HR 3679 — Small Business Artificial Intelligence Advancement Act

changes in existing law made by 
the bill, as reported, are shown as follows (existing law 
proposed to be omitted is enclosed in black brackets, new 
matter is printed in italics, and existing law in which no 
change is proposed is shown in roman):

 NATIONAL INSTITUTE OF STANDARDS AND TECHNOLOGY ACT

 * * * * * * *
SEC. 22A. STANDARDS FOR ARTIFICIAL INTELLIGENCE.

 (a) Mission.--The Institute shall--
 (1) advance collaborative frameworks, standards, 
 guidelines, and associated methods and techniques for 
 artificial intelligence;
 (2) support the development of a risk-mitigation 
 framework for deploying artificial intelligence 
 systems;
 (3) support the development of technical standards 
 and guidelines that promote trustworthy artificial 
 intelligence systems; and
 (4) support the development of technical standards 
 and guidelines by which to test for bias in artificial 
 intelligence training data and applications.
 (b) Supporting Activities.--The Director of the National 
Institute of Standards and Technology may--
 (1) support measurement research and development of 
 best practices and voluntary standards for trustworthy 
 artificial intelligence systems, which may include--
 (A) privacy and security, including for 
 datasets used to train or test artificial 
 intelligence systems and software and hardware 
 used in artificial intelligence systems;
 (B) advanced computer chips and hardware 
 designed for artificial intelligence systems;
 (C) data management and techniques to 
 increase the usability of data, including 
 strategies to systematically clean, label, and 
 standardize data into forms useful for training 
 artificial intelligence systems and the use of 
 common, open licenses;
 (D) safety and robustness of artificial 
 intelligence systems, including assurance, 
 verification, validation, security, control, 
 and the ability for artificial intelligence 
 systems to withstand unexpected inputs and 
 adversarial attacks;
 (E) auditing mechanisms and benchmarks for 
 accuracy, transparency, verifiability, and 
 safety assurance for artificial intelligence 
 systems;
 (F) applications of machine learning and 
 artificial intelligence systems to improve 
 other scientific fields and engineering;
 (G) model documentation, including 
 performance metrics and constraints, measures 
 of fairness, training and testing processes, 
 and results;
 (H) system documentation, including 
 connections and dependences within and between 
 systems, and complications that may arise from 
 such connections; and
 (I) all other areas deemed by the Director to 
 be critical to the development and deployment 
 of trustworthy artificial intelligence;
 (2) produce curated, standardized, representative, 
 high-value, secure, aggregate, and privacy protected 
 data sets for artificial intelligence research, 
 development, and use;
 (3) support one or more institutes as described in 
 section 5201(b) of the National Artificial Intelligence 
 Initiative Act of 2020 for the purpose of advancing 
 measurement science, voluntary consensus standards, and 
 guidelines for trustworthy artificial intelligence 
 systems;
 (4) support and strategically engage in the 
 development of voluntary consensus standards, including 
 international standards, through open, transparent, and 
 consensus-based processes; and
 (5) enter into and perform such contracts, including 
 cooperative research and development arrangements and 
 grants and cooperative agreements or other 
 transactions, as may be necessary in the conduct of the 
 work of the National Institute of Standards and 
 Technology and on such terms as the Director considers 
 appropriate, in furtherance of the purposes of this 
 division.
 (c) Risk Management Framework.--Not later than 2 years after 
the date of the enactment of this Act, the Director shall work 
to develop, and periodically update, in collaboration with 
other public and private sector organizations, including the 
National Science Foundation and the Department of Energy, a 
voluntary risk management framework for trustworthy artificial 
intelligence systems. The framework shall--
 (1) identify and provide standards, guidelines, best 
 practices, methodologies, procedures and processes 
 for--
 (A) developing trustworthy artificial 
 intelligence systems;
 (B) assessing the trustworthiness of 
 artificial intelligence systems; and
 (C) mitigating risks from artificial 
 intelligence systems;
 (2) establish common definitions and 
 characterizations for aspects of trustworthiness, 
 including explainability, transparency, safety, 
 privacy, security, robustness, fairness, bias, ethics, 
 validation, verification, interpretability, and other 
 properties related to artificial intelligence systems 
 that are common across all sectors;
 (3) provide case studies of framework implementation;
 (4) align with international standards, as 
 appropriate;
 (5) incorporate voluntary consensus standards and 
 industry best practices; and
 (6) not prescribe or otherwise require the use of 
 specific information or communications technology 
 products or services.
 (d) Participation in Standard Setting Organizations.--
 (1) Requirement.--The Institute shall participate in 
 the development of standards and specifications for 
 artificial intelligence.
 (2) Purpose.--The purpose of this participation shall 
 be to ensure--
 (A) that standards promote artificial 
 intelligence systems that are trustworthy; and
 (B) that standards relating to artificial 
 intelligence reflect the state of technology 
 and are fit-for-purpose and developed in 
 transparent and consensus-based processes that 
 are open to all stakeholders.
 (e) Data Sharing Best Practices.--Not later than 1 year after 
the date of enactment of this Act, the Director shall, in 
collaboration with other public and private sector 
organizations, develop guidance to facilitate the creation of 
voluntary data sharing arrangements between industry, federally 
funded research centers, and Federal agencies for the purpose 
of advancing artificial intelligence research and technologies, 
including options for partnership models between government 
entities, industry, universities, and nonprofits that 
incentivize each party to share the data they collected.
 (f) Best Practices for Documentation of Data Sets.--Not later 
than 1 year after the date of enactment of this Act, the 
Director shall, in collaboration with other public and private 
sector organizations, develop best practices for datasets used 
to train artificial intelligence systems, including--
 (1) standards for metadata that describe the 
 properties of datasets, including--
 (A) the origins of the data;
 (B) the intent behind the creation of the 
 data;
 (C) authorized uses of the data;
 (D) descriptive characteristics of the data, 
 including what populations are included and 
 excluded from the datasets; and
 (E) any other properties as determined by the 
 Director; and
 (2) standards for privacy and security of datasets 
 with human characteristics.
 (g) Testbeds.--In coordination with other Federal agencies as 
appropriate, the private sector, and institutions of higher 
education (as such term is defined in section 101 of the Higher 
Education Act of 1965 (20 U.S.C. 1001)), the Director may 
establish testbeds, including in virtual environments, to 
support the development of robust and trustworthy artificial 
intelligence and machine learning systems, including testbeds 
that examine the vulnerabilities and conditions that may lead 
to failure in, malfunction of, or attacks on such systems.
 (h) Development of Resources for Small Businesses in 
Utilizing Artificial Intelligence.--
 (1) In general.--Subject to the availability of 
 appropriations, the Director shall, in carrying out 
 subsection (a), develop or identify, and disseminate 
 (in accordance with paragraph (4)), resources for small 
 business concerns (as such term is defined in section 3 
 of the Small Business Act (15 U.S.C. 632)) relating to 
 artificial intelligence. Such resources may include 
 technical standards, best practices, benchmarks, 
 methodologies, procedures, or processes for the 
 understanding, adoption, or integration of artificial 
 intelligence.
 (2) Requirements.--The Director shall ensure that the 
 resources described in paragraph (1) satisfy the 
 following:
 (A) Are generally applicable and usable by a 
 wide range of small business concerns.
 (B) Include elements that promote basic 
 understanding, identification, and adoption of 
 proper use cases of artificial intelligence.
 (C) Include case studies of practical 
 application across a range of business sizes 
 and types.
 (D) Are technology-neutral and relevant to 
 technologies that are accessible and suitable 
 for small businesses.
 (E) Are based on international voluntary 
 standards as applicable, and are consistent 
 with the Stevenson-Wydler Technology Innovation 
 Act of 1980 (15 U.S.C. 3701 et seq.).
 (F) Include recommendations and references to 
 existing Federal educational resources, 
 including the risk management framework under 
 subsection (c), privacy and cybersecurity risk 
 management frameworks established by the 
 Institute, and activities relating to the 
 national cybersecurity awareness and education 
 program under section 303 of the Cybersecurity 
 Enhancement Act of 2014 (15 U.S.C. 7443).
 (3) Review and update of resources.--Not later than 
 two years after the date of the enactment of this 
 subsection and not less frequently than once every two 
 years thereafter, the Director shall carry out the 
 following:
 (A) Review the resources described in 
 paragraph (1).
 (B) Update such resources as the Director 
 considers appropriate.
 (4) Dissemination and use of training resources.--The 
 Director shall coordinate with the Administrator of the 
 Small Business Administration regarding the 
 distribution and use through the resource partners of 
 the Small Business Administration of the resources 
 described in paragraph (1).
 (5) Voluntary resources.--The use of the resources 
 described in paragraph (1) shall be considered 
 voluntary.
 (6) Report.--
 (A) In general.--Not later than four years 
 after the date of the enactment of this 
 subsection, the Director shall submit to the 
 Committee on Science, Space, and Technology of 
 the House of Representatives and the Committee 
 on Commerce, Science, and Transportation of the 
 Senate a report on the development, 
 identification, dissemination, and use of the 
 resources described in paragraph (1), including 
 updates made pursuant to paragraph (3).
 (B) Contents.--The report under subparagraph 
 (A) shall include the following:
 (i) A list of the resources described 
 in paragraph (1), including updates 
 made pursuant to paragraph (3).
 (ii) Relevant feedback from 
 recipients of such resources, and 
 disseminators of such resources 
 pursuant to paragraph (4).
 (iii) Recommendations to Congress for 
 further actions to help with the 
 utilization of artificial intelligence 
 by small business concerns.
 [(h)] (i) Authorization of Appropriations.--There are 
authorized to be appropriated to the National Institute of 
Standards and Technology to carry out this section--
 (1) $64,000,000 for fiscal year 2021;
 (2) $70,400,000 for fiscal year 2022;
 (3) $77,440,000 for fiscal year 2023;
 (4) $85,180,000 for fiscal year 2024; and
 (5) $93,700,000 for fiscal year 2025.

 * * * * * * *