Database for artificial intelligence security and safety incidents and risks

(a) Voluntary tracking of artificial intelligence security and artificial intelligence safety incidents (1) Voluntary submissions Not later than 1 year after the date of the enactment of this Act, the Director of the National Institute of Standards and Technology shall, in coordination with the Director of the Cybersecurity and Infrastructure Security Agency, establish mechanisms by which private sector entities, public sector organizations, civil society groups, and academic researchers may voluntarily share information with the National Institute of Standards and Technology on confirmed or suspected artificial intelligence security or artificial intelligence safety incidents, in a manner that preserves confidentiality of any affected party, which shall— (A) leverage, to the greatest extent possible, standardized disclosure and incident description formats; (B) develop processes to associate reports pertaining to the same incident with a single incident identifier; (C) establish classification, information retrieval, and reporting mechanisms that sufficiently differentiate between artificial intelligence security incidents and artificial intelligence safety incidents; and (D) create appropriate taxonomies to classify incidents based on relevant characteristics, impact, or other relevant criteria. (2) Publicly accessible database (A) Establishment of database required Not later than 1 year after the date of the enactment of this Act, the Director of the Institute shall, in coordination with the Director of the Cybersecurity and Infrastructure Security Agency, establish a publicly accessible database of artificial intelligence security incidents and artificial intelligence safety incidents. (B) Review and population of database Upon receipt of relevant information on an artificial intelligence security or artificial intelligence safety incident under paragraph (1), the Director of the Institute shall review the information and determine whether the described incident constitutes an artificial intelligence security or artificial intelligence safety risk appropriate for inclusion in the database developed and established under subparagraph (A). (C) Identification of causal factors When making a determination under subparagraph (B), the Director of the Institute shall identify causal factors for the artificial intelligence security incident or the artificial intelligence safety incident, including— (i) the artificial intelligence system; (ii) the deployment of the artificial intelligence systems; and (iii) practices related to the operation of the artificial intelligence system, including misuse of the artificial intelligence system. (D) Priorities In evaluating information under subparagraph (B) and determining under such subparagraph whether to include a report of an incident in the database required by subparagraph (A), the Director shall prioritize inclusion in the database of cases in which a described incident— (i) describes an artificial intelligence system used in critical infrastructure or safety-critical systems; (ii) would result in a high-severity or catastrophic impact to the people or economy of the United States; or (iii) includes an artificial intelligence system widely used in commercial or public sector contexts in the United States. (3) Exemption from disclosure; reports and anonymity (A) Anonymity The Director shall populate the voluntary database developed and established under paragraph (2)(A) with incidents based on public reports and information shared using the mechanism established pursuant to paragraph (1), ensuring that any incident description sufficiently anonymizes those affected, unless those who are affected have consented to their names being included in the database. (B) Exemption from disclosure Any information shared using the mechanism established pursuant to paragraph (1)— (i) shall be exempt from disclosure and withheld, unless an affected party consents to the inclusion of their names in the database as provided for under subparagraph (A), from the public, pursuant to section 552(b)(3)(B) of title 5, United States Code, and any other provision of United States law or law of any State, political subdivision or agency thereof, or Tribe requiring disclosure of information or records; and (ii) shall not be deemed a waiver of any applicable privilege or protection, including trade secret protection. (C) Consultation required Before publishing information regarding artificial intelligence safety incident under paragraph (2)(B), the Director shall consult with the developer or provider of the artificial intelligence system involved in an incident. (b) Material risk guidance Not later than 180 days after the date of the enactment of this Act the Director of the National Institute of Standards and Technology shall, in coordination with the Director of the Cybersecurity and Infrastructure Security Agency, publish nonbinding guidance that provides illustrative criteria and examples for determining when an event materially increases a risk for purposes of paragraphs (3) and (4) of section 2.