In brief
GAAFA regulates what a system actually does, its authority, consequences, provenance and accountability, rather than banning or mandating particular model families by label. Its governing construction: technical ability to infer does not create authority to infer.
- Boundary inheritance. AI systems inherit the authority limits of the governmental function they serve. Software is not a fiduciary or a source of authority; accountable people and agencies remain responsible (Section 5).
- Classification by use. Systems are classified by actual use and consequence, with baseline requirements for each tier (Sections 7 and 8).
- Authority before deployment. Algorithmic authority and deployment assessment, purpose and question particularity, and provenance for features, models, training and grounding data (Sections 9 to 11).
- No capability laundering. Commercial scores and outputs do not become authorized governmental knowledge because a vendor produced them (Sections 13 and 34).
- Rights of affected people. Meaningful human judgment, decisional explanation, notice of automated involvement, contestability and correction, including correction of derived inferences (Sections 14 to 18).
- Analytics with limits. Population-scale analytics may serve legitimate purposes, but scale does not create authority to search for unspecified patterns. Purpose-bounded enclaves, separation of analytics from adjudication, and limits on signal retention (Sections 20 to 24).
- Agents and assistants. Specific rules for agentic and tool-using AI, citizen-facing assistants, official-source grounding and synthetic media (Sections 29 to 32).
Section map
| Sections | What they do |
|---|---|
| 1–6 | Title, findings, definitions, relationship to PDTA, VIDA and FCGIAS; AI boundary inheritance; governmental informational operations. |
| 7–13 | Classification by actual use and consequence; tier baselines; authority and deployment assessment; purpose and question particularity; provenance; vendor predeployment assessment; commercial outputs. |
| 14–19 | Meaningful human judgment; decisional explanation; notice; contestability and independent review; correction; material derived inference. |
| 20–25 | Bounded discovery; purpose-bounded analytics enclaves; hypothesis-generating analytics; analytics-adjudication separation; signal retention; composite machine action. |
| 26–32 | Lifecycle impact assessment; civil-rights and disparate-outcome testing; drift and reauthorization; agentic systems; citizen-facing AI; accuracy and grounding; synthetic media. |
| 33–38 | Procurement and vendor obligations; capability laundering; DTA oversight; conformance; transparency registry; auditability and records. |
| 39–43 | Enforcement and remedies; legacy transition through PDTA Section 28; review; severability; effective date 180 days after enactment. |
Text
For drafting assistance, write to legislative@fiduciarycommons.com.