Full export 1/6: master bill, header through Sec. 201 (master sha256 8e65e062…b2b7)
119TH CONGRESS, 2D SESSION
DISCUSSION DRAFT — not introduced. Prepared for a sponsor's office and for review by the Office of the Legislative Counsel.
A BILL
To establish the AI Security Administration, to require the testing, containment, and incident reporting of frontier artificial intelligence systems, to authorize narrow and judicially supervised emergency restraint, to protect minors and users in crisis who use conversational services, and for other purposes.
Be it enacted by the Senate and House of Representatives of the United States of America in Congress assembled,
SECTION 1. SHORT TITLE; TABLE OF CONTENTS.
(a) SHORT TITLE.—This Act may be cited as the "American AI Security Act".
(b) TABLE OF CONTENTS.—The table of contents for this Act is as follows:
Sec. 1. Short title; table of contents.
Sec. 2. Findings and purposes.
Sec. 3. Definitions.
TITLE I—AI SECURITY ADMINISTRATION
Sec. 101. Establishment.
Sec. 102. Officers and independent functions.
Sec. 103. Personnel authorities.
Sec. 104. Coordination and transfer of functions.
Sec. 105. Technical Advisory Council.
Sec. 106. Publication and transparency.
Sec. 107. Conforming amendments.
TITLE II—FRONTIER ARTIFICIAL INTELLIGENCE SAFETY AND SECURITY
Sec. 201. Coverage.
Sec. 202. Tier 2 signals and determinations.
Sec. 203. Safety case and assessment.
Sec. 204. Incident reporting.
Sec. 205. Containment, security, and evidence.
Sec. 206. Emergency restraint.
Sec. 207. Accredited assessors.
Sec. 208. Privacy, purpose limitation, and recipients.
Sec. 209. Whistleblower protections.
Sec. 210. Relationship to State law.
TITLE III—CONVERSATIONAL AND COMPANION SERVICES: MINORS AND USERS IN CRISIS
Sec. 301. Definitions and scope.
Sec. 302. Duties to all users.
Sec. 303. Known or likely minors.
Sec. 304. Incident reporting.
Sec. 305. Enforcement.
Sec. 306. Relation to other law; speech.
TITLE IV—NATIONAL SECURITY AND MILITARY USE
Sec. 401. Human authority over nuclear employment.
Sec. 402. Autonomous weapon systems.
Sec. 403. Artificial intelligence analysis of data on United States persons.
Sec. 404. National security systems.
TITLE V—PROCUREMENT DUE PROCESS FOR ARTIFICIAL INTELLIGENCE SECURITY ACTIONS
Sec. 501. Scope.
Sec. 502. Requirements.
Sec. 503. Conforming amendments.
Sec. 504. Review.
TITLE VI—INTERNATIONAL TECHNICAL SUPPORT
Sec. 601. Role.
Sec. 602. Functions.
Sec. 603. Limits and oversight.
TITLE VII—FOREIGN PROVIDERS AND REPRESENTATIVES
Sec. 701. Nexus and scope.
Sec. 702. Representative.
Sec. 703. Domestic intermediaries.
Sec. 704. Enforcement and limits.
Sec. 705. Evidence held abroad.
TITLE VIII—RESILIENCE, REMEDIATION, AND REPAIR
Sec. 801. Program.
Sec. 802. Eligible activities.
Sec. 803. Awards and validation.
Sec. 804. Accountability.
Sec. 805. Limits.
TITLE IX—ENFORCEMENT, REMEDIES, AND JUDICIAL REVIEW
Sec. 901. Civil penalties.
Sec. 902. Enforcement by the Administrator.
Sec. 903. Review of final actions.
Sec. 904. Emergency restraint proceedings.
Sec. 905. Protected information in civil proceedings.
Sec. 906. Actions to compel discrete duties.
Sec. 907. Existing rights and safeguards.
Sec. 908. Studies.
TITLE X—FUNDING, TRANSITION, AND EFFECTIVE DATES
Sec. 1001. Authorization of appropriations.
Sec. 1002. Fees.
Sec. 1003. Transition.
Sec. 1004. Effective dates and interim reporting.
Sec. 1005. Continuity during a lapse in appropriations.
Sec. 1006. Rules of construction.
Sec. 1007. Severability.
SEC. 2. FINDINGS AND PURPOSES.
(a) FINDINGS.—Congress finds the following:
(1) Artificial intelligence systems are being deployed across the economy and in government at a pace that outstrips the capacity of existing law to test them, to learn of their failures, or to act quickly when a failure threatens life or critical infrastructure.
(2) Documented harms from artificial intelligence already include fraud, impersonation, and the creation of sexually exploitative imagery, including of minors. Failures of containment can occur during training, evaluation, and internal use, not only after public release.
(3) Many popular claims about artificial intelligence risk are overstated or unsupported. Federal law should rest on evidence, state its uncertainty, and distinguish harms that have occurred from harms that are possible.
(4) A voluntary evaluation program cannot compel evidence, enforce containment, receive mandatory incident reports, or give affected persons a protected right to be heard. Those functions require statutory authority, secure capacity, and judicial review.
(5) Several States have enacted laws requiring frontier developers to publish safety frameworks, report critical incidents, or undergo audits. A national standard can reduce conflicting obligations, but only if the Federal protection that replaces a State obligation is actually in force, funded, and staffed.
(6) Regulation cannot guarantee the prevention of every foreign attack or recover model weights that have already been copied. Those limits do not make domestic testing, containment, reporting, and remedies ineffective.
(7) Strategic competition with foreign adversaries is a reason to secure United States artificial intelligence systems, not a reason to exempt them from safety and security duties.
(8) Emergency powers over lawful technology must be narrow, brief, and subject to prompt adversarial review before a neutral court, so that the power to restrain cannot become a power to license by delay.
(b) PURPOSES.—The purposes of this Act are—
(1) to establish an independent Federal agency with the scientific, security, and legal capacity to test frontier artificial intelligence systems and to receive and act on reports of their failures;
(2) to require the developers and operators of the most capable systems to contain them, test them, report serious incidents promptly, and submit a safety case before irreversible release or deployment of a system confirmed to present a specified high-consequence pathway;
(3) to authorize emergency restraint of a specific system only on evidence of imminent serious harm, for no more than 7 days unless a court, after a meaningful adversarial hearing, continues it;
(4) to protect minors and users in crisis who use conversational and companion services;
(5) to protect privacy, lawful speech, and due process, including in procurement and national security decisions;
(6) to displace State law only to the extent that equivalent Federal protection is in force, funded, and capable; and
(7) to publish what the Federal Government learns, including its own missed deadlines and failures.
SEC. 3. DEFINITIONS.
In this Act:
(1) ACCREDITED ASSESSOR.—The term "accredited assessor" means a person accredited under section 207 and assigned by the Administrator to a particular assessment.
(2) ADMINISTRATION; ADMINISTRATOR.—The terms "Administration" and "Administrator" mean the AI Security Administration established by section 101 and the Administrator of that Administration, respectively.
(3) ARTIFICIAL INTELLIGENCE.—The term "artificial intelligence" has the meaning given the term in section 5002 of the National Artificial Intelligence Initiative Act of 2020 (15 U.S.C. 9401).
(4) COMMITTEES OF JURISDICTION.—The term "committees of jurisdiction" means—
(A) the Committee on Commerce, Science, and Transportation, the Committee on Homeland Security and Governmental Affairs, and the Committee on the Judiciary of the Senate; and
(B) the Committee on Energy and Commerce, the Committee on Science, Space, and Technology, the Committee on Homeland Security, and the Committee on the Judiciary of the House of Representatives.
(5) COMPELLED RESTRICTION.—
(A) IN GENERAL.—The term "compelled restriction" means any direction, however labeled and whether or not later held lawful, that—
(i) is communicated by or on behalf of the Administrator to a person; and
(ii) purports, under this Act or any other asserted authority of the Administrator, to require the person to stop, suspend, or refrain from, or to materially limit the scope, access, or exposure of—
(I) training, evaluating, operating, deploying, or releasing a covered system or configuration; or
(II) any other specified activity involving a covered system.
(B) SCOPE.—Any order, notice, or direction of the Administrator, including under section 205(f) or 703(b), that requires a person to stop, suspend, materially limit, or refrain from training, operating, deploying, or releasing a covered system or configuration is a compelled restriction and may be imposed only under section 206, except for a condition under section 203(d) on an action described in section 203(a)(1), a notice under section 202(c)(7), or a direction under section 202(b)(7). A duty imposed directly by statute, and an ordinary prospective remedial order that does not require a person to stop, suspend, materially limit, or refrain from such an activity, is not a compelled restriction, subject to section 206(j)(3). Subparagraph (A) shall be applied consistently with this subparagraph. Each exception in this subparagraph is limited to a measure satisfying its own separately enacted actor, predicate, process, and endpoint and remains subject to section 206(j)(3). A label or cross-reference alone does not establish the exception, and a measure that actually continues or evades a section 206 restriction is subject to that section.
(6) CONFIGURATION; COVERED OPERATED CONFIGURATION.—
(A) CONFIGURATION.—The term "configuration" means a specified combination of a model or its weights with the tools, permissions, scaffolding, orchestration, and computing environment through which it operates.
(B) COVERED OPERATED CONFIGURATION.—The term "covered operated configuration" means a configuration of a covered system that is operated, whether in internal use or deployment, with covered access or with access to external systems or persons.
(7) CONGRESSIONAL INTELLIGENCE COMMITTEES.—The term "congressional intelligence committees" has the meaning given the term in section 3 of the National Security Act of 1947 (50 U.S.C. 3003).
(8) CONTROL.—
(A) IN GENERAL.—The term "control", with respect to training or operation of a system, means the actual power, whether sole, joint, or shared, to direct that training or operation, including an enforceable right to approve it.
(B) AGGREGATION.—Operations are aggregated and counted once where persons jointly control, coordinate, or deliberately divide the relevant training or operation.
(C) INDICATORS.—Holding 50 percent or more of voting securities or of rights to profits, or holding contractual power to direct the work, is a rebuttable indicator of control. None of the following, by itself, establishes control: minority ownership, ordinary investment protections, independent unrelated research, ordinary provision of services, or model lineage.
(D) DESIGNATION.—The Administrator may designate a person as having control on grounds of coordination only on evidence of operational power over the covered activity, or of deliberate functional splitting to evade a duty, by a scoped written designation that the person may contest under section 903.
(E) FOREIGN AFFILIATES.—Aggregation under this paragraph reaches a foreign affiliate under common control if the system is made available to persons in the United States or is trained or operated using facilities in the United States.
(F) NO EXEMPTION.—The absence of a single controlling person does not exempt any activity from this Act.
(9) COVERED ACCESS.—The term "covered access" means configured authority, or access realistically obtainable by a system, that together with a capability materially enables a defined pathway to serious harm. Possession of ordinary software tools is not, by itself, covered access.
(10) COVERED CAPABILITY.—
(A) IN GENERAL.—The term "covered capability" means a capability that, under published and reproducible assessment criteria established by rule under section 201(d), materially enables a specified high-consequence pathway to serious harm involving—
(i) chemical, biological, radiological, or nuclear weapons;
(ii) cyber operations capable of serious harm to critical infrastructure or to a substantial number of persons; or
(iii) evasion, disabling, or resistance of authorized monitoring, containment, or shutdown, or acquisition of unauthorized resources or permissions.
(B) TESTING.—Conduct described in subparagraph (A)(iii) is reportable and testable without realized harm, but is not, by itself, a finding of imminent serious harm. Authorized, bounded elicitation of a behavior during testing is not prohibited because it produces the tested behavior. An actual failure of a boundary or stop mechanism is not exempt because it occurred during a test.
(11) COVERED DEVELOPER.—The term "covered developer" means a person that has control of the training of a covered system.
(12) COVERED SYSTEM.—The term "covered system" means an artificial intelligence model or operated artificial intelligence system, including its tool scaffold, orchestration, fine-tuned versions, and relevant derivatives, that—
(A) meets the compute screen established under section 201(a); or
(B) is designated under section 201(b).
(13) CRITICAL INFRASTRUCTURE.—The term "critical infrastructure" has the meaning given the term in section 1016(e) of the Critical Infrastructures Protection Act of 2001 (42 U.S.C. 5195c(e)). Incorporation of that definition delegates no power and does not establish that any particular digital service is critical infrastructure.
(14) DAY.—Except as otherwise provided, the term "day" means a calendar day. A period stated in hours runs continuously.
(15) DUTY HOLDER.—
(A) IN GENERAL.—The term "duty holder" means, with respect to a covered system, each of the following to the extent of its control:
(i) A covered developer.
(ii) A deployer, meaning a person that makes a covered system available to others as its own offering, or that configures a covered system with covered access.
(iii) A person directing a material modification.
(iv) An orchestration operator, meaning the person accountable for a covered operated configuration.
(v) An environment controller, meaning a person that controls the computing environment, network access, or permissions of a covered system.
(B) RULES.—Each covered operated configuration shall have an orchestration operator, designated in writing by the covered developer or, if the covered developer does not control the configuration, by the deployer, and identified to the Administrator on request. There may be more than one duty holder. Duties follow actual control, and no contract, outsourcing arrangement, or division of components relieves a person of a duty for a function it controls. A provider of general hosting is not an environment controller unless it exercises control described in subparagraph (A)(v).
(16) INTERNAL USE.—The term "internal use" means training, evaluation, research, or operational activity by or for a covered developer or orchestration operator. Duties apply to internal use in proportion to capability, exposure, and control, and sections 204 and 205 apply to internal use without regard to revenue.
(17) IRREVERSIBLE RELEASE; REVERSIBLE DEPLOYMENT.—
(A) IRREVERSIBLE RELEASE.—The term "irreversible release" means making the weights of a covered system, or a configuration from which those weights can practicably be extracted, available to a person outside the control of the duty holder in a manner under which the duty holder lacks the actual, feasible, and continuing technical ability to prevent further use and further distribution of the weights by that person. Contractual terms alone do not establish that ability. A transfer to a recipient that maintains security for the weights meeting the standards under section 205(c), under enforceable terms that permit the duty holder to terminate access and that prohibit further distribution, is not an irreversible release if the duty holder retains that ability. The number of recipients is relevant evidence but is not by itself determinative. Access through a service that the duty holder can revoke, and from which the weights cannot practicably be extracted, is not an irreversible release, regardless of the number of users.
(B) REVERSIBLE DEPLOYMENT.—The term "reversible deployment" means making a covered system available for use by others in a manner that is not an irreversible release.
(18) MATERIAL MODIFICATION.—The term "material modification" means a reasonably supported change to a relevant capability or access pathway, or to the effectiveness of a safeguard, that meets objective triggers established by rule. A routine change with no material effect on risk is not a material modification.
(19) PERSON.—The term "person" means an individual, partnership, corporation, association, organization, or other entity, domestic or foreign, but does not include the United States or an agency of the United States except where expressly provided.
(20) PROTECTED MODEL WEIGHTS.—The term "protected model weights" means the weights of a covered system that have not been made publicly available by, or with the authorization of, the covered developer.
(21) RESTRICTION START.—The term "restriction start" means the earlier of—
(A) the time a compelled restriction is first communicated to any officer, employee, or agent of the person to whom it is directed, not including an unsent draft or the receipt of unrelated information; or
(B) the time any compelled restriction on a substantially identical pathway first takes legal or practical effect against that person.
The restriction start governs duration only. Sufficiency of notice and culpability for noncompliance are governed by section 206(b)(7).
(22) SECTOR RISK MANAGEMENT AGENCY.—The term "Sector Risk Management Agency" has the meaning given the term in section 2200 of the Homeland Security Act of 2002 (6 U.S.C. 650).
(23) SERIOUS HARM.—The term "serious harm" means—
(A) death or serious bodily injury to one or more individuals; or
(B) incapacity or destruction of, or serious disruption of or damage to, critical infrastructure.
(24) SMALL ENTITY.—The term "small entity" means a small business concern, as defined in section 3 of the Small Business Act (15 U.S.C. 632), and a nonprofit organization or institution of higher education with fewer than 500 employees.
(25) SPECIAL ADVOCATE.—The term "special advocate" means an attorney appointed under section 905(d) who is independent of the Administrator, free of conflicts, and appointed to advocate for the interests of a person, without an attorney-client relationship, in a proceeding in which that person or its counsel cannot lawfully review protected information, as defined in section 905(a). Appointment of a special advocate does not dilute the person's own right to contest.
(26) STATE.—The term "State" means each of the several States, the District of Columbia, each commonwealth, territory, or possession of the United States, and each federally recognized Indian Tribe.
(27) SUBSTANTIALLY IDENTICAL PATHWAY.—
(A) IN GENERAL.—The term "substantially identical pathway" means a pathway to serious harm that relies on the same or a materially similar system or configuration, and the same mechanism of harm, as a pathway that is or was the basis of a compelled restriction.
(B) WHAT DOES NOT MAKE A PATHWAY DISTINCT.—A change of label, a change of recipient entity within a group of affiliated entities, or an immaterial change in configuration does not make a pathway distinct.
(C) DISTINCT PATHWAYS.—Distinctness shall rest on a materially distinct, evidenced pathway, including a newly evidenced material change in capability, access, exposure, or safeguards. A relabeling or new description of substantially the same pathway does not suffice. A genuinely distinct acute pathway newly established by lawful evidence may be acted on under its own predicates, whether or not every underlying fact arose after an earlier restriction.
(28) TIER 2 SIGNAL; TIER 2 SYSTEM.—The terms "Tier 2 signal" and "Tier 2 system" have the meanings given those terms in section 202.
(29) VOLUNTARY COOPERATION.—
(A) IN GENERAL.—A communication from the Administrator is voluntary cooperation, and not a compelled restriction, if—
(i) it states in writing that compliance is voluntary;
(ii) no consequence for noncompliance under this Act is stated, threatened, or imposed; and
(iii) the person to whom it is directed has not been told that it is required under this Act or any other authority, and is not otherwise reasonably led to believe so.
(B) RULES.—A voluntary label does not exclude actual compulsion. The absence of a written statement does not, by itself, make a noncoercive communication a compelled restriction. The Administrator bears the burden of showing that a contested communication was voluntary cooperation.
TITLE I—AI SECURITY ADMINISTRATION
SEC. 101. ESTABLISHMENT.
(a) IN GENERAL.—There is established in the executive branch an independent establishment, as defined in section 104 of title 5, United States Code, to be known as the "AI Security Administration".
(b) ADMINISTRATOR.—
(1) IN GENERAL.—There is established the position of Administrator of the AI Security Administration, who shall be the head of the Administration.
(2) APPOINTMENT.—The Administrator shall be appointed by the President, by and with the advice and consent of the Senate, from among individuals with demonstrated expertise in artificial intelligence, computer security, or the evaluation of technological risk.
(3) TERM.—The Administrator shall serve for a term of 5 years and may continue to serve after the expiration of the term until a successor is appointed and qualified, for not more than 1 year.
(4) REMOVAL.—If the President removes the Administrator, the President shall, not later than 30 days after the removal, transmit to the committees of jurisdiction a written statement of the reasons for the removal. This paragraph does not limit the President's power of removal.
(c) PRINCIPAL DEPUTY ADMINISTRATOR.—There is established the position of Principal Deputy Administrator, who shall be appointed by the Administrator. The Principal Deputy Administrator shall be the first assistant to the Administrator for purposes of subchapter III of chapter 33 of title 5, United States Code, and, during the absence or disability of the Administrator or a vacancy in that office, shall perform the functions and duties of the office only to the extent and for the periods lawfully authorized under that subchapter.
(d) CONTINUITY OF AUTHORITY.—
(1) SUCCESSION PLAN.—Not later than 30 days after taking office, the Administrator shall, by written order transmitted to the committees of jurisdiction, designate in advance an order of succession for the exercise of each authority under section 206, consistent with subchapter III of chapter 33 of title 5, United States Code, including its eligibility requirements, restrictions relating to nominations, and time limits.
(2) PROMPT DESIGNATION.—Any designation of an acting officer shall be made promptly after a vacancy arises.
(3) LIMITS.—No authority under section 206 may be exercised by an official, other than the Administrator, who is not so designated and lawfully serving. A designation or plan under this subsection does not itself create a lawful acting appointment. A vacancy, or a late designation, does not extend any period under section 206 or permit an otherwise unauthorized officer to issue an order.
(e) PRINCIPAL OFFICE.—The principal office of the Administration shall be in the District of Columbia metropolitan area. The Administration shall maintain facilities able to receive, store, and process classified information.
SEC. 102. OFFICERS AND INDEPENDENT FUNCTIONS.
(a) CHIEF PRIVACY AND CIVIL LIBERTIES OFFICER.—
(1) ESTABLISHMENT.—There is in the Administration a Chief Privacy and Civil Liberties Officer, appointed by the Administrator.
(2) DUTIES.—The Officer shall review each rule, demand, linkage authorization, and data-retention practice of the Administration for compliance with section 208 and with applicable privacy law, and shall investigate complaints of misuse.
(3) REPORTS.—The Officer shall report not less than twice each year directly to the committees of jurisdiction and to the Privacy and Civil Liberties Oversight Board, without prior review or clearance by the Administrator, on the matters described in paragraph (2).
(b) OFFICE OF INCIDENT REVIEW.—
(1) ESTABLISHMENT.—There is in the Administration an Office of Incident Review, headed by a Director of Incident Review appointed by the Administrator for a term of 5 years. The Director may be removed only for inefficiency, neglect of duty, or malfeasance in office, and the Administrator shall report the reasons for any removal to the committees of jurisdiction not later than 30 days after the removal.
(2) FUNCTIONS.—The Office shall investigate serious incidents and material containment failures reported under section 204 or otherwise known to the Administration, to determine their causes and to recommend measures to prevent recurrence.
(3) SEPARATION.—The Office shall not participate in enforcement, in the issuance of a compelled restriction, or in any assessment under section 203. Personnel of the Office may not be directed by enforcement personnel with respect to the conduct or findings of an investigation.
(4) ACCESS.—The Office shall have access to all records held by the Administration that are relevant to an investigation, for the purposes of the investigation only, through personnel holding any clearance the records require, and subject to applicable privilege rulings and the handling requirements of section 208. Access to records held by the Administration is not a substitute for acquisition of other records, which the Office may obtain only through the authorities of section 205(d) and (e) and section 208, on their own predicates and safeguards. Neither the Office nor enforcement personnel may select a substitute for requested evidence and certify its own adequacy.
(5) FINDINGS.—The Office shall publish each final report, redacted under section 106, not later than 30 days after its completion, and shall provide the unredacted report to the Inspector General, the Comptroller General, and the committees of jurisdiction. A finding of the Office as to cause does not determine fault, waive liability, or bar any claim of an injured person.
(6) INDEPENDENCE SAFEGUARDS.—
(A) QUALIFICATIONS.—The Director shall have demonstrated technical competence in the investigation of failures of complex technical systems.
(B) CONFLICTS.—The Director and personnel of the Office are subject to subsection (d) of section 103 and shall recuse themselves from any investigation in which they have a conflict of interest under applicable law.
(C) NO INTERFERENCE.—No officer or employee of the Administration may prevent, delay, or condition the initiation, conduct, findings, or publication of an investigation of the Office, except to the extent required to protect classified information or material that may be withheld under section 106(d), and the Director shall report each such exception to the Inspector General and the committees of jurisdiction.
(D) ACCESS DISPUTES.—The Inspector General shall decide in writing, not later than 10 days after it is raised, any dispute concerning access by the Office to records of the Administration, and the Administration shall comply with the decision.
(E) BUDGET.—The budget request of the Administration shall identify separately the amounts requested for the Office.
(c) INSPECTOR GENERAL.—The Administration shall have an Inspector General appointed in accordance with chapter 4 of title 5, United States Code, as amended by section 107.
(d) RESPONSIBLE OFFICIAL FOR REPORTS OF RISK.—The Administrator shall designate by name a senior official responsible for compliance with section 206(i), who shall report quarterly to the Inspector General on that compliance.
SEC. 103. PERSONNEL AUTHORITIES.
(a) DIRECT HIRE.—The Administrator may appoint, without regard to sections 3309 through 3318 of title 5, United States Code, candidates directly to positions in the competitive service in the Administration for which the Administrator determines there is a severe shortage of candidates or a critical hiring need, after public notice. The merit system principles in section 2301 of title 5, United States Code, and the prohibitions in section 2302 of that title apply to appointments under this subsection.
(b) CRITICAL TECHNICAL EXPERTS.—
(1) AUTHORITY.—Notwithstanding section 3104 of title 5, United States Code, the provisions of that title governing appointments in the competitive service, chapter 51 of that title, and subchapter III of chapter 53 of that title, the Administrator may appoint not more than 100 scientific, engineering, and professional personnel and fix their rates of basic pay.
(2) LIMIT.—The rate of basic pay for a position under this subsection shall not exceed the rate of basic pay for level I of the Executive Schedule. The aggregate of basic pay and any other payment of compensation to an individual under this subsection in a calendar year, excluding employer contributions for retirement, health, and life insurance benefits, shall not exceed the annual rate of salary of the Vice President under section 104 of title 3, United States Code.
(3) LAWS PRESERVED.—This subsection does not waive any law relating to ethics, antidiscrimination, the merit system principles and prohibited personnel practices under sections 2301 and 2302 of title 5, United States Code, security requirements, or the availability of appropriations.
(c) EXCEPTED SERVICE.—
(1) AUTHORITY.—The Administrator may establish positions in the excepted service for personnel who perform evaluation, security, or incident-response functions, may appoint individuals to those positions without regard to the provisions of title 5, United States Code, governing appointments in the competitive service, and may fix their rates of basic pay without regard to chapter 51 and subchapter III of chapter 53 of that title.
(2) LIMITS.—The limits in subsection (b)(2) and the laws preserved in subsection (b)(3) apply to positions under this subsection.
(3) COMPARABILITY.—In fixing rates of pay under this subsection, the Administrator shall consider rates paid for comparable positions under section 2208 of the Homeland Security Act of 2002 (6 U.S.C. 658) and in the private sector. That section does not itself apply to the Administration.
(d) CONFLICTS.—No employee of the Administration may participate in a matter involving a person by whom the employee was employed, for whom the employee served as a contractor, consultant, attorney, or agent, or from whom the employee received compensation, during the 2 years before the employee's appointment, or in a matter in which the employee has a disqualifying financial interest under section 208 of title 18, United States Code. For 2 years after leaving the Administration, a former senior employee (as described in section 207(c)(2) of title 18, United States Code) may not knowingly make, with the intent to influence, any communication to or appearance before the Administration on behalf of a covered developer in connection with a matter in which the former employee participated personally and substantially. This subsection is in addition to, and does not shorten or otherwise limit, any restriction under section 207 of title 18, United States Code.
(e) SECURITY CLEARANCES.—The Director of National Intelligence shall give priority to the investigation and adjudication of security clearances for personnel of the Administration and for attorneys designated to the panel of special advocates under section 905(d). Priority under this subsection does not establish eligibility for access to classified information and does not extend any period under this Act.
SEC. 104. COORDINATION AND TRANSFER OF FUNCTIONS.
(a) LEAD-AGENCY AGREEMENTS.—Not later than 180 days after the date of enactment of this Act, the Administrator shall enter into, and publish, written agreements with the Director of the National Institute of Standards and Technology, the Director of the Cybersecurity and Infrastructure Security Agency, the Assistant Secretary for Preparedness and Response of the Department of Health and Human Services, the Federal Trade Commission, and each relevant Sector Risk Management Agency. Each agreement shall assign responsibility for intake, referral, and response for each category of report under this Act, and shall establish a procedure to resolve disputes between agencies within 14 days. Until an agreement takes effect, reports are received, routed, and given a reasoned disposition under sections 204(e), 204(i), and 1004(b), and an acute warning shall be acted on promptly under existing authority or authority expressly provided in this Act and shall not be held pending an agreement or the product of an assessor.
(b) SECTOR JURISDICTION PRESERVED.—Sector regulators retain their jurisdiction over particular uses of artificial intelligence within their sectors. Nothing in this Act limits any authority of another agency under any other provision of law.
(c) TRANSFER OF EVALUATION FUNCTIONS.—
(1) PLAN.—Not later than 180 days after the date of enactment of this Act, the Administrator and the Director of the National Institute of Standards and Technology shall jointly publish a transition plan identifying the functions, personnel, records, contracts, and testing and security capacity of the Center for AI Standards and Innovation of the National Institute of Standards and Technology, or any successor organization, that are to be transferred to the Administration, and the functions that the National Institute of Standards and Technology will retain, including the development of measurement science and voluntary standards.
(2) TRANSFER.—The functions identified for transfer shall transfer to the Administration on the dates specified in the plan, which shall be not later than 2 years after the date of enactment of this Act. Personnel transferred under this subsection shall be transferred in accordance with applicable law relating to the transfer of functions.
(3) CONTINUITY.—The plan shall include lawful arrangements for continuity of incident intake and handling during the transfer. Those arrangements are planning and response duties and do not guarantee uninterrupted operation.
(4) TRANSFER TERMS.—Upon each transfer under paragraph (2), the personnel, assets, liabilities, contracts, property, records, and unexpended balances of appropriations, authorizations, allocations, and other funds employed, held, used, arising from, available to, or to be made available in connection with the functions transferred shall be transferred to the Administration, subject to section 1531 of title 31, United States Code. Unexpended balances so transferred shall be used only for the purposes for which they were originally authorized and appropriated. Functions not identified for transfer, including the development of measurement science and voluntary standards, remain with the National Institute of Standards and Technology.
(5) COST REPORTING.—The Administrator shall report the costs of transferred functions separately from the incremental costs of the Administration.
SEC. 105. TECHNICAL ADVISORY COUNCIL.
(a) ESTABLISHMENT.—The Administrator shall establish a Technical Advisory Council of not more than 15 members, appointed by the Administrator for staggered terms of 3 years, including independent assessors, academic researchers, representatives of affected communities and of users, representatives of smaller developers, and representatives of covered developers.
(b) LIMITS.—The Council is advisory and has no vote on any action of the Administration. Each member shall disclose the member's employer, clients during the preceding 2 years, and financial interests relevant to the work of the Council. No member may participate in any matter involving the member's employer, such a client, or a person in which the member has a financial interest, or in any other matter in which the member has a conflict of interest under applicable law. Protected information shall be provided to members only under protections equivalent to those in section 208. Participation in the Council is not endorsement of any action of the Administration. No regulated person or class of persons has a veto over any action of the Administration.
(c) FACA.—Chapter 10 of title 5, United States Code, applies to the Council, except that the Council shall not terminate under section 1013 of that title.
SEC. 106. PUBLICATION AND TRANSPARENCY.
(a) FINDINGS AND DETERMINATIONS.—The Administrator shall publish, not later than 30 days after taking any final action under title II, a redacted statement of the action and its basis.
(b) EMERGENCY RESTRAINT.—Publication with respect to a compelled restriction is governed by section 206(g).
(c) MISSED DEADLINES.—The Administrator shall publish, not later than the 15th day of each month, a list of each deadline imposed on the Administration by this Act that was missed during the preceding month, with the reason. Publication does not cure the missed deadline.
(d) REDACTIONS.—
(1) PERMITTED GROUNDS.—The Administrator may redact from any publication under this Act only—
(A) classified information;
(B) details of an exploitable vulnerability or attack method that is not yet mitigated;
(C) trade secrets and commercial or financial information that is privileged or confidential within the meaning of section 552(b)(4) of title 5, United States Code; and
(D) personal information the disclosure of which would constitute a clearly unwarranted invasion of personal privacy.
(2) DOCUMENTATION AND REVIEW.—Each redaction shall be documented with its ground. The Administrator shall review each redaction not later than 180 days after it is made and every 180 days thereafter, and shall release redacted material when the ground no longer applies. Material withheld under subparagraph (B) or (C) of paragraph (1) shall be released not later than 1 year after the original publication unless the Administrator makes a renewed written finding that the ground continues to apply. Before releasing material withheld under subparagraph (C), the Administrator shall give the submitter not less than 30 days' written notice and an opportunity to object, and, except as provided in the following sentence, shall not release the disputed material while a timely objection is pending review under section 903, which the court shall decide expeditiously. A pending objection does not by itself prohibit publication of segregable information that is not lawfully protected, or a necessary timely warning in a form that protects the disputed material; the court may order protection or a stay. Where safe, the Administrator shall give the submitter notice before publishing such a warning. A renewed finding under this paragraph shall state specific reasons.
(3) NO VETO ON WARNINGS.—An opportunity given to any person to correct a draft publication shall not delay an urgent public warning.
(e) OVERSIGHT ACCESS.—The Inspector General, the Comptroller General, and the committees of jurisdiction shall have secure access to unredacted material, subject to appropriate security procedures.
(f) ANNUAL REPORT.—The Administrator shall submit to Congress and publish an annual report that includes minimized statistics on reports received, dispositions and their timeliness, assessments, conditions, compelled restrictions and their durations, lapses and continuations, judicial outcomes, backlog, privacy and security failures, missed incidents identified after the fact, compliance burden, and validated outcomes, with a statement of uncertainty.
SEC. 107. CONFORMING AMENDMENTS.
(a) EXECUTIVE SCHEDULE.—
(1) LEVEL II.—Section 5313 of title 5, United States Code, is amended by adding at the end the following:
"Administrator, AI Security Administration.".
(2) LEVEL III.—Section 5314 of title 5, United States Code, is amended by adding at the end the following:
"Principal Deputy Administrator, AI Security Administration.".
(b) INSPECTOR GENERAL.—Section 401 of title 5, United States Code, is amended—
(1) in paragraph (1), by striking "the National Security Agency, or the National Reconnaissance Office" and inserting "the National Security Agency, the National Reconnaissance Office, or the AI Security Administration"; and
(2) in paragraph (3), by striking "or the Director of the National Reconnaissance Office;" and inserting "the Director of the National Reconnaissance Office; or the Administrator of the AI Security Administration;".
TITLE II—FRONTIER ARTIFICIAL INTELLIGENCE SAFETY AND SECURITY
SEC. 201. COVERAGE.
(a) COMPUTE SCREEN.—
(1) INITIAL SCREEN.—A model or operated system meets the compute screen if it was trained using a quantity of computing power greater than 10^26 integer or floating-point operations.
(2) MEASUREMENT.—Operations attributable to training are counted once under a methodology the Administrator shall publish by rule, aggregated across coordinated training runs, relevant derivatives, and persons under common control. Training compute and inference-time compute shall be measured and reported separately, and an equal count of each shall not be treated as equal risk.
(3) ADJUSTMENT.—The Administrator may raise or lower the threshold in paragraph (1) by rule, on published evidence of the relationship between computing power and covered capabilities. The threshold is a policy screen that triggers coverage and the duties that follow from coverage. Meeting it is not a finding that a system is a Tier 2 system, and not meeting it is not a finding that a system is safe.
(4) NOTIFICATION.—A person that begins a training run it reasonably expects to meet the compute screen shall notify the Administrator not later than 30 days after the run begins, and shall notify the Administrator of its completion not later than 30 days after completion, in the form the Administrator prescribes by rule.
(b) DESIGNATION.—
(1) AUTHORITY.—The Administrator may designate a model or operated system as a covered system, regardless of the computing power used to train it, on a written finding supported by evidence that the system, in a specified configuration, has a covered capability or covered access that presents a high-consequence pathway to serious harm.
(2) CONTENTS.—A designation shall state its precise scope, its reasons, its duration, and the conditions for reassessment, and is subject to review under section 903.
(3) VIEWPOINT.—The lawful viewpoint of a person, or of the lawful outputs of its systems, shall not be a ground for designation.
(4) DIRECTION TO ASSESS.—A direction to assess under section 202(b)(7) is distinct from a condition under section 203(d) and from a compelled restriction under section 206. The lower threshold for a direction to assess does not authorize a condition or a compelled restriction.
(5) RATIONALE.—For each designation, the Administrator shall publish the causal and access rationale, with its uncertainty, subject to section 106(d).
(c) DERIVATIVES AND ASSEMBLED SYSTEMS.—A derivative, fine-tuned, or assembled system is a covered system if it retains or creates the covered pathway, under the applicable criterion of subsection (a) or (b). Lineage alone is not proof that a system is a Tier 2 system. The failure of the Administrator to assess a system is not evidence that the system is safe.
(d) CAPABILITY RULES.—
(1) IN GENERAL.—Not later than 1 year after the date of enactment of this Act, the Administrator shall issue rules, after notice and opportunity for comment under section 553 of title 5, United States Code, establishing—
(A) published and reproducible assessment criteria for each covered capability, with the causal and access rationale and its uncertainty;
(B) the criteria for a Tier 2 signal;
(C) a high-consequence criterion for each pathway described in section 3(10)(A)(i) and (ii);
(D) objective triggers for material modification;
(E) the rules required by section 204(a)(2)(B)(i), section 204(c)(1)(A), and section 204(c)(2), and any rules clarifying section 204(a)(3)(F), which may clarify but not narrow it;
(F) the closed list under section 203(b)(1); and
(G) the standards under section 205(c) and (g), except that the standards under section 205(c) shall be issued not later than 180 days after the date of enactment of this Act.
(2) FAILURE TO ISSUE.—The duty in paragraph (1) is a discrete, nondiscretionary duty enforceable under section 906. A failure to issue a rule does not suspend any duty that this Act imposes directly.
(3) FLOORS.—The rules may not narrow the categories of serious harm in section 3(23), the categories of covered capability in section 3(10), or any duty imposed by this Act.
(4) REVIEW.—The Administrator shall review the rules not less than once every 2 years and shall publish the review.
(e) OPEN RELEASES.—Nothing in this Act creates a registry of persons who download publicly released model weights, or imposes a duty on a person solely because that person downloads or uses publicly released weights of a system that is not a Tier 2 system.