S2367 AI Accountability and Personal Data Protection Act 2025

• Authority: United States Congress
• Parent authority: Federal government
• Jurisdiction: United States
• Collections: U.S. federal laws
• Most recent activity: Proposed
• Most recent activity date: 2025-07-21

Risk subdomain coverage

Good coverage — Comprehensive governance measures or mitigations with clear procedures relating to the risk subdomain are explicitly described.

• Compromise of privacy
• Fraud, scams, and targeted manipulation
• Lack of transparency or interpretability

Minimal coverage — Brief mention but no specific mitigations, recommendations or governance measures relating to the risk subdomain are described.

• AI system security vulnerabilities
• Loss of human agency and autonomy
• Economic and cultural devaluation of human effort

All other risk subdomains had no coverage in this document.

Risk Coverage Summary

The document has good coverage of approximately 4-5 subdomains, with strong focus on privacy compromise (2.1), security vulnerabilities (2.2), fraud and manipulation (4.3), and lack of transparency (7.4). Coverage is concentrated in privacy, security, and malicious actor domains.

Sector coverage

Good coverage — Comprehensive governance measures or mitigations with clear procedures relating to the sector are explicitly described.

• Information
• Professional & Technical Services
• Scientific Research & Development Services

Minimal coverage — Brief mention but no specific mitigations, recommendations or governance measures relating to the sector are described.

• Agriculture, Mining, Construction & Manufacturing
• Trade, Transportation & Utilities
• Finance & Insurance
• Real Estate, Rental & Leasing
• Management, Administrative & Support Services
• Educational Services
• Health Care & Social Assistance
• Arts, Entertainment & Recreation
• Accommodation, Food & Other Services

All other sectors had no coverage in this document.

Sectors Summary

This is a cross-sectoral federal law that applies to any person or entity in interstate or foreign commerce that handles personal data, including for AI training. While it does not explicitly name specific sectors, its broad applicability means it governs data practices across all economic sectors that collect, process, or use personal data, with particular relevance to Information, Professional and Technical Services, and Scientific Research and Development Services sectors where AI development and deployment are concentrated.

Legislative Status

Hard Law

Legislative Status Summary

This is a binding federal statute establishing legal liability, private rights of action, and enforceable remedies including compensatory damages, punitive damages, and injunctive relief. The document uses mandatory language throughout and creates enforceable legal obligations.

Actors

Proposer

• Entity Types: AI_Governance_Actor
• Summary: The document is a bill proposed by the United States Congress, as indicated by the opening text 'Be it enacted by the Senate and House of Representatives of the United States of America in Congress assembled'.

Target

• Entity Types: AI_Developer, AI_Deployer, AI_Infrastructure_Provider
• Summary: The Act targets any person or entity that handles covered data without express prior consent, with specific focus on AI system providers and those who train generative AI systems. The definition explicitly includes 'the training of a generative artificial intelligence system that is sold, rented, licensed, or otherwise used by the provider'.

Enforcer

• Entity Types: AI_Governance_Actor, Affected_Stakeholder
• Summary: Enforcement is primarily through private rights of action brought by individuals in federal or state courts. The Act explicitly provides that courts, rather than arbitrators, determine applicability and enforceability.

Monitor

• Summary: The document does not establish any specific monitoring body, agency, or oversight mechanism. Monitoring and enforcement are entirely dependent on private civil actions brought by affected individuals.

AI Lifecycle Stages

Lifecycle stages covered by the documents, as defined in the OECD Framework for the Classification of AI Systems

• Collect and Process Data
• Build and Use Model
• Deploy
• Operate and Monitor

AI Lifecycle Summary

The document primarily covers the Collect and Process Data stage and the Build and Use Model stage, with particular focus on data collection practices and AI training. It also addresses Deploy and Operate and Monitor stages through requirements for consent and disclosure at the point of data use and ongoing exploitation.

Technical Scope

Terms relating to technical scope that are mentioned or implicitly referenced in the document

• AI Systems
• Generative AI

Technical Scope Summary

The document explicitly mentions AI systems, artificial intelligence, and generative artificial intelligence systems. It does not mention frontier AI, general purpose AI, task-specific AI, foundation models, predictive AI, open-weight models, or compute thresholds. The focus is on generative AI systems and their use of personal data.