Requirements for summary reports to the Commission

The summary report that a covered entity is required to submit under subparagraph (D) or (E) of section 3(b)(1) for any automated decision system or augmented critical decision process shall, to the extent possible— (1) contain information from the impact assessment of such system or process, as applicable, including— (A) the name, website, and point of contact for the covered entity; (B) a detailed description of the specific critical decision that the augmented critical decision process is intended to make, including the category of critical decision as described in subparagraphs (A) through (I) of section 2(8); (C) the covered entity's intended purpose for the automated decision system or augmented critical decision process; (D) an identification of any stakeholders consulted by the covered entity as required by section 3(b)(1)(G) and documentation of the existence and nature of any legal agreements between the stakeholders and the covered entity; (E) documentation of the testing and evaluation of the automated decision system or augmented critical decision process, including— (i) the methods and technical and business metrics used to assess the performance of such system or process and a description of what metrics are deemed successful performance; (ii) the results of any assessment of the performance of such system or process and a comparison of the results of any assessment under test and deployed conditions; and (iii) an evaluation of any differential performance of such system or process assessed during the impact assessment; (F) any publicly stated guard rail for or limitation on certain uses or applications of the automated decision system or augmented critical decision process, including whether such uses or applications ought to be prohibited or otherwise limited through any terms of use, licensing agreement, or other legal agreement between entities; (G) documentation about the data or other input information used to develop, test, maintain, or update the automated decision system or augmented critical decision process including— (i) how and when the covered entity sourced such data or other input information; and (ii) why such data or other input information was used and what alternatives were explored; (H) documentation of whether and how the covered entity implements any transparency or explainability measures, including— (i) which categories of third-party decision recipients receive a copy of or have access to the results of any decision or judgment that results from such system or process; and (ii) any mechanism by which a consumer may contest, correct, or appeal a decision or opt out of such system or process, including the corresponding website for such mechanism, where applicable; (I) any likely material negative impact on consumers identified by the covered entity and a description of the steps taken to remediate or mitigate such impact; (J) a list of any impact assessment requirements that were attempted but were not possible to comply with because they were infeasible, as well as the corresponding rationale for not being able to comply with such requirements; and (K) any additional capabilities, tools, standards, datasets, security protocols, improvements to stakeholder engagement, or other resources identified by an impact assessment as necessary or beneficial to improve the performance of impact assessment or the development and deployment of any automated decision system or augmented critical decision process that the covered entity determines appropriate to share with the Commission; (2) include, in addition to the information required under paragraph (1), any relevant additional information from section 4(a) the covered entity wishes to share with the Commission; (3) follow any format or structure requirements specified by the Commission; and (4) include additional criteria that are essential for the purpose of consumer protection, as determined by the Commission.