Rulemaking

(a) Procedure Each regulation prescribed under this Act shall be prescribed in accordance with section 553 of title 5, United States Code. (b) Framework requirements (1) Deadline Not later than 180 days after the date of enactment of this Act, the Under Secretary shall issue, and thereafter update as appropriate, regulations establishing minimum requirements for frontier AI frameworks. (2) Contents Regulations issued under this subsection shall, at a minimum, address each of the requirements of section 4(a). (3) Periodic review The Under Secretary shall review the regulations issued under this subsection not less frequently than once every year, and shall update such regulations as the Under Secretary determines to be necessary or appropriate. (c) IVO licensing and oversight Not later than 180 days after the date of enactment of this Act, the Under Secretary shall prescribe regulations necessary to carry out the licensing and oversight of IVOs under section 5, which shall include the following: (1) Conflict-of-interest and funding-transparency requirements, including reporting requirements regarding the IVOs’ funding sources and revenue generation and self-audit requirements regarding the IVOs’ personnel and leadership to ensure adequate independence from the artificial intelligence industry. (2) Procedures and requirements for entities to apply for licensure as an IVO, including the following: (A) Procedures and requirements for the applicant to submit a plan to the Under Secretary detailing— (i) the benchmarks, technologies, metrics, and methodologies the applicant proposes using to assess the adequacy of the frontier developer’s frontier AI framework, governance policies and practices, risk-monitoring, and mitigation of detected risks, to ensure acceptable levels of catastrophic risk mitigation; (ii) the applicant’s proposed procedure for prescribing and assessing implementation of corrective action to remedy any identified deficiency in achieving acceptable levels of catastrophic risk mitigation; (iii) the applicant’s proposed methodology for ensuring that the benchmarks, technologies, metrics, and methodologies proposed in clause (i) keep pace with technological and organizational changes in frontier model development; (iv) any subcontractors that the applicant proposes to use to carry out its responsibilities under this Act; and (v) the technical qualifications of the personnel the applicant proposes to use to conduct assessments and of any subcontractor the applicant plans to engage under subsection (d) of section 5 to perform any portion of an assessment. (B) Findings required for the Under Secretary to license an applicant as an IVO, including— (i) that the applicant has demonstrated its independence from the artificial intelligence industry; and (ii) that every element of the applicant’s plan is adequate to ensure that frontier models assessed by the IVO achieve acceptable levels of catastrophic risk mitigation. (C) Findings that require the Under Secretary to revoke an IVO’s license, including— (i) that the IVO’s plan is materially misleading or inaccurate; (ii) that the IVO fails to adhere to its plan in a manner that materially impairs its ability to fulfill its responsibilities; (iii) that a material change compromises the IVO’s independence from the artificial intelligence industry; (iv) that models verified by the IVO fail to achieve or have failed to achieve acceptable levels of catastrophic risk mitigation, unless the IVO demonstrates that— (I) the IVO identified the relevant failure, deficiency, or material weakness in an assessment report submitted under subsection (f) of section 5 or a supplemental report submitted under subsection (i) of such section, and recommended corrective actions adequate to achieve acceptable levels of catastrophic risk mitigation; and (II) such failure is attributable to the very large frontier developer’s failure to implement such corrective actions, and not to any deficiency in the IVO’s assessment, methods, or performance of its obligations under section 5; (v) that evolution of technology renders the IVO’s methods obsolete for verifying acceptable mitigation of catastrophic risk; and (vi) that the IVO has failed to comply with its obligations under section 5. (D) Procedures for the formation of expert panels with respect to one or more specific catastrophic risks to advise the Under Secretary on the issuance and revocation of IVO licenses. (3) Minimum requirements for assessments, taking into account relevant approaches, best practices, frameworks, and methods. (4) Provisions regarding circumstances mandating corrective action or loss of license. (5) Rules regarding the submission and processing of assessment reports, including a secure method for submission of assessment reports under subsection (f), subsection (g), and subsection (i) of section 5 and other sensitive information, and a process for securely processing sensitive information and protecting trade secrets. (6) Any other rules reasonably necessary to the administration of the IVO oversight and licensing regime described in section 5. (d) Modification criteria Not later than 180 days after the date of enactment of this Act, the Under Secretary shall prescribe regulations establishing criteria for determining whether a modification to a frontier model constitutes a substantial modification within the meaning of subsection (t) of section 2, and whether a modification to a frontier AI framework constitutes a material modification within the meaning of subsection (p) of section 2. (e) Procedures for reports, redactions, and State opt-In The Under Secretary may prescribe regulations establishing— (1) the approaches, formats, and procedures applicable to publications, reports, and submissions required under sections 4 and 5; (2) procedures applicable to redactions made under subsection (f) of section 4 and subsection (m) of section 5, including standards for justifications required under subsection (f)(2) of section 4 and subsection (m)(2) of section 5; and (3) the form, manner, and procedures applicable to the opt-in by State Attorneys General under subsection (i) of section 4 and subsection (k) of section 5, including the secure transmission to opted-in State Attorneys General of the reports and referrals covered by such opt-ins. (f) Updates to coverage thresholds (1) Authority The Under Secretary may by regulation increase— (A) the threshold quantity of computing power specified in subsection (l) of section 2; or (B) the threshold amounts of gross revenues and AI-related development expenditures specified in subsections (o) and (v) of section 2. (2) Criteria The Under Secretary shall set each threshold at the level the Under Secretary determines is best calculated to ensure that the terms defined in subsections (k), (l), (o), and (v) of section 2 encompass the artificial intelligence models and developers whose activities present catastrophic risk, and do not encompass those whose activities do not, taking into account advances in algorithmic and hardware efficiency, changes in the cost of developing and training foundation models, inflation, and the anticipated effect of the modification on the entities subject to sections 5 and 6. (3) Periodic review Not less frequently than once every 2 years, the Under Secretary shall review the thresholds described in paragraph (1), determine whether an increase is warranted, and publish the determination and its basis on a website of the Department of Commerce. (4) Prospective application A regulation prescribed under this subsection shall take effect not earlier than 180 days after publication in final form and shall apply only with respect to obligations arising on or after its effective date.