You quoted the regulatory analysis, not the actual rule.
The final rule, at 81 FR 11405, amends 49 CFR 1540.107 to add paragraph (d) as follows:
"(d) The screening and inspection described in paragraph (a) of this section may include the use of advanced imaging technology. Advanced imaging technology used for the screening of passengers under this section must be equipped with and employ automatic target recognition software and any other requirement TSA deems necessary to address privacy considerations.
(1) For purposes of this section, advanced imaging technology.
(i) Means a device used in the screening of passengers that creates a visual image of an individual showing the surface of the skin and revealing other objects on the body; and
(ii) May include devices using backscatter x.rays or millimeter waves and devices referred to as whole body imaging technology or body scanning machines.
(2) For purposes of this section, automatic target recognition software means software installed on an advanced imaging technology device that produces a generic image of the individual being screened that is the same as the images produced for all other screened individuals."
The 2013 NPRM version, at 78 FR 18302, had instead proposed the following amendment:
"(d) The screening and inspection described in (a) may include the use of advanced imaging technology. For purposes of this section, advanced imaging technology is defined as screening technology used to detect concealed anomalies without requiring physical contact with the individual being screened."
TSA
argued in court that "may include" means "might require". I argued that it means "might have as an optional component", like it did in 2011. (And besides, that they can't require it anyway.)
So far, no court has yet ruled on the substance of TSA's new mandatory-AIT policy.