Federal Artificial Intelligence Risk Management Act of 2023

• Authority: United States Congress
• Parent authority: Federal government
• Jurisdiction: United States
• Collections: U.S. federal laws
• Most recent activity: Defunct
• Most recent activity date: 2025-01-03

Risk subdomain coverage

Good coverage — Comprehensive governance measures or mitigations with clear procedures relating to the risk subdomain are explicitly described.

• Governance failure

Minimal coverage — Brief mention but no specific mitigations, recommendations or governance measures relating to the risk subdomain are described.

• AI system security vulnerabilities
• Environmental harm
• Lack of capability or robustness
• Lack of transparency or interpretability

All other risk subdomains had no coverage in this document.

Risk Coverage Summary

The document has minimal direct coverage of specific risk subdomains. While it extensively references the NIST AI Risk Management Framework (which addresses multiple risks), the Act itself primarily establishes governance mechanisms and procedural requirements rather than explicitly describing specific AI risks or harms. The document shows implicit awareness of risks through its emphasis on risk management, testing, and validation, but does not detail specific risk scenarios.

Sector coverage

Good coverage — Comprehensive governance measures or mitigations with clear procedures relating to the sector are explicitly described.

• Public Administration (excl. National Security)

Minimal coverage — Brief mention but no specific mitigations, recommendations or governance measures relating to the sector are described.

• Scientific Research & Development Services
• Management, Administrative & Support Services
• National Security

All other sectors had no coverage in this document.

Sectors Summary

This document governs AI use across all federal government agencies in the executive branch, which primarily falls under Public Administration. The requirements apply to government procurement and use of AI systems across all agency functions, with an explicit exception for national security systems.

Legislative Status

Hard Law

Legislative Status Summary

This is a federal statute enacted by the United States Congress that creates binding legal obligations on federal agencies with mandatory compliance requirements, enforcement mechanisms, and reporting obligations.

Actors

Proposer

• Entity Types: AI_Governance_Actor
• Entities: United States Congress
• Summary: The document is titled 'Federal Artificial Intelligence Risk Management Act of 2023' and is a Congressional statute, indicating it was proposed and enacted by the United States Congress.

Target

• Entity Types: AI_Governance_Actor, AI_Deployer
• Entities: Federal agencies (departments, independent establishments, Government corporations, or other agencies of the executive branch); Suppliers of artificial intelligence to federal agencies; Small business concerns
• Summary: The Act explicitly applies to federal agencies that develop, procure, and use artificial intelligence systems, as well as to suppliers who provide AI to these agencies. Small businesses are also specifically addressed in profile development requirements.

Enforcer

• Entity Types: AI_Governance_Actor
• Entities: Office of Management and Budget (OMB); Director of OMB; Federal Acquisition Regulatory Council; Administrator of Federal Procurement Policy; National Institute of Standards and Technology (NIST); Director of NIST
• Summary: The Act designates OMB to issue binding guidance requiring agency compliance, NIST to develop technical guidelines, and the Federal Acquisition Regulatory Council to promulgate procurement regulations. These entities have authority to establish and enforce compliance requirements.

Monitor

• Entity Types: AI_Governance_Actor
• Entities: Comptroller General of the United States; Government Accountability Office (GAO); Office of Management and Budget; Director of NIST; Congress
• Summary: The Act establishes monitoring through GAO studies, OMB reporting to Congress, and NIST's ongoing review of testing and validation. Congress receives regular reports on agency implementation and conformity.

AI Lifecycle Stages

Lifecycle stages covered by the documents, as defined in the OECD Framework for the Classification of AI Systems

• Plan and Design
• Collect and Process Data
• Build and Use Model
• Verify and Validate
• Deploy
• Operate and Monitor

AI Lifecycle Summary

The document comprehensively covers multiple AI lifecycle stages with particular emphasis on procurement, deployment, and operational monitoring. It addresses planning through framework adoption requirements, development through standards and testing protocols, and ongoing operations through monitoring and reporting obligations.

Technical Scope

Terms relating to technical scope that are mentioned or implicitly referenced in the document

• AI Models
• AI Systems

Technical Scope Summary

The document explicitly references 'artificial intelligence' throughout and defines it by reference to the National Artificial Intelligence Initiative Act of 2020. It addresses AI systems broadly in the context of federal agency use and procurement. The document does not distinguish between different types of AI (frontier, general purpose, task-specific, generative, predictive) or mention compute thresholds or open-weight models.