S. 2164: Algorithmic Accountability Act of 2025

S. 2164 would create a federal accountability system for automated decision tools used in high-stakes areas like education, employment, essential utilities, family planning, financial services, healthcare, housing, and legal services. The bill defines an "automated decision system" broadly to include software, machine learning, statistics, and AI that use computation as a basis for a decision or judgment, while excluding passive computing infrastructure like web hosting, domain registration, networking, caching, data storage, and cybersecurity. In practice, that means the law is aimed at systems that actually influence decisions, not the back-end internet plumbing.

The bill focuses on large companies and major developers. A company is covered if, over the preceding 3-taxable-year period, it had more than $50 million in average annual gross receipts or more than $250 million in equity value, or if it possesses, manages, or controls identifying information for more than 1,000,000 consumers, households, or devices. It also covers firms substantially owned or controlled by a covered entity. Developers can be covered at a lower threshold — more than $5 million in average annual gross receipts or more than $25 million in equity value over the preceding 3-taxable-year period — if they build systems for use in an augmented critical decision process by a covered entity. Companies that met these thresholds within the previous 3 years still count, and the dollar thresholds would rise with annual CPI adjustments after the first fiscal year following enactment.

The core requirement is impact assessment. Covered entities would have to conduct assessments before deployment and after deployment, keep documentation for 3 years longer than the deployment duration, and send annual summary reports to the FTC. New systems would require an initial summary report before deployment. Those assessments must include baseline descriptions of how the process works, logs of stakeholder consultation, privacy risk testing such as data minimization and security checks, and performance testing including benchmarking and differential performance analysis by race, sex, age, disability, and other factors. They also must evaluate whether consumers get notice, whether there is an opt-out mechanism, and whether people can understand, contest, or appeal decisions. If a company cannot comply with part of the assessment, it has to document what was infeasible and explain why.

The FTC would be on a tight implementation clock. It must issue regulations within 2 years of enactment, and those regulations would take effect 2 years after they are promulgated. Within 180 days after regulations are issued, the FTC must build a public repository, and that repository must become publicly accessible 180 days after the effective date, with quarterly updates. Starting 1 year after the effective date, the FTC must publish annual reports on broad trends and aggregated statistics. The agency also would have to review its rules at least every 5 years, share summary reports with NIST, OSTP, and relevant federal regulators, and stand up a Bureau of Technology led by a Chief Technologist with at least 50 personnel appointed within 2 years of enactment, plus up to 25 additional enforcement staff. Violations would be treated as unfair or deceptive acts under the FTC Act, and state attorneys general could also sue as parens patriae after notifying the FTC, unless notice is infeasible and then immediate notice follows. The bill does not preempt any state, tribal, city, or local law.