Relationship to State laws

(a) Covered subject area For purposes of this section, the term Covered Subject Area means any of the following: (1) Frontier ai risk transparency The disclosure by a developer, to any State, member of the public, or other person, of information regarding— (A) the policies, procedures, frameworks, or practices used by the developer to identify, assess, manage, or mitigate catastrophic risks associated with the development, training, evaluation, or release of an AI model; (B) the results, methodologies, benchmarks, or thresholds of testing, evaluation, or red-teaming of an AI model with respect to catastrophic risks; or (C) the characteristics, capabilities, training, or deployment of an AI model, where the disclosure relates to the assessment, monitoring, communication, or mitigation of catastrophic risks. (2) Frontier ai third-party auditing and independent verification The assessment, audit, evaluation, certification, attestation, or verification, by a person other than its developer, of— (A) activities involved in the development, training, evaluation, or deployment of an AI model by such developer that relate to the identification, assessment, management, or mitigation of catastrophic risks; (B) the policies, procedures, frameworks, or practices of such developer relating to the identification, assessment, management, or mitigation of catastrophic risks; or (C) the compliance of such developer with any requirement relating to the development, training, evaluation, or release of an AI model, if such requirement relates to the mitigation of catastrophic risks, including any requirement that such developer obtain certification, attestation, registration, accreditation, or other approval as a condition of, or in connection with, the development, training, evaluation, or release of an AI model, or that such developer provide access to an AI model, model weights, training data, source code, evaluation results, or other technical materials for purposes of any such assessment, audit, evaluation, or verification. (3) Frontier ai incident reporting The reporting by a developer to any State, agency, regulator, or other governmental entity of— (A) safety or security incidents involving an AI model, including unauthorized access to or exfiltration of model weights, loss of control over a deployed model, use of a model to cause or materially contribute to catastrophic harm, or material failure of a safety mitigation; or (B) other events involving the development, training, evaluation, or release of an AI model that bear on the potential for the model to cause or materially contribute to catastrophic harm. (b) Preemption Except as provided in subsection (c), no State or political subdivision of a State may adopt or enforce any law, regulation, order, or other requirement that imposes new substantive obligations on artificial intelligence developers with respect to any Covered Subject Area. (c) Rule of construction Nothing in this section shall be construed to affect the authority of a State or political subdivision of a State to— (1) adopt or enforce generally applicable laws, regulations, orders, or other requirements that do not target artificial intelligence developers; (2) regulate the use or deployment of AI systems by deployers or users, including via consumer protection, civil rights, contract, criminal, or privacy laws, provided that no substantive obligations are imposed on developers with respect to model development, training, evaluation, or release; (3) adopt or enforce laws, regulations, orders, or other requirements specifically relating to the protection of minors from harms arising from the use of AI systems, including requirements addressing sexually explicit content, content promoting self-harm, content facilitating exploitation, age verification, parental controls, or similar matters; and (4) adopt or enforce laws, regulations, orders, or other requirements governing the procurement or use of AI systems by State governments. (d) Definition In this section, the term artificial intelligence developer means— (1) an entity that builds, designs, codes, produces, trains, or owns an artificial intelligence model or models for internal use or for use by a third party; and (2) does not include an entity that is solely a deployer of the artificial intelligence model.