H.R. 6356 — Artificial Intelligence Civil Rights Act of 2025

This section prohibits a developer or deployer from offering, licensing, promoting, selling, or using a covered algorithm in a manner that (1) causes or contributes to a disparate impact, (2) otherwise discriminates, or (3) otherwise makes unavailable the equal enjoyment of goods, services, or other activities or opportunities related to a consequential action on the basis of a protected characteristic. This section does not apply to (1) such offer, licensing, or use for the sole purpose of (A) a developer's or deployer's self-testing (or auditing by an independent auditor) to identify, prevent, or mitigate discrimination or ensure compliance with federal law; (B) expanding an applicant, participant, or customer pool to increase diversity or redress historic discrimination; or (C) conducting good faith security research or other non-commercial research; or (2) any private club or other establishment not in fact open to the public, as described in section 201(e) of the Civil Rights Act of 1964.

This section requires developers and deployers, prior to deploying, licensing, or offering a covered algorithm (including material changes) for a consequential action, to conduct a pre-deployment evaluation consisting of (1) a preliminary evaluation of harm plausibility—for developers, based on expected use, and for deployers, based on intended use—with results either recorded and submitted to the Commission (if no plausible harm) or triggering a full evaluation (if harm is plausible); and (2) if required, a full evaluation by an independent auditor. For developers, the full evaluation must detail the algorithm's design and methodology (including inputs/outputs), creation/training/testing (including metrics, benchmarks, demographic representation, stakeholder consultations, protected characteristics used, precursor algorithms, data sources/authorization/representativeness, and training processes), potential harms or disparate impacts, mitigation recommendations, post-deployment monitoring, and other Commission-specified information. For deployers, the full evaluation must include a detailed review and description sufficient for an individual having ordinary skill in the art to understand the algorithm's functioning, risks, uses, benefits, limitations, and other attributes (with specifics mirroring developer requirements, as provided). The independent auditor submits a report with findings and recommendations to the developer or deployer.

This section requires developers and deployers of covered algorithms to (1) take reasonable measures to prevent and mitigate harms identified in pre-deployment evaluations or impact assessments under section 102; (2) ensure independent auditors have necessary information for such evaluations; (3) consult stakeholders, including impacted communities, prior to deploying, licensing, or offering the algorithm; (4) certify, based on those evaluations, that the algorithm is unlikely to cause harm or disparate impact, that benefits outweigh harms, and that it is not deceptive; (5) ensure reasonable performance consistent with advertised capabilities; (6) use relevant and appropriate data; and (7) ensure intended use complies with the Act. The section further prohibits developers and deployers from deceptive marketing of covered algorithms and from off-label use—i.e., offering, licensing, or deploying for consequential actions not evaluated in the pre-deployment evaluation (unless the deployer assumes developer responsibilities).

This section establishes responsibilities for developers of covered algorithms toward deployers, requiring developers (1) to provide deployers, upon reasonable request, with reports of the developer's pre-deployment evaluations or annual reviews and information enabling deployers to conduct their own evaluations or impact assessments; and (2) either to cooperate with deployer-conducted assessments or to arrange and share reports from independent audits of the developer's compliance policies using accepted standards. The section further requires contracts for offering or licensing covered algorithms to specify data processing procedures and instructions; to prohibit relief from statutory requirements, data combination across parties, or restrictions on reporting concerns to enforcers; and mandates developer retention of such contracts for 10 years. It specifies that these requirements apply to developers providing services to government entities.

This section directs the Commission to promulgate two sets of regulations within two years of enactment using notice-and-comment procedures: (1) specifying circumstances and manner in which deployers must provide individuals a means to opt out of covered algorithms for consequential actions and elect human review instead; and (2) specifying circumstances and manner in which deployers must provide appeal mechanisms to humans for consequential actions resulting from covered algorithms. In developing these regulations, the Commission must consider factors such as notice clarity and conspicuousness, accessibility for people with disabilities, proportionality to harm risks, feasibility, training for human reviewers, and data correction mechanisms. The section further prohibits developers and deployers from conditioning exercise of individual rights under the Act through false or misleading statements or user interface designs that obscure or impair individual autonomy.

This section prohibits developers and deployers from discriminating or retaliating against individuals (including by denying equal enjoyment of goods, services, or opportunities related to a consequential action) for exercising rights under the Act, refusing to waive such rights, raising concerns about consequential actions, or assisting in investigations or proceedings under the Act. It permits differentials in goods, services, prices, or rates if necessary and directly related to the value provided to the developer or deployer by the covered algorithm (i.e., excluding discrimination based on protected characteristics) and allows loyalty, rewards, or discount programs based on patronage frequency or spending. The section further prohibits developers and deployers from discharging, demoting, suspending, threatening, harassing, or otherwise discriminating against individuals for reporting or raising concerns about Act violations or cooperating in related investigations or proceedings.

This section requires developers and deployers of covered algorithms to make publicly available a detailed disclosure—in plain language, clear, conspicuous, easy-to-read, readily accessible form, in covered languages, and accessible to individuals with disabilities—covering their identity and contacts; links to required evaluations and assessments; categories of personal data collected or processed and purposes; data transfers (except certain government-ordered ones); individual rights; compliance practices under specified sections; a mandated statement on audits under the Artificial Intelligence Civil Rights Act of 2025; and effective date. For material changes to the disclosure, it requires prior direct electronic notification to affected individuals, retention of prior versions for at least 10 years with public logs of changes (not applying to pre-enactment versions), and public website publication of versions. It further requires deployers to provide a short-form notice (no more than 500 words) on first interaction or via website—concise, clear, conspicuous, accessible, highlighting key rights and unexpected practices—and directs the Federal Trade Commission to promulgate regulations under 5 U.S.C. §553 specifying minimum content (not exceeding main disclosure requirements) and a model notice.

This section directs the Commission to conduct a study, with notice and public comment, on the feasibility of requiring deployers to provide a clear, conspicuous, easy-to-use, no-cost mechanism—accessible to individuals with disabilities—for individuals to receive explanations on whether and how a covered algorithm affected them. The study must include (1) an overview of purposes for explanations and their feasible uses; (2) methods for providing clear, accessible explanations effective for limited English proficiency individuals and calibrated to risk levels; (3) an assessment of requiring detailed, truthful explanations identifying significant factors; (4) information developers must provide deployers; (5) impacts of current technical capabilities; (6) deployer measures to verify requester identity and securely handle personal information; and (7) recommendations for Congress on regulations. In conducting the study, the Commission must consult the National Institute of Standards and Technology, National Telecommunications and Information Administration, Office of Science and Technology Policy, and other relevant agencies and submit a report with findings and recommendations for legislation or administrative action to the Senate Committee on Commerce, Science, and Transportation and the House Committee on Energy and Commerce not later than 18 months after enactment.

This section directs the Commission to publish, within 90 days of enactment, a web page describing the Act's provisions, rights, obligations, remedies, exemptions, and protections (categorized by individuals, deployers, and developers) in plain, concise language, each covered language, and an accessible format, with updates as needed for changes in law, regulation, guidance, or judicial decisions. The section further requires the Commission to publish annual reports, beginning two years after enactment, summarizing submitted pre-deployment evaluations, impact assessments, and developer reviews; describing trends and aggregated statistics on impact assessments; and making recommendations, with reports accessible and machine-readable per the 21st Century Integrated Digital Experience Act. Finally, the section requires the Commission to establish, within 180 days of the first annual report, a publicly accessible online repository for such submissions that supports sorting, searching, and downloading; to publish submissions within 30 days of receipt (absent good cause for delay); and to redact trade secrets, personal data, and other information exempt under FOIA (5 U.S.C. § 552).

This section authorizes the Federal Trade Commission (FTC) to enforce titles I, II, and III of this Act by treating violations thereof, or of regulations thereunder, as unfair or deceptive acts or practices under FTC Act section 18(a)(1)(B) (15 U.S.C. 57a(a)(1)(B)); incorporates applicable terms, powers, jurisdiction, duties, penalties, privileges, and immunities of the FTC Act (15 U.S.C. 41 et seq.); preserves other FTC authorities; and authorizes FTC rulemaking under the Administrative Procedure Act (5 U.S.C. 553). Notwithstanding FTC Act jurisdictional limits applicable to for-profit entities in commerce (15 U.S.C. 44, 45(a)(2), 46)—which generally exclude nonprofits, banks, common carriers, air carriers, and packers and stockyards entities—the section applies such enforcement to (1) organizations not organized for profit; (2) common carriers subject to the Communications Act of 1934 (47 U.S.C. 151 et seq.); (3) banks, savings and loan institutions described in FTC Act section 18(f)(3) (15 U.S.C. 57a(f)(3)), and federal credit unions described in section 18(f)(4); (4) air carriers and foreign air carriers subject to the Federal Aviation Act of 1958 (49 U.S.C. App. 1301 et seq.); and (5) persons, partnerships, or corporations subject to the Packers and Stockyards Act of 1921 (7 U.S.C. 181 et seq.).

This section authorizes the attorney general of a state or a state data protection authority to bring a civil action in an appropriate U.S. district court meeting venue requirements under 28 U.S.C. §1391, as parens patriae on behalf of state residents, to enforce titles I, II, or III of the Act or related regulations and to obtain remedies including (1) injunctive relief; (2) enforcement of compliance; (3) equitable relief; (4) civil penalties of $15,000 per violation or 4% of the defendant's average gross annual revenue over the preceding three years, whichever is greater; (5) damages, restitution, or other compensation; (6) attorneys' fees and costs; and (7) other appropriate relief. The section requires the state attorney general to notify the Commission before filing (with an exception if not feasible), grants the Commission the right to intervene within 180 days of notice, and preserves state investigatory powers under state law. The section further directs the Commission to consult with relevant federal agencies and, within 180 days of enactment, enter a memorandum of understanding with them establishing procedures for coordinating investigations and enforcement, information sharing, division of authority, and complaint referrals.

This section establishes a private right of action allowing any individual or class alleging a violation of titles I, II, or III of the Act or related regulations to bring a civil action in any court of competent jurisdiction. Prevailing plaintiffs may receive treble damages or $15,000 per violation (whichever greater), nominal damages, punitive damages, reasonable attorney’s fees and litigation costs, and other appropriate relief, including equitable or declaratory relief. Prior to filing, plaintiffs must notify the Commission and the attorney general of their state of residence (including a description of allegations), who have 60 days to determine whether to intervene; intervenors may be heard on all matters and appeal decisions, with state attorneys general limited to their residents’ interests and retaining later enforcement authority. This section further invalidates pre-dispute arbitration agreements and pre-dispute joint action waivers for disputes under the Act, with courts (not arbitrators) determining applicability. (Thus, parties cannot be compelled to arbitrate such claims pre-dispute or waive rights to class, collective, or joint actions.)

This section establishes a severability clause for the Act. (Thus, if any provision of the Act, or its application to any person or circumstance, is held invalid, the remainder of the Act and the application of that provision to other persons or circumstances remains unaffected.)

This section provides rules of construction clarifying that nothing in the Act (1) waives or limits any National Labor Relations Act (NLRA) requirement for employers (as defined in 29 U.S.C. 152) to collectively bargain over the deployment or effects of a covered algorithm; (2) absolves employers of obligations to ensure covered algorithms comply with health and safety laws; (3) allows deployment of a covered algorithm that interferes with employee rights under federal, state, or local law; or (4) absolves any other duty or requirement under other law. It further states that no regulation or standard under the Act may lessen the stringency of otherwise applicable federal or state agency requirements and that the Act does not divest such agencies of authority under other law.

This section directs the Director of the Office of Personnel Management, not later than 270 days after enactment, to exercise authority under 5 U.S.C. 5105 to establish a new occupational series and associated policies for federal positions in algorithm auditing. The series covers algorithm auditing practices, platform auditing, evaluation and assessment of artificial intelligence systems, computer security, independent evaluation and audits of computer systems, data science, statistics, auditing of anticompetitive practices, and related fields (as described in GAO-21–519SP).

This section (1) authorizes appropriations of such sums as necessary to the Commission and other federal agencies enumerated in the Act to carry out the Act, and (2) permits the Commission to hire not more than 500 additional personnel, notwithstanding any other provision of law, to address unfair or deceptive acts or practices relating to the development or deployment of covered algorithms.