,i #aaith ,,congress #b;d ,session ,h4 ,r4 #idgg ,,in ,,the ,,house ,,of ,,representatives ,june #be1 #bjbf,mr4 ,moran introduced the following bill2 which was referred to the ,committee on ,energy and ,commerce ,a ,,bill ,to require certain artificial intelligence model developers to submit reports to the ,secretary of ,commerce1 and for other purposes4 #a4 ,short title ,this ,act may be cited as the ,,ai ,incident ,reporting ,act4 #b4 ,requirement to report ,,ai incidents 7a7 ,designation of covered models2 guidelines and regulations 7#a7 ,designation of covered models and entities ,not later than #ahj days after the date of the enactment of this section1 the ,secretary1 in consultation with1 as appropriate1 the heads of relevant agencies as determined by the ,secretary1 artificial intelligence model developers1 other relevant private-sector entities1 academic1 technical1 cybersecurity1 national security1 and public safety experts1 and such other outside experts as the ,secretary determines to be appropriate1 shall promulgate regulations that-- 7,a7 establish capability or other thresholds that determine which artificial intelligence models and model developers could pose significant risks to the national security of the ,united ,states or to public safety2 and 7,b7 designate such developers as covered model developers and such models as covered models for purposes of this section4 7#b7 ,coordination ,the ,secretary may coordinate with the heads of other agencies1 as determined appropriate by the ,secretary1 to identify reportable activity and to receive1 analyze1 and act upon reports submitted under this section4 7#c7 ,guidelines and regulations 7,a7 ,in general ,not later than #ahj days after the date of the enactment of this ,act1 the ,secretary shall issue guidelines for covered model developers to be in compliance with the requirements of this ,act and may promulgate regulations as are necessary to carry out this ,act4 7,b7 ,requirements for regulations ,in establishing regulations and requirements under this subsection1 the ,secretary shall ensure1 to the maximum extent practicable1 that the regulations and requirements-- 7i7 clearly describe the categories of information that must be reported under this section2 7ii7 minimize unnecessary ambiguity1 duplication1 and undue reporting burden2 and 7iii7 establish clear1 secure1 and straightforward mechanisms for submission of reports4 7,c7 ,thresholds ,in establishing thresholds under paragraph 7#a71 the ,secretary shall give particular weight to whether a model has the capability to engage in1 or presents a significant risk of1 reportable activity described in subsection 7b77#b74 7b7 ,reporting requirement 7#a7 ,in general ,not later than #g days after the date on which a covered model developer knows1 or reasonably believes1 that reportable activity described in paragraph 7#b7 has occurred related to a covered model1 the developer shall submit to the ,secretary a report that contains a detailed description of the activity4 7#b7 ,reportable activity ,for purposes of this section1 reportable activity is any of the following3 7,a7 ,behavior expressing that the model is attempting to evade human oversight1 deceive evaluators or operators1 circumvent safeguards1 resist shutdown or modification1 obtain unauthorized access to tools1 systems1 or privileges1 or otherwise undermine the ability of human operators to reliably control the model1 but does not include behavior elicited solely through an evaluation designed to elicit such behavior1 in which the model is not in production deployment and the behavior is not indicative of analogous behavior in deployment4 7,b7 ,unauthorized access to1 theft of1 or attempted theft of model weights that the developer reasonably assesses had a credible prospect of obtaining1 evidence that model weights have been exfiltrated or materially compromised1 or behavior suggesting that a model is autonomously attempting to exfiltrate model weights without authorization or otherwise facilitate unauthorized transfer of model weights or related model artifacts outside of a testing environment4 7,c7 ,capabilities that could materially enable or accelerate offensive cyber operations against important software1 widely used digital infrastructure1 industrial systems1 or critical infrastructure1 including through the discovery1 exploitation1 chaining1 weaponization1 or operationalization of vulnerabilities at a scale1 speed1 or level of sophistication that could pose serious risks to the national security of the ,united ,states or to public safety4 7,d7 ,evidence that a covered model1 when unprompted1 has demonstrated the ability to materially accelerate or automate the research1 development1 evaluation1 engineering1 or improvement of advanced artificial intelligence systems1 including in ways that could significantly compress timelines for the development or deployment of more capable systems1 where the model developer knows1 or reasonably believes1 that such developments could have serious implications for the national security of the ,united ,states or for public safety4 7,e7 ,capabilities that could materially enable or accelerate the development1 acquisition1 or use of chemical1 biological1 radiological1 nuclear1 or explosive weapons by providing uplift to actors that would not otherwise possess such capabilities at a scale1 speed1 or level of sophistication that could pose serious risks to the national security of the ,united ,states or to public safety4 7,f7 ,any circumstance in which an incident or harm of a type described in subparagraph 7,a71 7,b71 7,c71 7,d71 or 7,e7 was reasonably likely to occur and would have posed a serious risk to the national security of the ,united ,states or to public safety1 but was prevented only because of circumstances unrelated to the safeguards1 controls1 or mitigations of the developer1 such as the conduct of a third party1 the absence of capability or intent on the part of a user1 or other fortuity4 7,g7 ,any other capability1 incident1 or combination of circumstances that the ,secretary determines1 by rulemaking1 appropriate relating to serious harm to the national security of the ,united ,states or to public safety4 7c7 ,timing1 form1 and contents of reports 7#a7 ,initial report ,the ,secretary shall require-- 7,a7 a covered model developer to submit an initial report within such period as the ,secretary determines appropriate and not later than the #g-;day period described in subsection 7b77#a72 and 7,b7 expedited reporting for any reportable activity described in subsection 7b77#b7 that presents any imminent or ongoing risk of serious harm4 7#b7 ,supplemental reports ,the ,secretary shall require a covered model developer to submit supplemental reports as additional material information1 relating to the reportable activity and steps that are being taken to mitigate the risks of the incident1 becomes available4 7#c7 ,required contents ,each report submitted under this subsection shall include1 as applicable and to the extent known at the time of submission1 the following3 7,a7 ,a description of the relevant incident1 behavior1 or capability4 7,b7 ,the date on which1 or approximate period during which1 the covered model developer discovered the relevant information4 7,c7 ,any known or suspected threat actor1 attack vector1 system vulnerability1 safeguard failure1 or other relevant causal or contextual information4 7,d7 ,any known or reasonably suspected implication for the national security of the ,united ,states or for public safety4 7,e7 ,such other information as the ,secretary determines appropriate4 7#d7 ,congressional ,reporting ,not later than #dh hours after receipt of any report submitted under subsection 7b7 that presents an imminent or ongoing risk of serious harm1 and not later than #cj days after receiving any report submitted under paragraph 7#b71 the ,secretary shall inform the following individuals of each such report3 7,a7 ,the ,speaker of the ,house of ,representatives4 7,b7 ,the ,minority ,leader of the ,house of ,representatives4 7,c7 ,the ,chair of the ,committee on ,science1 ,space1 and ,technology of the ,house of ,representatives4 7,d7 ,the ,chair of the ,committee on ,energy and ,commerce of the ,house of ,representatives4 7,e7 ,the ,chair of the ,permanent ,select ,committee on ,intelligence of the ,house of ,representatives4 7,f7 ,the ,majority ,leader of the ,senate4 7,g7 ,the ,minority ,leader of the ,senate4 7,h7 ,the ,chair of the ,committee on ,commerce1 ,science1 and ,transportation of the ,senate4 7,i7 ,the ,chair of the ,committee on ,energy and ,natural ,resources of the ,senate4 7,j7 ,the ,chair of the ,select ,committee on ,intelligence of the ,senate4 7d7 ,protection and use of information 7#a7 ,protection of sensitive information ,not later than #ahj days after the date of the enactment of this section1 the ,secretary shall establish procedures to appropriately protect from unauthorized disclosure any sensitive1 classified1 controlled1 or security-relevant information submitted under this section1 consistent with applicable law4 7#b7 ,exemption from disclosure ,information submitted to the ,secretary under this section is exempt from disclosure under paragraph 7#c77;,b7 of section #eeb7;b7 of title #e1 ,united ,states ,code1 and may not be disclosed under any ,state or local law that requires disclosure of information or records4 7#c7 ,no waiver of privilege or protection ,the submission of information under this section is not a waiver of any applicable privilege or legal protection1 including trade secret protection and any attorney-client and work product privilege4 7#d7 ,restrictions on use 7,a7 ,civil actions and administrative proceedings ,a report submitted under this section1 and any communication or material created for the sole purpose of preparing or submitting such a report1 may not be received in evidence1 subjected to discovery1 or otherwise used in any civil or criminal action or administrative proceeding against the covered model developer that submitted the report1 communications1 or material4 7,b7 ,federal1 ,state1 or local government ,information submitted under this section may not be used by any ,federal1 ,state1 or local government to regulate1 or to bring an enforcement action against1 the covered model developer4 7,c7 ,rule of construction ,nothing in this paragraph may-- 7i7 limit the use of such information by the ,secretary or any other agency to respond to1 mitigate1 or prevent a risk to the national security of the ,united ,states or to public safety2 7ii7 limit use of a report1 or information in the report1 to determine compliance with or enforce the requirements of this section2 or 7iii7 affect the liability of any person for the underlying incident1 conduct1 or capability described in a report in which such liability can be established on the basis of information obtained independently of the report4 7#e7 ,information sharing within ,government ,the ,secretary may share information submitted under this section with other agencies1 including an element of the intelligence community and law enforcement agencies1 where appropriate and consistent with applicable law4 ,any information shared under this paragraph is subject to the protections and use restrictions of this subsection for the agency that receives the information4 7e7 ,good-,faith reporting ,in issuing guidelines and regulations under this section1 the ,secretary shall1 to the maximum extent practicable1 design reporting requirements to facilitate timely reporting of material incidents1 including for a case in which relevant facts are incomplete at the time of initial disclosure1 and shall permit supplemental reporting as additional material information becomes available4 7f7 ,enforcement 7#a7 ,authority of the ,secretary ,to enforce this section1 the ,secretary may-- 7,a7 issue orders1 regulations1 and guidance2 7,b7 require1 inspect1 and obtain books1 records1 reports1 audit materials1 and other information that the ,secretary determines to be relevant or material to determine compliance with1 or violations of1 this section1 from any developer or other person subject to this section2 7,c7 administer oaths or affirmations and1 by subpoena1 require any person to appear1 testify1 and produce books1 records1 reports1 audit materials1 and other materials relevant or material to determine compliance with1 or violations of1 this section1 from any developer or other person subject to this section2 7,d7 conduct investigations within the ,united ,states and1 consistent with applicable law1 outside the ,united ,states2 7,e7 require corrective action1 including the production of omitted records or materials2 and 7,f7 refer a matter to the ,attorney ,general for appropriate civil action1 including to recover a civil penalty assessed under paragraph 7#b7 that remains unpaid1 to enjoin a violation of this section1 or to compel compliance with an order or subpoena issued under this subsection4 7#b7 ,civil penalties 7,a7 ,in general ,after notice and an opportunity for a hearing1 the ,secretary may assess a civil penalty for a violation of this section in an amount not to exceed #b1jjj1jjj4 ,each day of a continuing violation shall constitute a separate offense4 7,b7 ,factors ,in determining the amount of a civil penalty under subparagraph 7,a71 the ,secretary shall consider the nature1 circumstances1 extent1 gravity1 and duration of the violation1 the degree of culpability1 any history of prior violation1 any good faith effort to comply1 any other mitigating factor1 and such other matters as justice may require4 7g7 ,definitions ,in this section3 7#a7 ,agency ,the term agency has the meaning given that term in section #eea of title #e1 ,united ,states ,code4 7#b7 ,artificial intelligence ,the term artificial intelligence includes the following3 7,a7 ,any artificial system that performs tasks under varying and unpredictable circumstances without significant human oversight1 or that can learn from experience and improve performance when exposed to data sets4 7,b7 ,an artificial system developed in computer software1 physical hardware1 or other context that solves tasks requiring human-like perception1 cognition1 planning1 learning1 communication1 or physical action4 7,c7 ,an artificial system designed to think or act like a human1 including cognitive architectures and neural networks4 7,d7 ,a set of techniques1 including machine learning1 that is designed to approximate a cognitive task4 7,e7 ,an artificial system designed to act rationally1 including an intelligent software agent or embodied robot that achieves goals using perception1 planning1 reasoning1 learning1 communicating1 decision making1 and acting4 7#c7 ,covered model ,the term covered model means a model designated by the ,secretary under subsection 7a77#a74 7#d7 ,covered model developer ,the term covered model developer means any person or entity that-- 7,a7 develops or trains a covered model2 or 7,b7 substantially modifies a covered model1 including through fine-tuning or other modification of the weights of the model1 in a manner that the ,secretary determines causes the model to meet a threshold established under subsection 7a77#a74 7#e7 ,model weights ,the term model weights means the parameters1 numerical values1 or other internal artifacts of an artificial intelligence model that are sufficient to reproduce1 substantially reproduce1 or enable the operational use of the model4 7#f7 ,secretary ,the term ,secretary means the ,secretary of ,commerce4 7#g7 ,state ,the term ,state means each of the several ,states1 the ,district of ,columbia1 each commonwealth1 territory1 or possession of the ,united ,states1 and each federally recognized ,indian ,tribe4