Federal Register Doc. No. 2024-01580. Taking Additional Steps To Address the National Emergency With Respect to Significant Malicious Cyber-Enabled Activities

• Authority: Department of Commerce
• Parent authority: Federal government
• Jurisdiction: United States
• Collections: U.S. regulations, executive orders, and agency policies
• Most recent activity: Proposed
• Most recent activity date: 2024-04-29

Risk subdomain coverage

Good coverage — Comprehensive governance measures or mitigations with clear procedures relating to the risk subdomain are explicitly described.

• AI system security vulnerabilities
• Cyberattacks, weapon development or use
• AI possessing dangerous capabilities

Minimal coverage — Brief mention but no specific mitigations, recommendations or governance measures relating to the risk subdomain are described.

• Disinformation, surveillance, and influence at scale
• Fraud, scams, and targeted manipulation
• Competitive dynamics
• AI pursuing its own goals

All other risk subdomains had no coverage in this document.

Risk Coverage Summary

The document has good coverage of approximately 6-8 subdomains, with strong focus on malicious actors (4.1, 4.2, 4.3), AI system security (2.2), competitive dynamics (6.4), and AI safety failures (7.2, 7.3). Coverage is concentrated in security, misuse prevention, and governance domains related to preventing malicious use of AI infrastructure.

Sector coverage

Good coverage — Comprehensive governance measures or mitigations with clear procedures relating to the sector are explicitly described.

• Information
• National Security

Minimal coverage — Brief mention but no specific mitigations, recommendations or governance measures relating to the sector are described.

• Scientific Research & Development Services

All other sectors had no coverage in this document.

Sectors Summary

The document primarily governs the Information sector, specifically Infrastructure as a Service (IaaS) providers that offer computing infrastructure. It also has implications for National Security through its focus on preventing malicious cyber-enabled activities by foreign actors.

Legislative Status

Hard Law

Legislative Status Summary

This is a binding federal regulation issued by the Department of Commerce with explicit enforcement mechanisms, civil and criminal penalties, and mandatory compliance requirements for U.S. IaaS providers.

Actors

Proposer

• Entity Types: AI_Governance_Actor
• Summary: The document is a Federal Register notice issued by the Department of Commerce establishing regulatory requirements. The Under Secretary of Commerce for Industry and Security, Alan F. Estevez, is listed as the issuing authority.

Target

• Entity Types: AI_Infrastructure_Provider
• Summary: The regulation explicitly targets U.S. IaaS providers and their foreign resellers, requiring them to implement Customer Identification Programs and report on AI training activities. The document defines these entities and establishes comprehensive obligations for them.

Enforcer

• Entity Types: AI_Governance_Actor
• Summary: The Department of Commerce has explicit authority to conduct compliance assessments, impose special measures, request information, and impose civil penalties. Criminal enforcement occurs through U.S. district courts.

Monitor

• Entity Types: AI_Governance_Actor
• Summary: The Department of Commerce conducts ongoing compliance assessments and reviews submitted certifications. Other agencies are consulted for special measures and exemption determinations, providing oversight and monitoring functions.

AI Lifecycle Stages

Lifecycle stages covered by the documents, as defined in the OECD Framework for the Classification of AI Systems

• Build and Use Model
• Operate and Monitor

AI Lifecycle Summary

The document primarily focuses on the Build and Use Model stage (training of large AI models) and the Operate and Monitor stage (ongoing verification and monitoring of IaaS accounts). It does not substantially cover planning, data collection, verification/validation, or deployment stages.

Technical Scope

Terms relating to technical scope that are mentioned or implicitly referenced in the document

• AI Models
• Foundation Models
• AI Systems
• Compute Threshold
• Generative AI

Technical Scope Summary

The document explicitly mentions AI models, AI systems, dual-use foundation models, and generative AI. It establishes compute thresholds through reference to interpretive rules and addresses training of large AI models. It does not explicitly mention general purpose AI, task-specific AI, predictive AI, or open-weight models.