Predeployment evaluations and post-deployment impact assessments

(a) Predeployment evaluations (1) For developers Before a developer deploys, licenses, or offers an automated decision system (including deploying a material change to a previously deployed automated decision system or a material change made prior to deployment) that is intended or reasonably likely to be used to make a work-related decision, the developer of the automated decision system shall conduct a predeployment evaluation that— (A) includes a detailed review of the automated decision system; and (B) results in a report, sufficient for an individual having ordinary skill in the art to understand the functioning, risks, uses, benefits, limitations, and other pertinent attributes of the automated decision system, that includes— (i) a description of the automated decision system’s design and methodology, including the inputs the automated decision system is designed to use to produce an output and the outputs the automated decision system is designed to produce for purposes of specific work-related decisions; (ii) a description of how the automated decision system was created and tested, including— (I) any metric used to test the performance of the automated decision system; (II) defined benchmarks and goals that correspond to such metrics, including whether there was sufficient representation of demographic groups that are reasonably likely to use or be affected by the automated decision system in the data used to create or train the automated decision system, and whether there was reasonable testing, if any, across such demographic groups; (III) the outputs the automated decision system actually produces in testing; (IV) a description of any consultation with relevant stakeholders, including covered individuals that will be impacted by the automated decision system, regarding the development of the automated decision system or a disclosure that no such consultation occurred; (V) any computational algorithm incorporated into the development of the automated decision system and a description of the training process for such algorithm including the training, validation, and test data used to confirm the intended outputs; and (VI) a description of the data and information used to develop, test, maintain, or update the automated decision system, including— (aa) each type of personal data used, each source from which the personal data was collected, and how each type of personal data was inferred and processed; (bb) the legal authorization for collecting and processing the personal data; and (cc) an explanation of how the data (including personal data) used is representative, proportional, and appropriate to the development and intended uses of the automated decision system; (iii) a description of— (I) the potential for the automated decision system to pose risks to workers' rights, including with respect to the privacy, physical and mental health and safety, dignity, and autonomy of workers or to result in the chilling of legally protected activity (including organizing and collective bargaining); and (II) any potential economic impact of the automated decision system on workers, such as with respect to wages, hours, schedules, benefits, skills training, work opportunities, and advancement; (iv) a description of the potential for the automated decision system to discriminate, including by having a disparate impact on the equal enjoyment of goods, services, or other activities or opportunities, and a description of such discrimination; and (v) a description of alternative practices and recommendations to prevent or mitigate risks to workers' rights and recommendations for how the developer could monitor for risks to workers' rights after offering, licensing, or deploying the automated decision system. (2) For employers Before an employer deploys an automated decision system (including deploying a material change to a previously deployed automated decision system or a material change made prior to deployment) that is intended or reasonably likely to be used to make a work-related decision, the employer shall conduct a predeployment evaluation that— (A) includes a detailed review of the automated decision system; and (B) results in a report, sufficient for an individual having ordinary skill in the art to understand the functioning, risks, uses, benefits, limitations, and other pertinent attributes of the automated decision system, that includes— (i) a description of the manner in which the automated decision system may be used to make or contribute to a work-related decision and the purpose for which the automated decision system will be deployed; (ii) a description of the necessity and proportionality of the automated decision system in relation to its planned use, including the intended benefits and limitations of the automated decision system and a description of the baseline process being enhanced or replaced by the automated decision system, if applicable; (iii) a description of the inputs to the automated decision system that the employer plans to use to produce an output, including— (I) the type of personal data and information used and how the personal data and information will be collected, inferred, and processed; (II) the legal authorization for collecting and processing the personal data; and (III) an explanation of how the data used is representative, proportional, and appropriate to the deployment of the automated decision system; (iv) a description of the outputs the automated decision system is expected to produce and the outputs the automated decision system actually produces in testing; (v) a description of any additional testing or training completed by the employer for the context in which the automated decision system will be deployed; (vi) a description of any consultation with relevant stakeholders, including covered individuals that will be impacted by the automated decision system, regarding the deployment of the automated decision system; (vii) a description of— (I) the potential for the automated decision system to pose risks to workers' rights, including with respect to the privacy, physical and mental health and safety, dignity, and autonomy of workers or to result in the chilling of legally protected activity (including organizing and collective bargaining); and (II) any potential economic impact of the automated decision system on workers, such as with respect to wages, hours, schedules, benefits, skills training, work opportunities, and advancement; (viii) a description of the potential for the automated decision system to discriminate, including by having a disparate impact on the equal enjoyment of goods, services, or other activities or opportunities, and a description of such discrimination; and (ix) a description of alternative practices and recommendations to prevent or mitigate risks to workers' rights and recommendations for how the employer could monitor for risks to workers' rights after offering, licensing, or deploying the automated decision system. (3) Effective date The requirements for predeployment evaluations under paragraphs (1) and (2) shall only apply with respect to the deployment, licensing, or offering of any automated decision system that occurs on or after the date of enactment of this Act. (b) Employer annual impact assessment An employer that deploys an automated decision system used to make a work-related decision in any year shall conduct an impact assessment of the automated decision system with respect to the use of such system in such year in accordance with the following: (1) Impact assessment The employer shall— (A) conduct a full impact assessment on the automated decision system with respect to the year, including the information described in paragraph (2) as relevant; and (B) prepare a report on such assessment, including— (i) a description of the extent to which the automated system during the year infringed on the rights of any worker, including with respect to the privacy, physical and mental health and safety, dignity, and autonomy of workers or to result in the chilling of legally protected activity (including organizing and collective bargaining), or had an economic impact on any worker, such as with respect to wages, hours, schedules, benefits, skills training, work opportunities, and advancement; (ii) a description of the extent to which the automated decision system produced a disparate impact in the equal enjoyment of goods, services, or other activities or opportunities, including the methodology for such evaluation, of how the automated decision system produced or likely produced such disparity; (iii) a description of the types of data input into the automated decision system during the reporting period to produce an output, including— (I) documentation of how data input into the automated decision system to produce an output is represented and complete descriptions of each field of data; and (II) whether and to what extent the data input into the automated decision system to produce an output was used to modify the automated decision system; (iv) whether and to what extent the automated decision system produced the outputs it was expected to produce; and (v) a detailed description of how the automated decision system was used to make a work-related decision. (2) Employers with a deployed automated decision system An employer that deployed an automated decision system used to make a work-related decision before the date of enactment of this Act and has not otherwise conducted a predeployment evaluation under subsection (a) or a review under this paragraph with respect to the automated decision system shall— (A) conduct a detailed review of the automated decision system; and (B) include in the first impact assessment of such automated decision system under paragraph (1) a report, sufficient for an individual having ordinary skill in the art to understand the functioning, risks, uses, benefits, limitations, and other pertinent attributes of the automated decision system, that includes— (i) a description of the manner in which the automated decision system may be used to make or contribute to a work-related decision and the purpose for which the automated decision system will be deployed; (ii) a description of the necessity and proportionality of the automated decision system in relation to its planned use, including the intended benefits and limitations of the automated decision system and a description of the baseline process being enhanced or replaced by the automated decision system, if applicable; and (iii) a description of the inputs to the automated decision system that the employer plans to use to produce an output, including— (I) the type of personal data and information used and how the personal data and information will be collected, inferred, and processed; (II) the legal authorization for collecting and processing the personal data; and (III) an explanation of how the data used is representative, proportional, and appropriate to the deployment of the automated decision system. (3) Report Not later than 30 days after the completion of a report on an impact assessment under paragraph (1)(B), an employer shall submit to the developer of the automated decision system a summary of such report. (c) Developer annual review of assessments A developer of an automated decision system used by an employer in any year to make a work-related decision shall review each impact assessment summary submitted by an employer under subsection (b)(3) with respect to such system in such year for the following: (1) To assess how the employer is using the automated decision system, including the methodology for assessing such use. (2) To assess the type of data the employer is inputting into the automated decision system to produce an output and the types of outputs the automated decision system is producing. (3) To assess whether the employer is complying with any relevant contractual agreement with the developer and whether any remedial action is necessary. (4) To compare the automated decision system’s performance in real-world conditions versus any predeployment testing available, including the methodology used to evaluate such performance. (5) To assess whether the automated decision system infringed on workers' rights or is reasonably likely to be infringing on workers' rights. (6) To assess whether and, if so, how the automated decision system is causing, or is reasonably likely to be causing, a disparate impact in the equal enjoyment of goods, services, or other activities or opportunities. (7) To determine whether the automated decision system needs modification. (8) To determine whether any other action is appropriate to ensure that the automated decision system remains safe and effective. (d) Joint developer and employer obligations If a person is both the developer of an automated decision system and an employer deploying an automated decision system, the person may conduct combined predeployment evaluations and annual assessments, provided that each combined evaluation or assessment satisfies all requirements for both developers and employers. (e) Relationships between developers and employer The developer of an automated decision system shall, upon the reasonable request of an employer using the automated decision system, make available to the employer information necessary for the employer to demonstrate compliance with the requirements of this Act, including— (1) making available to the employer a report on the predeployment evaluation required under subsection (a) or the annual review of assessments conducted by the developer under subsection (c); and (2) providing information necessary to enable the employer to conduct and document a predeployment evaluation under subsection (a) or an impact assessment under subsection (b). (f) Reporting and retention requirements (1) Reporting A developer or employer that conducts a predeployment evaluation, impact assessment, or developer annual review of assessments under this section shall— (A) not later than 30 days after completion of such evaluation, assessment, or review, submit the evaluation, assessment, or review to the Fairness and Transparency Office of the Department of Labor; (B) upon request, make the completed evaluation, assessment, or review available to Congress; and (C) not later than 30 days after such completion— (i) publish a summary of the evaluation, assessment, or review on the website of the developer or employer in a manner that is easily accessible to individuals; and (ii) submit such summary to the Fairness and Transparency Office of the Department of Labor. (2) Retention A developer or employer shall retain all evaluations, assessments, and reviews conducted under this section for a period of not fewer than 10 years after the completion of the evaluation, assessment, or review. (3) Trade secrets and privacy A developer or employer— (A) may redact and segregate any trade secret (as defined in section 1839 of title 18, United States Code) from public disclosure in the summary published and submitted under paragraph (1)(C); and (B) shall redact and segregate personal data from public disclosure in such summary. (g) Rulemaking (1) Authority The Director of the Fairness and Transparency Office of the Department of Labor may, in accordance with section 553 of title 5, United States Code, promulgate such rules as may be necessary to carry out this section. (2) Additional regulations Not later than 2 years after the date of enactment of this Act, the Director of the Fairness and Transparency Office shall— (A) promulgate rules, pursuant to section 553 of title 5, United States Code, specifying— (i) what information and factors a developer or employer shall consider in making the predeployment evaluation required under subsection (a); (ii) what information a developer or employer shall include in a summary of an evaluation, assessment, or review described in subsection (f)(1)(C); and (iii) the extent to and process by which a developer may request additional information from a employer for purposes of the review under subsection (c), including the purposes for which a developer is permitted to use such additional information; and (B) in promulgating such rules, consider the need to protect the privacy of personal data, as well as the need for information sharing by developers and employers to comply with this section and inform the public.