Taking Further Agency Action on AI

In response to the surge of attention, excitement, and fear surrounding AI developments since the release of OpenAI’s ChatGPT in November 2022,¹ governments worldwide² have rushed to address the risks and opportunities of AI.³ In the United States, policymakers have sharply disagreed about the necessity and scope of potential new AI legislation.⁴ By contrast, stakeholders ranging from government officials and advocates to academics and companies seem to agree that it is essential for policymakers to utilize existing laws to address the risks and opportunities of AI where possible, especially in the absence of congressional action.⁵

What this means in practice, however, remains murky. What are the statutory authorities and policy levers available to the federal government in the context of AI? And how should policymakers use them? To date, there has been no comprehensive survey to map the federal government’s existing ability to impose guardrails on the use of AI across the economy. In 2019, the Trump administration issued Executive Order 13859,⁶ which directed agencies to “review their [regulatory] authorities relevant to applications of AI.”⁷ Subsequent 2020 OMB guidance further required: “The agency plan must identify any statutory authorities specifically governing agency regulation of AI applications, as well as collections of AI-related information from regulated entities.”⁸ Unfortunately, it appears the U.S. Department of Health and Human Services (HHS) was the only agency to respond in detail.⁹

Since taking office, the Biden administration has taken critical strides to prepare the federal government for the potential proliferation of AI. Its 2023 executive order on AI¹⁰ and the subsequent 2024 OMB memo on “Advancing Governance, Innovation, and Risk Management for Agency Use of Artificial Intelligence”¹¹ (OMB M-24-10 AI guidance) directed agencies to undertake specific AI-related tasks and provided guidance on federal agency use of AI.

But what comes next? These Biden administration actions hardly represent the culmination of the federal government’s interventions into or involvement with AI. As technologies advance, new AI risks and benefits will emerge, sometimes demanding new federal responses. Agencies must be ready to deploy every tool at their disposal to ensure that the AI revolution benefits everyday Americans, rather than just the tech giants developing new models.

With that in mind, GFI and CAP undertook research to identify existing authorities that can be used to address AI. In the interest of keeping this initial report to a reasonable length, only a sample of federal agencies were selected, including:

• The White House and its subordinate agencies, including the OMB and the Office of Information and Regulatory Affairs (Chapter 1)
• The Department of Labor (Chapter 2)
• The Department of Education (Chapter 3)
• The housing regulators (Chapter 4)
• Financial regulatory agencies (Chapter 5):
  • The Treasury Department
  • The Office of the Comptroller of the Currency
  • The Board of Governors of the Federal Reserve System
  • The Federal Deposit Insurance Corporation
  • The Commodity Futures Trading Commission
  • The National Credit Union Administration
  • The Securities and Exchange Commission
  • The Consumer Financial Protection Bureau
  • The Financial Stability Oversight Council

This report is structured to include a chapter for each of the above agencies, covering:

• An overview of the agency and its intersection with AI
• AI risks and opportunities within the specific agency and its jurisdiction
• The current state of the agency and its efforts to address AI
• The specific relevant authorities the agency could invoke to regulate AI risks
• Recommendations for how the agency could use each identified authority to regulate AI
• A fact sheet to accompany each chapter with a summary of all the recommendations in that chapter for the specific agency or agencies

Recognizing that many readers may only be interested in a specific agency or agencies, each chapter is designed to be read and understood independently of the other chapters. The report is accessible online and in PDF form. Finally, the report includes fact sheets detailing all recommendations from each chapter, available both online and in PDF form.

When OpenAI released its ChatGPT large language model (LLM) generative AI chatbot to the public in November 2022,¹² it quickly became one of the fastest-growing consumer technology applications ever.¹³ Generative AI and its ability to generate synthetic text, images, audio, and video represents the most user-accessible form of AI, and new generations of AI are poised to interface with and control our devices and programs directly.¹⁴ Meanwhile, behind the scenes, automated systems increasingly control health care, finance, and housing decisions. In the finance sector, lenders deploy AI-based systems to make lending decisions or depend on third-party models to guide their lending processes. Similarly, in the housing sector, AI is now employed in both public and private housing screening. AI is set to affect almost every sector of our economy. As Bill Gates has suggested, we may well be living in the “Age of AI”—a technological inflection point as momentous as the invention of the personal computer, the internet, and the mobile phone.¹⁵

The explosion in growth of this new AI technology raised immediate concern among the public, lawmakers, and regulators about how society and government can and should best respond. The immediate opportunities and challenges of AI are clear to many; however, the solutions to these very real benefits and harms are far less clear, yet critically important, to address as this technology spreads with a rapidity not seen in recent history. It is imperative to examine all the tools in the toolkit to address AI, from legislation that may take years to draft, pass, and implement to existing authorities that can be exercised by agencies now.

Passing new AI legislation, though vital, does not appear to be imminently forthcoming from Congress. In 2023, Senate Majority Leader Chuck Schumer (D-NY) hosted a series of eight closed-door AI insight forums with senators and leading experts¹⁶ that culminated in a May 2024 AI white paper.¹⁷ Sen. Schumer has previously announced to the 118th Congress that his approach to AI legislation will be through the regular order committee process.¹⁸ Meanwhile, the House of Representatives did not announce a bipartisan AI task force until February 2024,¹⁹ with no clear legislative path outlined. To date, the most Congress has done is hold numerous hearings on AI,²⁰ and the prospects for comprehensive AI legislation in the 118th Congress appear distant.

As a result, the primary federal actor in the AI policy space has been and will likely continue to be the executive branch. The Trump administration issued two executive orders on AI²¹ and OMB guidance that included requiring agencies with regulatory authorities to “identify any statutory authorities specifically governing agency regulation of AI applications”²² and submit them to the OMB, with which only HHS complied.²³ In the wake of ChatGPT’s release, the Biden administration immediately began to announce a series of steps to address AI—building on its 2022 “Blueprint for an AI Bill of Rights”²⁴—which started with voluntary commitments from leading AI companies.²⁵ This culminated with the October 2023 executive order on AI²⁶ and the subsequent March 2024 release of the OMB M-24-10 memorandum, “Advancing Governance, Innovation, and Risk Management for Agency Use of Artificial Intelligence,” for federal government use of AI.²⁷ A crucial task for federal regulators moving forward will be to scope their existing ability to regulate AI in the absence of new AI legislation.

Despite consensus around the need to apply existing laws to novel AI applications, more work remains to be done. While it is true that existing statutes may allow agencies to regulate the use of AI, regulations on implementation may still need to be updated accordingly. As a result, a central challenge will be identifying with specificity how agencies may need to adapt or revise their regulatory regimes for an AI era.

Inspired by the HHS response to the 2020 OMB request for a catalog of agencies’ existing authorities to address AI³⁷ and recognizing the need for a deeper examination of existing authorities as they relate to AI, GFI and CAP have undertaken extensive research to outline potential statutory authorities that selected federal agencies could leverage to address the challenges and opportunities presented by AI. This joint report outlines those potential statutory authorities and offers initial recommendations on utilizing those authorities.

GFI and CAP engaged in an intensive effort to canvas existing authorities and identify potential recommendations to address AI. This included extensive analysis of existing statues, consultation with numerous subject matter experts, and review from various stakeholders. This report does not purport to be perfectly comprehensive, even on the agencies selected for consideration. Instead, it aims to highlight the authorities where the strongest intersection exists between existing authority and actionable recommendations.

Initial research revealed that some agencies were already making significant progress. For example, the FTC has led the way among agencies considering applying its existing authorities to address AI.³⁸ Similarly, the Department of Commerce is actively exploring and utilizing its existing authorities to address AI-related concerns.³⁹ Of course, there are more federal agencies than those covered in this report, and every state has agencies and authorities that could be leveraged to address AI.⁴⁰ A similar analysis of other federal or state agencies’ statutory authorities to effectively mitigate AI-related harms via regulation could be valuable. As noted above, GFI and CAP also encourage agencies that have yet to do so to respond to OMB Circular M-21-06 with an inventory of their regulatory authorities applicable to AI.⁴¹

Authors’ note: For this report, the authors use the definition of artificial intelligence (AI) from the 2020 National Defense Authorization Act, which established the National Artificial Intelligence Initiative.⁴² This definition was also used by the 2023 “Executive Order on the Safe, Secure, and Trustworthy Development and Use of Artificial Intelligence.”⁴³ Similarly, this report makes repeated reference to “Appendix I: Purposes for Which AI is Presumed to be Safety-Impacting and Rights-Impacting” of the 2024 OMB M-24-10 memo, “Advancing Governance, Innovation, and Risk Management for Agency Use of Artificial Intelligence.”⁴⁴

A note on the Supreme Court and Congress

At the time of this report’s publication, several pending U.S. Supreme Court cases could affect federal agencies’ ability to regulate.⁴⁵ Chevron deference has served as the foundation of agency rulemaking for nearly 40 years, enshrining the simple but critical legal maxim that federal agencies, because of their expertise, should be given deference in interpreting and implementing laws passed by Congress. If, as seems likely, the Supreme Court severely limits or overturns Chevron, it will be more important than ever for agencies and policy advocates to ground regulatory policy proposals in the sort of statutory analysis that is undertaken throughout this report. The authors have not, however, analyzed the litigation risk associated with each of the policy recommendations included in this report, which is a necessary precursor to action, particularly considering this court’s anti-regulatory bent. This report’s focus on existing authorities aims to illustrate the tools agencies currently have at their disposal. Understanding the strengths and limitations of these statutes is essential in helping Congress understand what may be needed in future legislation. CAP has advocated for and continues to believe that AI legislation⁴⁶ and broader regulation of online services⁴⁷ will be necessary to address the growing risks and challenges of technology.

For the past 30 years, Congress has largely failed to take meaningful action on technology policy, with the recent exception of banning a single application.⁴⁸ While the authors believe this to be an unsustainable status quo, current congressional dysfunction does not inspire confidence that legislative action is imminent. In the event of continued congressional inaction, existing statutory authorities, executive action, and voluntary measures at the federal level, along with existing state regulations and new state laws, will remain the sole tools for addressing the risks and opportunities of AI in America.

The 2023 executive order on AI was detailed and prescriptive in its initial tasking to agencies, outlining eight policies and principles in an ambitious attempt to direct government action at the challenges and opportunities of AI. This report details more than 80 recommendations that agencies can take using existing authorities to address AI in furtherance of those AI policies and principles, representing a starting point in thinking about a subsequent stage of AI regulation. The goal of this report is not to set a definitive regulatory policy agenda for AI, but rather to put forward a range of potential proposals for consideration that agencies could assemble into a future roadmap. Some may prove especially effective; others may not be worth pursuing. Ultimately, the hope is that feedback from policymakers, academics, civil society groups, and private firms will help to identify the most promising recommendations for more exhaustive research—an important step before the federal government begins adopting any proposal contained in this report. Examining federal agencies’ existing authorities and developing regulatory proposals that utilize those authorities is thus essential to address the immediate risks and opportunities of AI. GFI and CAP hope this report helps spur the next phase of discussion by providing initial analysis and recommendations for immediate action on AI.

While the opinions and proposals put forward in this report solely represent the views of the authors, we would like to thank the following individuals for their feedback and helpful contributions: Aiha Nguyen of Data & Society, Alvin Velasquez, Brian Chen of Data & Society, David Brody of the Lawyers’ Committee for Civil Rights Under Law, Jesse Lehrich of Accountable Tech, Kate Dunn of the National Fair Housing Alliance, Kristin Woelfel of the Center for Democracy and Technology, Mariah De Leon of Upturn, Matt Scherer of the Center for Democracy and Technology, Michael Akinwumi of the National Fair Housing Alliance, Michele Evermore of The Century Foundation, Michelle Miller of the Center for Labor and a Just Economy, Natasha Duarte of Upturn, Sarah Myers West of the AI Now Institute, Snigdha Sharma of the National Fair Housing Alliance, and Tanya Goldman of Workshop.

We would also like to thank the following CAP staff for their help: Maggie O’Neill, Zachary Geiger, Alice Lillydahl, David Madland, Karla Walter, Marc Jarsulic, Alex Thornton, Lilith Fellowes-Granda, Jared Bass, Lisette Partelow, Molly Weston Williamson, Veronica Goodman, Rozina Kiflom, Mona Alsaidi, Audrey Juarez, Nicolas Del Vecchio, Christian Rodriguez, Carl Chancellor, Beatrice Aronson, Steve Bonitatibus, Shanée Simhoni, Bill Rapp, Chester Hawkins, Keenan Alexander, Sam Hananel, and Billy Flanagan.