Bureau of Industry and Security Information Technology Modernization Act

• Authority: United States Congress
• Parent authority: Federal government
• Jurisdiction: United States
• Collections: U.S. federal laws
• Most recent activity: Defunct
• Most recent activity date: 2025-01-03

Risk subdomain coverage

Minimal coverage — Brief mention but no specific mitigations, recommendations or governance measures relating to the risk subdomain are described.

• AI system security vulnerabilities
• Cyberattacks, weapon development or use
• Fraud, scams, and targeted manipulation
• Competitive dynamics

All other risk subdomains had no coverage in this document.

Risk Coverage Summary

The document has minimal coverage of AI risk domains, with limited focus on AI system security (2.2) and competitive dynamics (6.4). The document primarily addresses IT modernization and export controls rather than comprehensive AI risk management. Coverage is concentrated in security infrastructure and geopolitical competition aspects.

Sector coverage

Good coverage — Comprehensive governance measures or mitigations with clear procedures relating to the sector are explicitly described.

• Public Administration (excl. National Security)
• National Security

All other sectors had no coverage in this document.

Sectors Summary

This document primarily governs Public Administration (excluding National Security) and National Security sectors, as it regulates the operations and IT modernization of a federal government agency (Bureau of Industry and Security) responsible for export controls and national security functions. The document does not directly regulate private sector activities but rather governs how a government agency uses AI/ML tools in its regulatory and security functions.

Legislative Status

Hard Law

Legislative Status Summary

This is a binding legislative act from the United States Congress with mandatory language, specific appropriations, and legal obligations for the Bureau of Industry and Security.

Actors

Proposer

• Entity Types: AI_Governance_Actor
• Entities: United States Congress
• Summary: The document is an Act of Congress, as indicated by the legislative format and structure. Congress is the proposing authority for this legislation.

Target

• Entity Types: AI_Governance_Actor
• Entities: Bureau of Industry and Security of the Department of Commerce; Under Secretary of Commerce for Industry and Security
• Summary: The Act directly targets the Bureau of Industry and Security, requiring it to modernize its IT systems and adopt AI/ML capabilities. The Under Secretary is specifically obligated to carry out the modernization.

Enforcer

• Entity Types: AI_Governance_Actor
• Entities: United States Congress; Under Secretary of Commerce for Industry and Security
• Summary: Congress enforces through appropriations control and oversight. The Under Secretary has direct implementation authority and must consult with Congress on personnel needs.

Monitor

• Entity Types: AI_Governance_Actor
• Entities: United States Congress; Under Secretary of Commerce for Industry and Security
• Summary: Congress maintains monitoring authority through consultation requirements and appropriations oversight. The Under Secretary must reassess staffing and consult with Congress throughout the modernization process.

AI Lifecycle Stages

Lifecycle stages covered by the documents, as defined in the OECD Framework for the Classification of AI Systems

• Plan and Design
• Collect and Process Data
• Build and Use Model
• Verify and Validate
• Deploy
• Operate and Monitor

AI Lifecycle Summary

The document primarily addresses the deployment and operational monitoring of AI/ML systems within the Bureau's IT infrastructure. It focuses on integrating AI capabilities into existing systems for export control purposes, with emphasis on ongoing modernization through 2029.

Technical Scope

Terms relating to technical scope that are mentioned or implicitly referenced in the document

• AI Systems

Technical Scope Summary

The document explicitly mentions AI and machine learning as technologies to be incorporated into Bureau IT systems. It does not define specific AI model types, compute thresholds, or distinguish between different categories of AI systems. The focus is on practical integration of AI/ML tools for export control purposes.