Intelligence Authorization Act for Fiscal Year 2025, Title V, Section 505 ("Establishment of Artificial Intelligence Security Center")

• Authority: United States Congress
• Parent authority: Federal government
• Jurisdiction: United States
• Collections: U.S. federal laws
• Most recent activity: Defunct
• Most recent activity date: 2025-01-03

Risk subdomain coverage

Good coverage — Comprehensive governance measures or mitigations with clear procedures relating to the risk subdomain are explicitly described.

• AI system security vulnerabilities
• Cyberattacks, weapon development or use
• Governance failure
• AI possessing dangerous capabilities
• Lack of capability or robustness

Minimal coverage — Brief mention but no specific mitigations, recommendations or governance measures relating to the risk subdomain are described.

• Compromise of privacy
• Overreliance and unsafe use
• Competitive dynamics
• Lack of transparency or interpretability

All other risk subdomains had no coverage in this document.

Risk Coverage Summary

The document has good coverage of approximately 6-8 subdomains, with strong focus on AI system security (2.2), malicious actors using AI for cyberattacks (4.2), competitive dynamics (6.4), governance structures (6.5), and AI system safety failures (7.2, 7.3). Coverage is concentrated in security, infrastructure, and governance domains.

Sector coverage

Good coverage — Comprehensive governance measures or mitigations with clear procedures relating to the sector are explicitly described.

• Scientific Research & Development Services
• National Security

Minimal coverage — Brief mention but no specific mitigations, recommendations or governance measures relating to the sector are described.

• Information
• Educational Services
• Public Administration (excl. National Security)

All other sectors had no coverage in this document.

Sectors Summary

The document primarily governs the National Security sector through establishment of the AI Security Center within NSA. It also has significant coverage of Scientific Research and Development Services through the research test bed provisions, and Information sector through coordination with NIST and engagement with commercial AI model vendors.

Legislative Status

Hard Law

Legislative Status Summary

This is a binding federal statute enacted by the United States Congress with mandatory obligations and enforcement authority vested in the Director of the National Security Agency.

Actors

Proposer

• Entity Types: AI_Governance_Actor
• Entities: United States Congress
• Summary: The document is a section of the Intelligence Authorization Act for Fiscal Year 2025, which is federal legislation enacted by the United States Congress.

Target

• Entity Types: AI_Governance_Actor, AI_Developer, AI_Infrastructure_Provider
• Entities: National Security Agency; Cybersecurity Collaboration Center; private sector researchers; academic researchers; model vendors; managers of national security systems; elements of the defense industrial base; Federal agencies
• Summary: The document establishes obligations for the NSA Director to create the AI Security Center and provide services to researchers, model vendors, national security system managers, and other federal agencies. It also governs AI developers who provide proprietary models and researchers who access the test bed.

Enforcer

• Entity Types: AI_Governance_Actor
• Entities: Director of the National Security Agency
• Summary: The Director of the NSA is given explicit authority to establish the Center, set terms of usage, establish mechanisms for model access, and ensure compliance with the statutory requirements.

Monitor

• Entity Types: AI_Governance_Actor
• Entities: Director of the National Security Agency; Artificial Intelligence Safety Institute of the National Institute of Standards and Technology
• Summary: The Director of the NSA has oversight responsibility for the AI Security Center's operations. The document also establishes coordination with NIST's AI Safety Institute, suggesting a monitoring and coordination role.

AI Lifecycle Stages

Lifecycle stages covered by the documents, as defined in the OECD Framework for the Classification of AI Systems

• Build and Use Model
• Verify and Validate
• Deploy
• Operate and Monitor

AI Lifecycle Summary

The document primarily covers the Build and Use Model, Verify and Validate, and Operate and Monitor stages. It establishes infrastructure for AI security research, model testing, and ongoing security guidance for deployed AI systems in national security contexts.

Technical Scope

Terms relating to technical scope that are mentioned or implicitly referenced in the document

• AI Models
• AI Systems
• Open Weight / Open Source

Technical Scope Summary

The document explicitly mentions AI systems and AI models, with focus on proprietary models from commercial vendors. It addresses security research infrastructure and counter-AI techniques but does not specify particular AI types (frontier, general purpose, task-specific) or compute thresholds. There is implicit coverage of both open and proprietary models through the voluntary provision mechanism.