The Blueprint for an AI Bill of Rights: Making Automated Systems Work for the American People is a framework published by the White House Office of Science and Technology Policy in October 2022. It sets out five principles to guide the design, use and deployment of automated systems, together with a technical companion, From Principles to Practice, giving concrete expectations for organizations building or deploying such systems. The document describes itself as following "a year of public engagement" after OSTP announced a process to develop "a bill of rights for an AI-powered world" (Source: bidenwhitehouse.archives.gov).
Legal status by its own terms
The document states its status directly and at some length. It "is non-binding and does not constitute U.S. government policy," and "does not supersede, modify, or direct an interpretation of any existing statute, regulation, policy, or international instrument. It does not constitute binding guidance for the public or Federal agencies." It further states that it "is not intended to, and does not, create any legal right, benefit, or defense, substantive or procedural, enforceable at law or in equity by any party against the United States, its departments, agencies, or entities, its officers, employees, or agents, or any other person, nor does it constitute a waiver of sovereign immunity" (primary text, Foreword).
The document describes itself as "a national values statement and toolkit that is sector-agnostic," and states that "ensuring some of the additional protections proposed in this framework would require new laws to be enacted or new policies and practices to be adopted." It records that exceptions may be necessary "to comply with existing law, conform to the practicalities of a specific use case, or balance competing public interests," naming law enforcement and other regulatory contexts as places where government actors may need alternate mechanisms. It also states that the framework "does not analyze or take a position on legislative and regulatory proposals in municipal, state, and federal government, or those in other countries" (primary text, Relationship to Existing Law and Policy).
Scope
The framework applies a two-part test: it covers (1) automated systems that (2) have the potential to meaningfully impact the American public's rights, opportunities, or access to critical resources or services. The three protected categories are defined as civil rights, civil liberties and privacy (including freedom of speech, voting, and protections from discrimination, excessive punishment, unlawful surveillance and privacy violations, in both public and private sector contexts); equal opportunities (including equitable access to education, housing, credit and employment); and access to critical resources or services (such as healthcare, financial services, safety, social services, non-deceptive information about goods and services, and government benefits) (primary text, Applying the Blueprint).
Its definition of an automated system is deliberately broad: "any system, software, or process that uses computation as whole or part of a system to determine outcomes, make or aid decisions, inform policy implementation, collect data or observations, or otherwise interact with individuals and/or communities," including but not limited to systems derived from machine learning, statistics or other data processing or AI techniques. It excludes passive computing infrastructure, defined as intermediary technology that does not influence or determine outcomes — web hosting, domain registration, networking, caching, data storage, cybersecurity. The framework's reach is therefore set by consequence rather than by technique, which is a different scoping approach from the risk-tier model of the EU AI Act and from compute-threshold approaches (primary text, Definitions).
Algorithmic discrimination is defined as occurring "when automated systems contribute to unjustified different treatment or impacts disfavoring people based on their race, color, ethnicity, sex (including pregnancy, childbirth, and related medical conditions, gender identity, intersex status, and sexual orientation), religion, age, national origin, disability, veteran status, genetic information, or any other classification protected by law," with the document noting this is not a technical sense of discrimination as distinguishing between items. Communities is defined to include neighborhoods, online and offline social networks, families construed broadly, people connected by affinity, identity or shared traits, formal organizational ties, and expressly Tribes, Clans, Bands, Rancherias, Villages and other Indigenous communities (primary text, Definitions).
The five principles
Each principle is stated in the second person as an entitlement, followed by expectations on designers, developers and deployers.
- Safe and effective systems. "You should be protected from unsafe or ineffective systems." Systems should be developed in consultation with diverse communities, stakeholders and domain experts; should undergo pre-deployment testing, risk identification and mitigation, and ongoing monitoring; and the protective measures should include "the possibility of not deploying the system or removing a system from use." Systems should not be designed with an intent or reasonably foreseeable possibility of endangering safety, and should protect against harms from unintended but foreseeable uses. Independent evaluation and reporting confirming safety and effectiveness "should be performed and the results made public whenever possible."
- Algorithmic discrimination protections. "You should not face discrimination by algorithms and systems should be used and designed in an equitable way." Expected measures include proactive equity assessments as part of system design, use of representative data and protection against proxies for demographic features, accessibility for people with disabilities in design and development, pre-deployment and ongoing disparity testing and mitigation, and clear organizational oversight. Independent evaluation and plain-language reporting "in the form of an algorithmic impact assessment, including disparity testing results and mitigation information," should be performed and made public where possible.
- Data privacy. "You should be protected from abusive data practices via built-in protections and you should have agency over how data about you is used." Protections should be included by default; data collection should conform to reasonable expectations and be limited to what is strictly necessary for the specific context. The principle rejects design that "obfuscate[s] user choice or burden[s] users with defaults that are privacy invasive," and states that "consent should only be used to justify collection of data in cases where it can be appropriately and meaningfully given." It calls for enhanced protections in sensitive domains — health, work, education, criminal justice and finance — and for data pertaining to youth, where data and inferences "should only be used for necessary functions" subject to ethical review and use prohibitions. On surveillance it states that people "should be free from unchecked surveillance," that surveillance technologies should face heightened oversight including pre-deployment harm assessment and scope limits, and that continuous surveillance and monitoring "should not be used in education, work, housing, or in other contexts where the use of such surveillance technologies is likely to limit rights, opportunities, or access."
- Notice and explanation. "You should know that an automated system is being used and understand how and why it contributes to outcomes that impact you." Expected are generally accessible plain-language documentation of overall system functioning and the role automation plays, notice that such systems are in use, identification of the responsible individual or organization, and explanations that are clear, timely and accessible. Notice should be kept current and people should be told of significant use-case or key-functionality changes. The principle applies "including when the automated system is not the sole input determining the outcome," and requires explanations "calibrated to the level of risk based on the context."
- Human alternatives, consideration, and fallback. "You should be able to opt out, where appropriate, and have access to a person who can quickly consider and remedy problems you encounter." Appropriateness is to be judged on reasonable expectations in context, with a focus on broad accessibility and protection from especially harmful impacts, and the document notes that in some cases a human alternative may be required by law. Timely human consideration and remedy should be available through a fallback and escalation process when a system fails, produces an error, or the person wishes to appeal or contest its impacts, and this "should not impose an unreasonable burden on the public." Systems intended for use in sensitive domains — criminal justice, employment, education and health are named — should additionally be tailored to purpose, provide meaningful access for oversight, include training for people interacting with the system, and incorporate human consideration for adverse or high-risk decisions.
The document characterizes the five together as "an overlapping set of backstops against potential harms," with measures to be "proportionate with the extent and nature of the harm, or risk of harm."
The technical companion
From Principles to Practice treats each principle in three parts: Why this principle is important, summarizing the problems it addresses with illustrative examples; What should be expected of automated systems, giving practical steps; and How these principles can move into practice, giving examples of existing implementations. The document states the expectations "are meant to serve as a blueprint for the development of additional technical standards and practices that should be tailored for particular sectors and contexts."
Its reporting expectations are addressed to the entity developing or using the system, with resulting reports to be made public "as much as possible consistent within law, regulation, and policy," and provided to oversight bodies or to privacy, civil liberties or ethics officers where intellectual property, law enforcement or national security considerations prevent public release. The Data Privacy section carries an additional subsection on extra protections for data related to sensitive domains.
Development and provenance
OSTP describes a year-long process of panel discussions, public listening sessions, meetings, a formal request for information, and a publicly accessible email address, drawing input from impacted communities, industry stakeholders, technology developers, experts, and federal policymakers, with a full list of public engagements in the appendix. The document is a work of the United States Government and is in the public domain under 17 U.S.C. §105.
Subsequent status
The framework was never rescinded by a named instrument, and by its own terms there was no binding effect to rescind. Its practical standing changed through replacement of the surrounding policy: Executive Order 14110 (RESCINDED) was rescinded, and America's AI Action Plan (July 2025) and Executive Order 14365 (December 2025) adopted a deregulatory posture that reverses the framing without addressing the Blueprint directly. The Action Plan's direction to NIST to remove references to diversity, equity and inclusion, misinformation and climate from the NIST AI Risk Management Framework narrows the technical inheritance the Blueprint was paired with.
The document names its own home address as whitehouse.gov/ostp/ai-bill-of-rights. That URL no longer serves the framework; the text survives at the National Archives copy of the Biden White House site, which carries a banner describing it as "historical material 'frozen in time'."
Its principles continue to appear in other instruments. State legislation including California SB 53, the Colorado AI Act and California SB 243 — Companion Chatbots carries framing traceable to the algorithmic-discrimination and notice-and-explanation principles, and civil-society advocacy on AI civil rights is frequently organized around the five principles.
Relationships
- depends-on: AI and Civil Liberties, AI Bias and Discrimination, AI and Privacy — the substantive policy areas the principles address.
- related: NIST AI Risk Management Framework 1.0 — the technical framework developed in parallel as the operational counterpart.
- related: Executive Order 14110 (RESCINDED) — the binding Biden-era instrument the Blueprint preceded.
- contradicts: America's AI Action Plan, Executive Order 14365 — later executive-branch instruments taking the opposite regulatory posture without revoking this framework.
- related: California SB 53, Colorado AI Act (SB 24-205), California SB 243 — Companion Chatbots — state instruments inheriting its framing.
- related: EU AI Act (Regulation 2024/1689) — contrasting scope model, tiering by risk class rather than by potential impact on rights, opportunities or access.
Provenance
Captured 1 September 2026 from the National Archives copy of the Biden White House site: the landing page at bidenwhitehouse.archives.gov and the complete 73-page PDF at bidenwhitehouse.archives.gov, both by forced live fetch returning HTTP 200. The capture includes the technical companion and endnotes in full. PDF text extraction introduces intermittent intra-word spacing in section headings; body text is faithful. The document itself is dated October 2022 and does not state a day; the 4 October 2022 date in this page's frontmatter is the widely reported release date rather than one carried in the text.