AI Incident Reporting and Security Enhancement Act

• Authority: United States Congress
• Parent authority: Federal government
• Jurisdiction: United States
• Collections: U.S. federal laws
• Most recent activity: Defunct
• Most recent activity date: 2025-01-03

Risk subdomain coverage

Good coverage — Comprehensive governance measures or mitigations with clear procedures relating to the risk subdomain are explicitly described.

• AI system security vulnerabilities
• Governance failure
• Lack of capability or robustness

Minimal coverage — Brief mention but no specific mitigations, recommendations or governance measures relating to the risk subdomain are described.

• Cyberattacks, weapon development or use
• Competitive dynamics
• AI pursuing its own goals
• Lack of transparency or interpretability

All other risk subdomains had no coverage in this document.

Risk Coverage Summary

The document has good coverage of approximately 5-6 subdomains, with strong focus on AI system security vulnerabilities (2.2), governance structures (6.5), competitive dynamics (6.4), and AI safety failures (7.1, 7.3). Coverage is concentrated in security, governance, and system safety domains.

Sector coverage

Minimal coverage — Brief mention but no specific mitigations, recommendations or governance measures relating to the sector are described.

• Agriculture, Mining, Construction & Manufacturing
• Trade, Transportation & Utilities
• Information
• Finance & Insurance
• Real Estate, Rental & Leasing
• Professional & Technical Services
• Scientific Research & Development Services
• Management, Administrative & Support Services
• Educational Services
• Health Care & Social Assistance
• Arts, Entertainment & Recreation
• Accommodation, Food & Other Services
• Public Administration (excl. National Security)
• National Security

All other sectors had no coverage in this document.

Sectors Summary

This is an external regulation that applies broadly across all sectors where AI systems are deployed. The multi-stakeholder process explicitly includes representatives from different sectors and use cases, and the voluntary incident reporting framework is designed to track incidents 'across different sectors.' No specific sectors are prioritized or excluded.

Legislative Status

Hard Law

Legislative Status Summary

This is a binding legislative instrument (Congressional bill) that directs federal agencies to take specific actions with mandatory language and establishes legal obligations.

Actors

Proposer

• Entity Types: AI_Governance_Actor
• Summary: The document is a Congressional bill enacted by the Senate and House of Representatives, establishing it as proposed by the legislative branch of the U.S. government.

Target

• Entity Types: AI_Governance_Actor, AI_Developer, AI_Deployer
• Summary: The Act directs NIST to coordinate with industry stakeholders and convene multi-stakeholder processes involving AI developers, deployers, and various governance actors to develop voluntary reporting mechanisms.

Enforcer

• Entity Types: AI_Governance_Actor
• Summary: NIST is designated as the primary implementing agency with authority to update the National Vulnerability Database and convene stakeholder processes, in consultation with CISA. However, the Act explicitly limits enforcement authority.

Monitor

• Entity Types: AI_Governance_Actor
• Summary: Congress serves as the monitoring body through mandatory reporting requirements, while NIST monitors the multi-stakeholder process and voluntary incident reporting mechanisms being developed.

AI Lifecycle Stages

Lifecycle stages covered by the documents, as defined in the OECD Framework for the Classification of AI Systems

• Plan and Design
• Build and Use Model
• Verify and Validate
• Deploy
• Operate and Monitor

AI Lifecycle Summary

The document primarily addresses the Deploy and Operate and Monitor lifecycle stages through its focus on vulnerability databases, incident reporting, and tracking mechanisms. It also covers Build and Use Model through vulnerability management processes and Verify and Validate through safety and security incident assessment.

Technical Scope

Terms relating to technical scope that are mentioned or implicitly referenced in the document

• AI Systems

Technical Scope Summary

The document explicitly mentions AI systems and AI security vulnerabilities. It does not specifically reference AI models, frontier AI, general purpose AI, foundation models, generative AI, predictive AI, open-weight models, or compute thresholds. The focus is on AI systems broadly defined.