S. 2164 — Algorithmic Accountability Act of 2025

This section defines 15 terms for purposes of the Act, including "automated decision system" (i.e., computation-based software or processes, including AI, serving as a basis for decisions, excluding passive computing infrastructure); "critical decision" (i.e., decisions with legal or material effects on consumers' access to or terms of essential services such as education, employment, healthcare, housing, financial services, and utilities); "biometrics"; "deploy"; "develop"; "identifying information"; and "impact assessment." The section defines "covered entity" as any person, partnership, or corporation subject to FTC jurisdiction under section 5(a)(2) of the Federal Trade Commission Act (15 U.S.C. 45(a)(2)) that (1) deploys an augmented critical decision process (i.e., automated system for critical decisions) and either had average annual gross receipts over $50 million or equity value over $250 million in the prior three taxable years, handles identifying information on over 1 million consumers/households/devices, or is controlled by such an entity; (2) had average annual gross receipts over $5 million or equity value over $25 million and deploys systems expected for use in such processes by larger entities; or (3) met these criteria within the prior three years. Dollar thresholds are subject to annual CPI inflation adjustments after the first full fiscal year following enactment.

This section declares unlawful violations of regulations to be promulgated by the Federal Trade Commission (FTC) under Section 5(a)(2) of the FTC Act (15 U.S.C. 45(a)(2)), including by covered entities using automated decision systems (ADS) or augmented critical decision processes (ACDP) or persons knowingly providing substantial assistance to such violations, preempting contrary private contracts. It directs the FTC, in consultation with the National Institute of Standards and Technology, National Artificial Intelligence Initiative, Office of Science and Technology Policy, and stakeholders (e.g., standards bodies, industry, academia, civil rights advocates, consumers, and impacted communities), to issue such regulations within two years of enactment that require covered entities to (1) conduct impact assessments for ADS deployed or expected to be used in ACDP and for ACDP itself, both before and after deployment; (2) maintain related documentation (per section 4(a)) for three years beyond deployment; (3) disclose covered entity status to ADS/ACDP providers; (4) submit initial summary reports before new deployments and annual summary reports thereafter; (5) consult internal and external stakeholders during assessments; and (6) timely mitigate material negative impacts with legal or significant effects on consumers. The regulations must also establish definitions (e.g., for "access to or the cost, terms, or availability of" critical decisions and third-party recipients), guidelines for determining covered entity status via consumer counts and for prioritizing assessments, and accessible machine-readable report formats; they allow voluntary reports from non-covered entities under FTC jurisdiction and account for development stages, reporting timeliness, administrative burdens, and standardization benefits.

This section establishes requirements for covered entities to perform impact assessments under section 3(b)(1) for automated decision systems or augmented critical decision processes, to the extent possible as determined by the Commission. The requirements are as follows: (1) for a new augmented critical decision process, evaluate any prior critical decision-making process, including its description, known harms, intended benefits, and purpose; (2) document stakeholder consultations, including points of contact, dates, terms, and handling of recommendations; (3) conduct ongoing testing of privacy risks and measures per NIST or other federal standards, covering data minimization, security (e.g., differential privacy), and impacts on consumer privacy, safety, or security; (4) perform ongoing performance testing using benchmarks and historical data, including success metrics, test/deployed comparisons, and differential performance by characteristics such as race, sex, age, disability, religion, family status, socioeconomic status, or veteran status (with methodology and proxy data documentation); (5) provide ongoing training for relevant personnel on prior negative impacts and best practices; (6) assess needs for guardrails or limitations on uses via terms of use or agreements; and (7) maintain updated documentation of input data, including sourcing, licensing, and metadata.

This section establishes requirements for summary reports that covered entities must submit to the Commission regarding automated decision systems or augmented critical decision processes, requiring such reports to include, to the extent possible—(1) specified information from the relevant impact assessment, including the covered entity's name and contact information; a description of the critical decision and its category; intended purpose; consulted stakeholders and related agreements; testing, evaluation, and performance metrics (including differential performance); publicly stated guardrails or limitations; data sourcing, selection rationale, and alternatives; transparency and explainability measures (including consumer contestation, correction, appeal, or opt-out mechanisms); identified material negative consumer impacts and remediation steps; infeasible impact assessment requirements and rationales; and any recommended resources to improve assessments or systems; (2) additional relevant information from section 4(a); (3) any Commission-specified format or structure; and (4) additional Commission-determined criteria essential for consumer protection.

This section requires the Commission to publish an annual report, beginning one year after the effective date specified in section 3(b)(3), summarizing information from summary reports submitted under section 3(b)(1)(D), (E), or (F). The report must be publicly available on the Commission's website in a machine-readable format compliant with the 21st Century Integrated Digital Experience Act, describing broad trends, aggregated statistics, and anonymized lessons learned to support guidance updates, oversight, and recommendations to other agencies. This section further directs the Commission to develop, within 180 days after promulgating regulations under section 3(b)(1), and make publicly accessible within 180 days after the effective date in section 3(b)(3), a searchable and downloadable online repository—updated quarterly—of a limited subset of information from those summary reports. The repository must (1) identify covered entities and critical decisions (with categories), publicly stated prohibited applications, data sources, performance metrics, and consumer recourse links (to the extent possible); (2) comply with the 21st Century Integrated Digital Experience Act and Open, Public, Electronic, and Necessary Government Data Act; (3) include metadata on its design, updates, and content scope; and (4) serve to inform consumers, enable research, and promote compliance. Such sums as necessary are authorized to be appropriated for the repository.

This section directs the Commission to (1) publish guidance on meeting requirements of sections 4 and 5—including documentation templates and guides for meaningful consultation—developed after consultation with the Directors of the National Institute of Standards and Technology (NIST), National Artificial Intelligence Initiative, and Office of Science and Technology Policy (OSTP), as well as standards bodies, private industry, academia, technology experts, and advocates for civil rights, consumers, and impacted communities; and (2) issue and regularly update guidance and training materials to assist entities in determining covered entity status. It further (1) permits covered entities to publicize impact assessment documentation maintained under section 3(b)(1)(B) (beyond summary report requirements), unless it violates consumer privacy; (2) requires the Commission to review and update as appropriate regulations promulgated under section 3(b) at least every five years; and (3) requires the Commission to share summary reports submitted under section 3(b)(1)(D), (E), or (F) privately with the NIST Director, OSTP Director, and heads of relevant federal agencies with regulatory jurisdiction over augmented critical decision processes to inform future standards or regulations.

This section establishes within the Commission the Bureau of Technology—headed by a Chief Technologist—to aid and advise on technological aspects of Commission functions (including studies, workshops, audits, and enforcement), provide technical assistance to enforcement bureaus, and appoint at least 50 personnel with relevant expertise (e.g., technology, civil rights, machine learning) without regard to civil service laws within two years of enactment; authorizes necessary appropriations for the bureau; authorizes appointment of 25 additional personnel without regard to civil service laws to the Division of Enforcement in the Bureau of Consumer Protection and necessary appropriations for them; and directs the Commission to negotiate cooperation agreements with relevant federal agencies on information sharing and enforcement regarding automated decision systems or augmented processes for critical decisions by covered entities (including procedures for determining lead agency on civil actions).

This section establishes Federal Trade Commission (FTC) and state enforcement authority for violations of the Act or its regulations. **(a) Enforcement by the Commission** Treats such violations as a violation of a rule defining an unfair or deceptive act or practice under FTC Act §18(a)(1)(B) (15 U.S.C. 57a(a)(1)(B)); incorporates all applicable terms, powers, penalties, privileges, and immunities of the FTC Act (15 U.S.C. 41 et seq.); preserves the FTC's other statutory authorities; and directs the FTC to promulgate necessary additional rules under the Administrative Procedure Act (5 U.S.C. §553). **(b) Enforcement by States** (1) authorizes state attorneys general to bring parens patriae civil actions in federal district court for appropriate relief, after providing prior written notice to the FTC (including the complaint) unless not feasible, in which case notice must be immediate; (2) permits FTC intervention, including on all matters and appeals; (3) preserves state attorneys general investigatory powers under state law; (4) specifies venue under 28 U.S.C. §1391 or state court and service of process rules; and (5) extends the same authority to other state officials authorized by state law, without affecting ongoing state proceedings.

This section directs the Commission, in carrying out this Act, to coordinate with appropriate federal agencies and state regulators to promote consistent regulatory treatment of automated decision systems and augmented critical decision processes.