United States - Algorithmic Accountability Act (H.R. 5628)

Overview

The Algorithmic Accountability Act of 2023 (H.R.5628) is a proposed federal statute that would require covered entities to conduct and document ongoing impact assessments for automated decision systems used in "augmented critical decision processes"—that is, automated or AI-based systems that make decisions with legal, material, or similarly significant effects on individuals (e.g., in healthcare, housing, employment, finances, education). The Act directs the Federal Trade Commission (FTC) to promulgate implementing regulations (in consultation with NIST, the Office of Science and Technology Policy (OSTP), and the National AI Initiative) within a statutory period and to establish a public repository aggregating limited summary information for consumer and research use. The bill also establishes a Bureau of Technology within the FTC to provide technical expertise and authorizes staff appointments to support enforcement and oversight. The Act adopts enforcement mechanisms modeled on the FTC Act and empowers state attorneys general to bring parens patriae actions; it preserves state and local laws and explicitly prohibits private-contract clauses from overriding the Act's prohibitions. (Primary source: Congress.gov — H.R.5628 text, PDF at BILLS-118hr5628ih.pdf.)

Definitions

The Act defines core terms used throughout the bill, including "automated decision system" (any system, software, or process—excluding passive infrastructure—whose computational result serves as the basis for decisions), "augmented critical decision process" (a process using an automated decision system to make a critical decision), "critical decision" (decisions with legal, material, or similarly significant effects, with enumerated categories such as education, employment, essential utilities, family planning, financial services, healthcare, housing, and legal services), "covered entity" (entities under FTC jurisdiction meeting revenue, equity, or data-holding thresholds), "impact assessment" (ongoing study and evaluation of systems and their consumer impacts), and "summary report" (a limited subset of impact-assessment information to be submitted to the FTC). These definitions establish the legal scope and thresholds for compliance and enforcement under the Act.

Governance and Institutional Framework

The FTC is the primary regulator under the Act and is directed to promulgate regulations under the Administrative Procedure Act (5 U.S.C. 553) within two years of enactment (subject to consultation with NIST, OSTP, the National AI Initiative, standards bodies, academia, civil-rights and consumer advocates, and industry). The FTC must design the reporting and repository systems, adopt categories of critical decisions, and issue guidance and templates to assist covered entities. The Act creates within the FTC a Bureau of Technology led by a Chief Technologist (minimum staffing and authority to appoint technical experts outside civil service constraints are specified) and authorizes additional enforcement personnel for the Bureau of Consumer Protection. The Commission may negotiate information-sharing and enforcement-coordination agreements with other federal agencies and preserve other agency authorities; the Act also requires the FTC to share summary reports securely with NIST, OSTP, and appropriate federal agencies to inform standards and rulemaking. See H.R.5628 text for staff-authority and bureau provisions.

Key Focus Areas

The bill's regulatory focus includes the following areas: mandatory impact assessments and documentation (development, validation, deployment, monitoring, and remediation plans); standardized summary reporting to the FTC for qualifying systems; a public, searchable repository with limited, consumer-relevant fields to promote transparency while mitigating commercial risk and privacy harms; stakeholder consultation and documentation of outreach to affected communities; specific attention to differential performance and disparate impacts by demographic groups; data provenance and source documentation; evaluation metrics and testing protocols; monitoring and incident reporting; and documentation of infeasible assessment elements with rationale. The Act also contemplates tiered or category-specific requirements—allowing the FTC to craft tailored assessment obligations and summary-report fields by category of critical decision and stage of system lifecycle. Finally, the bill requires guidance materials, templates, and training from the FTC to support compliance and to assist entities in determining whether they are covered entities.

Implementation Framework

The FTC must promulgate regulations within two years after enactment and those regulations become effective two years after promulgation. Regulations will specify: the categories of critical decisions; the minimum content of impact assessments (e.g., baseline comparisons, data sources, technical design descriptions, testing/validation metrics, monitoring plans, stakeholder consultation records, mitigation/remediation actions); the format and fields for summary reports; conditions for public repository publication; and exemptions or adjustments where privacy or security concerns apply. The Commission is required to consider privacy limits and existing data-protection law when deciding what assessment material may be stored or published. The Act authorizes appropriations and staffing to operationalize these requirements and instructs the FTC to issue guidance and templates to simplify compliance and to train potential covered entities in evaluating their obligations.

Monitoring and Evaluation

Covered entities must maintain the full impact-assessment documentation and submit limited summary reports when required. The FTC will publish an annual anonymized, machine-readable report summarizing trends, aggregated statistics, and lessons learned from the submitted summaries to inform updates to guidance and recommendations to other agencies. The public repository will be updated quarterly; the FTC must ensure repository discoverability, searchability, accessibility, and downloadability consistent with applicable federal guidance (e.g., 21st Century Integrated Digital Experience Act and OMB guidance). The FTC is also required to review the regulations at least every five years to update requirements in light of new evidence, evolving technologies, and stakeholder input.

Penalties, Liability, and Appeals

Violations of the Act or of regulations promulgated under it are treated as violations of rules defining unfair or deceptive acts or practices under the FTC Act; enforcement will be by the FTC with the same jurisdiction, powers, and duties as under the FTC Act, including injunctive relief, civil penalties where authorized, and other remedies. The Act authorizes state attorneys general to bring parens patriae civil actions on behalf of residents; the FTC may intervene, be heard, or appeal decisions. The bill preserves other agency authorities and does not preclude enforcement under other federal or state laws. There is no express private right of action created by the bill, but state enforcement and FTC enforcement provide significant enforcement channels. See enforcement provisions at H.R.5628.

Relationship to Other Instruments

The Act is designed to operate within the FTC's consumer-protection authority and to coordinate with existing federal agencies and programs: the National Institute of Standards and Technology (NIST) for standards, OSTP for policy guidance, and other regulators with sectoral authority (e.g., HHS for health, CFPB for consumer finance) for consistent treatment across jurisdictions. It references the FTC Act and cross-references OMB and federal information-access statutes for repository design. The Act explicitly preserves state, tribal, and local law and forbids preemption of such laws; it also prohibits contractual clauses that would waive or limit obligations under the Act.

International Alignment

While the Act is a domestic U.S. regulatory proposal, its impact-assessment and transparency architecture echoes global approaches to high-risk AI systems (for example, the European Union's AI Act emphasis on high-risk system obligations and documentation). The requirement for detailed impact assessments, recordkeeping, and public transparency aligns with international trends and would allow interoperability with standards developed by NIST and other standards bodies. The bill's consultative rulemaking approach (including standards bodies and international stakeholders) aims to promote coherence with international norms and facilitate cross-border research and compliance where applicable.

Implementation Timeline

Sources and References