Consumer protections for users

(a) Tiered disclosure and safety requirements (1) In general Each covered entity shall ensure that its artificial intelligence chatbot meets the following requirements: (A) Baseline disclosure An artificial intelligence chatbot shall— (i) at the initiation of each conversation with a user and during any extended interaction, at reasonably regular intervals, clearly and conspicuously disclose to the user that the chatbot is an artificial intelligence chatbot and not a human being; (ii) not falsely represent that the chatbot is a human being or that a response is generated by a human being; (iii) not falsely represent that the chatbot is a licensed professional, including a therapist, physician, lawyer, financial advisor, or other licensed or certified professional, or that a response is generated by such a professional; and (iv) disclose, in a form and manner prescribed by the Commission, whether and under what circumstances the chatbot interaction is subject to human oversight or review. (B) Detection of high stakes decisions An artificial intelligence chatbot shall be designed and maintained using reasonable and appropriate methods to identify when a user is seeking or receiving guidance tailored to the circumstance of the user or another individual from the artificial intelligence chatbot concerning a high-stakes decision. (C) Disclosure regarding high-stakes decisions If an artificial intelligence chatbot identifies that a user is seeking or receiving guidance tailored to the circumstance of the user or another individual concerning a high-stakes decision, such chatbot shall disclose that— (i) it is not a licensed professional and does not provide medical, legal, financial, psychological, or other licensed and certified professional services; (ii) information provided by the chatbot should not be relied upon as the sole basis for making a high-stakes decision and should be verified with an appropriate trusted individual, caregiver, or licensed professional before taking action; and (iii) the user’s conversation with such chatbot is not protected by attorney-client, physician-patient, psychotherapist-patient, or other professional privilege. (D) Detection of user crisis An artificial intelligence chatbot shall be designed and maintained using evidence-based methods for identifying reasonably apparent indicators of a crisis, consistent with evidence-based crisis intervention practices and applicable Federal guidance, including guidance issued by the National Institute of Standards and Technology under section 6 or guidance issued by other relevant Federal agencies. (E) Disclosure and intervention regarding user crisis If an artificial intelligence chatbot detects indicators of a crisis, such chatbot shall— (i) refer the user, as appropriate, to emergency services, a human professional, or crisis service provider, including the 988 Suicide and Crisis Lifeline; (ii) not provide advice to such user regarding— (I) self-harm or suicide; (II) adjusting, discontinuing, or managing medication; or (III) managing a medical emergency without professional assistance; (iii) provide information that prioritizes referral to a crisis service provider or human professional support; and (iv) not provide instructions or encouragement relating to self-harm, suicide, harm to others, medication changes, or management of a medical emergency without professional assistance. (F) Accessibility and usability An artificial intelligence chatbot shall provide each disclosure required under this paragraph in a manner that is clear, accessible, readable, compatible with assistive technologies, and easy to understand, taking into consideration the needs of older adults. (2) Protocol publication Each covered entity shall develop protocols to comply with this subsection and publish details of such protocols on the covered entity’s publicly accessible internet website. (3) Training Each covered entity shall train a machine learning or artificial intelligence model using any information about or provided by a user only if the user has provided affirmative consent authorizing such training. (b) Data protection (1) In general (A) Any conversation Except as described in subparagraph (C), a covered entity shall not collect, process, transcribe, record, retain, or disclose a conversation with a user or data obtained from a conversation with a user, including through machine learning or artificial intelligence, unless necessary to— (i) provide the artificial intelligence chatbot service requested by the user; (ii) comply with the requirements of this Act; (iii) prepare reports required under section 4; (iv) protect against fraud, abuse, a security incident, or imminent harm; or (v) comply with other applicable law. (B) Service providers A covered entity shall require any service provider that processes data obtained from a conversation on behalf of the covered entity to process such data only pursuant to written instructions and only for purposes permitted under subparagraph (A). (C) Affirmative consent for non-covered conversations A covered entity may transcribe, record, retain, or disclose a conversation with a user that is not a covered conversation or data obtained from a conversation with a user that is not a covered conversation for purposes other than the purposes described in subparagraph (A) if such covered entity has obtained affirmative consent from such user prior to such transcription, recording, retention, or disclosure. (D) Covered conversations In this paragraph, the term covered conversation means a conversation with a user and an artificial intelligence chatbot— (i) that involves a high-stakes decision; or (ii) during which the artificial intelligence chatbot detects a crisis. (2) Deletion of user conversation history A covered entity shall provide each user with a clear and readily accessible ability to delete conversation history with an artificial intelligence chatbot. (c) Deceptive or manipulative interaction design practices (1) In general Each covered entity shall take reasonable steps to prevent an artificial intelligence chatbot from employing deceptive or manipulative interaction design practices that— (A) encourage excessive reliance on, or prolonged engagement with, such chatbot; (B) take advantage of age-related cognitive limitations or impairments, including memory impairment, reduced executive function, or limitations related to social isolation; (C) discourage users from seeking assistance or support from family members, caregivers, licensed professionals, or other real-world relationships; (D) encourage users to prioritize interactions with the chatbot over real-world relationships or activities; (E) persistently urge continued interaction after a user has attempted to end, pause, or disengage from a conversation; or (F) use emotionally coercive language intended to create guilt, distress, or fear associated with ending or reducing interaction with the chatbot. (2) Rule of construction Nothing in this subsection shall be construed to prohibit a covered entity from designing an artificial intelligence chatbot intended to reduce loneliness, support social connection, facilitate access to information, or provide benign companionship. (d) User understanding Each covered entity shall take reasonable steps to ensure users understand the nature and limitations of artificial intelligence chatbots through clear disclosures, user interface design, and other appropriate measures. (e) Effective dates (1) In general Except as described in paragraph (2), this section shall take effect on the date that is 180 days after the date of enactment of this Act. (2) Crisis detection and response Subparagraphs (D) and (E) of subsection (a)(1) shall take effect on the date that is 1 year after the date of enactment of this Act.