Assessing the impact of automated decision systems and augmented critical decision processes

(a) Acts prohibited (1) In general It is unlawful for— (A) any covered entity to violate a regulation promulgated under subsection (b); or (B) any person to knowingly provide substantial assistance to any covered entity in violating subsection (b). (2) Preemption of private contracts It shall be unlawful for any covered entity to commit the acts prohibited in paragraph (1), regardless of specific agreements between entities or consumers. (b) Regulations (1) In general Subject to paragraph (2), not later than 2 years after the date of enactment of this Act, the Commission shall, in consultation with the Director of the National Institute of Standards and Technology, the Director of the National Artificial Intelligence Initiative, the Director of the Office of Science and Technology Policy, and other relevant stakeholders, including standards bodies, private industry, academia, technology experts, and advocates for civil rights, consumers, and impacted communities, promulgate regulations, in accordance with section 553 of title 5, United States Code, that— (A) require each covered entity to perform impact assessment of any— (i) deployed automated decision system that was developed for implementation or use, or that the covered entity reasonably expects to be implemented or used, in an augmented critical decision process by any person, partnership, or corporation that meets the requirements described in section 2(7)(A)(i); and (ii) augmented critical decision process, both prior to and after deployment by the covered entity; (B) require each covered entity to maintain documentation of any impact assessment performed under subparagraph (A), including the applicable information described in section 4(a) for 3 years longer than the duration of time for which the automated decision system or augmented critical decision process is deployed; (C) require each person, partnership, or corporation that meets the requirements described in section 2(7)(A)(i) to disclose their status as a covered entity to any person, partnership, or corporation that sells, licenses, or otherwise provides through a commercial relationship any automated decision system deployed by the covered entity in an automated decision system or augmented critical decision process; (D) require each covered entity to submit to the Commission, on an annual basis, a summary report for ongoing impact assessment of any deployed automated decision system or augmented critical decision process; (E) require each covered entity to submit an initial summary report to the Commission for any new automated decision system or augmented critical decision process prior to its deployment by the covered entity; (F) allow any person, partnership, or corporation over which the Commission has jurisdiction under section 5(a)(2) of the Federal Trade Commission Act (15 U.S.C. 45(a)(2)) that deploys any automated decision system or augmented critical decision process, but is not a covered entity, to submit to the Commission a summary report for any impact assessment performed with respect to such system or process; (G) require each covered entity, in performing the impact assessment described in subparagraph (A), to the extent possible, to meaningfully consult (including through participatory design, independent auditing, or soliciting or incorporating feedback) with relevant internal stakeholders (such as employees, ethics teams, and responsible technology teams) and independent external stakeholders (such as representatives of and advocates for impacted groups, civil society and advocates, and technology experts) as frequently as necessary; (H) require each covered entity to attempt to eliminate or mitigate, in a timely manner, any impact made by an augmented critical decision process that demonstrates a likely material negative impact that has legal or similarly significant effects on a consumer's life; (I) establish definitions for— (i) what constitutes access to or the cost, terms, or availability of with respect to a critical decision; (ii) what constitutes possession, management, modification, and control with respect to identifying information; (iii) the different categories of third-party decision recipients that a covered entity must document under section 5(1)(H); and (iv) any of the services, programs, or opportunities described in subparagraphs (A) through (I) of section 2(8) for the purpose of informing consumers, covered entities, and regulators, as the Commission deems necessary; (J) establish guidelines for any person, partnership, or corporation to calculate the number of consumers, households, or consumer devices for which the person, partnership, or corporation possesses, manages, modifies, or controls identifying information for the purpose of determining covered entity status; (K) establish guidelines for a covered entity to prioritize different automated decision systems and augmented critical decision processes deployed by the covered entity for performing impact assessment; and (L) establish a required format for any summary report, as described in subparagraphs (D), (E), and (F), to ensure that such reports are submitted in an accessible and machine-readable format. (2) Considerations In promulgating the regulations under paragraph (1), the Commission— (A) shall take into consideration— (i) that certain assessment or documentation of an automated decision system or augmented critical decision process may only be possible at particular stages of the development and deployment of such system or process or may be limited or not possible based on the availability of certain types of information or data or the nature of the relationship between the covered entity and consumers; (ii) the duration of time between summary report submissions and the timeliness of the reported information; (iii) the administrative burden placed on the Commission and the covered entity; (iv) the benefits of standardizing and structuring summary reports for comparative analysis compared with the benefits of less-structured narrative reports to provide detail and flexibility in reporting; (v) that summary reports submitted by different covered entities may contain different fields according to the requirements established by the Commission, and the Commission may allow or require submission of incomplete reports; (vi) that existing data privacy and other regulations may inhibit a covered entity from storing or sharing certain information; and (vii) that a covered entity may require information from other persons, partnerships, or corporations that develop any automated decision system deployed in an automated decision system or augmented critical decision process by the covered entity for the purpose of performing impact assessment; and (B) may develop specific requirements for impact assessments and summary reports for particular— (i) categories of critical decisions, as described in subparagraphs (A) through (I) of section 2(8) or any subcategory developed by the Commission; and (ii) stages of development and deployment of an automated decision system or augmented critical decision process. (3) Effective date The regulations described in paragraph (1) shall take effect on the date that is 2 years after such regulations are promulgated.