Regulon — US-S-2892 · US S 2892 (Algorithmic Accountability)

WHAT THIS BILL REGULATES · 7 REQUIREMENT TYPES

How Is This Bill Enforced

Enforcement Authority

Federal Trade Commission enforcement. Violations are treated as unfair or deceptive acts or practices under FTC Act § 18(a)(1)(B). FTC enforces with same jurisdiction, powers, and duties as under the FTC Act. State attorneys general may bring parens patriae civil actions in federal district court on behalf of state residents; other authorized state officials may also bring actions. No private right of action.

Private Right of Action

No private right of action. Enforcement is exclusive to the designated authority.

Penalties

Penalties and immunities are those provided under the Federal Trade Commission Act (15 U.S.C. 41 et seq.). The bill does not specify statutory damages amounts. State attorneys general may seek 'appropriate relief' in federal district court.

Verbatim statutory text on the left; plain-language analysis and a per-section checklist on the right. Numbered markers cross-link to the matching checklist row.

Statutory Text

Analysis & Obligations

Sec. 2

Definitions

(1)–(16) AUGMENTED CRITICAL DECISION PROCESS.—The term "augmented critical decision process" means a process, procedure, or other activity that employs an automated decision system to make a critical decision. (2) AUTOMATED DECISION SYSTEM.—The term "automated decision system" means any system, software, or process (including one derived from machine learning, statistics, or other data processing or artificial intelligence techniques and excluding passive computing infrastructure) that uses computation, the result of which serves as a basis for a decision or judgment. (3) BIOMETRICS.—The term "biometrics" means any information that represents a biological, physiological, or behavioral attribute or feature of a consumer. (4) CHAIR.—The term "Chair" means the Chair of the Commission. (5) COMMISSION.—The term "Commission" means the Federal Trade Commission. (6) CONSUMER.—The term "consumer" means an individual. (7) COVERED ENTITY.— (A) IN GENERAL.—The term "covered entity" means any person, partnership, or corporation over which the Commission has jurisdiction under section 5(a)(2) of the Federal Trade Commission Act (15 U.S.C. 45(a)(2))— (i) that deploys any augmented critical decision process; and (I) had greater than $50,000,000 in average annual gross receipts or is deemed to have greater than $250,000,000 in equity value for the 3-taxable-year period preceding the most recent fiscal year; (II) possesses, manages, modifies, handles, analyzes, controls, or otherwise uses identifying information about more than 1,000,000 consumers, households, or consumer devices for the purpose of developing or deploying any automated decision system or augmented critical decision process; or (III) is substantially owned, operated, or controlled by a person, partnership, or corporation that meets the requirements under subclause (I) or (II); (ii) that— (I) had greater than $5,000,000 in average annual gross receipts or is deemed to have greater than $25,000,000 in equity value for the 3-taxable-year period preceding the most recent fiscal year; and (II) deploys any automated decision system that is developed for implementation or use, or that the person, partnership, or corporation reasonably expects to be implemented or used, in an augmented critical decision process by any person, partnership, or corporation if such person, partnership, or corporation meets the requirements described in clause (i); or (iii) that met the criteria described in clause (i) or (ii) within the previous 3 years. (B) INFLATION ADJUSTMENT.—For purposes of applying this paragraph in any fiscal year after the first fiscal year that begins on or after the date of enactment of this Act, each of the dollar amounts specified in subparagraph (A) shall be increased by the percentage increase (if any) in the consumer price index for all urban consumers (U.S. city average) from such first fiscal year that begins after such date of enactment to the fiscal year involved. (8) CRITICAL DECISION.—The term "critical decision" means a decision or judgment that has any legal, material, or similarly significant effect on a consumer's life relating to access to or the cost, terms, or availability of— (A) education and vocational training, including assessment, accreditation, or certification; (B) employment, workers management, or self-employment; (C) essential utilities, such as electricity, heat, water, internet or telecommunications access, or transportation; (D) family planning, including adoption services or reproductive services; (E) financial services, including any financial service provided by a mortgage company, mortgage broker, or creditor; (F) healthcare, including mental healthcare, dental, or vision; (G) housing or lodging, including any rental or short-term housing or lodging; (H) legal services, including private arbitration or mediation; or (I) any other service, program, or opportunity decisions about which have a comparably legal, material, or similarly significant effect on a consumer's life as determined by the Commission through rulemaking. (9) DEPLOY.—The term "deploy" means to implement, use, or make available for sale, license, or other commercial relationship. (10) DEVELOP.—The term "develop" means to design, code, produce, customize, or otherwise create or modify. (11) IDENTIFYING INFORMATION.—The term "identifying information" means any information, regardless of how the information is collected, inferred, predicted, or obtained that identifies or represents a consumer, household, or consumer device through data elements or attributes, such as name, postal address, telephone number, biometrics, email address, internet protocol address, social security number, or any other identifying number, identifier, or code. (12) IMPACT ASSESSMENT.—The term "impact assessment" means the ongoing study and evaluation of an automated decision system or augmented critical decision process and its impact on consumers. (13) PASSIVE COMPUTING INFRASTRUCTURE.—The term "passive computing infrastructure" means any intermediary technology that does not influence or determine the outcome of a decision, including— (A) web hosting; (B) domain registration; (C) networking; (D) caching; (E) data storage; or (F) cybersecurity. (14) STATE.—The term "State" means each of the 50 States, the District of Columbia, and any territory or possession of the United States. (15) SUMMARY REPORT.—The term "summary report" means documentation of a subset of information required to be addressed by the impact assessment as described in this Act or determined appropriate by the Commission. (16) THIRD-PARTY DECISION RECIPIENT.—The term "third-party decision recipient" means any person, partnership, or corporation (beyond the consumer and the covered entity) that receives a copy of or has access to the results of any decision or judgment that results from a covered entity's deployment of an automated decision system or augmented critical decision process.

Section 2 establishes the definitional framework for the entire Act. Key defined terms include automated decision system (broadly covering any computational system whose output serves as a basis for a decision), augmented critical decision process (a process using an automated decision system to make a critical decision), and covered entity (entities under FTC jurisdiction meeting revenue, equity, or data-volume thresholds that deploy such systems). The definition of critical decision spans employment, education, housing, healthcare, financial services, utilities, legal services, and family planning — with a catch-all for comparable decisions as determined by FTC rulemaking.

Sec. 3

Assessing the Impact of Automated Decision Systems and Augmented Critical Decision Processes

Deployer

(a)(1)–(2) ACTS PROHIBITED.— (1) IN GENERAL.—It is unlawful for— (A) any covered entity to violate a regulation promulgated under subsection (b); or (B) any person to knowingly provide substantial assistance to any covered entity in violating subsection (b). (2) PREEMPTION OF PRIVATE CONTRACTS.—It shall be unlawful for any covered entity to commit the acts prohibited in paragraph (1), regardless of specific agreements between entities or consumers.

(b)(1)(A) 1 require each covered entity to perform impact assessment of any— (i) deployed automated decision system that was developed for implementation or use, or that the covered entity reasonably expects to be implemented or used, in an augmented critical decision process by any person, partnership, or corporation that meets the requirements described in section 2(7)(A)(i); and (ii) augmented critical decision process, both prior to and after deployment by the covered entity;

(b)(1)(B) 2 require each covered entity to maintain documentation of any impact assessment performed under subparagraph (A), including the applicable information described in section 4(a) for 3 years longer than the duration of time for which the automated decision system or augmented critical decision process is deployed;

(b)(1)(C) 3 require each person, partnership, or corporation that meets the requirements described in section 2(7)(A)(i) to disclose their status as a covered entity to any person, partnership, or corporation that sells, licenses, or otherwise provides through a commercial relationship any automated decision system deployed by the covered entity in an automated decision system or augmented critical decision process;

(b)(1)(D)–(E) 4 require each covered entity to submit to the Commission, on an annual basis, a summary report for ongoing impact assessment of any deployed automated decision system or augmented critical decision process; (E) require each covered entity to submit an initial summary report to the Commission for any new automated decision system or augmented critical decision process prior to its deployment by the covered entity;

(b)(1)(F) allow any person, partnership, or corporation over which the Commission has jurisdiction under section 5(a)(2) of the Federal Trade Commission Act (15 U.S.C. 45(a)(2)) that deploys any automated decision system or augmented critical decision process, but is not a covered entity, to submit to the Commission a summary report for any impact assessment performed with respect to such system or process;

(b)(1)(G) 5 require each covered entity, in performing the impact assessment described in subparagraph (A), to the extent possible, to meaningfully consult (including through participatory design, independent auditing, or soliciting or incorporating feedback) with relevant internal stakeholders (such as employees, ethics teams, and responsible technology teams) and independent external stakeholders (such as representatives of and advocates for impacted groups, civil society and advocates, and technology experts) as frequently as necessary;

(b)(1)(H) 6 require each covered entity to attempt to eliminate or mitigate, in a timely manner, any impact made by an augmented critical decision process that demonstrates a likely material negative impact that has legal or similarly significant effects on a consumer's life;

(b)(1)(I)–(L) establish definitions for— (i) what constitutes "access to or the cost, terms, or availability of" with respect to a critical decision; (ii) what constitutes "possession", "management", "modification", and "control" with respect to identifying information; (iii) the different categories of third-party decision recipients that a covered entity must document under section 5(1)(H); and (iv) any of the services, programs, or opportunities described in subparagraphs (A) through (I) of section 2(8) for the purpose of informing consumers, covered entities, and regulators, as the Commission deems necessary; (J) establish guidelines for any person, partnership, or corporation to calculate the number of consumers, households, or consumer devices for which the person, partnership, or corporation possesses, manages, modifies, or controls identifying information for the purpose of determining covered entity status; (K) establish guidelines for a covered entity to prioritize different automated decision systems and augmented critical decision processes deployed by the covered entity for performing impact assessment; and (L) establish a required format for any summary report, as described in subparagraphs (D), (E), and (F), to ensure that such reports are submitted in an accessible and machine-readable format.

(b)(2)–(3) CONSIDERATIONS.—In promulgating the regulations under paragraph (1), the Commission— (A) shall take into consideration— (i) that certain assessment or documentation of an automated decision system or augmented critical decision process may only be possible at particular stages of the development and deployment of such system or process or may be limited or not possible based on the availability of certain types of information or data or the nature of the relationship between the covered entity and consumers; (ii) the duration of time between summary report submissions and the timeliness of the reported information; (iii) the administrative burden placed on the Commission and the covered entity; (iv) the benefits of standardizing and structuring summary reports for comparative analysis compared with the benefits of less-structured narrative reports to provide detail and flexibility in reporting; (v) that summary reports submitted by different covered entities may contain different fields according to the requirements established by the Commission, and the Commission may allow or require submission of incomplete reports; (vi) that existing data privacy and other regulations may inhibit a covered entity from storing or sharing certain information; and (vii) that a covered entity may require information from other persons, partnerships, or corporations that develop any automated decision system deployed in an automated decision system or augmented critical decision process by the covered entity for the purpose of performing impact assessment; and (B) may develop specific requirements for impact assessments and summary reports for particular— (i) categories of critical decisions, as described in subparagraphs (A) through (I) of section 2(8) or any subcategory developed by the Commission; and (ii) stages of development and deployment of an automated decision system or augmented critical decision process. (3) EFFECTIVE DATE.—The regulations described in paragraph (1) shall take effect on the date that is 2 years after such regulations are promulgated.

Section 3 is the core operative section of the bill. It makes it unlawful for any covered entity to violate FTC regulations promulgated under this section, or for any person to knowingly provide substantial assistance in such a violation. The FTC is directed to promulgate regulations within two years requiring covered entities to perform impact assessments both before and after deployment, maintain documentation for three years beyond the deployment period, submit annual and pre-deployment summary reports to the FTC, disclose covered-entity status to ADS vendors, consult meaningfully with stakeholders, and attempt to eliminate or mitigate material negative impacts on consumers. The regulations take effect two years after promulgation, creating a four-year minimum runway from enactment to compliance.

Private contracts cannot override these obligations. The section also directs the FTC to establish definitions, guidelines for prioritization, and a standardized machine-readable format for summary reports.

Compliance actions 6 items

Covered entities must perform impact assessments of each deployed automated decision system and each augmented critical decision process, both prior to and after deployment.

H-02.3

Covered entities must maintain documentation of each impact assessment, including all information described in Sec. 4(a), for 3 years beyond the duration of deployment of the automated decision system or augmented critical decision process.

G-01.3

Covered entities meeting the large-entity threshold must disclose their covered-entity status to any vendor that sells, licenses, or otherwise provides an automated decision system deployed by the covered entity.

—

Covered entities must submit to the FTC (1) an annual summary report for each deployed automated decision system or augmented critical decision process, and (2) an initial summary report for any new system or process prior to its deployment.

R-02.1

Covered entities must meaningfully consult with relevant internal stakeholders (employees, ethics teams, responsible technology teams) and independent external stakeholders (impacted-group representatives, civil society advocates, technology experts) as part of the impact assessment process, including through participatory design, independent auditing, or soliciting and incorporating feedback.

H-02

Covered entities must attempt to eliminate or mitigate, in a timely manner, any impact of an augmented critical decision process that demonstrates a likely material negative impact with legal or similarly significant effects on a consumer's life.

H-02

Sec. 4

Requirements for Covered Entity Impact Assessment

Deployer

(a)(1)–(2) 7 In the case of a new augmented critical decision process, evaluate any previously existing critical decision-making process used for the same critical decision prior to the deployment of the new augmented critical decision process, along with any related documentation or information, such as— (A) a description of the baseline process being enhanced or replaced by the augmented critical decision process; (B) any known harm, shortcoming, failure case, or material negative impact on consumers of the previously existing process used to make the critical decision; (C) the intended benefits of and need for the augmented critical decision process; and (D) the intended purpose of the automated decision system or augmented critical decision process. (2) Identify and describe any consultation with relevant stakeholders as required by section 3(b)(1)(G), including by documenting— (A) the points of contact for the stakeholders who were consulted; (B) the date of any such consultation; and (C) information about the terms and process of the consultation, such as— (i) the existence and nature of any legal or financial agreement between the stakeholders and the covered entity; (ii) any data, system, design, scenario, or other document or material the stakeholder interacted with; and (iii) any recommendations made by the stakeholders that were used to modify the development or deployment of the automated decision system or augmented critical decision process, as well as any recommendations not used and the rationale for such nonuse.

(a)(3) 8 In accordance with any relevant National Institute of Standards and Technology or other Federal Government best practices and standards, perform ongoing testing and evaluation of the privacy risks and privacy-enhancing measures of the automated decision system or augmented critical decision process, such as— (A) assessing and documenting the data minimization practices of such system or process and the duration for which the relevant identifying information and any resulting critical decision is stored; (B) assessing the information security measures in place with respect to such system or process, including any use of privacy-enhancing technology such as federated learning, differential privacy, secure multi-party computation, de-identification, or secure data enclaves based on the level of risk; and (C) assessing and documenting the current and potential future or downstream positive and negative impacts of such system or process on the privacy, safety, or security of consumers and their identifying information.

(a)(4) 9 Perform ongoing testing and evaluation of the current and historical performance of the automated decision system or augmented critical decision process using measures such as benchmarking datasets, representative examples from the covered entity's historical data, and other standards, including by documenting— (A) a description of what is deemed successful performance and the methods and technical and business metrics used by the covered entity to assess performance; (B) a review of the performance of such system or process under test conditions or an explanation of why such performance testing was not conducted; (C) a review of the performance of such system or process under deployed conditions or an explanation of why performance was not reviewed under deployed conditions; (D) a comparison of the performance of such system or process under deployed conditions to test conditions or an explanation of why such a comparison was not possible; (E) an evaluation of any differential performance associated with consumers' race, color, sex, gender, age, disability, religion, family status, socioeconomic status, or veteran status, and any other characteristics the Commission deems appropriate (including any combination of such characteristics) for which the covered entity has information, including a description of the methodology for such evaluation and information about and documentation of the methods used to identify such characteristics in the data (such as through the use of proxy data, including ZIP Codes); and (F) if any subpopulations were used for testing and evaluation, a description of which subpopulations were used and how and why such subpopulations were determined to be of relevance for the testing and evaluation.

(a)(5) 10 Support and perform ongoing training and education for all relevant employees, contractors, or other agents regarding any documented material negative impacts on consumers from similar automated decision systems or augmented critical decision processes and any improved methods of developing or performing an impact assessment for such system or process based on industry best practices and relevant proposals and publications from experts, such as advocates, journalists, and academics.

(a)(6) 11 Assess the need for and possible development of any guard rail for or limitation on certain uses or applications of the automated decision system or augmented critical decision process, including whether such uses or applications ought to be prohibited or otherwise limited through any terms of use, licensing agreement, or other legal agreement between entities.

(a)(7) 12 Maintain and keep updated documentation of any data or other input information used to develop, test, maintain, or update the automated decision system or augmented critical decision process, including— (A) how and when such data or other input information was sourced and, if applicable, licensed, including information such as— (i) metadata and information about the structure and type of data or other input information, such as the file type, the date of the file creation or modification, and a description of data fields; (ii) an explanation of the methodology by which the covered entity collected, inferred, or obtained the data or other input information and, if applicable, labeled, categorized, sorted, or clustered such data or other input information, including whether such data or other input information was labeled, categorized, sorted, or clustered prior to being collected, inferred, or obtained by the covered entity; and (iii) whether and how consumers provided informed consent for the inclusion and further use of data or other input information about themselves and any limitations stipulated on such inclusion or further use; (B) why such data or other input information was used and what alternatives were explored; and (C) other information about the data or other input information, such as— (i) the representativeness of the dataset and how this factor was measured, including any assumption about the distribution of the population on which the augmented critical decision process is deployed; and (ii) the quality of the data, how the quality was evaluated, and any measure taken to normalize, correct, or clean the data.

(a)(8) 13 Evaluate the rights of consumers, such as— (A) by assessing the extent to which the covered entity provides consumers with— (i) clear notice that such system or process will be used; and (ii) a mechanism for opting out of such use; (B) by assessing the transparency and explainability of such system or process and the degree to which a consumer may contest, correct, or appeal a decision or opt out of such system or process, including— (i) the information available to consumers or representatives or agents of consumers about the system or process, such as any relevant factors that contribute to a particular decision, including an explanation of which contributing factors, if changed, would cause the system or process to reach a different decision, and how such consumer, representative, or agent can access such information; (ii) documentation of any complaint, dispute, correction, appeal, or opt-out request submitted to the covered entity by a consumer with respect to such system or process; and (iii) the process and outcome of any remediation measure taken by the covered entity to address the concerns of or harms to consumers; and (C) by describing the extent to which any third-party decision recipient receives a copy of or has access to the results of such system or process and the category of such third-party decision recipient, as defined by the Commission in section 3(b)(1)(I)(iii).

(a)(9) 14 Identify any likely material negative impact of the automated decision system or augmented critical decision process on consumers and assess any applicable mitigation strategy, such as by— (A) identifying and measuring any likely material negative impact of the system or process on consumers, including documentation of the steps taken to identify and measure such impact; (B) documenting any steps taken to eliminate or reasonably mitigate any likely material negative impact identified, including steps such as removing the system or process from the market or terminating its development; (C) with respect to the likely material negative impacts identified, documenting which such impacts were left unmitigated and the rationale for the inaction, including details about the justifying non-discriminatory, compelling interest and why such interest cannot be satisfied by other means (such as where there is an equal, zero-sum trade-off between impacts on 2 or more consumers or where the required mitigating action would violate civil rights or other laws); and (D) documenting standard protocols or practices used to identify, measure, mitigate, or eliminate any likely material negative impact on consumers and how relevant teams or staff are informed of and trained about such protocols or practices.

(a)(10)–(13) 15 Describe any ongoing documentation of the development and deployment process with respect to the automated decision system or augmented critical decision process, including information such as— (A) the date of any testing, deployment, licensure, or other significant milestones; and (B) points of contact for any team, business unit, or similar internal stakeholder that was involved. (11) Identify any capabilities, tools, standards, datasets, security protocols, improvements to stakeholder engagement, or other resources that may be necessary or beneficial to improving the automated decision system, augmented critical decision process, or the impact assessment of such system or process, in areas such as— (A) performance, including accuracy, robustness, and reliability; (B) fairness, including bias and non-discrimination; (C) transparency, explainability, contestability, and opportunity for recourse; (D) privacy and security; (E) personal and public safety; (F) efficiency and timeliness; (G) cost; or (H) any other area determined appropriate by the Commission. (12) Document any of the impact assessment requirements described in paragraphs (1) through (11) that were attempted but were not possible to comply with because they were infeasible, as well as the corresponding rationale for not being able to comply with such requirements, which may include— (A) the absence of certain information about an automated decision system developed by other persons, partnerships, and corporations; (B) the absence of certain information about how clients, customers, licensees, partners, and other persons, partnerships, or corporations are deploying an automated decision system in their augmented critical decision processes; (C) a lack of demographic or other data required to assess differential performance because such data is too sensitive to collect, infer, or store; or (D) a lack of certain capabilities, including technological innovations, that would be necessary to conduct such requirements. (13) Perform and document any other ongoing study or evaluation determined appropriate by the Commission.

(b) RULE OF CONSTRUCTION.—Nothing in this Act should be construed to limit any covered entity from adding other criteria, procedures, or technologies to improve the performance of an impact assessment of their automated decision system or augmented critical decision process.

(c) NONDISCLOSURE OF IMPACT ASSESSMENT.—Nothing in this Act should be construed to require a covered entity to share with or otherwise disclose to the Commission or the public any information contained in an impact assessment performed in accordance with this Act, except for any information contained in the summary report required under subparagraph (D) or (E) of section 3(b)(1).

Section 4 prescribes the substantive content of the impact assessment that covered entities must perform under Sec. 3. The assessment must cover twelve enumerated areas: evaluation of any prior decision-making process being replaced; documentation of stakeholder consultations; ongoing testing and evaluation of privacy risks and privacy-enhancing measures; ongoing performance testing including differential performance across protected characteristics; employee training; assessment of guardrails and use limitations; documentation of training data and input information; evaluation of consumer rights including notice, opt-out, contestability, and explainability; identification and mitigation of material negative impacts; development and deployment documentation; identification of needed improvements; and documentation of any assessment requirements that were infeasible to complete.

The section also includes a rule of construction preserving covered entities' ability to exceed the statutory minimum and a nondisclosure provision clarifying that the full impact assessment need not be shared with the FTC or the public — only the summary report is submitted.

Compliance actions 9 items

Covered entities must, as part of the impact assessment, evaluate any previously existing decision-making process being replaced, document stakeholder consultations (including points of contact, dates, legal agreements, materials reviewed, and recommendations adopted or rejected with rationale), and document the baseline, known harms, intended benefits, and purpose of the new system.

G-01.3

Covered entities must perform ongoing testing and evaluation of the privacy risks and privacy-enhancing measures of each automated decision system or augmented critical decision process, including assessing data minimization practices, data retention duration, information security measures, privacy-enhancing technologies used, and current and potential impacts on consumer privacy, safety, and security.

D-01.4

Covered entities must perform ongoing testing and evaluation of automated decision system performance, including documenting success metrics, test vs. deployed performance, and differential performance across race, color, sex, gender, age, disability, religion, family status, socioeconomic status, veteran status, and any other FTC-designated characteristics, including methodology and proxy-data methods used.

H-02.1

Covered entities must provide ongoing training and education to all relevant employees, contractors, and agents regarding documented material negative impacts from similar automated decision systems and improved impact assessment methods based on industry best practices and expert publications.

G-01

Covered entities must assess the need for guardrails or limitations on certain uses or applications of each automated decision system or augmented critical decision process, including whether specific uses should be prohibited or limited through terms of use, licensing agreements, or other legal agreements.

S-01.1

Covered entities must maintain and keep updated documentation of all data and input information used to develop, test, maintain, or update each automated decision system, including data sourcing and licensing details, metadata and structure, collection methodology, labeling practices, consumer consent status, rationale for data selection, dataset representativeness, and data quality measures.

T-03

Covered entities must evaluate consumer rights as part of the impact assessment, including assessing whether consumers receive clear notice of system use, have an opt-out mechanism, can access information about factors driving their decision, and can contest, correct, or appeal decisions — and must document all consumer complaints, disputes, corrections, appeals, opt-out requests, and remediation outcomes.

H-01.1

Covered entities must identify and measure any likely material negative impact of each automated decision system or augmented critical decision process on consumers, document mitigation steps taken (including potential market removal), document unmitigated impacts with justification including non-discriminatory compelling interests, and maintain standard protocols for impact identification, measurement, and mitigation with staff training documentation.

S-01.5

Covered entities must maintain ongoing documentation of the development and deployment process (including milestone dates and responsible teams), identify needed capabilities and tools for improvement across performance, fairness, transparency, privacy, safety, efficiency, and cost, and document any impact assessment requirements that were infeasible to complete along with corresponding rationale.

G-01.3

Sec. 5

Requirements for Summary Reports to the Commission

Deployer

(1)–(4) 16 The summary report that a covered entity is required to submit under subparagraph (D) or (E) of section 3(b)(1) for any automated decision system or augmented critical decision process shall, to the extent possible— (1) contain information from the impact assessment of such system or process, as applicable, including— (A) the name, website, and point of contact for the covered entity; (B) a detailed description of the specific critical decision that the augmented critical decision process is intended to make, including the category of critical decision as described in subparagraphs (A) through (I) of section 2(8); (C) the covered entity's intended purpose for the automated decision system or augmented critical decision process; (D) an identification of any stakeholders consulted by the covered entity as required by section 3(b)(1)(G) and documentation of the existence and nature of any legal agreements between the stakeholders and the covered entity; (E) documentation of the testing and evaluation of the automated decision system or augmented critical decision process, including— (i) the methods and technical and business metrics used to assess the performance of such system or process and a description of what metrics are deemed successful performance; (ii) the results of any assessment of the performance of such system or process and a comparison of the results of any assessment under test and deployed conditions; and (iii) an evaluation of any differential performance of such system or process assessed during the impact assessment; (F) any publicly stated guard rail for or limitation on certain uses or applications of the automated decision system or augmented critical decision process, including whether such uses or applications ought to be prohibited or otherwise limited through any terms of use, licensing agreement, or other legal agreement between entities; (G) documentation about the data or other input information used to develop, test, maintain, or update the automated decision system or augmented critical decision process including— (i) how and when the covered entity sourced such data or other input information; and (ii) why such data or other input information was used and what alternatives were explored; (H) documentation of whether and how the covered entity implements any transparency or explainability measures, including— (i) which categories of third-party decision recipients receive a copy of or have access to the results of any decision or judgment that results from such system or process; and (ii) any mechanism by which a consumer may contest, correct, or appeal a decision or opt out of such system or process, including the corresponding website for such mechanism, where applicable; (I) any likely material negative impact on consumers identified by the covered entity and a description of the steps taken to remediate or mitigate such impact; (J) a list of any impact assessment requirements that were attempted but were not possible to comply with because they were infeasible, as well as the corresponding rationale for not being able to comply with such requirements; and (K) any additional capabilities, tools, standards, datasets, security protocols, improvements to stakeholder engagement, or other resources identified by an impact assessment as necessary or beneficial to improve the performance of impact assessment or the development and deployment of any automated decision system or augmented critical decision process that the covered entity determines appropriate to share with the Commission; (2) include, in addition to the information required under paragraph (1), any relevant additional information from section 4(a) the covered entity wishes to share with the Commission; (3) follow any format or structure requirements specified by the Commission; and (4) include additional criteria that are essential for the purpose of consumer protection, as determined by the Commission.

Section 5 prescribes the content of the summary reports that covered entities must submit to the FTC under Sec. 3(b)(1)(D) and (E). The summary report must include the covered entity's identity and contact information, a description of the critical decision being made, the entity's intended purpose, identification of consulted stakeholders, testing and evaluation documentation (including performance metrics, results, and differential performance findings), publicly stated guardrails or prohibited uses, data documentation, transparency and explainability measures, identified material negative impacts with remediation steps, a list of infeasible assessment requirements, and identified improvement resources. The report must follow FTC-specified format requirements and include additional consumer-protection criteria as determined by the FTC.

Compliance actions 1 item

Covered entities must include in each summary report submitted to the FTC: entity identification and contact information, description of the critical decision and its category, intended purpose, stakeholder consultation documentation, performance testing results and differential performance evaluations, publicly stated use restrictions, data sourcing documentation, transparency and explainability measures, identified material negative impacts and remediation steps, infeasible assessment requirements with rationale, and identified improvement resources. Reports must follow FTC-specified format and include FTC-determined consumer-protection criteria.

R-02.1

Sec. 6

Reporting; Publicly Accessible Repository

(a)–(b) ANNUAL REPORT.—Not later than 1 year after the effective date described in section 3(b)(3), and annually thereafter, the Commission shall publish publicly on the website of the Commission a report describing and summarizing the information from the summary reports submitted under subparagraph (D), (E), or (F) of section 3(b)(1) that— (1) is accessible and machine readable in accordance with the 21st Century Integrated Digital Experience Act (44 U.S.C. 3501 note); and (2) describes broad trends, aggregated statistics, and anonymized lessons learned about performing impact assessments of automated decision systems or augmented critical decision processes, for the purposes of updating guidance related to impact assessments and summary reporting, oversight, and making recommendations toother regulatory agencies. (b) PUBLICLY ACCESSIBLE REPOSITORY.— (1) IN GENERAL.— (A) ESTABLISHMENT.— (i) DEVELOPMENT.—Not later than 180 days after the Commission promulgates the regulations required under section 3(b)(1), the Commission shall develop a publicly accessible repository designed to publish a limited subset of the information about each automated decision system and augmented critical decision process for which the Commission received a summary report under subparagraph (D), (E), or (F) of section 3(b)(1) in order to facilitate consumer protection. (ii) PUBLICATION.—Not later than 180 days after the effective date described in section 3(b)(3), the Commission shall make the repository publicly accessible. (iii) UPDATES.—The Commission shall update the repository on a quarterly basis. (B) PURPOSE.—The purposes of the repository established under subparagraph (A) are— (i) to inform consumers about the use of automated decision systems and augmented critical decision processes; (ii) to allow researchers and advocates to study the use of automated decision systems and augmented critical decision processes; and (iii) to ensure compliance with the requirements of this Act. (C) CONSIDERATIONS.—In establishing the repository under subparagraph (A), the Commission shall consider— (i) how to provide consumers with pertinent information regarding augmented critical decision processes while minimizing any potential commercial risk to any covered entity of providing such information; (ii) what information, if any, to include regarding the specific automated decision systems deployed in the augmented critical decision processes; (iii) how to document information, when applicable, about how to contest or seek recourse for a critical decision in a manner that is readily accessible by the consumer; and (iv) how to streamline the submission of summary reports under subparagraph (D), (E), or (F) of section 3(b)(1) to allow the Commission to efficiently populate information into the repository to minimize or eliminate any burden on the Commission. (D) REQUIREMENTS.—The Commission shall design the repository established under subparagraph (A) to— (i) be publicly available and easily discoverable on the website of the Commission; (ii) allow users to sort and search the repository by multiple characteristics (such as by covered entity, date reported, or category of critical decision) simultaneously; (iii) allow users to make a copy of or download the information obtained from the repository, including any subsets of information obtained by sorting or searching as described in clause (ii), in accordance with current guidance from the Office of Management and Budget, such as the Open, Public, Electronic, and Necessary Government Data Act (44 U.S.C. 101 note); (iv) be in accordance with user experience and accessibility best practices such as those described in the 21st Century Integrated Digital Experience Act (44 U.S.C. 3501 note); (v) include a limited subset of information from the summary reports, as applicable, under subparagraph (D), (E), or (F) of section 3(b)(1) that includes— (I) the identity of the covered entity that submitted such summary report, including any link to the website of the covered entity; (II) the specific critical decision that the augmented critical decision process makes, along with the category of the critical decision; (III) any publicly stated prohibited applications of the automated decision system or augmented critical decision process, including whether such prohibition is enforced through any terms of use, licensing agreement, or other legal agreement between entities; (IV) to the extent possible, the sources of any data used to develop, test, maintain, or update the automated decision system or augmented critical decision process; (V) to the extent possible, the type of technical and business metrics used to assess the performance of the augmented critical decision process when deployed; and (VI) the link to any web page with instructions or other information related to a mechanism by which a consumer may contest, correct, or appeal a decision or opt out of the automated decision system or augmented critical decision process; and (vi) include information about design, use, and maintenance of the repository, including— (I) how frequently the repository is updated; (II) the date of the most recent such update; (III) the types of information from the summary reports submitted under subparagraph (D), (E), or (F) of section 3(b)(1) that are and are not included in the repository; and (IV) any other information about the design, use, and maintenance the Commission determines is— (aa) relevant to consumers and researchers; or (bb) essential for consumer education and recourse. (2) AUTHORIZATION OF APPROPRIATIONS.—There are authorized to be appropriated to the Commission such sums as are necessary to carry out this subsection.

Section 6 imposes obligations on the FTC rather than on covered entities. The FTC must publish an annual report summarizing information from submitted summary reports in an accessible, machine-readable format. The FTC must also establish, within defined timelines, a publicly accessible repository publishing a limited subset of summary-report data — including entity identity, critical decision descriptions, prohibited uses, data sources, performance metrics, and consumer contestation mechanisms. The repository must be searchable, downloadable, and updated quarterly. These are government-facing obligations and do not directly create compliance duties for covered entities beyond the submission requirements already established in Sections 3 and 5.

Sec. 7

Guidance and Technical Assistance; Other Requirements

(a)–(b) GUIDANCE AND TECHNICAL ASSISTANCE FROM THE COMMISSION.— (1) IN GENERAL.—The Commission shall publish guidance on how to meet the requirements of sections 4 and 5, including resources such as documentation templates and guides for meaningful consultation, that is developed by the Commission after consultation with the Director of the National Institute of Standards and Technology, the Director of the National Artificial Intelligence Initiative, the Director of the Office of Science and Technology Policy, and other relevant stakeholders, including standards bodies, private industry, academia, technology experts, and advocates for civil rights, consumers, and impacted communities. (2) ASSISTANCE IN DETERMINING COVERED ENTITY STATUS.—In addition to the guidance required under paragraph (1), the Commission shall— (A) issue guidance and training materials to assist persons, partnerships, and corporations in evaluating whether they are a covered entity; and (B) regularly update such guidance and training materials in accordance with any feedback or questions from covered entities, experts, or other relevant stakeholders. (b) OTHER REQUIREMENTS.— (1) PUBLICATION.—Nothing in this Act shall be construed to limit a covered entity from publicizing any documentation of the impact assessment maintained under section 3(b)(1)(B), including information beyond what is required to be submitted in a summary report under subparagraph (D) or (E) of section 3(b)(1), unless such publication would violate the privacy of any consumer. (2) PERIODIC REVIEW OF REGULATIONS.—The Commission shall review the regulations promulgated under section 3(b) not less than once every 5 years and update such regulations as appropriate. (3) REVIEW BY NIST AND OSTP.—The Commission shall make available, in a private and secure manner, to the Director of the National Institute of Standards and Technology, the Director of the Office of Science and Technology Policy, and the head of any Federal agency with relevant regulatory jurisdiction over an augmented critical decision process any summary report submitted under subparagraph (D), (E), or (F) of section 3(b)(1) for review in order to develop future standards or regulations.

Section 7 directs the FTC to publish guidance on how to meet the impact assessment and summary report requirements of Sections 4 and 5, developed in consultation with NIST, the National AI Initiative, OSTP, and stakeholders. The FTC must also provide guidance to help entities evaluate whether they qualify as a covered entity. The section includes three additional provisions: a clarification that covered entities may voluntarily publicize impact assessment documentation beyond what is required in summary reports (as long as it does not violate consumer privacy), a mandate for the FTC to review its regulations at least every five years, and a requirement for the FTC to share summary reports with NIST, OSTP, and relevant federal agencies in a secure manner for standards development purposes. These provisions primarily impose obligations on the FTC rather than on covered entities.

Sec. 8

Resources and Authorities

(a)–(c) BUREAU OF TECHNOLOGY.— (1) ESTABLISHMENT.— (A) IN GENERAL.—There is established within the Commission the Bureau of Technology (in this subsection referred to as the "Bureau"). (B) DUTIES.—The Bureau shall engage in activities that include: (i) Aiding or advising the Commission with respect to the technological aspects of the functions of the Commission, including— (I) preparing, conducting, facilitating, managing, or otherwise enabling studies, workshops, audits, community participation opportunities, or other similar activities; and (II) any other assistance deemed appropriate by the Commission or Chair. (ii) Aiding or advising the Commission with respect to the enforcement of this Act. (iii) Providing technical assistance to any enforcement bureau within the Commission with respect to the investigation and trial of cases. (2) CHIEF TECHNOLOGIST.—The Bureau shall be headed by a Chief Technologist. (3) STAFF.— (A) APPOINTMENTS.— (i) IN GENERAL.—Subject to subparagraph (B), the Chair may, without regard to the civil service laws (including regulations), appoint personnel with experience in fields such as management, technology, digital and product design, user experience, information security, civil rights, technology policy, privacy policy, humanities and social sciences, product management, software engineering, machine learning, statistics, or other related fields to enable the Bureau to perform its duties. (ii) MINIMUM APPOINTMENTS.—Not later than 2 years after the date of enactment of this Act, the Chair shall appoint not less than 50 personnel. (B) EXCEPTED SERVICE.—The personnel appointed in accordance with subparagraph (A) may be appointed to positions described in section 213.3102(r) of title 5, Code of Federal Regulations. (4) AUTHORIZATION OF APPROPRIATIONS.—There are authorized to be appropriated to the Commission such sums as are necessary to carry out this subsection. (b) ADDITIONAL PERSONNEL IN THE BUREAU OF CONSUMER PROTECTION.— (1) ADDITIONAL PERSONNEL.—Notwithstanding any other provision of law, the Chair may, without regard to the civil service laws (including regulations), appoint 25 additional personnel to the Division of Enforcement of the Bureau of Consumer Protection. (2) AUTHORIZATION OF APPROPRIATIONS.—There are authorized to be appropriated to the Commission such sums as are necessary to carry out this subsection. (c) ESTABLISHMENT OF AGREEMENTS OF COOPERATION.—The Commission shall negotiate agreements of cooperation, as needed, with any relevant Federal agency with respect to information sharing and enforcement actions taken regarding the development or deployment of an automated decision system to make a critical decision or of an augmented critical decision process. Such agreements shall include procedures for determining which agency shall file an action and providing notice to the non-filing agency, where feasible, prior to initiating a civil action to enforce any Federal law within such agencies' jurisdictions regarding the development or deployment of an automated decision system to make a critical decision or of an augmented critical decision process by a covered entity.

Section 8 establishes institutional infrastructure for enforcement. It creates a new Bureau of Technology within the FTC, headed by a Chief Technologist, to advise the Commission on technology matters and aid in enforcement. The Chair must appoint at least 50 personnel within two years, drawn from technology, civil rights, privacy, engineering, and related fields. The section also authorizes 25 additional personnel for the Division of Enforcement in the Bureau of Consumer Protection. Finally, it directs the FTC to negotiate cooperation agreements with other federal agencies regarding information sharing and enforcement actions related to automated decision systems. These provisions impose institutional obligations on the FTC rather than on covered entities.

Sec. 9

Enforcement

(a)–(b) ENFORCEMENT BY THE COMMISSION.— (1) UNFAIR OR DECEPTIVE ACTS OR PRACTICES.—A violation of this Act or a regulation promulgated thereunder shall be treated as a violation of a rule defining an unfair or deceptive act or practice under section 18(a)(1)(B) of the Federal Trade Commission Act (15 U.S.C. 57a(a)(1)(B)). (2) POWERS OF THE COMMISSION.— (A) IN GENERAL.—The Commission shall enforce this Act and the regulations promulgated under this Act in the same manner, by the same means, and with the same jurisdiction, powers, and duties as though all applicable terms and provisions of the Federal Trade Commission Act (15 U.S.C. 41 et seq.) were incorporated into and made a part of this Act. (B) PRIVILEGES AND IMMUNITIES.—Any person who violates this Act or a regulation promulgated thereunder shall be subject to the penalties and entitled to the privileges and immunities provided in the Federal Trade Commission Act (15 U.S.C. 41 et seq.). (C) AUTHORITY PRESERVED.—Nothing in this Act shall be construed to limit the authority of the Commission under any other provision of law. (D) RULEMAKING.—The Commission shall promulgate in accordance with section 553 of title 5, United States Code, such additional rules as may be necessary to carry out this Act. (b) ENFORCEMENT BY STATES.— (1) IN GENERAL.—If the attorney general of a State has reason to believe that an interest of the residents of the State has been or is being threatened or adversely affected by a practice that violates this Act or a regulation promulgated thereunder, the attorney general of the State may, as parens patriae, bring a civil action on behalf of the residents of the State in an appropriate district court of the United States to obtain appropriate relief. (2) RIGHTS OF COMMISSION.— (A) NOTICE TO COMMISSION.— (i) IN GENERAL.—Except as provided in clause (iii), the attorney general of a State, before initiating a civil action under paragraph (1), shall provide written notification to the Commission that the attorney general intends to bring such civil action. (ii) CONTENTS.—The notification required under clause (i) shall include a copy of the complaint to be filed to initiate the civil action. (iii) EXCEPTION.—If it is not feasible for the attorney general of a State to provide the notification required under clause (i) before initiating a civil action under paragraph (1), the attorney general shall notify the Commission immediately upon instituting the civil action. (B) INTERVENTION BY COMMISSION.—The Commission may— (i) intervene in any civil action brought by the attorney general of a State under paragraph (1); and (ii) upon intervening— (I) be heard on all matters arising in the civil action; and (II) file petitions for appeal of a decision in the civil action. (3) INVESTIGATORY POWERS.—Nothing in this subsection may be construed to prevent the attorney general of a State from exercising the powers conferred on the attorney general by the laws of the State to conduct investigations, to administer oaths or affirmations, or to compel the attendance of witnesses or the production of documentary or other evidence. (4) VENUE; SERVICE OF PROCESS.— (A) VENUE.—Any action brought under paragraph (1) may be brought in— (i) the district court of the United States that meets applicable requirements relating to venue under section 1391 of title 28, United States Code; or (ii) another court of competent jurisdiction. (B) SERVICE OF PROCESS.—In an action brought under paragraph (1), process may be served in any district in which— (i) the defendant is an inhabitant, may be found, or transacts business; or (ii) venue is proper under section 1391 of title 28, United States Code. (5) ACTIONS BY OTHER STATE OFFICIALS.— (A) IN GENERAL.—In addition to a civil action brought by an attorney general under paragraph (1), any other officer of a State who is authorized by the State to do so may bring a civil action under paragraph (1), subject to the same requirements and limitations that apply under this subsection to civil actions brought by attorneys general. (B) SAVINGS PROVISION.—Nothing in this subsection may be construed to prohibit an authorized official of a State from initiating or continuing any proceeding in a court of the State for a violation of any civil or criminal law of the State.

Section 9 establishes the enforcement framework. Violations of the Act or its regulations are treated as violations of FTC Act rules defining unfair or deceptive acts or practices, giving the FTC full enforcement authority under its existing powers. State attorneys general may bring parens patriae civil actions in federal district court on behalf of state residents, subject to prior written notification to the FTC (or immediate notification if advance notice is not feasible). The FTC may intervene in state-initiated actions. Other authorized state officials may also bring actions under the same terms. The section preserves existing state investigatory powers and existing FTC authority. There is no private right of action for individual consumers.

Sec. 10

Coordination

In carrying out this Act, the Commission shall coordinate with any appropriate Federal agency or State regulator to promote consistent regulatory treatment of automated decision systems and augmented critical decision processes.

Section 10 directs the FTC to coordinate with appropriate federal and state regulators to promote consistent regulatory treatment of automated decision systems and augmented critical decision processes. This is a government-facing coordination mandate and does not impose compliance obligations on covered entities.

Sec. 11

No Preemption

Nothing in this Act may be construed to preempt any State, tribal, city, or local law, regulation, or ordinance.

Section 11 is a blanket anti-preemption provision, expressly preserving all state, tribal, city, and local laws, regulations, and ordinances. This is a significant drafting choice — it means the federal impact assessment framework would operate as a floor, not a ceiling, and covered entities would need to comply with potentially more stringent state and local AI accountability requirements as well.

Transparency AI identity disclosure · periodic reminders

1 item

T-03

Safety Harmful content prevention · self-harm escalation

2 items

S-01.1

S-01.5

Data Controls Data sale restrictions · deidentification

1 item

D-01.4

Human Oversight Decision review · appeal pathways

5 items

H-02.3

Covered entities must perform impact assessments of each deployed automated decision system and each augmented critical decision process, both prior to and after deployment.

H-02