Establishment of Reporting Requirements for the Development of Advanced Artificial Intelligence Models and Computing Clusters

• Authority: Department of Commerce
• Parent authority: Federal government
• Jurisdiction: United States
• Collections: Editors' Picks;U.S. regulations, executive orders, and agency policies
• Most recent activity: Proposed
• Most recent activity date: 2024-09-11

Risk subdomain coverage

Good coverage — Comprehensive governance measures or mitigations with clear procedures relating to the risk subdomain are explicitly described.

• AI system security vulnerabilities
• Cyberattacks, weapon development or use
• Governance failure
• AI possessing dangerous capabilities

Minimal coverage — Brief mention but no specific mitigations, recommendations or governance measures relating to the risk subdomain are described.

• Fraud, scams, and targeted manipulation
• Loss of human agency and autonomy
• Competitive dynamics
• AI pursuing its own goals
• Lack of capability or robustness

All other risk subdomains had no coverage in this document.

Risk Coverage Summary

The document has minimal to good coverage of approximately 6-8 subdomains, with primary focus on AI system security (2.2), malicious actors and weapons development (4.2), competitive dynamics (6.4), governance failure (6.5), and AI safety failures (7.1, 7.2, 7.3). Coverage is concentrated in security, dual-use risks, and oversight mechanisms.

Sector coverage

Good coverage — Comprehensive governance measures or mitigations with clear procedures relating to the sector are explicitly described.

• Information
• Scientific Research & Development Services
• National Security

Minimal coverage — Brief mention but no specific mitigations, recommendations or governance measures relating to the sector are described.

• Educational Services

All other sectors had no coverage in this document.

Sectors Summary

This regulation applies broadly across all sectors where covered U.S. persons develop advanced AI models or computing clusters meeting specified thresholds. The governance is sector-agnostic, focusing on technical capabilities rather than industry-specific applications. However, the definition of dual-use foundation models references capabilities relevant to national security, cybersecurity, and CBRN weapons, suggesting particular relevance to defense, information technology, and scientific research sectors.

Legislative Status

Hard Law

Legislative Status Summary

This is a binding federal regulation with mandatory reporting requirements, specific enforcement mechanisms, and legal obligations imposed on covered U.S. persons by the Department of Commerce under statutory authority.

Actors

Proposer

• Entity Types: AI_Governance_Actor
• Summary: The document is a proposed amendment to federal regulations issued by the Department of Commerce through the Bureau of Industry and Security, with authority derived from federal statute and executive orders.

Target

• Entity Types: AI_Developer, AI_Infrastructure_Provider
• Summary: The regulation explicitly targets 'covered U.S. persons' who conduct AI model training runs exceeding 10^26 operations or develop computing clusters meeting specified thresholds. This includes corporations, partnerships, academic institutions, and research centers.

Enforcer

• Entity Types: AI_Governance_Actor
• Summary: BIS has explicit authority to receive notifications, send questions, require responses within specified timelines, demand corrections, and request clarifications from covered U.S. persons.

Monitor

• Entity Types: AI_Governance_Actor
• Summary: BIS monitors compliance through quarterly notifications, reviews responses to questions, tracks affirmations of no applicable activities, and has authority to request clarifications and corrections.

AI Lifecycle Stages

Lifecycle stages covered by the documents, as defined in the OECD Framework for the Classification of AI Systems

• Plan and Design
• Build and Use Model
• Verify and Validate
• Deploy
• Operate and Monitor

AI Lifecycle Summary

The document primarily covers the Build and Use Model stage through training run reporting requirements, and the Operate and Monitor stage through ongoing quarterly notifications and red-team testing requirements. It also addresses Deploy stage through computing cluster acquisition reporting.

Technical Scope

Terms relating to technical scope that are mentioned or implicitly referenced in the document

• AI Models
• Foundation Models
• AI Systems
• Compute Threshold

Technical Scope Summary

The document explicitly defines and covers AI models, AI systems, and dual-use foundation models with specific technical thresholds. It establishes a compute threshold of 10^26 operations for training runs and 10^20 OP/s for computing clusters. It does not explicitly mention frontier AI, general purpose AI, task-specific AI, generative AI, predictive AI, or open-weight models.