Secure Artificial Intelligence Act of 2024

• Authority: United States Congress
• Parent authority: Federal government
• Jurisdiction: United States
• Collections: U.S. federal laws
• Most recent activity: Defunct
• Most recent activity date: 2025-01-03

Risk subdomain coverage

Good coverage — Comprehensive governance measures or mitigations with clear procedures relating to the risk subdomain are explicitly described.

• AI system security vulnerabilities
• Cyberattacks, weapon development or use
• Governance failure
• Lack of capability or robustness

Minimal coverage — Brief mention but no specific mitigations, recommendations or governance measures relating to the risk subdomain are described.

• Compromise of privacy
• Competitive dynamics
• AI pursuing its own goals
• AI possessing dangerous capabilities
• Lack of transparency or interpretability

All other risk subdomains had no coverage in this document.

Risk Coverage Summary

The document has good coverage of approximately 6-8 subdomains, with strong focus on AI system security (2.2), malicious actors and cyberattacks (4.2), competitive dynamics (6.4), governance failure (6.5), and AI safety failures (7.1, 7.2, 7.3). Coverage is concentrated in security, vulnerability management, and AI safety incident tracking domains.

Sector coverage

Good coverage — Comprehensive governance measures or mitigations with clear procedures relating to the sector are explicitly described.

• Scientific Research & Development Services
• National Security

Minimal coverage — Brief mention but no specific mitigations, recommendations or governance measures relating to the sector are described.

• Agriculture, Mining, Construction & Manufacturing
• Trade, Transportation & Utilities
• Information
• Finance & Insurance
• Professional & Technical Services
• Health Care & Social Assistance
• Public Administration (excl. National Security)

All other sectors had no coverage in this document.

Sectors Summary

This is an external regulation that applies broadly across all sectors where AI systems are deployed, with particular emphasis on critical infrastructure and safety-critical systems. The document does not limit its scope to specific industries but rather establishes cross-sectoral governance mechanisms for AI security and safety incident tracking.

Legislative Status

Hard Law

Legislative Status Summary

This is a binding legislative act from the United States Congress with mandatory obligations on federal agencies, enforcement mechanisms including whistleblower protections with legal remedies, and specific timelines for implementation.

Actors

Proposer

• Entity Types: AI_Governance_Actor
• Summary: The document is a Congressional bill proposed by the legislative branch of the United States government, as indicated by the opening text and structure.

Target

• Entity Types: AI_Developer, AI_Deployer, AI_Governance_Actor
• Summary: The Act targets multiple entity types: AI developers and deployers who may report incidents voluntarily, federal agencies with mandatory obligations to establish databases and processes, and employers who are prohibited from retaliating against whistleblowers.

Enforcer

• Entity Types: AI_Governance_Actor
• Summary: Multiple federal agencies and officials are designated with enforcement and implementation authority, including NIST Director for database establishment, CISA Director for vulnerability management, Secretary of Labor for whistleblower complaints, and federal courts for legal remedies.

Monitor

• Entity Types: AI_Governance_Actor
• Summary: NIST and CISA Directors are responsible for monitoring and tracking AI security and safety incidents through the voluntary database. Congressional committees receive reports on the sufficiency of vulnerability reporting processes.

AI Lifecycle Stages

Lifecycle stages covered by the documents, as defined in the OECD Framework for the Classification of AI Systems

• Collect and Process Data
• Build and Use Model
• Verify and Validate
• Deploy
• Operate and Monitor

AI Lifecycle Summary

The document primarily addresses the Deploy and Operate and Monitor lifecycle stages through its focus on incident tracking, vulnerability management, and post-deployment security. It also covers Build and Use Model through supply chain risk considerations and Verify and Validate through the establishment of research test-beds for security testing.

Technical Scope

Terms relating to technical scope that are mentioned or implicitly referenced in the document

• AI Models
• AI Systems
• Open Weight / Open Source

Technical Scope Summary

The document explicitly mentions AI systems and AI models throughout, with particular focus on security vulnerabilities and safety incidents. It does not specifically define or distinguish between frontier AI, general purpose AI, task-specific AI, foundation models, generative AI, or predictive AI. There is no mention of compute thresholds or open-weight/open-source models.