AI child safety audit

(a) Independent audit (1) Audit requirement Each provider of an AI chatbot shall, on an annual basis, at the provider’s own cost, submit to an independent audit that meets the requirements described in paragraph (2). (2) Requirements The requirements described in this paragraph are the following: (A) The audit shall be conducted by an auditor that satisfies professional standards and independence requirements established by the Commission, including— (i) a mandatory code of professional conduct; (ii) conflict of interest safeguards; (iii) demonstrated independence, competence, and capacity to conduct objective compliance audits; and (iv) relevant experience and expertise in artificial intelligence systems, child development, and child safety. (B) The audit shall be conducted by an auditor that— (i) has not received any funding or other source of compensation or gift from a provider of an AI chatbot in the last 3 years; and (ii) has certified to the Commission that the auditor will not receive any such funding, compensation, or gift while conducting the audit. (C) The audit shall be conducted in accordance with principles, established by the Commission, for the audit procedure and the methodology for evaluating whether a provider of an AI chatbot has appropriately assessed child safety risks and implemented proportionate mitigation measures. (D) The audit shall test actual outputs of an AI chatbot using controlled test accounts without requiring access to, or use of, any real-world communication of a child or other users for testing. (E) The audit shall be conducted in accordance with standards, established by the Commission, regarding red-teaming and adversarial testing specific to child safety risks conducted through controlled test accounts that do not use any real-world communication of a child. (F) The audit shall evaluate the effectiveness of implemented safeguards for child safety risks on an AI chatbot through empirical testing based on de-identified and aggregated evidence. (G) The audit shall be conducted in accordance with procedures, established by the Commission, for auditors to assess compliance with all requirements of this Act, including parental settings, data handling practices, and crisis response protocols. (3) Deemed compliance through comparable audit A provider of an AI chatbot shall be deemed to be in compliance with the requirements of this section if the provider has, to the satisfaction of the Commission, conducted an audit in accordance with a comparable foreign, Federal, or State law, regulation, guidance document, or independent certification. (b) AI child safety audit report (1) In general A provider of an AI chatbot shall— (A) not later than 90 days after the completion of an independent audit under subsection (a), and annually thereafter in accordance with procedures established by the Commission, submit to the Commission an AI child safety audit report; and (B) not later than 90 days after the submission of each AI child safety report, publish a summary of such report on the website of the provider, with appropriate redactions for trade secrets, personal information, and information that would compromise the security of the AI chatbot, including information that would facilitate circumvention, exploitation, or misuse, or that is subject to a third party’s confidentiality obligations. (2) Requirements Each AI child safety audit report submitted under paragraph (1) shall— (A) include— (i) key observations and identified areas for improvement found by the audit conducted under subsection (a), as well as recommendations regarding child safety on AI chatbots; and (ii) any other information determined appropriate by the Commission; and (B) be confidential and exempt from disclosure under section 552 of title 5, United States Code (commonly known as the Freedom of Information Act). (3) Review The Commission shall establish procedures to— (A) review each AI child safety audit report submitted under paragraph (1); and (B) request additional information or clarification from a provider of an AI chatbot or independent auditor in order to clarify any information in the report. (c) Publication of findings (1) Report on aggregated findings (A) In general Notwithstanding subsection (b)(2)(B), not later than 1 year after the submission of an AI child safety audit report and annually thereafter, the Commission shall publish a report on aggregated findings and trends based on the information submitted in the AI child safety audit reports to inform parents and policymakers regarding the use of AI chatbots by children. (B) Requirements The report published under subparagraph (A) shall include a summary of— (i) the total number of audits conducted under subsection (a); (ii) common findings and trends across the industry; (iii) emerging child safety risks identified through such audits; (iv) best practices and effective mitigation strategies with respect to such child safety risks; (v) aggregated data on compliance rates and common deficiencies; and (vi) recommendations for providers of AI chatbots, parents, and policymakers. (2) Public registry Not later than 90 days after the receipt of each AI child safety audit report, the Commission shall publish in a public registry a high-level summary of such report. (3) Use by qualified researchers (A) In general The Commission may establish a process for qualified researchers to access anonymized and aggregated audit data for academic study of child safety in AI chatbots, subject to— (i) approval by the Commission based on research merit and methodology; (ii) data use agreements that prohibit re-identification of any provider of an AI chatbot or any user and the disclosure of proprietary, confidential, or trade-secret information; (iii) data use agreements limiting access to data to approved research purposes; (iv) Institutional Review Board approval for research involving analysis of child-related data; (v) a commitment to publish any findings in peer-reviewed venues or make such findings publicly available; and (vi) annual reporting to the Commission on research progress and findings. (B) Availability of other information The Commission shall make available to qualified researchers, upon request and subject to appropriate protections— (i) de-identified audit methodologies and testing protocols; (ii) aggregated statistical data on audit findings across multiple providers of AI chatbots; (iii) anonymized case studies of safety incidents and remediation efforts; and (iv) data on effectiveness of different safety interventions, settings, and controls. (4) Disclosure to other entities Notwithstanding subsection (b)(2)(B), the Commission may disclose information from any AI child safety audit report to any other Federal, State, local, or Tribal government agency, as necessary for law enforcement purposes. (5) Rules of construction (A) Security and safety protections Nothing in this section shall be construed to require the disclosure of any information that would cause significant vulnerabilities for the security of an AI chatbot or undermine public security. (B) Encryption Nothing in this section shall be construed to require a provider of an AI chatbot, as a condition of compliance with this section, to decrypt encrypted user content.