Review of artificial intelligence security vulnerabilities under vulnerabilities equities process

(a) Definitions In this section: (1) Appropriate congressional committees The term appropriate congressional committees means— (A) the Select Committee on Intelligence of the Senate; (B) the Committee on Homeland Security and Governmental Affairs of the Senate; (C) the Committee on the Judiciary of the Senate; (D) the Committee on Armed Services of the Senate; (E) the Permanent Select Committee on Intelligence of the House of Representatives; (F) the Committee on Homeland Security of the House of Representatives; (G) the Committee on the Judiciary of the House of Representatives; and (H) the Committee on Armed Services of the House of Representatives. (2) Vulnerabilities equities Policy and Process document The term Vulnerabilities Equities Policy and Process document means the executive branch document entitled Vulnerabilities Equities Policy and Process for the United States Government dated November 15, 2017. (3) Vulnerabilities equities process The term Vulnerabilities Equities Process means the interagency review of vulnerabilities carried out pursuant to the Vulnerabilities Equities Policy and Process document or any successor document. (b) Evaluation; report Not later than 90 days after the date of the enactment of this Act, the Federal departments and agencies participating in the Vulnerabilities Equities Process shall— (1) evaluate whether the existing Vulnerabilities Equities Process sufficiently accommodates the submission and review of artificial intelligence security vulnerabilities; and (2) submit to the appropriate congressional committees a report describing the applicability of the Vulnerabilities Equities Process to such vulnerabilities, including whether the submission and review of such vulnerabilities under the Vulnerabilities Equities Process would result in an unduly large volume of notifications to affected vendors and, if so, an assessment of mechanisms to manage the volume of such notifications. (c) Process In carrying out subsection (b), if the Federal departments and agencies participating in the Vulnerabilities Equities Process determine that the existing Vulnerabilities Equities Process does not sufficiently accommodate the submission and review of artificial intelligence security vulnerabilities identified by the evaluation required in subsection (b)(1), and that such vulnerabilities present public interest considerations meriting review under the Vulnerabilities Equities Process, the Federal departments and agencies participating in the Vulnerabilities Equities Process shall establish a process for the submission and review of such vulnerabilities under the Vulnerabilities Equities Process not later than 30 days after the date of such determination. (d) Report on vulnerabilities identified by artificial intelligence systems Not later than 90 days after the date of the enactment of this Act, the Director of National Intelligence shall submit to the congressional intelligence committees (as defined in section 3 of the National Security Act of 1947 (50 U.S.C. 3003)) a report on— (1) the volume of vulnerabilities of information systems identified by artificial intelligence systems; (2) the impact of any change in such volume on the functioning of the Vulnerabilities Equities Process; and (3) whether the increasingly rapid discovery and exploitation of such vulnerabilities by external cyber actors using artificial intelligence systems materially alters the equity of disclosure.