FAIRR Act

This Act may be cited as the “Financial Artificial Intelligence Risk Reduction Act” or the “FAIRR Act”.

(a) In general.— Subtitle A of the Financial Stability Act of 2010 (12 U.S.C. 5321 et seq.) is amended by adding at the end the following:

“126. Special provisions regarding artificial intelligence in the financial sector.—

(a) Definition.— In this section, the term artificial intelligence has the meaning given the term in section 5002 of the National Artificial Intelligence Initiative Act of 2020 (15 U.S.C. 9401).

(b) Coordination, report, and recommendations.— The Council shall coordinate with member agencies with regard to potential risks to the stability of the financial system posed by artificial intelligence, including—

(1) direct the Office of Financial Research, as appropriate, to conduct research into the uses of artificial intelligence by financial institutions and entities providing services to or performing functions on behalf of financial institutions;

(2) identify threats to the stability of the financial system posed by the use of artificial intelligence tools and technologies, such as—

(A) the generation and use of false representations of events or the likeness, speech, or actions of persons by malign actors to manipulate financial markets, institutions, or instruments, or to cause disruption in financial markets;

(B) agent deployment and development, including specific gaps in existing laws (including regulations) regarding liability for financial institutions and consumers for unauthorized transactions that could be initiated or completed by agents, including the fragility, if any, created by the concentration of economic activity, capital formation, and decision-making concerning artificial intelligence infrastructure providers; and

(C) any other acts or practices associated with the use or assistance of artificial intelligence tools or technologies that threaten the stability of the financial system;

(3) not later than 180 days after the date of enactment of this section, in consultation with the member agencies, financial institutions, securities market participants, and entities providing services to or performing functions on behalf of financial institutions or securities markets participants, submit to the Committee on Banking, Housing, and Urban Affairs of the Senate and the Committee on Financial Services of the House of Representatives a report that—

(A) identifies the threats described in paragraph (2);

(B) the training, development, deployment, and proliferation of artificial intelligence tools and technologies that are particularly suited for cybersecurity tasks, including specific aptitudes for identifying vulnerabilities and developing tools and techniques to exploit such vulnerabilities;

(C) identifies specific gaps in the existing regulations, guidance, and examination standards of the member agencies that prevent effective and comprehensive responses by each of the member agencies to the threats described in paragraph (2); and

(D) makes specific recommendations for addressing the gaps identified in subparagraph (B), including, as appropriate, recommendations regarding implementation of the recommendations in the Cybersecurity Information Sheet published by the National Security Agency, Federal Bureau of Investigation, and Cybersecurity and Infrastructure Security Agency on September 12, 2023; and

(4) identify, as appropriate, opportunities for the use of artificial intelligence technologies in financial regulation and supervision, specifying that any use of artificial intelligence by the agencies in regulation and supervision should be transparent and disclosed to their regulated entities as appropriate.

(c) Congressional review.— Not later than 30 days after the date on which the relevant congressional committees receive the report required under subsection (a), the committees shall review the report and submit comments and recommendations thereon.

(d) Implementation of council recommendations.—

(1) In general.— Upon review of comments and recommendations under subsection (c), the Council shall commence action under the procedures prescribed in section 120 with regard to implementation of the recommendations by each of the member agencies.

(e) Congressional review act.— The provisions of chapter 8 of title 5, United States Code, shall apply as appropriate to rules issued by the member agencies under this section.

(f) Scenario-Based exercises.— The Federal and Banking Information Infrastructure Committee sponsored by the President’s Working Group on Financial Markets shall, in consultation with private-sector entities and other relevant governmental entities—

(1) initiate a series of scenario-based exercises to test the effectiveness of defenses against financial market disruptions associated with the use or assistance of artificial intelligence technologies; and

(2) make recommendations for ongoing improvements in detection, prevention, and mitigation of such disruptions.”.

(b) Technical and conforming amendment.— The table of sections for the Dodd-Frank Wall Street Reform and Consumer Protection Act (12 U.S.C. 5301) is amended by inserting after the item relating to section 125 the following:

Section 206A of the Federal Credit Union Act (12 U.S.C. 1786a) is amended—

(1) in subsection (a)(1), by striking “that” and inserting “an”;

(2) in subsection (c)(2), in the matter preceding subparagraph (A), by inserting “, in a manner and method prescribed by the Board,” after “Board”; and

(3) by striking subsection (f).

Subpart A of part 2 of subtitle A of the Federal Housing Enterprises Financial Safety and Soundness Act of 1992 (12 U.S.C. 4541 et seq.) is amended by adding at the end the following:

“1329. Regulation and examination of certain service providers.— Whenever a regulated entity or the Office of Finance causes to be performed for itself, by contract or otherwise, any activity that is permissible for the regulated entity or the Office of Finance, whether on or off its premises—

(1) such performance shall be subject to regulation and examination by the Director to the same extent as if such activity were being performed by such entity or Office itself on its own premises; and

(2) the regulated entity or Office of Finance shall notify the Director of the existence of the service relationship not later than 30 days after the earlier of—

(A) making of such service contract; or

(B) the performance of the activity by the service provider.”.

Section 3 of the Securities Exchange Act of 1934 (15 U.S.C. 78c) is amended by adding at the end the following:

“(i) Rulemaking regarding artificial intelligence.—

(1) Definitions.— In this subsection:

(A) Artificial intelligence.— The term artificial intelligence has the meaning given the term in section 5002 of the National Artificial Intelligence Initiative Act of 2020 (15 U.S.C. 9401).

(B) Covered person.— The term covered person—

(i) means a person that is required by a provision of this title, or by a rule or regulation under this title, to maintain policies, procedures, or controls; and

(ii) includes—

(I) an issuer that has a class of securities registered pursuant to section 12;

(II) an issuer that is required to file reports under section 15(d);

(III) a broker;

(IV) a dealer;

(V) a security-based swap dealer; and

(VI) a self-regulatory organization.

(2) Requirement.—

(A) In general.— Not later than 180 days after the enactment of this section the Commission shall, by rule or regulation, impose specific requirements on each covered person to ensure that the policies, procedures, or controls described in paragraph (1)(B)(i) maintained by the covered person—

(i) address the use of artificial intelligence by the covered person; and

(ii) are reasonably designed to ensure compliance with the requirements of this title.

(B) Procedures.— In carrying out subparagraph (A), the Commission shall—

(i) identify and require governance measures with respect to testing, deployment, monitoring, human oversight, permissions, escalation procedures, and use limitations applicable to artificial intelligence systems; and

(ii) consider the extent to which—

(I) artificial intelligence systems are developed, controlled, modified, or operated by a covered person as compared to third-party providers; and

(II) control is exercised by a covered person over the actions of artificial intelligence systems.”.

(a) Definitions.—

(1) Artificial intelligence.— The term artificial intelligence has the meaning given the term in section 5002 of the National Artificial Intelligence Initiative Act of 2020 (15 U.S.C. 9401).

(2) Securities laws.— The term securities laws has the meaning given the term in section 3(a) of the Securities Exchange Act of 1934 (15 U.S.C. 78c(a)).

(b) Rules.— Nothing in this Act, or any amendment made by this Act, may be construed to—

(1) limit the securities laws such that artificial intelligence may be used in a manner that would contravene any of the securities laws; or

(2) provide that the use of artificial intelligence excuses compliance with any obligation under the securities laws.