions, content, recommendations, or decisions, that can influence physical or virtual environments.Sec. 3(1), as appropriate based on the intended application, use-case, and risk profile of the artificial intelligence systemArtificial intelligence systemThe term "artificial intelligence system" means a machine-based system that, for explicit or implicit objectives, infers, from the input the system receives, how to generate outputs, such as predictions, content, recommendations, or decisions, that can influence physical or virtual environments.Sec. 3(1); (2) to use meaningful assurance to supplement methodologies used to build trust in artificial intelligence systemsArtificial intelligence systemThe term "artificial intelligence system" means a machine-based system that, for explicit or implicit objectives, infers, from the input the system receives, how to generate outputs, such as predictions, content, recommendations, or decisions, that can influence physical or virtual environments.Sec. 3(1), increase adoption of artificial intelligence systemsArtificial intelligence systemThe term "artificial intelligence system" means a machine-based system that, for explicit or implicit objectives, infers, from the input the system receives, how to generate outputs, such as predictions, content, recommendations, or decisions, that can influence physical or virtual environments.Sec. 3(1), and provide for accountability and governance of artificial intelligence systemsArtificial intelligence systemThe term "artificial intelligence system" means a machine-based system that, for explicit or implicit objectives, infers, from the input the system receives, how to generate outputs, such as predictions, content, recommendations, or decisions, that can influence physical or virtual environments.Sec. 3(1); and (3) to further the goals of the Artificial Intelligence Risk Management Framework, including any successor framework, published by the National Institute of Standards and Technology and the Artificial Intelligence Safety Institute pursuant to section 22A(c) of the National Institute of Standards and Technology Act (15 U.S.C. 278h–1(c)).
States the legislative purposes of the Act: developing voluntary technical guidelines for AI assurance activities, using meaningful assurance to build trust and accountability in AI systems, and furthering the goals of the NIST AI Risk Management Framework. This section is a legislative findings and purpose statement and creates no compliance obligations.
(1)–(8) In this Act: (1) ARTIFICIAL INTELLIGENCE SYSTEMArtificial intelligence systemThe term "artificial intelligence system" means a machine-based system that, for explicit or implicit objectives, infers, from the input the system receives, how to generate outputs, such as predictions, content, recommendations, or decisions, that can influence physical or virtual environments.Sec. 3(1).—The term ''artificial intelligence systemArtificial intelligence systemThe term "artificial intelligence system" means a machine-based system that, for explicit or implicit objectives, infers, from the input the system receives, how to generate outputs, such as predictions, content, recommendations, or decisions, that can influence physical or virtual environments.Sec. 3(1)'' means a machine-based system that, for explicit or implicit objectives, infers, from the input the system receives, how to generate outputs, such as predictions, content, recommendations, or decisions, that can influence physical or virtual environments. (2) DEPLOYERDeployerThe term "deployer" means an entity that operates an artificial intelligence system for internal use or for use by a third party.Sec. 3(2).—The term ''deployerDeployerThe term "deployer" means an entity that operates an artificial intelligence system for internal use or for use by a third party.Sec. 3(2)'' means an entity that operates an artificial intelligence systemArtificial intelligence systemThe term "artificial intelligence system" means a machine-based system that, for explicit or implicit objectives, infers, from the input the system receives, how to generate outputs, such as predictions, content, recommendations, or decisions, that can influence physical or virtual environments.Sec. 3(1) for internal use or for use by a third party. (3) DEVELOPERDeveloperThe term "developer"— (A) means an entity that builds, designs, codes, produces, trains, or owns an artificial intelligence system for internal use or for use by a third party; and (B) does not include an entity that is solely a deployer of the artificial intelligence system.Sec. 3(3).—The term ''developerDeveloperThe term "developer"— (A) means an entity that builds, designs, codes, produces, trains, or owns an artificial intelligence system for internal use or for use by a third party; and (B) does not include an entity that is solely a deployer of the artificial intelligence system.Sec. 3(3)''— (A) means an entity that builds, designs, codes, produces, trains, or owns an artificial intelligence systemArtificial intelligence systemThe term "artificial intelligence system" means a machine-based system that, for explicit or implicit objectives, infers, from the input the system receives, how to generate outputs, such as predictions, content, recommendations, or decisions, that can influence physical or virtual environments.Sec. 3(1) for internal use or for use by a third party; and (B) does not include an entity that is solely a deployer of the artificial intelligence systemArtificial intelligence systemThe term "artificial intelligence system" means a machine-based system that, for explicit or implicit objectives, infers, from the input the system receives, how to generate outputs, such as predictions, content, recommendations, or decisions, that can influence physical or virtual environments.Sec. 3(1). (4) DIRECTORDirectorThe term "Director" means the Director of the National Institute of Standards and Technology.Sec. 3(4).—The term ''DirectorDirectorThe term "Director" means the Director of the National Institute of Standards and Technology.Sec. 3(4)'' means the Director of the National Institute of Standards and Technology. (5) EXTERNAL ARTIFICIAL INTELLIGENCE ASSURANCEExternal artificial intelligence assuranceThe term "external artificial intelligence assurance" means an independent and impartial evaluation of an artificial intelligence system conducted by a nonaffiliated third party in accordance with the voluntary assurance technical guidelines and specifications described in section 4 or consensus-driven voluntary standards, for the purpose of— (A) verifying claims with respect to the functionality and testing of the artificial intelligence system, including verifying whether it is fit for its intended purpose; or (B) identifying any significant error or inconsistency in the testing, risk management processes, or internal governance, any substantial vulnerability, or any negative societal impact of the artificial intelligence system.Sec. 3(5).—The term ''external artificial intelligence assuranceExternal artificial intelligence assuranceThe term "external artificial intelligence assurance" means an independent and impartial evaluation of an artificial intelligence system conducted by a nonaffiliated third party in accordance with the voluntary assurance technical guidelines and specifications described in section 4 or consensus-driven voluntary standards, for the purpose of— (A) verifying claims with respect to the functionality and testing of the artificial intelligence system, including verifying whether it is fit for its intended purpose; or (B) identifying any significant error or inconsistency in the testing, risk management processes, or internal governance, any substantial vulnerability, or any negative societal impact of the artificial intelligence system.Sec. 3(5)'' means an independent and impartial evaluation of an artificial intelligence systemArtificial intelligence systemThe term "artificial intelligence system" means a machine-based system that, for explicit or implicit objectives, infers, from the input the system receives, how to generate outputs, such as predictions, content, recommendations, or decisions, that can influence physical or virtual environments.Sec. 3(1) conducted by a nonaffiliated third partyNonaffiliated third partyThe term "nonaffiliated third party" with respect to the evaluation of an artificial intelligence system, means a person who— (A) is not related by common ownership or affiliated by common corporate control with the developer or deployer of the artificial intelligence system; (B) can demonstrate financial independence from the developer or deployer of the artificial intelligence system; (C) does not employ any individual, who is also employed by the developer or deployer of the artificial intelligence system; and (D) is a qualified evaluator of artificial intelligence systems, with— (i) demonstrated expertise in relevant technical domains, including— (I) data privacy and security principles; and (II) risk management practices in artificial intelligence systems; and (ii) familiarity with the relevant details regarding the type of artificial intelligence system being evaluated.Sec. 3(7) in accordance with the voluntary assurance technical guidelines and specifications described in section 4 or consensus-driven voluntary standards, for the purpose of— (A) verifying claims with respect to the functionality and testing of the artificial intelligence systemArtificial intelligence systemThe term "artificial intelligence system" means a machine-based system that, for explicit or implicit objectives, infers, from the input the system receives, how to generate outputs, such as predictions, content, recommendations, or decisions, that can influence physical or virtual environments.Sec. 3(1), including verifying whether it is fit for its intended purpose; or (B) identifying any significant error or inconsistency in the testing, risk management processes, or internal governance, any substantial vulnerability, or any negative societal impact of the artificial intelligence systemArtificial intelligence systemThe term "artificial intelligence system" means a machine-based system that, for explicit or implicit objectives, infers, from the input the system receives, how to generate outputs, such as predictions, content, recommendations, or decisions, that can influence physical or virtual environments.Sec. 3(1). (6) INTERNAL ARTIFICIAL INTELLIGENCE ASSURANCEInternal artificial intelligence assuranceThe term "internal artificial intelligence assurance" means an independent evaluation of an artificial intelligence system conducted by the party being evaluated with an internal reporting structure that encourages impartial evaluations and prevents conflicts of interest, for the purpose of— (A) verifying claims with respect to the functionality and testing of the artificial intelligence system, including verifying whether it is fit for its intended purpose; or (B) identifying any significant error or inconsistency in the testing, risk management process, or internal governance or any substantial vulnerability of the artificial intelligence system.Sec. 3(6).—The term ''internal artificial intelligence assuranceInternal artificial intelligence assuranceThe term "internal artificial intelligence assurance" means an independent evaluation of an artificial intelligence system conducted by the party being evaluated with an internal reporting structure that encourages impartial evaluations and prevents conflicts of interest, for the purpose of— (A) verifying claims with respect to the functionality and testing of the artificial intelligence system, including verifying whether it is fit for its intended purpose; or (B) identifying any significant error or inconsistency in the testing, risk management process, or internal governance or any substantial vulnerability of the artificial intelligence system.Sec. 3(6)'' means an independent evaluation of an artificial intelligence systemArtificial intelligence systemThe term "artificial intelligence system" means a machine-based system that, for explicit or implicit objectives, infers, from the input the system receives, how to generate outputs, such as predictions, content, recommendations, or decisions, that can influence physical or virtual environments.Sec. 3(1) conducted by the party being evaluated with an internal reporting structure that encourages impartial evaluations and prevents conflicts of interest, for the purpose of— (A) verifying claims with respect to the functionality and testing of the artificial intelligence systemArtificial intelligence systemThe term "artificial intelligence system" means a machine-based system that, for explicit or implicit objectives, infers, from the input the system receives, how to generate outputs, such as predictions, content, recommendations, or decisions, that can influence physical or virtual environments.Sec. 3(1), including verifying whether it is fit for its intended purpose; or (B) identifying any significant error or inconsistency in the testing, risk management process, or internal governance or any substantial vulnerability of the artificial intelligence systemArtificial intelligence systemThe term "artificial intelligence system" means a machine-based system that, for explicit or implicit objectives, infers, from the input the system receives, how to generate outputs, such as predictions, content, recommendations, or decisions, that can influence physical or virtual environments.Sec. 3(1). (7) NONAFFILIATED THIRD PARTYNonaffiliated third partyThe term "nonaffiliated third party" with respect to the evaluation of an artificial intelligence system, means a person who— (A) is not related by common ownership or affiliated by common corporate control with the developer or deployer of the artificial intelligence system; (B) can demonstrate financial independence from the developer or deployer of the artificial intelligence system; (C) does not employ any individual, who is also employed by the developer or deployer of the artificial intelligence system; and (D) is a qualified evaluator of artificial intelligence systems, with— (i) demonstrated expertise in relevant technical domains, including— (I) data privacy and security principles; and (II) risk management practices in artificial intelligence systems; and (ii) familiarity with the relevant details regarding the type of artificial intelligence system being evaluated.Sec. 3(7).—The term ''nonaffiliated third partyNonaffiliated third partyThe term "nonaffiliated third party" with respect to the evaluation of an artificial intelligence system, means a person who— (A) is not related by common ownership or affiliated by common corporate control with the developer or deployer of the artificial intelligence system; (B) can demonstrate financial independence from the developer or deployer of the artificial intelligence system; (C) does not employ any individual, who is also employed by the developer or deployer of the artificial intelligence system; and (D) is a qualified evaluator of artificial intelligence systems, with— (i) demonstrated expertise in relevant technical domains, including— (I) data privacy and security principles; and (II) risk management practices in artificial intelligence systems; and (ii) familiarity with the relevant details regarding the type of artificial intelligence system being evaluated.Sec. 3(7)'' with respect to the evaluation of an artificial intelligence systemArtificial intelligence systemThe term "artificial intelligence system" means a machine-based system that, for explicit or implicit objectives, infers, from the input the system receives, how to generate outputs, such as predictions, content, recommendations, or decisions, that can influence physical or virtual environments.Sec. 3(1), means a person who— (A) is not related by common ownership or affiliated by common corporate control with the developerDeveloperThe term "developer"— (A) means an entity that builds, designs, codes, produces, trains, or owns an artificial intelligence system for internal use or for use by a third party; and (B) does not include an entity that is solely a deployer of the artificial intelligence system.Sec. 3(3) or deployer of the artificial intelligence systemArtificial intelligence systemThe term "artificial intelligence system" means a machine-based system that, for explicit or implicit objectives, infers, from the input the system receives, how to generate outputs, such as predictions, content, recommendations, or decisions, that can influence physical or virtual environments.Sec. 3(1); (B) can demonstrate financial independence from the developerDeveloperThe term "developer"— (A) means an entity that builds, designs, codes, produces, trains, or owns an artificial intelligence system for internal use or for use by a third party; and (B) does not include an entity that is solely a deployer of the artificial intelligence system.Sec. 3(3) or deployer of the artificial intelligence systemArtificial intelligence systemThe term "artificial intelligence system" means a machine-based system that, for explicit or implicit objectives, infers, from the input the system receives, how to generate outputs, such as predictions, content, recommendations, or decisions, that can influence physical or virtual environments.Sec. 3(1); (C) does not employ any individual, who is also employed by the developerDeveloperThe term "developer"— (A) means an entity that builds, designs, codes, produces, trains, or owns an artificial intelligence system for internal use or for use by a third party; and (B) does not include an entity that is solely a deployer of the artificial intelligence system.Sec. 3(3) or deployer of the artificial intelligence systemArtificial intelligence systemThe term "artificial intelligence system" means a machine-based system that, for explicit or implicit objectives, infers, from the input the system receives, how to generate outputs, such as predictions, content, recommendations, or decisions, that can influence physical or virtual environments.Sec. 3(1); and (D) is a qualified evaluator of artificial intelligence systemsArtificial intelligence systemThe term "artificial intelligence system" means a machine-based system that, for explicit or implicit objectives, infers, from the input the system receives, how to generate outputs, such as predictions, content, recommendations, or decisions, that can influence physical or virtual environments.Sec. 3(1), with— (i) demonstrated expertise in relevant technical domains, including— (I) data privacy and security principles; and (II) risk management practices in artificial intelligence systemsArtificial intelligence systemThe term "artificial intelligence system" means a machine-based system that, for explicit or implicit objectives, infers, from the input the system receives, how to generate outputs, such as predictions, content, recommendations, or decisions, that can influence physical or virtual environments.Sec. 3(1); and (ii) familiarity with the relevant details regarding the type of artificial intelligence systemArtificial intelligence systemThe term "artificial intelligence system" means a machine-based system that, for explicit or implicit objectives, infers, from the input the system receives, how to generate outputs, such as predictions, content, recommendations, or decisions, that can influence physical or virtual environments.Sec. 3(1) being evaluated. (8) SECRETARYSecretaryThe term "Secretary" means the Secretary of Commerce.Sec. 3(8).—The term ''SecretarySecretaryThe term "Secretary" means the Secretary of Commerce.Sec. 3(8)'' means the Secretary of Commerce.
Defines eight key terms used throughout the Act, including artificial intelligence system, developer, deployer, external artificial intelligence assurance, internal artificial intelligence assurance, and nonaffiliated third party. Notably, the definitions of developer and deployer are used for scoping purposes within the voluntary guidelines framework — neither term triggers direct compliance obligations on those entities. The nonaffiliated third party definition imposes independence and qualification requirements for external assurance evaluators.
(a) 1 Not later than 1 year after the date of the enactment of this Act, the DirectorDirectorThe term "Director" means the Director of the National Institute of Standards and Technology.Sec. 3(4), in collaboration with public and private sector organizations, including the National Science Foundation and the Department of Energy, shall develop and, not less frequently than every 2 years, shall review and update as the DirectorDirectorThe term "Director" means the Director of the National Institute of Standards and Technology.Sec. 3(4) considers appropriate, a set of voluntary technical guidelines and specifications for internal artificial intelligence assuranceInternal artificial intelligence assuranceThe term "internal artificial intelligence assurance" means an independent evaluation of an artificial intelligence system conducted by the party being evaluated with an internal reporting structure that encourages impartial evaluations and prevents conflicts of interest, for the purpose of— (A) verifying claims with respect to the functionality and testing of the artificial intelligence system, including verifying whether it is fit for its intended purpose; or (B) identifying any significant error or inconsistency in the testing, risk management process, or internal governance or any substantial vulnerability of the artificial intelligence system.Sec. 3(6) and external artificial intelligence assuranceExternal artificial intelligence assuranceThe term "external artificial intelligence assurance" means an independent and impartial evaluation of an artificial intelligence system conducted by a nonaffiliated third party in accordance with the voluntary assurance technical guidelines and specifications described in section 4 or consensus-driven voluntary standards, for the purpose of— (A) verifying claims with respect to the functionality and testing of the artificial intelligence system, including verifying whether it is fit for its intended purpose; or (B) identifying any significant error or inconsistency in the testing, risk management processes, or internal governance, any substantial vulnerability, or any negative societal impact of the artificial intelligence system.Sec. 3(5).
(b)(1)–(10) 1 The technical guidelines and specifications required by subsection (a) shall— (1) identify consensus-driven, voluntary standards for internal artificial intelligence assuranceInternal artificial intelligence assuranceThe term "internal artificial intelligence assurance" means an independent evaluation of an artificial intelligence system conducted by the party being evaluated with an internal reporting structure that encourages impartial evaluations and prevents conflicts of interest, for the purpose of— (A) verifying claims with respect to the functionality and testing of the artificial intelligence system, including verifying whether it is fit for its intended purpose; or (B) identifying any significant error or inconsistency in the testing, risk management process, or internal governance or any substantial vulnerability of the artificial intelligence system.Sec. 3(6) and external artificial intelligence assuranceExternal artificial intelligence assuranceThe term "external artificial intelligence assurance" means an independent and impartial evaluation of an artificial intelligence system conducted by a nonaffiliated third party in accordance with the voluntary assurance technical guidelines and specifications described in section 4 or consensus-driven voluntary standards, for the purpose of— (A) verifying claims with respect to the functionality and testing of the artificial intelligence system, including verifying whether it is fit for its intended purpose; or (B) identifying any significant error or inconsistency in the testing, risk management processes, or internal governance, any substantial vulnerability, or any negative societal impact of the artificial intelligence system.Sec. 3(5) that address— (A) safeguards for consumer privacy; (B) methods to assess and mitigate harms to individuals by artificial intelligence systemsArtificial intelligence systemThe term "artificial intelligence system" means a machine-based system that, for explicit or implicit objectives, infers, from the input the system receives, how to generate outputs, such as predictions, content, recommendations, or decisions, that can influence physical or virtual environments.Sec. 3(1); (C) dataset quality; (D) documentation, disclosure, and provenance communications to external parties; and (E) governance and process controls; (2) provide technical guidelines, best practices, methodologies, procedures, and processes, as appropriate, for internal artificial intelligence assuranceInternal artificial intelligence assuranceThe term "internal artificial intelligence assurance" means an independent evaluation of an artificial intelligence system conducted by the party being evaluated with an internal reporting structure that encourages impartial evaluations and prevents conflicts of interest, for the purpose of— (A) verifying claims with respect to the functionality and testing of the artificial intelligence system, including verifying whether it is fit for its intended purpose; or (B) identifying any significant error or inconsistency in the testing, risk management process, or internal governance or any substantial vulnerability of the artificial intelligence system.Sec. 3(6) and external artificial intelligence assuranceExternal artificial intelligence assuranceThe term "external artificial intelligence assurance" means an independent and impartial evaluation of an artificial intelligence system conducted by a nonaffiliated third party in accordance with the voluntary assurance technical guidelines and specifications described in section 4 or consensus-driven voluntary standards, for the purpose of— (A) verifying claims with respect to the functionality and testing of the artificial intelligence system, including verifying whether it is fit for its intended purpose; or (B) identifying any significant error or inconsistency in the testing, risk management processes, or internal governance, any substantial vulnerability, or any negative societal impact of the artificial intelligence system.Sec. 3(5) that effectively address the elements listed in paragraph (1); (3) establish common definitions and characterizations for testing, evaluating, verifying, and validating methods for internal artificial intelligence assuranceInternal artificial intelligence assuranceThe term "internal artificial intelligence assurance" means an independent evaluation of an artificial intelligence system conducted by the party being evaluated with an internal reporting structure that encourages impartial evaluations and prevents conflicts of interest, for the purpose of— (A) verifying claims with respect to the functionality and testing of the artificial intelligence system, including verifying whether it is fit for its intended purpose; or (B) identifying any significant error or inconsistency in the testing, risk management process, or internal governance or any substantial vulnerability of the artificial intelligence system.Sec. 3(6) and external artificial intelligence assuranceExternal artificial intelligence assuranceThe term "external artificial intelligence assurance" means an independent and impartial evaluation of an artificial intelligence system conducted by a nonaffiliated third party in accordance with the voluntary assurance technical guidelines and specifications described in section 4 or consensus-driven voluntary standards, for the purpose of— (A) verifying claims with respect to the functionality and testing of the artificial intelligence system, including verifying whether it is fit for its intended purpose; or (B) identifying any significant error or inconsistency in the testing, risk management processes, or internal governance, any substantial vulnerability, or any negative societal impact of the artificial intelligence system.Sec. 3(5); (4) recommend criteria or approaches for a developerDeveloperThe term "developer"— (A) means an entity that builds, designs, codes, produces, trains, or owns an artificial intelligence system for internal use or for use by a third party; and (B) does not include an entity that is solely a deployer of the artificial intelligence system.Sec. 3(3) or deployerDeployerThe term "deployer" means an entity that operates an artificial intelligence system for internal use or for use by a third party.Sec. 3(2) to determine the frequency and circumstances under which internal artificial intelligence assuranceInternal artificial intelligence assuranceThe term "internal artificial intelligence assurance" means an independent evaluation of an artificial intelligence system conducted by the party being evaluated with an internal reporting structure that encourages impartial evaluations and prevents conflicts of interest, for the purpose of— (A) verifying claims with respect to the functionality and testing of the artificial intelligence system, including verifying whether it is fit for its intended purpose; or (B) identifying any significant error or inconsistency in the testing, risk management process, or internal governance or any substantial vulnerability of the artificial intelligence system.Sec. 3(6) and external artificial intelligence assuranceExternal artificial intelligence assuranceThe term "external artificial intelligence assurance" means an independent and impartial evaluation of an artificial intelligence system conducted by a nonaffiliated third party in accordance with the voluntary assurance technical guidelines and specifications described in section 4 or consensus-driven voluntary standards, for the purpose of— (A) verifying claims with respect to the functionality and testing of the artificial intelligence system, including verifying whether it is fit for its intended purpose; or (B) identifying any significant error or inconsistency in the testing, risk management processes, or internal governance, any substantial vulnerability, or any negative societal impact of the artificial intelligence system.Sec. 3(5) activities should be conducted, accounting for the relevant risk and use-case profile of the artificial intelligence systemArtificial intelligence systemThe term "artificial intelligence system" means a machine-based system that, for explicit or implicit objectives, infers, from the input the system receives, how to generate outputs, such as predictions, content, recommendations, or decisions, that can influence physical or virtual environments.Sec. 3(1), and any additional circumstance under which an assurance should be conducted; (5) recommend criteria or approaches for a developerDeveloperThe term "developer"— (A) means an entity that builds, designs, codes, produces, trains, or owns an artificial intelligence system for internal use or for use by a third party; and (B) does not include an entity that is solely a deployer of the artificial intelligence system.Sec. 3(3) or deployerDeployerThe term "deployer" means an entity that operates an artificial intelligence system for internal use or for use by a third party.Sec. 3(2) to determine the scope of internal artificial intelligence assuranceInternal artificial intelligence assuranceThe term "internal artificial intelligence assurance" means an independent evaluation of an artificial intelligence system conducted by the party being evaluated with an internal reporting structure that encourages impartial evaluations and prevents conflicts of interest, for the purpose of— (A) verifying claims with respect to the functionality and testing of the artificial intelligence system, including verifying whether it is fit for its intended purpose; or (B) identifying any significant error or inconsistency in the testing, risk management process, or internal governance or any substantial vulnerability of the artificial intelligence system.Sec. 3(6) and external artificial intelligence assuranceExternal artificial intelligence assuranceThe term "external artificial intelligence assurance" means an independent and impartial evaluation of an artificial intelligence system conducted by a nonaffiliated third party in accordance with the voluntary assurance technical guidelines and specifications described in section 4 or consensus-driven voluntary standards, for the purpose of— (A) verifying claims with respect to the functionality and testing of the artificial intelligence system, including verifying whether it is fit for its intended purpose; or (B) identifying any significant error or inconsistency in the testing, risk management processes, or internal governance, any substantial vulnerability, or any negative societal impact of the artificial intelligence system.Sec. 3(5) conducted through testing and evaluating, accounting for the relevant risk and use-case profile of the artificial intelligence systemArtificial intelligence systemThe term "artificial intelligence system" means a machine-based system that, for explicit or implicit objectives, infers, from the input the system receives, how to generate outputs, such as predictions, content, recommendations, or decisions, that can influence physical or virtual environments.Sec. 3(1), including the minimum information or technical resources that should be provided to the party conducting the assurance to enable assurance activities; (6) provide guidance for the manner in which a developerDeveloperThe term "developer"— (A) means an entity that builds, designs, codes, produces, trains, or owns an artificial intelligence system for internal use or for use by a third party; and (B) does not include an entity that is solely a deployer of the artificial intelligence system.Sec. 3(3) or deployerDeployerThe term "deployer" means an entity that operates an artificial intelligence system for internal use or for use by a third party.Sec. 3(2) may disclose, as appropriate, the results of an internal or external assurance or carry out corrective actions with respect to an artificial intelligence systemArtificial intelligence systemThe term "artificial intelligence system" means a machine-based system that, for explicit or implicit objectives, infers, from the input the system receives, how to generate outputs, such as predictions, content, recommendations, or decisions, that can influence physical or virtual environments.Sec. 3(1) following the completion of an internal or external assurance of such system, and guidance on the manner in which a developerDeveloperThe term "developer"— (A) means an entity that builds, designs, codes, produces, trains, or owns an artificial intelligence system for internal use or for use by a third party; and (B) does not include an entity that is solely a deployer of the artificial intelligence system.Sec. 3(3) or deployerDeployerThe term "deployer" means an entity that operates an artificial intelligence system for internal use or for use by a third party.Sec. 3(2) may properly document any corrective action taken; (7) align with the voluntary consensus standards, including international standards, identified pursuant to paragraph (1) to the fullest extent possible; (8) incorporate the relevant voluntary consensus standards identified pursuant to paragraph (1) and industry best practices to the fullest extent possible; (9) not prescribe or otherwise require— (A) the use of any specific solution; or (B) the use of any specific information or any communications technology product or service; and (10) recommend methods to protect the confidentiality of sensitive information, including personal data and proprietary knowledge of an artificial intelligence systemArtificial intelligence systemThe term "artificial intelligence system" means a machine-based system that, for explicit or implicit objectives, infers, from the input the system receives, how to generate outputs, such as predictions, content, recommendations, or decisions, that can influence physical or virtual environments.Sec. 3(1), that may be obtained during the assurance process.
(c)(1)–(3) 2 In developing the voluntary technical guidelines and specifications required by subsection (a), the DirectorDirectorThe term "Director" means the Director of the National Institute of Standards and Technology.Sec. 3(4) shall— (1) solicit public comment on at least 1 draft of the technical guidelines and specifications, and provide a reasonable period of not less than 30 days for the submission of comments by interested stakeholders; (2) make each complete draft of the voluntary technical guidelines and specifications developed under subsection (a) available to the public on the website of the National Institute of Standards and Technology; and (3) convene workshops, roundtables, and other public forums, as the DirectorDirectorThe term "Director" means the Director of the National Institute of Standards and Technology.Sec. 3(4) considers appropriate, to consult with relevant stakeholders in industry, academia, civil society, consumer advocacy, workforce development organizations, labor organizations, conformance assessment bodies, and any other sector the DirectorDirectorThe term "Director" means the Director of the National Institute of Standards and Technology.Sec. 3(4) considers appropriate, on the development of the voluntary technical guidelines and specifications.
(d) 3 The DirectorDirectorThe term "Director" means the Director of the National Institute of Standards and Technology.Sec. 3(4) shall publish the voluntary technical guidelines and specifications required by subsection (a) as a standalone framework or document available to the public on the website of the National Institute of Standards and Technology.
This is the operative core of the bill. It directs the Director of NIST, within one year of enactment, to develop voluntary technical guidelines and specifications for internal and external AI assurance, and to review and update them at least every two years. The guidelines must cover consumer privacy safeguards, harm assessment and mitigation, dataset quality, documentation and provenance, governance and process controls, common definitions for testing and evaluation methods, recommended frequency and scope of assurance activities, disclosure and corrective action guidance, alignment with international standards, technology neutrality, and methods to protect confidential information during assurance. The Director must solicit public comment on at least one draft, post drafts on the NIST website, and convene stakeholder workshops. The final guidelines must be published as a standalone framework on the NIST website. All obligations in this section fall on a federal agency (NIST) — no private-sector compliance obligations are created.
(a) 4 Not later than 90 days after the date on which the DirectorDirectorThe term "Director" means the Director of the National Institute of Standards and Technology.Sec. 3(4) publishes the voluntary technical guidelines and specifications required under section 4(a), the SecretarySecretaryThe term "Secretary" means the Secretary of Commerce.Sec. 3(8) shall establish the Artificial Intelligence Assurance Qualifications Advisory Committee (referred to in this section as the ''Advisory Committee'').
(b) 4 The SecretarySecretaryThe term "Secretary" means the Secretary of Commerce.Sec. 3(8) shall appoint to the Advisory Committee not more than 20 individuals with expertise relating to artificial intelligence systemsArtificial intelligence systemThe term "artificial intelligence system" means a machine-based system that, for explicit or implicit objectives, infers, from the input the system receives, how to generate outputs, such as predictions, content, recommendations, or decisions, that can influence physical or virtual environments.Sec. 3(1), including at least 1 representative from each of the following: (1) Institutions of higher education. (2) Organizations developing artificial intelligence systemsArtificial intelligence systemThe term "artificial intelligence system" means a machine-based system that, for explicit or implicit objectives, infers, from the input the system receives, how to generate outputs, such as predictions, content, recommendations, or decisions, that can influence physical or virtual environments.Sec. 3(1). (3) Organizations deploying artificial intelligence systemsArtificial intelligence systemThe term "artificial intelligence system" means a machine-based system that, for explicit or implicit objectives, infers, from the input the system receives, how to generate outputs, such as predictions, content, recommendations, or decisions, that can influence physical or virtual environments.Sec. 3(1). (4) Organizations assessing artificial intelligence systemsArtificial intelligence systemThe term "artificial intelligence system" means a machine-based system that, for explicit or implicit objectives, infers, from the input the system receives, how to generate outputs, such as predictions, content, recommendations, or decisions, that can influence physical or virtual environments.Sec. 3(1). (5) Consumers or consumer advocacy groups. (6) Public health organizations. (7) Public safety organizations. (8) Civil rights organizations. (9) Professional accreditation organizations. (10) Workforce development organizations. (11) Labor organizations. (12) Nonprofit assurance professional organizations.
(c)–(d) 5 The Advisory Committee shall— (1) review and assess case studies from entities that provide licensure, certification, or accreditation to independent organizations with a primary mission of verifying compliance with applicable statutes, regulations, standards, or guidelines; and (2) determine the applicability of the case studies reviewed and assessed under paragraph (1) to the development, maintenance, and use of artificial intelligence systemsArtificial intelligence systemThe term "artificial intelligence system" means a machine-based system that, for explicit or implicit objectives, infers, from the input the system receives, how to generate outputs, such as predictions, content, recommendations, or decisions, that can influence physical or virtual environments.Sec. 3(1) for the purpose of developing recommendations under subsection (d). Not later than 1 year after the date on which the SecretarySecretaryThe term "Secretary" means the Secretary of Commerce.Sec. 3(8) establishes the Advisory Committee under this section, the Advisory Committee shall submit to the SecretarySecretaryThe term "Secretary" means the Secretary of Commerce.Sec. 3(8) and Congress and make publicly available a report that includes recommendations for the SecretarySecretaryThe term "Secretary" means the Secretary of Commerce.Sec. 3(8) to consider regarding— (1) the qualifications, expertise, professional licensing, independence, and accountability that a party conducting an assurance of an artificial intelligence systemArtificial intelligence systemThe term "artificial intelligence system" means a machine-based system that, for explicit or implicit objectives, infers, from the input the system receives, how to generate outputs, such as predictions, content, recommendations, or decisions, that can influence physical or virtual environments.Sec. 3(1) should have, including with respect to the type of artificial intelligence systemArtificial intelligence systemThe term "artificial intelligence system" means a machine-based system that, for explicit or implicit objectives, infers, from the input the system receives, how to generate outputs, such as predictions, content, recommendations, or decisions, that can influence physical or virtual environments.Sec. 3(1) under evaluation and the internal and external assurance processes; and (2) whether accreditation for internal artificial intelligence assuranceInternal artificial intelligence assuranceThe term "internal artificial intelligence assurance" means an independent evaluation of an artificial intelligence system conducted by the party being evaluated with an internal reporting structure that encourages impartial evaluations and prevents conflicts of interest, for the purpose of— (A) verifying claims with respect to the functionality and testing of the artificial intelligence system, including verifying whether it is fit for its intended purpose; or (B) identifying any significant error or inconsistency in the testing, risk management process, or internal governance or any substantial vulnerability of the artificial intelligence system.Sec. 3(6) and external artificial intelligence assuranceExternal artificial intelligence assuranceThe term "external artificial intelligence assurance" means an independent and impartial evaluation of an artificial intelligence system conducted by a nonaffiliated third party in accordance with the voluntary assurance technical guidelines and specifications described in section 4 or consensus-driven voluntary standards, for the purpose of— (A) verifying claims with respect to the functionality and testing of the artificial intelligence system, including verifying whether it is fit for its intended purpose; or (B) identifying any significant error or inconsistency in the testing, risk management processes, or internal governance, any substantial vulnerability, or any negative societal impact of the artificial intelligence system.Sec. 3(5) can be met through a combination of existing licensure, certification, or accreditation programs.
(e) The Advisory Committee shall terminate not later than 1 year after the date on which the Advisory Committee submits the recommendations required under subsection (d).
Directs the Secretary of Commerce to establish the Artificial Intelligence Assurance Qualifications Advisory Committee within 90 days of the NIST guidelines publication. The committee must include up to 20 members drawn from higher education, AI developers, deployers, assessors, consumers, public health and safety organizations, civil rights organizations, professional accreditation bodies, workforce development groups, labor organizations, and nonprofit assurance organizations. The committee must review accreditation case studies, assess their applicability to AI assurance, and within one year submit to Congress and the Secretary a public report recommending qualifications for AI assurance evaluators and assessing whether existing accreditation programs can serve AI assurance needs. The committee terminates one year after submitting its report. All duties fall on the Secretary and the advisory committee — no private-sector compliance obligations are created.
(a) 6 Not later than 90 days after the date on which the DirectorDirectorThe term "Director" means the Director of the National Institute of Standards and Technology.Sec. 3(4) publishes the voluntary technical guidelines and specifications required under section 4(a), the SecretarySecretaryThe term "Secretary" means the Secretary of Commerce.Sec. 3(8) shall commence a study to evaluate the capabilities of the sector of entities that conduct internal artificial intelligence assurancesInternal artificial intelligence assuranceThe term "internal artificial intelligence assurance" means an independent evaluation of an artificial intelligence system conducted by the party being evaluated with an internal reporting structure that encourages impartial evaluations and prevents conflicts of interest, for the purpose of— (A) verifying claims with respect to the functionality and testing of the artificial intelligence system, including verifying whether it is fit for its intended purpose; or (B) identifying any significant error or inconsistency in the testing, risk management process, or internal governance or any substantial vulnerability of the artificial intelligence system.Sec. 3(6) and external artificial intelligence assurancesExternal artificial intelligence assuranceThe term "external artificial intelligence assurance" means an independent and impartial evaluation of an artificial intelligence system conducted by a nonaffiliated third party in accordance with the voluntary assurance technical guidelines and specifications described in section 4 or consensus-driven voluntary standards, for the purpose of— (A) verifying claims with respect to the functionality and testing of the artificial intelligence system, including verifying whether it is fit for its intended purpose; or (B) identifying any significant error or inconsistency in the testing, risk management processes, or internal governance, any substantial vulnerability, or any negative societal impact of the artificial intelligence system.Sec. 3(5).
(b)(1)–(4) 6 In carrying out the study required by subsection (a), the SecretarySecretaryThe term "Secretary" means the Secretary of Commerce.Sec. 3(8) shall— (1) assess the capabilities of the sector of entities described in subsection (a) with respect to personnel, technical tools, evaluation methods, computing infrastructure, and physical infrastructure and whether such capabilities are adequate for providing internal artificial intelligence assurancesInternal artificial intelligence assuranceThe term "internal artificial intelligence assurance" means an independent evaluation of an artificial intelligence system conducted by the party being evaluated with an internal reporting structure that encourages impartial evaluations and prevents conflicts of interest, for the purpose of— (A) verifying claims with respect to the functionality and testing of the artificial intelligence system, including verifying whether it is fit for its intended purpose; or (B) identifying any significant error or inconsistency in the testing, risk management process, or internal governance or any substantial vulnerability of the artificial intelligence system.Sec. 3(6) or external artificial intelligence assurancesExternal artificial intelligence assuranceThe term "external artificial intelligence assurance" means an independent and impartial evaluation of an artificial intelligence system conducted by a nonaffiliated third party in accordance with the voluntary assurance technical guidelines and specifications described in section 4 or consensus-driven voluntary standards, for the purpose of— (A) verifying claims with respect to the functionality and testing of the artificial intelligence system, including verifying whether it is fit for its intended purpose; or (B) identifying any significant error or inconsistency in the testing, risk management processes, or internal governance, any substantial vulnerability, or any negative societal impact of the artificial intelligence system.Sec. 3(5) that comport with the voluntary technical guidelines and specifications required under section 4(a); (2) review the features, best practices, and safeguards employed by such entities to maintain the integrity of confidential or proprietary information of a developerDeveloperThe term "developer"— (A) means an entity that builds, designs, codes, produces, trains, or owns an artificial intelligence system for internal use or for use by a third party; and (B) does not include an entity that is solely a deployer of the artificial intelligence system.Sec. 3(3) or deployerDeployerThe term "deployer" means an entity that operates an artificial intelligence system for internal use or for use by a third party.Sec. 3(2) during an internal artificial intelligence assuranceInternal artificial intelligence assuranceThe term "internal artificial intelligence assurance" means an independent evaluation of an artificial intelligence system conducted by the party being evaluated with an internal reporting structure that encourages impartial evaluations and prevents conflicts of interest, for the purpose of— (A) verifying claims with respect to the functionality and testing of the artificial intelligence system, including verifying whether it is fit for its intended purpose; or (B) identifying any significant error or inconsistency in the testing, risk management process, or internal governance or any substantial vulnerability of the artificial intelligence system.Sec. 3(6) or an external artificial intelligence assuranceExternal artificial intelligence assuranceThe term "external artificial intelligence assurance" means an independent and impartial evaluation of an artificial intelligence system conducted by a nonaffiliated third party in accordance with the voluntary assurance technical guidelines and specifications described in section 4 or consensus-driven voluntary standards, for the purpose of— (A) verifying claims with respect to the functionality and testing of the artificial intelligence system, including verifying whether it is fit for its intended purpose; or (B) identifying any significant error or inconsistency in the testing, risk management processes, or internal governance, any substantial vulnerability, or any negative societal impact of the artificial intelligence system.Sec. 3(5); (3) assess the market demand for internal artificial intelligence assurancesInternal artificial intelligence assuranceThe term "internal artificial intelligence assurance" means an independent evaluation of an artificial intelligence system conducted by the party being evaluated with an internal reporting structure that encourages impartial evaluations and prevents conflicts of interest, for the purpose of— (A) verifying claims with respect to the functionality and testing of the artificial intelligence system, including verifying whether it is fit for its intended purpose; or (B) identifying any significant error or inconsistency in the testing, risk management process, or internal governance or any substantial vulnerability of the artificial intelligence system.Sec. 3(6) and external artificial intelligence assurancesExternal artificial intelligence assuranceThe term "external artificial intelligence assurance" means an independent and impartial evaluation of an artificial intelligence system conducted by a nonaffiliated third party in accordance with the voluntary assurance technical guidelines and specifications described in section 4 or consensus-driven voluntary standards, for the purpose of— (A) verifying claims with respect to the functionality and testing of the artificial intelligence system, including verifying whether it is fit for its intended purpose; or (B) identifying any significant error or inconsistency in the testing, risk management processes, or internal governance, any substantial vulnerability, or any negative societal impact of the artificial intelligence system.Sec. 3(5) and the availability of such assurers; and (4) assess the feasibility of leveraging an existing facility accredited by the DirectorDirectorThe term "Director" means the Director of the National Institute of Standards and Technology.Sec. 3(4) under the National Voluntary Laboratory Accreditation Program established under part 285 of title 15, Code of Federal Regulations, to conduct external assurances of artificial intelligence systemsArtificial intelligence systemThe term "artificial intelligence system" means a machine-based system that, for explicit or implicit objectives, infers, from the input the system receives, how to generate outputs, such as predictions, content, recommendations, or decisions, that can influence physical or virtual environments.Sec. 3(1).
(c)(1)–(3) 7 Not later than 1 year after the date on which the SecretarySecretaryThe term "Secretary" means the Secretary of Commerce.Sec. 3(8) commences the study required by subsection (a), the SecretarySecretaryThe term "Secretary" means the Secretary of Commerce.Sec. 3(8) shall submit to the appropriate committees of Congress and the head of any Federal agency that the SecretarySecretaryThe term "Secretary" means the Secretary of Commerce.Sec. 3(8) considers relevant, a report that contains the results of the study required by subsection (a), including— (1) recommendations for improving the capabilities and the availability of the entities assessed in the study; (2) descriptions of the features, best practices, and safeguards of the entities studied and the effectiveness of such features, practices, or safeguards at implementing the voluntary technical guidelines and specifications required under section 4(a) and at maintaining the integrity of confidential and proprietary information, as described under subsection (b)(2); and (3) any conclusions drawn from the assessment of the facilities described in subsection (b)(4).
(d) In this section, the term the ''appropriate committees of Congress'' means— (1) the Committee of Commerce, Science, and Transportation of the Senate; and (2) the Committee on Science, Space, and Technology of the House of Representatives.
Directs the Secretary of Commerce to commence a study within 90 days of NIST guidelines publication evaluating the capabilities of entities that conduct internal and external AI assurances. The study must assess personnel, technical tools, evaluation methods, computing and physical infrastructure adequacy; review safeguards for confidential and proprietary information during assurance processes; assess market demand and availability of assurers; and evaluate the feasibility of leveraging NIST-accredited National Voluntary Laboratory Accreditation Program facilities for external AI assurance. The Secretary must submit a report to the Senate Committee on Commerce, Science, and Transportation and the House Committee on Science, Space, and Technology within one year. No private-sector obligations are created.