Recordkeeping and incident information

(a) Reporting requirement Not later than 1 year after the date of enactment of this Act, and annually thereafter, each covered entity shall submit to the Director of the National Institutes of Health and the Commission a report regarding material adverse incidents (as determined by the Commission) involving an artificial intelligence chatbot and a high-stakes decision or crisis. (b) Content of reports Each report described in subsection (a) shall include, for the period covered by the report— (1) the total number of material adverse incidents that occurred, disaggregated by— (A) the type of material adverse incident; (B) subject to subsection (d), whether the affected user was— (i) younger than 50 years of age; (ii) 50 to 64 years of age; (iii) 65 to 74 years of age; (iv) 75 to 84 years of age; or (v) 85 years of age or older; and (C) the outcome of any crisis response protocol, including— (i) whether the user was referred to a crisis service provider; (ii) to the extent known by the covered entity, whether the user completed the referral; and (iii) any follow-up actions taken by the covered entity. (2) a description of the crisis detection methods employed by the covered entity and any modifications made to such methods during the reporting period; and (3) any corrective actions taken by the covered entity in response to any material adverse incident. (c) Reporting standards By not later than 180 days after the date of enactment of this Act, the Commission, in consultation with the Director of the National Institutes of Health, shall prescribe standards for the format and submission of reports under this section, including how to ensure that the information submitted in such reports is limited to aggregate, anonymized, and operational metrics. (d) Construction regarding age information Nothing in this section shall be construed to require a covered entity to collect, infer, verify, or retain a user’s age solely for purposes of complying with this section. A covered entity shall provide the information described in subsection (b)(1)(B) only to the extent such information is already known to the covered entity in the ordinary course of business or voluntarily provided by the user. (e) Public availability The Commission and the Director of the National Institutes of Health shall jointly publish aggregate, de-identified data from reports submitted under subsection (a) on a publicly accessible internet website not less frequently than annually.