Voluntary assurance technical guidelines and specifications for artificial intelligence systems

(a) Voluntary technical guidelines and specifications for assurance Not later than 1 year after the date of the enactment of this Act, the Director, in collaboration with public and private sector organizations, including the National Science Foundation and the Department of Energy, shall develop and, not less frequently than every 2 years, shall review and update as the Director considers appropriate, a set of voluntary technical guidelines and specifications for internal artificial intelligence assurance and external artificial intelligence assurance. (b) Contents The technical guidelines and specifications required by subsection (a) shall— (1) identify consensus-driven, voluntary standards for internal artificial intelligence assurance and external artificial intelligence assurance that address— (A) safeguards for consumer privacy; (B) methods to assess and mitigate harms to individuals by artificial intelligence systems; (C) dataset quality; (D) documentation, disclosure, and provenance communications to external parties; and (E) governance and process controls; (2) provide technical guidelines, best practices, methodologies, procedures, and processes, as appropriate, for internal artificial intelligence assurance and external artificial intelligence assurance that effectively address the elements listed in paragraph (1); (3) establish common definitions and characterizations for testing, evaluating, verifying, and validating methods for internal artificial intelligence assurance and external artificial intelligence assurance; (4) recommend criteria or approaches for a developer or deployer to determine the frequency and circumstances under which internal artificial intelligence assurance and external artificial intelligence assurance activities should be conducted, accounting for the relevant risk and use-case profile of the artificial intelligence system, and any additional circumstance under which an assurance should be conducted; (5) recommend criteria or approaches for a developer or deployer to determine the scope of internal artificial intelligence assurance and external artificial intelligence assurance conducted through testing and evaluating, accounting for the relevant risk and use-case profile of the artificial intelligence system, including the minimum information or technical resources that should be provided to the party conducting the assurance to enable assurance activities; (6) provide guidance for the manner in which a developer or deployer may disclose, as appropriate, the results of an internal or external assurance or carry out corrective actions with respect to an artificial intelligence system following the completion of an internal or external assurance of such system, and guidance on the manner in which a developer or deployer may properly document any corrective action taken; (7) align with the voluntary consensus standards, including international standards, identified pursuant to paragraph (1) to the fullest extent possible; (8) incorporate the relevant voluntary consensus standards identified pursuant to paragraph (1) and industry best practices to the fullest extent possible; (9) not prescribe or otherwise require— (A) the use of any specific solution; or (B) the use of any specific information or any communications technology product or service; and (10) recommend methods to protect the confidentiality of sensitive information, including personal data and proprietary knowledge of an artificial intelligence system, that may be obtained during the assurance process. (c) Stakeholder outreach In developing the voluntary technical guidelines and specifications required by subsection (a), the Director shall— (1) solicit public comment on at least 1 draft of the technical guidelines and specifications, and provide a reasonable period of not less than 30 days for the submission of comments by interested stakeholders; (2) make each complete draft of the voluntary technical guidelines and specifications developed under subsection (a) available to the public on the website of the National Institute of Standards and Technology; and (3) convene workshops, roundtables, and other public forums, as the Director considers appropriate, to consult with relevant stakeholders in industry, academia, civil society, consumer advocacy, workforce development organizations, labor organizations, conformance assessment bodies, and any other sector the Director considers appropriate, on the development of the voluntary technical guidelines and specifications. (d) Publication The Director shall publish the voluntary technical guidelines and specifications required by subsection (a) as a standalone framework or document available to the public on the website of the National Institute of Standards and Technology.