Intelligence Authorization Act for Fiscal Year 2025, Title V, Section 504 ("National security procedures to address certain risks and threats relating to artificial intelligence")

• Authority: United States Congress
• Parent authority: Federal government
• Jurisdiction: United States
• Collections: U.S. federal laws
• Most recent activity: Defunct
• Most recent activity date: 2025-01-03

Risk subdomain coverage

Good coverage — Comprehensive governance measures or mitigations with clear procedures relating to the risk subdomain are explicitly described.

• AI system security vulnerabilities
• Disinformation, surveillance, and influence at scale
• Cyberattacks, weapon development or use
• Governance failure
• AI possessing dangerous capabilities

Minimal coverage — Brief mention but no specific mitigations, recommendations or governance measures relating to the risk subdomain are described.

• Compromise of privacy
• Fraud, scams, and targeted manipulation
• Competitive dynamics
• Lack of capability or robustness

All other risk subdomains had no coverage in this document.

Risk Coverage Summary

The document has good coverage of approximately 8-10 subdomains, with strong focus on malicious actors (4.1, 4.2, 4.3), AI system security (2.2), competitive dynamics (6.4), governance (6.5), and AI safety failures (7.1, 7.2, 7.3). Coverage is concentrated in security, misuse prevention, and AI safety domains.

Sector coverage

Good coverage — Comprehensive governance measures or mitigations with clear procedures relating to the sector are explicitly described.

• Information
• National Security

Minimal coverage — Brief mention but no specific mitigations, recommendations or governance measures relating to the sector are described.

• Trade, Transportation & Utilities
• Scientific Research & Development Services
• Health Care & Social Assistance

All other sectors had no coverage in this document.

Sectors Summary

The document governs AI use across multiple critical sectors including Health Care, Trade/Transportation/Utilities (critical infrastructure), Information (AI vendors and computation providers), and has national security implications. The governance is sector-agnostic in its notification requirements but explicitly mentions mission-critical applications in healthcare, critical infrastructure, and transportation.

Legislative Status

Hard Law

Legislative Status Summary

This is a binding federal statute enacted by the United States Congress with mandatory obligations on the President to develop procedures within a specified timeframe and provide briefings to Congress.

Actors

Proposer

• Entity Types: AI_Governance_Actor
• Entities: United States Congress
• Summary: The document is a section of the Intelligence Authorization Act for Fiscal Year 2025, which is federal legislation enacted by the United States Congress.

Target

• Entity Types: AI_Developer, AI_Infrastructure_Provider, AI_User
• Entities: vendors of advanced computation capabilities; vendors of artificial intelligence systems; commercial users of artificial intelligence systems; independent researchers
• Summary: The document explicitly identifies multiple categories of entities that must participate in notification procedures, including AI system vendors, computation providers, commercial users, and researchers.

Enforcer

• Entity Types: AI_Governance_Actor
• Entities: The President; Federal agencies; appropriate elements of the United States Government
• Summary: The President is mandated to develop and issue procedures, and federal agencies are designated to lead outreach and implementation. The document requires specification of which federal agencies will be responsible for enforcement activities.

Monitor

• Entity Types: AI_Governance_Actor
• Entities: congressional intelligence committees; Committee on Homeland Security and Governmental Affairs of the Senate; Committee on Homeland Security of the House of Representatives
• Summary: Congress has established oversight mechanisms requiring the President to brief specified congressional committees on the procedures developed and their implementation.

AI Lifecycle Stages

Lifecycle stages covered by the documents, as defined in the OECD Framework for the Classification of AI Systems

• Collect and Process Data
• Build and Use Model
• Deploy
• Operate and Monitor

AI Lifecycle Summary

The document primarily addresses the Deploy and Operate and Monitor stages of the AI lifecycle, focusing on post-deployment security risks, threat notification procedures, and ongoing monitoring of AI systems in operational environments. It also implicitly covers Build and Use Model through references to training data and system development risks.

Technical Scope

Terms relating to technical scope that are mentioned or implicitly referenced in the document

• AI Models
• AI Systems
• Generative AI

Technical Scope Summary

The document explicitly mentions 'artificial intelligence systems' and 'artificial intelligence models' throughout. It references 'large-scale artificial intelligence models' and 'advanced computation capabilities' but does not use specific terminology like frontier AI, general purpose AI, foundation models, or compute thresholds. The focus is on AI systems broadly defined by their capabilities rather than technical classifications.