Intelligence Authorization Act for Fiscal Year 2025, Title V, Section 510 ("Management of artificial intelligence security risks")

• Authority: United States Congress
• Parent authority: Federal government
• Jurisdiction: United States
• Collections: U.S. federal laws
• Most recent activity: Defunct
• Most recent activity date: 2025-01-03

Risk subdomain coverage

Good coverage — Comprehensive governance measures or mitigations with clear procedures relating to the risk subdomain are explicitly described.

• AI system security vulnerabilities
• Cyberattacks, weapon development or use
• Governance failure
• Lack of capability or robustness
• Lack of transparency or interpretability

Minimal coverage — Brief mention but no specific mitigations, recommendations or governance measures relating to the risk subdomain are described.

• Compromise of privacy
• Fraud, scams, and targeted manipulation
• Competitive dynamics
• Environmental harm

All other risk subdomains had no coverage in this document.

Risk Coverage Summary

The document has good coverage of approximately 6-8 subdomains, with strong focus on AI system security vulnerabilities (2.2), privacy compromise (2.1), malicious actors using AI for cyberattacks (4.2), lack of robustness (7.3), lack of transparency (7.4), and governance failure (6.5). Coverage is concentrated in security, privacy, and AI safety domains.

Sector coverage

Good coverage — Comprehensive governance measures or mitigations with clear procedures relating to the sector are explicitly described.

• Public Administration (excl. National Security)
• National Security

Minimal coverage — Brief mention but no specific mitigations, recommendations or governance measures relating to the sector are described.

• Trade, Transportation & Utilities
• Information
• Professional & Technical Services
• Scientific Research & Development Services
• Health Care & Social Assistance

All other sectors had no coverage in this document.

Sectors Summary

This document does not govern specific economic sectors but rather establishes cross-sectoral federal processes for AI security vulnerability management and incident tracking. It mentions critical infrastructure and safety-critical systems as priority areas for incident tracking, suggesting broad applicability across multiple sectors.

Legislative Status

Hard Law

Legislative Status Summary

This is a binding federal statute enacted by the United States Congress with mandatory obligations on federal agencies (NIST, CISA) to establish processes, databases, and reporting mechanisms within specified timeframes.

Actors

Proposer

• Entity Types: AI_Governance_Actor
• Summary: This is a federal statute enacted by Congress as part of the Intelligence Authorization Act for Fiscal Year 2025, Title V, Section 510.

Target

• Entity Types: AI_Governance_Actor, AI_Developer, AI_Deployer
• Summary: The document mandates actions by federal agencies (NIST, CISA) and establishes voluntary mechanisms for private sector entities, public sector organizations, civil society groups, and academic researchers to participate in incident reporting.

Enforcer

• Entity Types: AI_Governance_Actor
• Summary: NIST and CISA are designated to implement and oversee the vulnerability management processes, databases, and reporting mechanisms. Congressional committees receive reports and provide oversight.

Monitor

• Entity Types: AI_Governance_Actor
• Summary: NIST and CISA are responsible for tracking and processing security and safety incidents through databases and reporting mechanisms. Congressional committees monitor implementation through required reports.

AI Lifecycle Stages

Lifecycle stages covered by the documents, as defined in the OECD Framework for the Classification of AI Systems

• Collect and Process Data
• Build and Use Model
• Deploy
• Operate and Monitor

AI Lifecycle Summary

The document primarily addresses the Deploy and Operate and Monitor lifecycle stages, with some coverage of Build and Use Model through supply chain risk considerations. It focuses on post-deployment vulnerability management, incident tracking, and ongoing monitoring of AI security and safety risks.

Technical Scope

Terms relating to technical scope that are mentioned or implicitly referenced in the document

• AI Models
• AI Systems
• Open Weight / Open Source

Technical Scope Summary

The document explicitly mentions AI systems and AI models throughout. It does not specifically reference frontier AI, general purpose AI, task-specific AI, foundation models, generative AI, predictive AI, or compute thresholds. It addresses open-source datasets and does not mention open-weight models specifically.