119-hr5511

[Congressional Bills 119th Congress]
[From the U.S. Government Publishing Office]
[H.R. 5511 Introduced in House

    (IH) ]

<DOC>

119th CONGRESS
 1st Session
 H. R. 5511

To direct the Federal Trade Commission to require impact assessments of 
 certain algorithms, and for other purposes.

_______________________________________________________________________

 IN THE HOUSE OF REPRESENTATIVES

 September 19, 2025

 Ms. Clarke of New York (for herself, Ms. Balint, Ms. Barragan, Mr. 
 Bell, Ms. Brown, Mr. Davis of Illinois, Mr. Deluzio, Mr. Evans of 
 Pennsylvania, Mr. Figures, Mrs. Foushee, Mr. Garcia of Illinois, Ms. 
Norton, Mr. Huffman, Mr. Jackson of Illinois, Ms. Jacobs, Ms. Jayapal, 
 Ms. Kelly of Illinois, Ms. Lee of Pennsylvania, Mrs. Ramirez, Ms. 
Tlaib, Mr. Veasey, and Ms. Wilson of Florida) introduced the following 
 bill; which was referred to the Committee on Energy and Commerce

_______________________________________________________________________

 A BILL

To direct the Federal Trade Commission to require impact assessments of 
 certain algorithms, and for other purposes.

 Be it enacted by the Senate and House of Representatives of the 
United States of America in Congress assembled,

SECTION 1. SHORT TITLE.

 This Act may be cited as the ``Algorithmic Accountability Act of 
2025''.

SEC. 2. DEFINITIONS.

 In this Act:

    (1) Biometrics.--The term ``biometrics'' means any 
 information that represents a biological, physiological, or 
 behavioral attribute or feature of a consumer.

    (2) Chair.--The term ``Chair'' means the Chair of the 
 Commission.

    (3) Commission.--The term ``Commission'' means the Federal 
 Trade Commission.

    (4) Consumer.--The term ``consumer'' means an individual.

    (5) Covered algorithm.--The term ``covered algorithm'' 
 means a computational process derived from machine learning, 
 natural language processing, artificial intelligence 
 techniques, or other computational processing techniques of 
 similar or greater complexity, that, with respect to a 
 consequential action--
        (A) creates or facilitates the creation of a 
 product or information;
        (B) promotes, recommends, ranks, or otherwise 
 affects the display or delivery of information that is 
 material to the consequential action;
            (C) makes a decision; or
            (D) facilitates human decision making.

    (6) Covered entity.--
        (A) In general.--The term ``covered entity'' means 
 any person, partnership, or corporation over which the 
 Commission has jurisdiction under 

section 5

    (a)

    (2) of 
 the Federal Trade Commission Act (15 U.S.C. 45

    (a)

    (2) )--
            (i) that deploys any covered algorithm;
            (I) had greater than $50,000,000 in 
 average annual gross receipts or is 
 deemed to have greater than 
 $250,000,000 in equity value for the 3-
 taxable-year period (or for the period 
 during which the person, partnership, 
 or corporation has been in existence, 
 if such period is less than 3 years) 
 preceding the most recent fiscal year, 
 as determined in accordance with 
 paragraphs

    (2) and

    (3) of 

section 448
            (c) of the Internal Revenue Code of 
 1986;
            (II) possesses, manages, modifies, 
 handles, analyzes, controls, or 
 otherwise uses identifying information 
 about more than 1,000,000 consumers, 
 households, or consumer devices for the 
 purpose of developing or deploying any 
 covered algorithm; or
            (III) is substantially owned, 
 operated, or controlled by a person, 
 partnership, or corporation that meets 
 the requirements under subclause
            (I) or
            (II) ;
            (ii) that--
            (I) had greater than $5,000,000 in 
 average annual gross receipts or is 
 deemed to have greater than $25,000,000 
 in equity value for the 3-taxable-year 
 period (or for the period during which 
 the person, partnership, or corporation 
 has been in existence, if such period 
 is less than 3 years) preceding the 
 most recent fiscal year, as determined 
 in accordance with paragraphs

    (2) and

    (3) of 

section 448
            (c) of the Internal 
 Revenue Code of 1986; and
            (II) deploys any covered algorithm 
 that is developed for implementation or 
 use, or that the person, partnership, 
 or corporation reasonably expects to be 
 implemented or used by any person, 
 partnership, or corporation if such 
 person, partnership, or corporation 
 meets the requirements described in 
 clause
            (i) ; or
            (iii) that met the criteria described in 
 clause
            (i) or
            (ii) within the previous 3 years.
        (B) Inflation adjustment.--For purposes of applying 
 this paragraph in any fiscal year after the first 
 fiscal year that begins on or after the date of 
 enactment of this Act, each of the dollar amounts 
 specified in subparagraph
        (A) shall be increased by the 
 percentage increase (if any) in the consumer price 
 index for all urban consumers (U.S. city average) from 
 such first fiscal year that begins after such date of 
 enactment to the fiscal year involved.

    (7) Critical decision.--The term ``critical decision'' 
 means a decision or judgment that has any legal, material, or 
 similarly significant effect on a consumer's life relating to 
 access to or the cost, terms, or availability of--
        (A) education and vocational training, including 
 assessment, accreditation, or certification;
        (B) employment, workers management, or self-
 employment;
            (C) essential utilities, such as electricity, heat, 
 water, internet or telecommunications access, or 
 transportation;
            (D) family planning, including adoption services or 
 reproductive services;
        (E) financial services, including any financial 
 service provided by a mortgage company, mortgage 
 broker, or creditor;
        (F) healthcare, including mental healthcare, 
 dental, or vision;
        (G) housing or lodging, including any rental or 
 short-term housing or lodging;
        (H) legal services, including private arbitration 
 or mediation; or
            (I) any other service, program, or opportunity 
 decisions about which have a comparably legal, 
 material, or similarly significant effect on a 
 consumer's life as determined by the Commission through 
 rulemaking.

    (8) Deploy.--The term ``deploy'' means to implement, use, 
 or make available for sale, license, or other commercial 
 relationship.

    (9) Develop.--The term ``develop'' means to design, code, 
 produce, customize, or otherwise create or modify.

    (10) Identifying information.--The term ``identifying 
 information'' means any information, regardless of how the 
 information is collected, inferred, predicted, or obtained that 
 identifies or represents a consumer, household, or consumer 
 device through data elements or attributes, such as name, 
 postal address, telephone number, biometrics, email address, 
 internet protocol address, social security number, or any other 
 identifying number, identifier, or code.

    (11) Impact assessment.--The term ``impact assessment'' 
 means the ongoing study and evaluation of a covered algorithm 
 and its impact on consumers.

    (12) State.--The term ``State'' means each of the 50 
 States, the District of Columbia, and any territory or 
 possession of the United States.

    (13) Summary report.--The term ``summary report'' means 
 documentation of a subset of information required to be 
 addressed by the impact assessment as described in this Act or 
 determined appropriate by the Commission.

    (14) Third-party decision recipient.--The term ``third-
 party decision recipient'' means any person, partnership, or 
 corporation (beyond the consumer and the covered entity) that 
 receives a copy of or has access to the results of any decision 
 or judgment that results from a covered entity's deployment of 
 a covered algorithm.

SEC. 3. ASSESSING THE IMPACT OF COVERED ALGORITHMS.

    (a) Acts Prohibited.--

    (1) In general.--It is unlawful for--
        (A) any covered entity to violate a regulation 
 promulgated under subsection

    (b) ; or
        (B) any person to knowingly provide substantial 
 assistance to any covered entity in violating 
 subsection

    (b) .

    (2) Preemption of private contracts.--It shall be unlawful 
 for any covered entity to commit the acts prohibited in 
 paragraph

    (1) , regardless of specific agreements between 
 entities or consumers.

    (b) Regulations.--

    (1) In general.--Subject to paragraph

    (2) , not later than 2 
 years after the date of enactment of this Act, the Commission 
 shall, in consultation with the Director of the National 
 Institute of Standards and Technology, the Director of the 
 National Artificial Intelligence Initiative, the Director of 
 the Office of Science and Technology Policy, and other relevant 
 stakeholders, including standards bodies, private industry, 
 academia, technology experts, and advocates for civil rights, 
 consumers, and impacted communities, promulgate regulations, in 
 accordance with 

section 553 of title 5, United States Code, 
 that--
        (A) require each covered entity to perform impact 
 assessment of any covered algorithm--
            (i) that was developed for implementation 
 or use, or that the covered entity reasonably 
 expects to be implemented or used, by any 
 person, partnership, or corporation that meets 
 the requirements described in 

section 2

    (6)
        (A)
            (i) ; and
            (ii) both prior to and after deployment by 
 the covered entity;
        (B) require each covered entity to maintain 
 documentation of any impact assessment performed under 
 subparagraph
        (A) , including the applicable information 
 described in 

section 4

    (a) for 3 years longer than the 
 duration of time for which the covered algorithm is 
 deployed;
            (C) require each person, partnership, or 
 corporation that meets the requirements described in 
 

section 2

    (6)
        (A)
            (i) to disclose their status as a 
 covered entity to any person, partnership, or 
 corporation that sells, licenses, or otherwise provides 
 through a commercial relationship any covered algorithm 
 deployed by the covered entity;
            (D) require each covered entity to submit to the 
 Commission, on an annual basis, a summary report for 
 ongoing impact assessment of any deployed covered 
 algorithm;
        (E) require each covered entity to submit an 
 initial summary report to the Commission for any new 
 covered algorithm prior to its deployment by the 
 covered entity;
        (F) allow any person, partnership, or corporation 
 over which the Commission has jurisdiction under 
 

section 5

    (a)

    (2) of the Federal Trade Commission Act (15 
 U.S.C. 45

    (a)

    (2) ) that deploys any covered algorithm, 
 but is not a covered entity, to submit to the 
 Commission a summary report for any impact assessment 
 performed with respect to such algorithm;
        (G) require each covered entity, in performing the 
 impact assessment described in subparagraph
        (A) , to the 
 extent possible, to meaningfully consult (including 
 through participatory design, independent auditing, or 
 soliciting or incorporating feedback) with relevant 
 internal stakeholders (such as employees, ethics teams, 
 and responsible technology teams) and independent 
 external stakeholders (such as representatives of and 
 advocates for impacted groups, civil society and 
 advocates, and technology experts) as frequently as 
 necessary;
        (H) require each covered entity to attempt to 
 eliminate or mitigate, in a timely manner, any impact 
 made by a covered algorithm that demonstrates a likely 
 material negative impact that has legal or similarly 
 significant effects on a consumer's life;
            (I) establish definitions for--
            (i) what constitutes ``access to or the 
 cost, terms, or availability of'' with respect 
 to a critical decision;
            (ii) what constitutes ``possession'', 
 ``management'', ``modification'', and 
 ``control'' with respect to identifying 
 information;
            (iii) the different categories of third-
 party decision recipients that a covered entity 
 must document under 

section 5

    (1)
        (H) ; and
            (iv) any of the services, programs, or 
 opportunities described in subparagraphs
        (A) through
            (I) of 

section 2

    (7) for the purpose of 
 informing consumers, covered entities, and 
 regulators, as the Commission deems necessary;
        (J) establish guidelines for any person, 
 partnership, or corporation to calculate the number of 
 consumers, households, or consumer devices for which 
 the person, partnership, or corporation possesses, 
 manages, modifies, or controls identifying information 
 for the purpose of determining covered entity status;
        (K) establish guidelines for a covered entity to 
 prioritize different covered algorithms deployed by the 
 covered entity for performing impact assessment; and
            (L) establish a required format for any summary 
 report, as described in subparagraphs
            (D) ,
        (E) , and
        (F) , to ensure that such reports are submitted in an 
 accessible and machine-readable format.

    (2) Considerations.--In promulgating the regulations under 
 paragraph

    (1) , the Commission--
        (A) shall take into consideration--
            (i) that certain assessment or 
 documentation of a covered algorithm may only 
 be possible at particular stages of the 
 development and deployment of such algorithm or 
 may be limited or not possible based on the 
 availability of certain types of information or 
 data or the nature of the relationship between 
 the covered entity and consumers;
            (ii) the duration of time between summary 
 report submissions and the timeliness of the 
 reported information;
            (iii) the administrative burden placed on 
 the Commission and the covered entity;
            (iv) the benefits of standardizing and 
 structuring summary reports for comparative 
 analysis compared with the benefits of less-
 structured narrative reports to provide detail 
 and flexibility in reporting;
            (v) that summary reports submitted by 
 different covered entities may contain 
 different fields according to the requirements 
 established by the Commission, and the 
 Commission may allow or require submission of 
 incomplete reports;
            (vi) that existing data privacy and other 
 regulations may inhibit a covered entity from 
 storing or sharing certain information; and
            (vii) that a covered entity may require 
 information from other persons, partnerships, 
 or corporations that develop any covered 
 algorithm by the covered entity for the purpose 
 of performing impact assessment; and
        (B) may develop specific requirements for impact 
 assessments and summary reports for particular--
            (i) categories of critical decisions, as 
 described in subparagraphs
        (A) through
            (I) of 
 

section 2

    (7) or any subcategory developed by 
 the Commission; and
            (ii) stages of development and deployment 
 of a covered algorithm.

    (3) Effective date.--The regulations described in paragraph

    (1) shall take effect on the date that is 2 years after such 
 regulations are promulgated.

SEC. 4. REQUIREMENTS FOR COVERED ENTITY IMPACT ASSESSMENT.

    (a) Requirements for Impact Assessment.--In performing any impact 
assessment required under 

section 3

    (b)

    (1) for a covered algorithm, a 
covered entity shall do the following, to the extent possible, as 
applicable to such covered entity as determined by the Commission:

    (1) In the case of a new covered algorithm, evaluate any 
 previously existing critical decision-making process used for 
 the same critical decision prior to the deployment of the new 
 covered algorithm, along with any related documentation or 
 information, such as--
        (A) a description of the baseline process being 
 enhanced or replaced by the covered algorithm;
        (B) any known harm, shortcoming, failure case, or 
 material negative impact on consumers of the previously 
 existing process used to make the critical decision;
            (C) the intended benefits of and need for the 
 covered algorithm; and
            (D) the intended purpose of the covered algorithm.

    (2) Identify and describe any consultation with relevant 
 stakeholders as required by 

section 3

    (b)

    (1)
        (G) , including by 
 documenting--
        (A) the points of contact for the stakeholders who 
 were consulted;
        (B) the date of any such consultation; and
            (C) information about the terms and process of the 
 consultation, such as--
            (i) the existence and nature of any legal 
 or financial agreement between the stakeholders 
 and the covered entity;
            (ii) any data, system, design, scenario, or 
 other document or material the stakeholder 
 interacted with; and
            (iii) any recommendations made by the 
 stakeholders that were used to modify the 
 development or deployment of the covered 
 algorithm, as well as any recommendations not 
 used and the rationale for such nonuse.

    (3) In accordance with any relevant National Institute of 
 Standards and Technology or other Federal Government best 
 practices and standards, perform ongoing testing and evaluation 
 of the privacy risks and privacy-enhancing measures of the 
 covered algorithm, such as--
        (A) assessing and documenting the data minimization 
 practices of such algorithm and the duration for which 
 the relevant identifying information and any resulting 
 critical decision is stored;
        (B) assessing the information security measures in 
 place with respect to such algorithm, including any use 
 of privacy-enhancing technology such as federated 
 learning, differential privacy, secure multi-party 
 computation, de-identification, or secure data enclaves 
 based on the level of risk; and
            (C) assessing and documenting the current and 
 potential future or downstream positive and negative 
 impacts of such algorithm on the privacy, safety, or 
 security of consumers and their identifying 
 information.

    (4) Perform ongoing testing and evaluation of the current 
 and historical performance of the covered algorithm using 
 measures such as benchmarking datasets, representative examples 
 from the covered entity's historical data, and other standards, 
 including by documenting--
        (A) a description of what is deemed successful 
 performance and the methods and technical and business 
 metrics used by the covered entity to assess 
 performance;
        (B) a review of the performance of such algorithm 
 under test conditions or an explanation of why such 
 performance testing was not conducted;
            (C) a review of the performance of such algorithm 
 under deployed conditions or an explanation of why 
 performance was not reviewed under deployed conditions;
            (D) a comparison of the performance of such 
 algorithm under deployed conditions to test conditions 
 or an explanation of why such a comparison was not 
 possible;
        (E) an evaluation of any differential performance 
 associated with consumers' race, color, sex, gender, 
 age, disability, religion, family status, socioeconomic 
 status, or veteran status, and any other 
 characteristics the Commission deems appropriate 
 (including any combination of such characteristics) for 
 which the covered entity has information, including a 
 description of the methodology for such evaluation and 
 information about and documentation of the methods used 
 to identify such characteristics in the data (such as 
 through the use of proxy data, including ZIP Codes); 
 and
        (F) if any subpopulations were used for testing and 
 evaluation, a description of which subpopulations were 
 used and how and why such subpopulations were 
 determined to be of relevance for the testing and 
 evaluation.

    (5) Support and perform ongoing training and education for 
 all relevant employees, contractors, or other agents regarding 
 any documented material negative impacts on consumers from 
 similar covered algorithms and any improved methods of 
 developing or performing an impact assessment for such 
 algorithm based on industry best practices and relevant 
 proposals and publications from experts, such as advocates, 
 journalists, and academics.

    (6) Assess the need for and possible development of any 
 guard rail for or limitation on certain uses or applications of 
 the covered algorithm, including whether such uses or 
 applications ought to be prohibited or otherwise limited 
 through any terms of use, licensing agreement, or other legal 
 agreement between entities.

    (7) Maintain and keep updated documentation of any data or 
 other input information used to develop, test, maintain, or 
 update the covered algorithm, including--
        (A) how and when such data or other input 
 information was sourced and, if applicable, licensed, 
 including information such as--
            (i) metadata and information about the 
 structure and type of data or other input 
 information, such as the file type, the date of 
 the file creation or modification, and a 
 description of data fields;
            (ii) an explanation of the methodology by 
 which the covered entity collected, inferred, 
 or obtained the data or other input information 
 and, if applicable, labeled, categorized, 
 sorted, or clustered such data or other input 
 information, including whether such data or 
 other input information was labeled, 
 categorized, sorted, or clustered prior to 
 being collected, inferred, or obtained by the 
 covered entity; and
            (iii) whether and how consumers provided 
 informed consent for the inclusion and further 
 use of data or other input information about 
 themselves and any limitations stipulated on 
 such inclusion or further use;
        (B) why such data or other input information was 
 used and what alternatives were explored; and
            (C) other information about the data or other input 
 information, such as--
            (i) the representativeness of the dataset 
 and how this factor was measured, including any 
 assumption about the distribution of the 
 population on which the covered algorithm is 
 deployed; and
            (ii) the quality of the data, how the 
 quality was evaluated, and any measure taken to 
 normalize, correct, or clean the data.

    (8) Evaluate the rights of consumers, such as--
        (A) by assessing the extent to which the covered 
 entity provides consumers with--
            (i) clear notice that such algorithm will 
 be used; and
            (ii) a mechanism for opting out of such 
 use;
        (B) by assessing the transparency and 
 explainability of such algorithm and the degree to 
 which a consumer may contest, correct, or appeal a 
 decision or opt out of such algorithm, including--
            (i) the information available to consumers 
 or representatives or agents of consumers about 
 the algorithm, such as any relevant factors 
 that contribute to a particular decision, 
 including an explanation of which contributing 
 factors, if changed, would cause the algorithm 
 to reach a different decision, and how such 
 consumer, representative, or agent can access 
 such information;
            (ii) documentation of any complaint, 
 dispute, correction, appeal, or opt-out request 
 submitted to the covered entity by a consumer 
 with respect to such algorithm; and
            (iii) the process and outcome of any 
 remediation measure taken by the covered entity 
 to address the concerns of or harms to 
 consumers; and
            (C) by describing the extent to which any third-
 party decision recipient receives a copy of or has 
 access to the results of such algorithm and the 
 category of such third-party decision recipient, as 
 defined by the Commission in 

section 3

    (b)

    (1)
            (I) 
            (iii) .

    (9) Identify any likely material negative impact of the 
 covered algorithm on consumers and assess any applicable 
 mitigation strategy, such as by--
        (A) identifying and measuring any likely material 
 negative impact of the algorithm on consumers, 
 including documentation of the steps taken to identify 
 and measure such impact;
        (B) documenting any steps taken to eliminate or 
 reasonably mitigate any likely material negative impact 
 identified, including steps such as removing the 
 algorithm from the market or terminating its 
 development;
            (C) with respect to the likely material negative 
 impacts identified, documenting which such impacts were 
 left unmitigated and the rationale for the inaction, 
 including details about the justifying non-
 discriminatory, compelling interest and why such 
 interest cannot be satisfied by other means (such as 
 where there is an equal, zero-sum trade-off between 
 impacts on 2 or more consumers or where the required 
 mitigating action would violate civil rights or other 
 laws); and
            (D) documenting standard protocols or practices 
 used to identify, measure, mitigate, or eliminate any 
 likely material negative impact on consumers and how 
 relevant teams or staff are informed of and trained 
 about such protocols or practices.

    (10) Describe any ongoing documentation of the development 
 and deployment process with respect to the covered algorithm, 
 including information such as--
        (A) the date of any testing, deployment, licensure, 
 or other significant milestones; and
        (B) points of contact for any team, business unit, 
 or similar internal stakeholder that was involved.

    (11) Identify any capabilities, tools, standards, datasets, 
 security protocols, improvements to stakeholder engagement, or 
 other resources that may be necessary or beneficial to 
 improving the covered algorithm or the impact assessment of 
 such algorithm, in areas such as--
        (A) performance, including accuracy, robustness, 
 and reliability;
        (B) fairness, including bias and nondiscrimination;
            (C) transparency, explainability, contestability, 
 and opportunity for recourse;
            (D) privacy and security;
        (E) personal and public safety;
        (F) efficiency and timeliness;
        (G) cost; or
        (H) any other area determined appropriate by the 
 Commission.

    (12) Document any of the impact assessment requirements 
 described in paragraphs

    (1) through

    (11) that were attempted 
 but were not possible to comply with because they were 
 infeasible, as well as the corresponding rationale for not 
 being able to comply with such requirements, which may 
 include--
        (A) the absence of certain information about a 
 covered algorithm developed by other persons, 
 partnerships, and corporations;
        (B) the absence of certain information about how 
 clients, customers, licensees, partners, and other 
 persons, partnerships, or corporations are deploying a 
 covered algorithm;
            (C) a lack of demographic or other data required to 
 assess differential performance because such data is 
 too sensitive to collect, infer, or store; or
            (D) a lack of certain capabilities, including 
 technological innovations, that would be necessary to 
 conduct such requirements.

    (13) Perform and document any other ongoing study or 
 evaluation determined appropriate by the Commission.

    (b) Rule of Construction.--Nothing in this Act should be construed 
to limit any covered entity from adding other criteria, procedures, or 
technologies to improve the performance of an impact assessment of 
their covered algorithm.
            (c) Nondisclosure of Impact Assessment.--Nothing in this Act should 
be construed to require a covered entity to share with or otherwise 
disclose to the Commission or the public any information contained in 
an impact assessment performed in accordance with this Act, except for 
any information contained in the summary report required under 
subparagraph
            (D) or
        (E) of 

section 3

    (b)

    (1) .

SEC. 5. REQUIREMENTS FOR SUMMARY REPORTS TO THE COMMISSION.

 The summary report that a covered entity is required to submit 
under subparagraph
            (D) or
        (E) of 

section 3

    (b)

    (1) for any covered 
algorithm shall, to the extent possible--

    (1) contain information from the impact assessment of such 
 algorithm, as applicable, including--
        (A) the name, website, and point of contact for the 
 covered entity;
        (B) a detailed description of the specific critical 
 decision that the covered algorithm is intended to 
 make, including the category of critical decision as 
 described in subparagraphs
        (A) through
            (I) of 

section 2

    (7) ;
            (C) the covered entity's intended purpose for the 
 covered algorithm;
            (D) an identification of any stakeholders consulted 
 by the covered entity as required by 

section 3

    (b)

    (1)
        (G) and documentation of the existence and nature of any 
 legal agreements between the stakeholders and the 
 covered entity;
        (E) documentation of the testing and evaluation of 
 the covered algorithm, including--
            (i) the methods and technical and business 
 metrics used to assess the performance of such 
 algorithm and a description of what metrics are 
 deemed successful performance;
            (ii) the results of any assessment of the 
 performance of such algorithm and a comparison 
 of the results of any assessment under test and 
 deployed conditions; and
            (iii) an evaluation of any differential 
 performance of such algorithm assessed during 
 the impact assessment;
        (F) any publicly stated guard rail for or 
 limitation on certain uses or applications of the 
 covered algorithm, including whether such uses or 
 applications ought to be prohibited or otherwise 
 limited through any terms of use, licensing agreement, 
 or other legal agreement between entities;
        (G) documentation about the data or other input 
 information used to develop, test, maintain, or update 
 the covered algorithm including--
            (i) how and when the covered entity sourced 
 such data or other input information; and
            (ii) why such data or other input 
 information was used and what alternatives were 
 explored;
        (H) documentation of whether and how the covered 
 entity implements any transparency or explainability 
 measures, including--
            (i) which categories of third-party 
 decision recipients receive a copy of or have 
 access to the results of any decision or 
 judgment that results from such algorithm; and
            (ii) any mechanism by which a consumer may 
 contest, correct, or appeal a decision or opt 
 out of such algorithm, including the 
 corresponding website for such mechanism, where 
 applicable;
            (I) any likely material negative impact on 
 consumers identified by the covered entity and a 
 description of the steps taken to remediate or mitigate 
 such impact;
        (J) a list of any impact assessment requirements 
 that were attempted but were not possible to comply 
 with because they were infeasible, as well as the 
 corresponding rationale for not being able to comply 
 with such requirements; and
        (K) any additional capabilities, tools, standards, 
 datasets, security protocols, improvements to 
 stakeholder engagement, or other resources identified 
 by an impact assessment as necessary or beneficial to 
 improve the performance of impact assessment or the 
 development and deployment of any covered algorithm 
 that the covered entity determines appropriate to share 
 with the Commission;

    (2) include, in addition to the information required under 
 paragraph

    (1) , any relevant additional information from 

section 4

    (a) the covered entity wishes to share with the Commission;

    (3) follow any format or structure requirements specified 
 by the Commission; and

    (4) include additional criteria that are essential for the 
 purpose of consumer protection, as determined by the 
 Commission.

SEC. 6. REPORTING; PUBLICLY ACCESSIBLE REPOSITORY.

    (a) Annual Report.--Not later than 1 year after the effective date 
described in 

section 3

    (b)

    (3) , and annually thereafter, the Commission 
shall publish publicly on the website of the Commission a report 
describing and summarizing the information from the summary reports 
submitted under subparagraph
            (D) ,
        (E) , or
        (F) of 

section 3

    (b)

    (1) that--

    (1) is accessible and machine readable in accordance with 
 the 21st Century Integrated Digital Experience Act (44 U.S.C. 
 3501 note); and

    (2) describes broad trends, aggregated statistics, and 
 anonymized lessons learned about performing impact assessments 
 of covered algorithms, for the purposes of updating guidance 
 related to impact assessments and summary reporting, oversight, 
 and making recommendations to other regulatory agencies.

    (b) Publicly Accessible Repository.--

    (1) In general.--
        (A) Establishment.--
            (i) Development.--Not later than 180 days 
 after the Commission promulgates the 
 regulations required under 

section 3

    (b)

    (1) , the 
 Commission shall develop a publicly accessible 
 repository designed to publish a limited subset 
 of the information about each covered algorithm 
 for which the Commission received a summary 
 report under subparagraph
            (D) ,
        (E) , or
        (F) of 
 

section 3

    (b)

    (1) in order to facilitate consumer 
 protection.
            (ii) Publication.--Not later than 180 days 
 after the effective date described in 

section 3

    (b)

    (3) , the Commission shall make the 
 repository publicly accessible.
            (iii) Updates.--The Commission shall update 
 the repository on a quarterly basis.
        (B) === Purpose ===
-The purposes of the repository 
 established under subparagraph
        (A) are--
            (i) to inform consumers about the use of 
 covered algorithms;
            (ii) to allow researchers and advocates to 
 study the use of covered algorithms; and
            (iii) to ensure compliance with the 
 requirements of this Act.
            (C) Considerations.--In establishing the repository 
 under subparagraph
        (A) , the Commission shall consider--
            (i) how to provide consumers with pertinent 
 information regarding covered algorithms while 
 minimizing any potential commercial risk to any 
 covered entity of providing such information;
            (ii) what information, if any, to include 
 regarding the specific covered algorithms 
 deployed;
            (iii) how to document information, when 
 applicable, about how to contest or seek 
 recourse for a critical decision in a manner 
 that is readily accessible by the consumer; and
            (iv) how to streamline the submission of 
 summary reports under subparagraph
            (D) ,
        (E) , or
        (F) of 

section 3

    (b)

    (1) to allow the Commission 
 to efficiently populate information into the 
 repository to minimize or eliminate any burden 
 on the Commission.
            (D) Requirements.--The Commission shall design the 
 repository established under subparagraph
        (A) to--
            (i) be publicly available and easily 
 discoverable on the website of the Commission;
            (ii) allow users to sort and search the 
 repository by multiple characteristics (such as 
 by covered entity, date reported, or category 
 of critical decision) simultaneously;
            (iii) allow users to make a copy of or 
 download the information obtained from the 
 repository, including any subsets of 
 information obtained by sorting or searching as 
 described in clause
            (ii) , in accordance with 
 current guidance from the Office of Management 
 and Budget, such as the Open, Public, 
 Electronic, and Necessary Government Data Act 
 (44 U.S.C. 101 note);
            (iv) be in accordance with user experience 
 and accessibility best practices such as those 
 described in the 21st Century Integrated 
 Digital Experience Act (44 U.S.C. 3501 note);
            (v) include a limited subset of information 
 from the summary reports, as applicable, under 
 subparagraph
            (D) ,
        (E) , or
        (F) of 

section 3

    (b)

    (1) that includes--
            (I) the identity of the covered 
 entity that submitted such summary 
 report, including any link to the 
 website of the covered entity;
            (II) the specific critical decision 
 that the covered algorithm makes, along 
 with the category of the critical 
 decision;
            (III) any publicly stated 
 prohibited applications of the covered 
 algorithm, including whether such 
 prohibition is enforced through any 
 terms of use, licensing agreement, or 
 other legal agreement between entities;
            (IV) to the extent possible, the 
 sources of any data used to develop, 
 test, maintain, or update the covered 
 algorithm;
            (V) to the extent possible, the 
 type of technical and business metrics 
 used to assess the performance of the 
 covered algorithm when deployed; and
            (VI) the link to any web page with 
 instructions or other information 
 related to a mechanism by which a 
 consumer may contest, correct, or 
 appeal a decision or opt out of the 
 covered algorithm; and
            (vi) include information about design, use, 
 and maintenance of the repository, including--
            (I) how frequently the repository 
 is updated;
            (II) the date of the most recent 
 such update;
            (III) the types of information from 
 the summary reports submitted under 
 subparagraph
            (D) ,
        (E) , or
        (F) of 
 

section 3

    (b)

    (1) that are and are not 
 included in the repository; and
            (IV) any other information about 
 the design, use, and maintenance the 
 Commission determines is--

    (aa) relevant to consumers 
 and researchers; or

    (bb) essential for consumer 
 education and recourse.

    (2) Authorization of appropriations.--There are authorized 
 to be appropriated to the Commission such sums as are necessary 
 to carry out this subsection.

SEC. 7. GUIDANCE AND TECHNICAL ASSISTANCE; OTHER REQUIREMENTS.

    (a) Guidance and Technical Assistance From the Commission.--

    (1) In general.--The Commission shall publish guidance on 
 how to meet the requirements of sections 4 and 5, including 
 resources such as documentation templates and guides for 
 meaningful consultation, that is developed by the Commission 
 after consultation with the Director of the National Institute 
 of Standards and Technology, the Director of the National 
 Artificial Intelligence Initiative, the Director of the Office 
 of Science and Technology Policy, and other relevant 
 stakeholders, including standards bodies, private industry, 
 academia, technology experts, and advocates for civil rights, 
 consumers, and impacted communities.

    (2) Assistance in determining covered entity status.--In 
 addition to the guidance required under paragraph

    (1) , the 
 Commission shall--
        (A) issue guidance and training materials to assist 
 persons, partnerships, and corporations in evaluating 
 whether they are a covered entity; and
        (B) regularly update such guidance and training 
 materials in accordance with any feedback or questions 
 from covered entities, experts, or other relevant 
 stakeholders.

    (b) Other Requirements.--

    (1) Publication.--Nothing in this Act shall be construed to 
 limit a covered entity from publicizing any documentation of 
 the impact assessment maintained under 

section 3

    (b)

    (1)
        (B) , 
 including information beyond what is required to be submitted 
 in a summary report under subparagraph
            (D) or
        (E) of 

section 3

    (b)

    (1) , unless such publication would violate the privacy of 
 any consumer.

    (2) Periodic review of regulations.--The Commission shall 
 review the regulations promulgated under 

section 3

    (b) not less 
 than once every 5 years and update such regulations as 
 appropriate.

    (3) Review by nist and ostp.--The Commission shall make 
 available, in a private and secure manner, to the Director of 
 the National Institute of Standards and Technology, the 
 Director of the Office of Science and Technology Policy, and 
 the head of any Federal agency with relevant regulatory 
 jurisdiction over a covered algorithm any summary report 
 submitted under subparagraph
            (D) ,
        (E) , or
        (F) of 

section 3

    (b)

    (1) for review in order to develop future standards or 
 regulations.

SEC. 8. RESOURCES AND AUTHORITIES.

    (a) Bureau of Technology.--

    (1) Establishment.--
        (A) In general.--There is established within the 
 Commission the Bureau of Technology (in this subsection 
 referred to as the ``Bureau'').
        (B) Duties.--The Bureau shall engage in activities 
 that include:
            (i) Aiding or advising the Commission with 
 respect to the technological aspects of the 
 functions of the Commission, including--
            (I) preparing, conducting, 
 facilitating, managing, or otherwise 
 enabling studies, workshops, audits, 
 community participation opportunities, 
 or other similar activities; and
            (II) any other assistance deemed 
 appropriate by the Commission or Chair.
            (ii) Aiding or advising the Commission with 
 respect to the enforcement of this Act.
            (iii) Providing technical assistance to any 
 enforcement bureau within the Commission with 
 respect to the investigation and trial of 
 cases.

    (2) Chief technologist.--The Bureau shall be headed by a 
 Chief Technologist.

    (3) Staff.--
        (A) Appointments.--
            (i) In general.--Subject to subparagraph
        (B) , the Chair may, without regard to the civil 
 service laws (including regulations), appoint 
 personnel with experience in fields such as 
 management, technology, digital and product 
 design, user experience, information security, 
 civil rights, technology policy, privacy 
 policy, humanities and social sciences, product 
 management, software engineering, machine 
 learning, statistics, or other related fields 
 to enable the Bureau to perform its duties.
            (ii) Minimum appointments.--Not later than 
 2 years after the date of enactment of this 
 Act, the Chair shall appoint not less than 50 
 personnel.
        (B) Excepted service.--The personnel appointed in 
 accordance with subparagraph
        (A) may be appointed to 
 positions described in 

section 213.3102

    (r) of title 5, 
 Code of Federal Regulations.

    (4) Authorization of appropriations.--There are authorized 
 to be appropriated to the Commission such sums as are necessary 
 to carry out this subsection.

    (b) Additional Personnel in the Bureau of Consumer Protection.--

    (1) Additional personnel.--Notwithstanding any other 
 provision of law, the Chair may, without regard to the civil 
 service laws (including regulations), appoint 25 additional 
 personnel to the Division of Enforcement of the Bureau of 
 Consumer Protection.

    (2) Authorization of appropriations.--There are authorized 
 to be appropriated to the Commission such sums as are necessary 
 to carry out this subsection.
            (c) Establishment of Agreements of Cooperation.--The Commission 
shall negotiate agreements of cooperation, as needed, with any relevant 
Federal agency with respect to information sharing and enforcement 
actions taken regarding the development or deployment of a covered 
algorithm to make a critical decision. Such agreements shall include 
procedures for determining which agency shall file an action and 
providing notice to the non-filing agency, where feasible, prior to 
initiating a civil action to enforce any Federal law within such 
agencies' jurisdictions regarding the development or deployment of a 
covered algorithm to make a critical decision by a covered entity.

SEC. 9. ENFORCEMENT.

    (a) Enforcement by the Commission.--

    (1) Unfair or deceptive acts or practices.--A violation of 
 this Act or a regulation promulgated thereunder shall be 
 treated as a violation of a rule defining an unfair or 
 deceptive act or practice under 

section 18

    (a)

    (1)
        (B) of the 
 Federal Trade Commission Act (15 U.S.C. 57a

    (a)

    (1)
        (B) ).

    (2) Powers of the commission.--
        (A) In general.--The Commission shall enforce this 
 Act and the regulations promulgated under this Act in 
 the same manner, by the same means, and with the same 
 jurisdiction, powers, and duties as though all 
 applicable terms and provisions of the Federal Trade 
 Commission Act (15 U.S.C. 41 et seq.) were incorporated 
 into and made a part of this Act.
        (B) Privileges and immunities.--Any person who 
 violates this Act or a regulation promulgated 
 thereunder shall be subject to the penalties and 
 entitled to the privileges and immunities provided in 
 the Federal Trade Commission Act (15 U.S.C. 41 et 
 seq.).
            (C) Authority preserved.--Nothing in this Act shall 
 be construed to limit the authority of the Commission 
 under any other provision of law.
            (D) Rulemaking.--The Commission shall promulgate in 
 accordance with 

section 553 of title 5, United States 
 Code, such additional rules as may be necessary to 
 carry out this Act.

    (b) Enforcement by States.--

    (1) In general.--If the attorney general of a State has 
 reason to believe that an interest of the residents of the 
 State has been or is being threatened or adversely affected by 
 a practice that violates this Act or a regulation promulgated 
 thereunder, the attorney general of the State may, as parens 
 patriae, bring a civil action on behalf of the residents of the 
 State in an appropriate district court of the United States to 
 obtain appropriate relief.

    (2) Rights of commission.--
        (A) Notice to commission.--
            (i) In general.--Except as provided in 
 clause
            (iii) , the attorney general of a State, 
 before initiating a civil action under 
 paragraph

    (1) , shall provide written 
 notification to the Commission that the 
 attorney general intends to bring such civil 
 action.
            (ii) Contents.--The notification required 
 under clause
            (i) shall include a copy of the 
 complaint to be filed to initiate the civil 
 action.
            (iii) Exception.--If it is not feasible for 
 the attorney general of a State to provide the 
 notification required under clause
            (i) before 
 initiating a civil action under paragraph

    (1) , 
 the attorney general shall notify the 
 Commission immediately upon instituting the 
 civil action.
        (B) Intervention by commission.--The Commission 
 may--
            (i) intervene in any civil action brought 
 by the attorney general of a State under 
 paragraph

    (1) ; and
            (ii) upon intervening--
            (I) be heard on all matters arising 
 in the civil action; and
            (II) file petitions for appeal of a 
 decision in the civil action.

    (3) Investigatory powers.--Nothing in this subsection may 
 be construed to prevent the attorney general of a State from 
 exercising the powers conferred on the attorney general by the 
 laws of the State to conduct investigations, to administer 
 oaths or affirmations, or to compel the attendance of witnesses 
 or the production of documentary or other evidence.

    (4) Venue; service of process.--
        (A) Venue.--Any action brought under paragraph

    (1) may be brought in--
            (i) the district court of the United States 
 that meets applicable requirements relating to 
 venue under 

section 1391 of title 28, United 
 States Code; or
            (ii) another court of competent 
 jurisdiction.
        (B) Service of process.--In an action brought under 
 paragraph

    (1) , process may be served in any district in 
 which--
            (i) the defendant is an inhabitant, may be 
 found, or transacts business; or
            (ii) venue is proper under 

section 1391 of 
 title 28, United States Code.

    (5) Actions by other state officials.--
        (A) In general.--In addition to a civil action 
 brought by an attorney general under paragraph

    (1) , any 
 other officer of a State who is authorized by the State 
 to do so may bring a civil action under paragraph

    (1) , 
 subject to the same requirements and limitations that 
 apply under this subsection to civil actions brought by 
 attorneys general.
        (B) Savings provision.--Nothing in this subsection 
 may be construed to prohibit an authorized official of 
 a State from initiating or continuing any proceeding in 
 a court of the State for a violation of any civil or 
 criminal law of the State.

SEC. 10. COORDINATION.

 In carrying out this Act, the Commission shall coordinate with any 
appropriate Federal agency or State regulator to promote consistent 
regulatory treatment of covered algorithms.

SEC. 11. NO PREEMPTION.

 Nothing in this Act may be construed to preempt any State, tribal, 
city, or local law, regulation, or ordinance.
 <all>