This post is part of a series exploring existing approaches to regulation that seem relevant for thinking about governing AI.
The goal of this series is to provide a brief overview of a type regulation or a regulatory body so others can understand how they work and glean insights for AI governance. These posts are by no means exhaustive, and I would love for others to dig deeper on any topic within that seems useful or fruitful.
While I’d be happy to answer any questions about the content below, to be honest I probably don’t know the answer; I’m just a guy who did a bunch Googling in the hopes that someone can gain value from this very high level research.
Thank you to Akash Wasil and Jakub Kraus for their feedback on earlier drafts.
While AI is a broad, general purpose technology, AI systems themselves are in many cases consumer products. There are open source models (most notably Llama) out there, but many of the most popular systems like GPT-4, Claude, and Stable Diffusion, are proprietary pieces of software meant for consumer or commercial use. OpenAI and Anthropic actually list their models as “Product” on their website.
If AI systems are products, then it seems valuable to understand how we currently regulate consumer goods to make sure they are safe for public use.
This post looks at the Consumer Product Safety Commission (CPSC), an independent agency that regulates consumer product in the US. CPSC focuses on addressing “unreasonable risks” of injury (through coordinating recalls, evaluating products that are the subject of consumer complaints or industry reports, etc.); developing uniform safety standards (some mandatory, some through a voluntary standards process); and conducting research into product-related illness and injury.
In particular, I focus on the testing and certification that the CPSC requires, which seems especially useful for thinking about how to govern AI.
Children’s products are subject to the strictest testing/certification process
Initial certification testing: every domestically-produced and imported children’s product must be tested by a third party, CPSC-approved laboratory before it can be sold
Over 400 CPSC-accredited labs around the world are authorized to test for different types of products
The manufacturer or importer is responsible for getting the test done and issuing a “Children’s Product Certificate” [more below]
Component part testing: if the component(s) of a product have already been third-party tested/approved, these can be accepted as proof of the product’s safety/compliance
Material Change Testing: If there has been a material change to a children’s product, the manufacturer/supplier is required to either retest the product or retest the component part that was changed to check for compliance with those rules affected by the material change
Manufacturer/supplier must then issue a new Children’s Product Certificate based on the new passing test results
Periodic Testing: third-party testing must continue to be conducted while a children’s product is being produced
Testing must be conducted at a minimum of 1-, 2-, or 3-year intervals, depending upon whether the manufacturer has a periodic testing plan, a production testing plan, or plans to conduct continued testing using an accredited laboratory
No standardized format: simply written in a word doc or equivalent
CPC must physically “accompany” the product or shipment of products covered by the certificate; manufacturers/importers must also “furnish” the GCC to distributors/retailers
If you sell directly to consumers, the certificate does not need to be provided to the consumer
You do not need to file your certificate with the government or any other regulatory body in the US; however, the CPSC can request a copy of your certificate at any time, and it must be supplied in such cases
It is a violation of the CPSA to fail to furnish a CPC and to issue a false CPC; a violation could lead to a civil penalty, criminal penalties, and asset forfeiture
Required elements
Identification of the product covered by the certificate
Describing the product(s) in enough detail to match the certificate to each product it covers and no others
Citation to each CPSC children’s product safety rule to which the product is being certified
The certificate must identify separately each children’s product safety rule that is applicable to the children’s product
Identification of the importer or domestic manufacturer certifying compliance of the product
Provide the name, full mailing address, and phone number of the importer or US domestic manufacturer certifying the product
Contact information for the individual maintaining records of test results
Provide the name, full mailing address, e-mail address, and phone number of the person maintaining test records in support of the certification
Date and place where this product was manufactured
For the date(s), provide at least the month and year. For the place, provide at least the city, state (if applicable), and country where the product was manufactured or finally assembled. If the same manufacturer operates more than one location in the same city, provide the street address of the factory.
Provide the date(s) and place when the product was tested for compliance with the consumer product safety rule(s) cited above
Provide the location(s) of the testing and the date(s) of the test(s) or test report(s) on which certification is being based
Identify any third party, CPSC-accepted laboratory on whose testing the certificate depends
Provide the name, full mailing address, and phone number of the lab
Manufacturers and importers of general use products for which consumer product safety rules apply (full list here), must certify in a written certificate that their products comply with applicable rules
The product must undergo a “reasonable testing program”: unlike with children’s products, there are no mandates specifying what this looks like
The CPSC “suggests best practices for a reasonable testing program, but the guidance is not mandatory”
CPSC guidance states that a reasonable testing program should:
“Provide a high degree of assurance that its consumer product complies with the applicable consumer product safety rule or standard”
“Be in writing and should be approved by the senior management of the manufacturer/ importer”
“Be based on the considered judgment and reasoning of the manufacturer/importer concerning the number, frequency, and methods of tests to be conducted on the products”
There is no requirement that the testing lab be CPSC-approved, or even a third party: testing can be done in-house
There is also no requirement to periodically retest/certify general use products or re-test them after materials changes (although the CPSC “recommends” these tests)
Once the reasonable testing plan has been completed, manufacturer/importer must issue a General Certificate of Conformity (GCC) ( very similar to Children’s Product Certificate)
GCC must “accompany” the product or shipment of products covered by the certificate; manufacturers/importers must “furnish” the GCC to distributors/retailers
There is no requirement to file the GCC with the government
However, it is a violation of the CPSA to fail to furnish a GCC, to issue a false certificate of conformity under certain conditions, and to otherwise fail to comply with section 14 of the CPSA; a violation of the CPSA could lead to a civil penalty and possibly criminal penalties and asset forfeiture
GCC required elements
Identification of the product covered by this certificate
Describe the product(s) in enough detail to match the certificate to each product it covers and no others
Citation to each consumer product safety regulation to which the product is being certified
The certificate must identify separately each consumer product safety rule administered by the Commission that is applicable to the produc
Identification of the importer or domestic manufacturer certifying compliance of the product
Provide the name, full mailing address, and phone number of the importer or US domestic manufacturer certifying the product
Contact information for the individual maintaining records of test results
Provide the name, full mailing address, e-mail address, and phone number of the person maintaining test records in support of the certification
Date and place where this product was manufactured
For the date(s) when the product was manufactured, provide at least the month and year. For the place of manufacture provide at least the city (or administrative region) and country where the product was manufactured or finally assembled. If the same manufacturer operates more than one location in the same city, provide the street address of the factory.
Provide the date(s) and place when the product was tested for compliance with the consumer product safety rule(s) cited above
Provide the location(s) of the testing and the date(s) of the test(s) or test report(s) on which certification is being based
Identification of any third party laboratory on whose testing the certificate depends
Duty to Report
While testing/certification for non-children’s products is somewhat vague, companies have pretty strict rules on reporting problems with consumer goods they make, distribute, or sell
Manufacturers, importers, distributors, and retailers of all consumer products have a legal obligation to immediately report the following information to the CPSC:
A defective product that could create a substantial risk of injury to consumers
A product that creates an unreasonable risk of serious injury or death
A product that fails to comply with an applicable consumer product safety rule or with any other rule, regulation, standard, or ban under the CPSA or any other statute enforced by the CPSC
When a child dies, suffers serious injury, ceases breathing for any length of time, or is treated by a medical professional after using a product
Certain types of lawsuits
Failure to fully and immediately report this information may lead to substantial civil or criminal penalties; CPSC advice is “when in doubt, report”
CPSC provides a handbook with detailed information on how to recognize hazardous products and what to do when this happens
AI-Relevant Regulation: CPSC
Preface
This post is part of a series exploring existing approaches to regulation that seem relevant for thinking about governing AI.
The goal of this series is to provide a brief overview of a type regulation or a regulatory body so others can understand how they work and glean insights for AI governance. These posts are by no means exhaustive, and I would love for others to dig deeper on any topic within that seems useful or fruitful.
While I’d be happy to answer any questions about the content below, to be honest I probably don’t know the answer; I’m just a guy who did a bunch Googling in the hopes that someone can gain value from this very high level research.
Thank you to Akash Wasil and Jakub Kraus for their feedback on earlier drafts.
___________________________________________________
Consumer Product Safety Commission (CPSC)
While AI is a broad, general purpose technology, AI systems themselves are in many cases consumer products. There are open source models (most notably Llama) out there, but many of the most popular systems like GPT-4, Claude, and Stable Diffusion, are proprietary pieces of software meant for consumer or commercial use. OpenAI and Anthropic actually list their models as “Product” on their website.
If AI systems are products, then it seems valuable to understand how we currently regulate consumer goods to make sure they are safe for public use.
This post looks at the Consumer Product Safety Commission (CPSC), an independent agency that regulates consumer product in the US. CPSC focuses on addressing “unreasonable risks” of injury (through coordinating recalls, evaluating products that are the subject of consumer complaints or industry reports, etc.); developing uniform safety standards (some mandatory, some through a voluntary standards process); and conducting research into product-related illness and injury.
In particular, I focus on the testing and certification that the CPSC requires, which seems especially useful for thinking about how to govern AI.
Childen’s products
Children’s products are subject to the strictest testing/certification process
Initial certification testing: every domestically-produced and imported children’s product must be tested by a third party, CPSC-approved laboratory before it can be sold
Over 400 CPSC-accredited labs around the world are authorized to test for different types of products
The manufacturer or importer is responsible for getting the test done and issuing a “Children’s Product Certificate” [more below]
Component part testing: if the component(s) of a product have already been third-party tested/approved, these can be accepted as proof of the product’s safety/compliance
Material Change Testing: If there has been a material change to a children’s product, the manufacturer/supplier is required to either retest the product or retest the component part that was changed to check for compliance with those rules affected by the material change
Manufacturer/supplier must then issue a new Children’s Product Certificate based on the new passing test results
Periodic Testing: third-party testing must continue to be conducted while a children’s product is being produced
Testing must be conducted at a minimum of 1-, 2-, or 3-year intervals, depending upon whether the manufacturer has a periodic testing plan, a production testing plan, or plans to conduct continued testing using an accredited laboratory
Children’s Product Certificate
No standardized format: simply written in a word doc or equivalent
CPC must physically “accompany” the product or shipment of products covered by the certificate; manufacturers/importers must also “furnish” the GCC to distributors/retailers
If you sell directly to consumers, the certificate does not need to be provided to the consumer
You do not need to file your certificate with the government or any other regulatory body in the US; however, the CPSC can request a copy of your certificate at any time, and it must be supplied in such cases
It is a violation of the CPSA to fail to furnish a CPC and to issue a false CPC; a violation could lead to a civil penalty, criminal penalties, and asset forfeiture
Required elements
Identification of the product covered by the certificate
Describing the product(s) in enough detail to match the certificate to each product it covers and no others
Citation to each CPSC children’s product safety rule to which the product is being certified
The certificate must identify separately each children’s product safety rule that is applicable to the children’s product
Identification of the importer or domestic manufacturer certifying compliance of the product
Provide the name, full mailing address, and phone number of the importer or US domestic manufacturer certifying the product
Contact information for the individual maintaining records of test results
Provide the name, full mailing address, e-mail address, and phone number of the person maintaining test records in support of the certification
Date and place where this product was manufactured
For the date(s), provide at least the month and year. For the place, provide at least the city, state (if applicable), and country where the product was manufactured or finally assembled. If the same manufacturer operates more than one location in the same city, provide the street address of the factory.
Provide the date(s) and place when the product was tested for compliance with the consumer product safety rule(s) cited above
Provide the location(s) of the testing and the date(s) of the test(s) or test report(s) on which certification is being based
Identify any third party, CPSC-accepted laboratory on whose testing the certificate depends
Provide the name, full mailing address, and phone number of the lab
Testing for non-children’s (“general use”) products
Manufacturers and importers of general use products for which consumer product safety rules apply (full list here), must certify in a written certificate that their products comply with applicable rules
The product must undergo a “reasonable testing program”: unlike with children’s products, there are no mandates specifying what this looks like
The CPSC “suggests best practices for a reasonable testing program, but the guidance is not mandatory”
CPSC guidance states that a reasonable testing program should:
“Provide a high degree of assurance that its consumer product complies with the applicable consumer product safety rule or standard”
“Be in writing and should be approved by the senior management of the manufacturer/ importer”
“Be based on the considered judgment and reasoning of the manufacturer/importer concerning the number, frequency, and methods of tests to be conducted on the products”
There is no requirement that the testing lab be CPSC-approved, or even a third party: testing can be done in-house
There is also no requirement to periodically retest/certify general use products or re-test them after materials changes (although the CPSC “recommends” these tests)
Once the reasonable testing plan has been completed, manufacturer/importer must issue a General Certificate of Conformity (GCC) ( very similar to Children’s Product Certificate)
GCC must “accompany” the product or shipment of products covered by the certificate; manufacturers/importers must “furnish” the GCC to distributors/retailers
There is no requirement to file the GCC with the government
However, it is a violation of the CPSA to fail to furnish a GCC, to issue a false certificate of conformity under certain conditions, and to otherwise fail to comply with section 14 of the CPSA; a violation of the CPSA could lead to a civil penalty and possibly criminal penalties and asset forfeiture
GCC required elements
Identification of the product covered by this certificate
Describe the product(s) in enough detail to match the certificate to each product it covers and no others
Citation to each consumer product safety regulation to which the product is being certified
The certificate must identify separately each consumer product safety rule administered by the Commission that is applicable to the produc
Identification of the importer or domestic manufacturer certifying compliance of the product
Provide the name, full mailing address, and phone number of the importer or US domestic manufacturer certifying the product
Contact information for the individual maintaining records of test results
Provide the name, full mailing address, e-mail address, and phone number of the person maintaining test records in support of the certification
Date and place where this product was manufactured
For the date(s) when the product was manufactured, provide at least the month and year. For the place of manufacture provide at least the city (or administrative region) and country where the product was manufactured or finally assembled. If the same manufacturer operates more than one location in the same city, provide the street address of the factory.
Provide the date(s) and place when the product was tested for compliance with the consumer product safety rule(s) cited above
Provide the location(s) of the testing and the date(s) of the test(s) or test report(s) on which certification is being based
Identification of any third party laboratory on whose testing the certificate depends
Duty to Report
While testing/certification for non-children’s products is somewhat vague, companies have pretty strict rules on reporting problems with consumer goods they make, distribute, or sell
Manufacturers, importers, distributors, and retailers of all consumer products have a legal obligation to immediately report the following information to the CPSC:
A defective product that could create a substantial risk of injury to consumers
A product that creates an unreasonable risk of serious injury or death
A product that fails to comply with an applicable consumer product safety rule or with any other rule, regulation, standard, or ban under the CPSA or any other statute enforced by the CPSC
When a child dies, suffers serious injury, ceases breathing for any length of time, or is treated by a medical professional after using a product
Certain types of lawsuits
Failure to fully and immediately report this information may lead to substantial civil or criminal penalties; CPSC advice is “when in doubt, report”
CPSC provides a handbook with detailed information on how to recognize hazardous products and what to do when this happens