Preface

This post is part of a series exploring existing approaches to regulation that seem relevant for thinking about governing AI.

The goal of this series is to provide a brief overview of a type regulation or a regulatory body so others can understand how they work and glean insights for AI governance. These posts are by no means exhaustive, and I would love for others to dig deeper on any topic within that seems useful or fruitful.

While I’d be happy to answer any questions about the content below, to be honest I probably don’t know the answer; I’m just a guy who did a bunch Googling in the hopes that someone can gain value from this very high level research.

Thank you to Akash Wasil and Jakub Kraus for their feedback on earlier drafts.

___________________________________________________

Consumer Product Safety Commission (CPSC)

While AI is a broad, general purpose technology, AI systems themselves are in many cases consumer products. There are open source models (most notably Llama) out there, but many of the most popular systems like GPT-4, Claude, and Stable Diffusion, are proprietary pieces of software meant for consumer or commercial use. OpenAI and Anthropic actually list their models as “Product” on their website.

If AI systems are products, then it seems valuable to understand how we currently regulate consumer goods to make sure they are safe for public use.

This post looks at the Consumer Product Safety Commission (CPSC), an independent agency that regulates consumer product in the US. CPSC focuses on addressing “unreasonable risks” of injury (through coordinating recalls, evaluating products that are the subject of consumer complaints or industry reports, etc.); developing uniform safety standards (some mandatory, some through a voluntary standards process); and conducting research into product-related illness and injury.

In particular, I focus on the testing and certification that the CPSC requires, which seems especially useful for thinking about how to govern AI.

Childen’s products

• Children’s products are subject to the strictest testing/certification process
• Initial certification testing: every domestically-produced and imported children’s product must be tested by a third party, CPSC-approved laboratory before it can be sold
  • Over 400 CPSC-accredited labs around the world are authorized to test for different types of products
  • The manufacturer or importer is responsible for getting the test done and issuing a “Children’s Product Certificate” [more below]
• Component part testing: if the component(s) of a product have already been third-party tested/approved, these can be accepted as proof of the product’s safety/compliance
• Material Change Testing: If there has been a material change to a children’s product, the manufacturer/supplier is required to either retest the product or retest the component part that was changed to check for compliance with those rules affected by the material change
  • Manufacturer/supplier must then issue a new Children’s Product Certificate based on the new passing test results
• Periodic Testing: third-party testing must continue to be conducted while a children’s product is being produced
  • Testing must be conducted at a minimum of 1-, 2-, or 3-year intervals, depending upon whether the manufacturer has a periodic testing plan, a production testing plan, or plans to conduct continued testing using an accredited laboratory
• Children’s Product Certificate
  • No standardized format: simply written in a word doc or equivalent
  • CPC must physically “accompany” the product or shipment of products covered by the certificate; manufacturers/importers must also “furnish” the GCC to distributors/retailers
  • If you sell directly to consumers, the certificate does not need to be provided to the consumer
  • You do not need to file your certificate with the government or any other regulatory body in the US; however, the CPSC can request a copy of your certificate at any time, and it must be supplied in such cases
  • It is a violation of the CPSA to fail to furnish a CPC and to issue a false CPC; a violation could lead to a civil penalty, criminal penalties, and asset forfeiture
  • Required elements
    • Identification of the product covered by the certificate
      • Describing the product(s) in enough detail to match the certificate to each product it covers and no others
    • Citation to each CPSC children’s product safety rule to which the product is being certified
      • The certificate must identify separately each children’s product safety rule that is applicable to the children’s product
    • Identification of the importer or domestic manufacturer certifying compliance of the product
      • Provide the name, full mailing address, and phone number of the importer or US domestic manufacturer certifying the product
    • Contact information for the individual maintaining records of test results
      • Provide the name, full mailing address, e-mail address, and phone number of the person maintaining test records in support of the certification
    • Date and place where this product was manufactured
      • For the date(s), provide at least the month and year. For the place, provide at least the city, state (if applicable), and country where the product was manufactured or finally assembled. If the same manufacturer operates more than one location in the same city, provide the street address of the factory.
    • Provide the date(s) and place when the product was tested for compliance with the consumer product safety rule(s) cited above
      • Provide the location(s) of the testing and the date(s) of the test(s) or test report(s) on which certification is being based
    • Identify any third party, CPSC-accepted laboratory on whose testing the certificate depends
      • Provide the name, full mailing address, and phone number of the lab

Testing for non-children’s (“general use”) products

• Manufacturers and importers of general use products for which consumer product safety rules apply (full list here), must certify in a written certificate that their products comply with applicable rules
• The product must undergo a “reasonable testing program”: unlike with children’s products, there are no mandates specifying what this looks like
  • The CPSC “suggests best practices for a reasonable testing program, but the guidance is not mandatory”
  • CPSC guidance states that a reasonable testing program should: 
    • “Provide a high degree of assurance that its consumer product complies with the applicable consumer product safety rule or standard”
    • “Be in writing and should be approved by the senior management of the manufacturer/ importer”
    • “Be based on the considered judgment and reasoning of the manufacturer/importer concerning the number, frequency, and methods of tests to be conducted on the products” 
  • There is no requirement that the testing lab be CPSC-approved, or even a third party: testing can be done in-house
  • There is also no requirement to periodically retest/certify general use products or re-test them after materials changes (although the CPSC “recommends” these tests)
• Once the reasonable testing plan has been completed, manufacturer/importer must issue a General Certificate of Conformity (GCC) ( very similar to Children’s Product Certificate)
  • GCC must “accompany” the product or shipment of products covered by the certificate; manufacturers/importers must “furnish” the GCC to distributors/retailers
  • There is no requirement to file the GCC with the government
  • However, it is a violation of the CPSA to fail to furnish a GCC, to issue a false certificate of conformity under certain conditions, and to otherwise fail to comply with section 14 of the CPSA; a violation of the CPSA could lead to a civil penalty and possibly criminal penalties and asset forfeiture
  • GCC required elements
    • Identification of the product covered by this certificate
      • Describe the product(s) in enough detail to match the certificate to each product it covers and no others
    • Citation to each consumer product safety regulation to which the product is being certified
      • The certificate must identify separately each consumer product safety rule administered by the Commission that is applicable to the produc
    • Identification of the importer or domestic manufacturer certifying compliance of the product
      • Provide the name, full mailing address, and phone number of the importer or US domestic manufacturer certifying the product
    • Contact information for the individual maintaining records of test results
      • Provide the name, full mailing address, e-mail address, and phone number of the person maintaining test records in support of the certification
    • Date and place where this product was manufactured
      • For the date(s) when the product was manufactured, provide at least the month and year. For the place of manufacture provide at least the city (or administrative region) and country where the product was manufactured or finally assembled. If the same manufacturer operates more than one location in the same city, provide the street address of the factory.
    • Provide the date(s) and place when the product was tested for compliance with the consumer product safety rule(s) cited above
      • Provide the location(s) of the testing and the date(s) of the test(s) or test report(s) on which certification is being based
    • Identification of any third party laboratory on whose testing the certificate depends

Duty to Report

• While testing/certification for non-children’s products is somewhat vague, companies have pretty strict rules on reporting problems with consumer goods they make, distribute, or sell
• Manufacturers, importers, distributors, and retailers of all consumer products have a legal obligation to immediately report the following information to the CPSC:
  • A defective product that could create a substantial risk of injury to consumers
  • A product that creates an unreasonable risk of serious injury or death
  • A product that fails to comply with an applicable consumer product safety rule or with any other rule, regulation, standard, or ban under the CPSA or any other statute enforced by the CPSC
  • When a child dies, suffers serious injury, ceases breathing for any length of time, or is treated by a medical professional after using a product
  • Certain types of lawsuits
  • Failure to fully and immediately report this information may lead to substantial civil or criminal penalties; CPSC advice is “when in doubt, report”
  • CPSC provides a handbook with detailed information on how to recognize hazardous products and what to do when this happens