,i #aai? ,,congress #b;d ,session ,h4 ,r4 #ajahi ,,9 ,,! ,,h\se ,,( ,,repres5tatives ,augu/ #ca1 #bjbf,ms4 ,jacobs 7= h]self1 ,mr4 ,moran1 & ,mr4 ,:itesides7 introduc$ ! foll[+ bill2 :i* 0 ref]r$ to ! ,committee on ,arm$ ,s]vices ,a ,,bill ,to am5d title #aj1 ,unit$ ,/ates ,code1 to direct ! ,secret>y ( ,def5se to e/abli% an artificial intellig5ce incid5t & vuln]ability report+ program1 & = o!r purposes4 #a4 ,%ort title ,?is ,act may be cit$ z ! ,def5se ,,ai ,reliability & ,report+ ,act4 #b4 ,dep>tm5t ( ,def5se ,,ai incid5t & vuln]ability report+ program ,*apt] #aca ( title #aj1 ,unit$ ,/ates ,code1 is am5d$ by ins]t+ aft] section #bbbd;a ! foll[+ new section3 #bbbd;b4 ,artificial intellig5ce incid5t & vuln]ability report+ program 7a7 ,9 g5]al ,! ,secret>y ( ,def5se %all e/abli% a c5traliz$ ,dep>tm5t-wide program = ! report+1 track+1 analysis1 & rem$iation ( cov]$ ,,ai incid5ts & cov]$ ,,ai vuln]abilities aris+ f ! developm5t1 te/+1 procurem5t1 field+1 or op]ation ( artificial intellig5ce sy/ems )9 ! ,dep>tm5t ( ,def5se4 7b7 ,purpose ,! purpose ( ! program e/abli%$ "u subsection 7a7 %all be to-- 7#a7 id5tify recurr+ risks1 failure modes1 vuln]abilities1 & sy/emic weaknesses 9 artificial intellig5ce sy/ems1 includ+ risks or failure modes aris+ f human-ma*9e team+2 7#b7 support mitigation ( significant risks2 & 7#c7 in=m te/+1 procurem5t1 cyb]security1 & deploym5t decisions to improve ! safety1 security1 reliability1 & op]ational effectiv5ess ( su* sy/ems4 7c7 ,requirem5ts = program ,! program %all-- 7#a7 be design$ us+ practices drawn f e/abli%$ safety incid5t report+ programs1 vuln]ability disclosure programs1 & programs to id5tify & develop lessons le>n$2 7#b7 emphasize non-punitive report+1 protection ( s5sitive & propriet>y in=mation1 & dissem9ation ( lessons le>n$1 z appropriate2 & 7#c7 include a me*anism to enable timely access to & %>+ ( relevant logs1 sy/em data1 & model in=mation z necess>y to support analysis & response4 7d7 ,designation ( (ficial ,! ,secret>y %all designate an appropriate (ficial = ! report+1 track+1 analysis1 & rem$iation ( cov]$ ,,ai incid5ts & cov]$ ,,ai vuln]abilities "u ?is section4 ,! ,secret>y1 act+ ?r\gh su* (ficial1 %all receive & /&>dize reports1 conduct tr5d analysis1 id5tify recurr+ risks & failure modes1 & issue guidance1 al]ts1 & recomm5dations1 z appropriate4 7e7 ,report+ & categorization 7#a7 ,! ,secret>y %all require prompt report+ to ! (ficial designat$ "u subsection 7d7 (-- 7,a7 any cov]$ ,,ai incid5t2 & 7,b7 any cov]$ ,,ai vuln]ability4 7#b7 ,! ,secret>y1 act+ ?r\gh ! (ficial1 %all categorize ea* incid5t or vuln]ability report$ to ! (ficial accord+ to :e!r ! incid5t or vuln]ability requires-- 7,a7 a ,dep>tm5t-wide response2 7,b7 a response at ! program level2 or 7,c7 a response at a local level4 7f7 ,dep>tm5t-,wide & program-,level matt]s 7#a7 ,9 ! case ( any incid5t or vuln]ability categoriz$ "u subsection 7e77#b77;,a7 or 7,b71 ! ,secret>y1 act+ ?r\gh ! (ficial designat$ "u subsection 7d71 %all coord9ate any responses t ! ,secret>y consid]s appropriate1 su* z rem$iation1 rete/+1 mitigation measures1 or deploym5t re/rictions4 7#b7 ,9 addition1 9 ! case ( any incid5t or vuln]ability describ$ 9 subsection 7e77#b77;,a71 ! ,secret>y1 act+ ?r\gh ! (ficial1 %all require-- 7,a7 a docum5t$ corrective action plan2 & 7,b7 validation t ! mitigation measures1 if any1 9 su* plan h be5 implem5t$ be=e cont9u$ op]ational use4 7g7 ,protection ( reports 7#a7 ,! ,secret>y %all e/abli% a protect$ disclosure process1 in=m$ by e/abli%$ vuln]ability disclosure practices1 ?r\gh :i* memb]s ( ! ,arm$ ,=ces1 civilian employees1 contractors1 & subcontractors at any ti] may report cov]$ ,,ai incid5ts & cov]$ ,,ai vuln]abilities 9 good fai?4 7#b7 ,! ,secret>y %all ensure t a p]son mak+ a report 9 good fai? "u p>agraph 7#a7 is n1 on ! basis ( t report alone1 subject to adv]se contract action1 subject to adv]se p]sonnel action1 or o!rwise retaliat$ aga9/ by ! ,dep>tm5t4 7h7 ,protection ( in=mation ,! ,secret>y %all e/abli% proc$ures to protect s5sitive1 propriet>y1 & classifi$ in=mation submitt$ ?r\gh ! protect$ disclosure process "u subsection 7g74 7i7 ,annual report 7#a7 ,9 ea* ( ye>s #bjbg ?r\gh #bjca1 ! ,secret>y %all submit to ! congressional def5se committees an annual report on ! program4 ,! report %all include-- 7,a7 ! numb] ( reports made ( incid5ts & vuln]abilities & ! categorizations ( su* reports2 7,b7 a summ>y ( significant tr5ds1 recurr+ risks1 sy/emic issues1 & corrective actions tak5 9 response2 7,c7 9 ! case ( any cov]$ ,,ai incid5t result+ 9 ! loss ( life (1 or 9 bodily h>m to1 a memb] ( ! ,army1 ,navy1 ,m>9e ,corps1 ,air ,=ce1 or ,space ,=ce-- 7i7 a description ( ! incid5t1 includ+ ! sy/em or sy/ems involv$ & ! op]ational context2 7ii7 ! date & "t ! incid5t occurr$2 7iii7 an assessm5t ( ! cause & op]ational consequ5ce ( ! incid5t2 & 7iv7 any corrective actions tak52 & 7,d7 any recomm5dations = *anges to te/+1 procurem5t1 cyb]security1 or deploym5t policies relat+ to artificial intellig5ce sy/ems4 7#b7 ,ea* report "u ?is subsection %all be submitt$ 9 unclassifi$ =m b may include a classifi$ annex4 7j7 ,def9itions ,9 ?is section3 7#a7 ,! t]m artificial intellig5ce has ! mean+ giv5 su* t]m 9 section #ejjb ( ! ,national ,artificial ,intellig5ce ,initiative ,act ( #bjbj 7#ae ,u4,s4,c4 #idja74 7#b7 ,! t]m cov]$ ,,ai incid5t means an ev5t 9 :i* an artificial intellig5ce sy/em-- 7,a7 causes un9t5d$ op]ational1 safety1 or security h>m2 7,b7 op]ates outside au?oriz$ p>amet]s or approv$ safety1 legal1 or mission gu>drails2 7,c7 mat]ially degrades mission p]=mance or reliability 9 a real-_w or op]ationally repres5tative environm5t2 7,d7 fails to respond to an op]ator dis5gage comm&2 7,e7 op]ates 9 a mann] t1 "u reasonably =eseeable circum/ances1 c\ld h result$ 9 significant un9t5d$ op]ational1 safety1 or security h>m2 or 7,f7 op]ates 9 a mann] t raises conc]ns reg>d+ sy/em control & autonomy4 7#c7 ,! t]m cov]$ ,,ai vuln]ability means an exploitable weakness1 vuln]ability1 or sy/emic issue 9 an artificial intellig5ce sy/em or relat$ compon5t t c\ld mat]ially affect mission p]=mance1 compromise sy/em integrity1 create safety risk1 or result 9 unau?oriz$ or un9t5d$ behavior4 4