H.R. 6356: Artificial Intelligence Civil Rights Act of 2025

H.R. 6356, the Artificial Intelligence Civil Rights Act of 2025, would set up a broad federal civil rights framework for AI and other automated decision systems. It applies when a "covered algorithm" is used for a "consequential action" — meaning decisions with a material effect on employment, education, housing, utilities, health care, credit or banking, insurance, criminal justice or law enforcement, legal determinations, elections, government benefits, public accommodations, and other services the Federal Trade Commission decides are significant. The bill bars developers and deployers from using these systems in ways that cause disparate impact or otherwise discriminate based on protected characteristics such as race, color, ethnicity, national origin or immigration status, religion, sex including sexual orientation and gender identity, disability, limited English proficiency, biometric information, familial or marital status, source of income, income level, age, veteran status, and genetic information or medical conditions.

The bill's core approach is prevention plus paper trail. Before deployment, a company has to evaluate whether harm is plausible; if it is, the company must hire an independent auditor for a full evaluation. Deployers must then run annual impact assessments, and if harm is identified, they must again engage an independent auditor. Those evaluations and assessments must be sent to the FTC within 30 days of completion, and records must be kept for at least 10 years. The FTC would also have to write rules within 2 years of enactment covering evaluation factors, summary requirements, and later regulations creating opt-out rights for a human alternative and appeal mechanisms when covered algorithms are used for consequential actions.

The transparency rules are also unusually specific. Deployers would have to publicly disclose their practices, including contact information, data categories, and a statutory disclaimer explaining the limits of an audit. They also must give a short-form notice of no more than 500 words either when a person first interacts with the system or on the company's website. The FTC would have 90 days after enactment to publish a consumer rights web page, 18 months to study whether useful explanations for algorithm outputs are feasible and report back to Congress, and 180 days after the first annual report to create a public repository for evaluations and assessments. The bill also defines "covered language" as the 10 languages with the most speakers in the United States, based on U.S. Census Bureau data, signaling that language access is part of the compliance picture.

What gives the bill bite is enforcement. Violations would be treated as unfair or deceptive acts under the FTC Act. State attorneys general and data protection authorities could sue for civil penalties of $15,000 per violation or 4% of the company's average gross annual revenue over the previous 3 years, whichever is greater. Individuals could sue too, and recover treble damages or $15,000 per violation, whichever is greater, plus nominal damages, punitive damages, and attorney's fees. The bill also voids pre-dispute arbitration agreements and joint-action waivers for disputes under the Act, making it easier for people to get into court. On top of that, the Office of Personnel Management would have 270 days to create a new federal occupational series for algorithm auditing, and the FTC could hire up to 500 additional personnel to enforce the law.