Regulating AI Systems: the US Algorithmic Accountability Act of 2022

  • Home
  • BLOG
  • Ethics of Artificial Intelligence

Regulating AI Systems: the US Algorithmic Accountability Act of 2022

                In our previous article, we began to cover the legal frameworks aimed to promote trustworthy AI by examining the EU AI Act. In this article, we will examine the US Algorithmic Accountability Act of 2022 which is another significant legal framework to ensure trustworthy AI.

                The US Algorithmic Accountability Act of 2022 (US AAA) was proposed on February 3rd. The first version of the Act was introduced in April 2019. Since it could not get support to become law, it was updated by keeping the main policy aim same.


[Image 1]

 

Key Definitions:

                The bill provides the definition of 16 terms which include “automated decision systems” (ADS) and “augmented critical decision process” (ACDP). It defines ADS as systems, software, or processes that use computation and generate outputs serving as a basis for a decision or judgment (Section 2(2)). The definition covers the systems benefiting from machine learning, statistics, other data processing and artificial intelligence techniques. An ACDP is defined as a process, procedure, or other activity using an ADS to make a critical decision (Section 2(1)).

 

FTC Regulations

If the bill becomes law, within two years after its enactment, the FTC must set forth regulations that will apply to “covered entities”[1]. These regulations would require covered entities to:

 

 

 

Impact assessments are performed for:

  • deployed ADS developed for implementation or use in an ACDP,
  • deployed ADS the covered entities reasonably expect to be implemented or used in an ACDP,
  • ACDP, both prior to and after deployment (Section 3(b)(1)(A)).

[1] “The term “covered entity” means any person, partnership, or corporation over which the Commission has jurisdiction under section 5(a)(2) of the Federal Trade Commission Act (15 U.S.C. 45(a)(2))—

(i) that deploys any augmented critical decision process; and

(I) had greater than $50,000,000 in average annual gross receipts or is deemed to have greater than $250,000,000 in equity value for the 3-taxable-year period (or for the period during which the person, partnership, or corporation has been in existence, if such period is less than 3 years) preceding the most recent fiscal year, as determined in accordance with paragraphs (2) and (3) of section 448(c) of the Internal Revenue Code of 1986;

(II) possesses, manages, modifies, handles, analyzes, controls, or otherwise uses identifying information about more than 1,000,000 consumers, households, or consumer devices for the purpose of developing or deploying any automated decision system or augmented critical decision process; or

(III) is substantially owned, operated, or controlled by a person, partnership, or corporation that meets the requirements under subclause (I) or (II);

(ii) that—

(I) had greater than $5,000,000 in average annual gross receipts or is deemed to have greater than $25,000,000 in equity value for the 3-taxable-year period (or for the period during which the person, partnership, or corporation has been in existence, if such period is less than 3 years) preceding the most recent fiscal year, as determined in accordance with paragraphs (2) and (3) of section 448(c) of the Internal Revenue Code of 1986; and

(II) deploys any automated decision system that is developed for implementation or use, or that the person, partnership, or corporation reasonably expects to be implemented or used, in an augmented critical decision process by any person, partnership, or corporation if such person, partnership, or corporation meets the requirements described in clause (i); or

(iii) that met the criteria described in clause (i) or (ii) within the previous 3 years.” ((Section 2(7)).

Requirements for Impact Assessments

The US AAA provides the extensive list of requirements for impact assessments altough the FTC will define its form and be able to add more requirements. According to the bill, in conducting impact assessments the requirements that must be met by covered entities are to (Section 4(a)):

  • evaluate the existing critical decision-making process for the same decision before deploying the new ACDP. The evaluation should include a description of the baseline process being enhanced or replaced, any known harm or shortcomings of the previous process, the intended benefits and need for the ACDP, and the intended purpose of the ADS or ACDP;
  • identify consultations with stakeholders and document the information about the consultations such as the points of contact for the stakeholders, the date of consultations and the terms and process of the consultations;
  • perform ongoing testing and evaluation of the privacy risks and privacy-enhancing measures of the ADS or ACDP;
  • perform ongoing testing and evaluation of the current and historical performance of the ADS or ACDP;
  • support and perform training and education for relevant agents about negative impacts of similar ADS and ACDP;
  • assess the need for limitations on the use of ADS or ACDP. This assessment should take into account whether certain uses or applications ought to be prohibited or limited;
  • maintain and update documentation of data or other input information used to develop, test, maintain, or update the ADS or ACDP;
  • evaluate the rights of consumers;
  • identify likely negative effects of ADS or ACDP and assess mitigation strategies;
  • describe documentation of the development and deployment process;
  • identify capabilities, tools, satandards or other resources to improve the ADS, ACDP or their impact asessments in areas such as performance, fairness, transparency, explainability, privacy and security, safety, and other areas;
  • documet above requirements that are infeasible to comply with and a rationale for it;
  • perform and document other studies and evaluations determined appropriate by the FTC.

 

Conclusion

The US AAA imposes obligations covered entities to identify and mitigate the risks arising from the use of ADS. These obligations are aimed at ensuring accountability, fairness, transparency, privacy and explainability. Although whether it will get necessary support to become law is not clear, it is a significant milestone in terms of the regulation of ADS.

Writer : Gamze Büşra Kaya