This bill directs the Director of the National Institute of Standards and Technology (NIST) to create voluntary technical guidelines and specifications for "internal" and "external" assurances of artificial intelligence (AI) systems. "Internal assurance" means independent evaluations done by the organization that built or uses the AI, with internal reporting to reduce conflicts of interest. "External assurance" means independent evaluations by a nonaffiliated third party. NIST must finish the first guidelines within 1 year of enactment and review them at least every 2 years. The guidelines must cover consumer privacy safeguards, ways to assess and reduce harms, dataset quality, documentation and provenance, governance and process controls, and methods to protect sensitive information. The guidelines must not require specific technologies or products.
The Secretary of Commerce must set up an Artificial Intelligence Assurance Qualifications Advisory Committee after NIST publishes the guidelines. That committee (up to 20 members) will include representatives from universities, AI developers and deployers, assessors, consumers, public health and safety, civil rights groups, accreditation groups, workforce and labor groups, and nonprofit assurance organizations. The committee must report recommendations on qualifications and whether existing accreditation programs can be used, and then end its work.
The Secretary must also study the sector of entities that perform AI assurances. The study must start within 90 days after NIST publishes the guidelines and report within 1 year. The study will assess personnel, tools, methods, infrastructure, data protection practices, market demand, availability of assurers, and whether existing accredited facilities could be used for external assurances.
If you build, operate, or buy AI systems, the bill would produce voluntary NIST guidance on how to test and check those systems. These guidelines would describe when and how internal and external evaluations should be done, what information to share for evaluations, and how to protect sensitive data during the process. The guidance is voluntary, not mandatory.
No publicly available information on estimated costs or budgetary effects. The bill requires NIST and the Department of Commerce to carry out guidance development, stakeholder outreach, an advisory committee, and a sector study, which would involve staff time and administrative work.
The bill states its purposes are to develop consensus-driven, evidence-based voluntary guidelines for testing and evaluating AI systems; to use meaningful assurance to build trust, increase adoption, and provide accountability and governance; and to further goals of the NIST AI Risk Management Framework.
No publicly available information on opposition or critiques in the bill text or metadata.