15 CFR part 7 ("Securing the Information and Communications Technology and Services Supply Chain")

• Authority: Department of Commerce
• Parent authority: Federal government
• Jurisdiction: United States
• Collections: U.S. regulations, executive orders, and agency policies
• Most recent activity: Enacted
• Most recent activity date: 2021-03-22

Risk subdomain coverage

Good coverage — Comprehensive governance measures or mitigations with clear procedures relating to the risk subdomain are explicitly described.

• Compromise of privacy
• AI system security vulnerabilities
• Cyberattacks, weapon development or use

Minimal coverage — Brief mention but no specific mitigations, recommendations or governance measures relating to the risk subdomain are described.

• Disinformation, surveillance, and influence at scale
• Competitive dynamics
• Governance failure
• Environmental harm
• AI possessing dangerous capabilities

All other risk subdomains had no coverage in this document.

Risk Coverage Summary

The document has good coverage of approximately 6-8 subdomains, with strong focus on malicious actors (4.1, 4.2), AI system security (2.2), competitive dynamics (6.4), and governance failure (6.5). Coverage is concentrated in security, national security threats, and supply chain risks. The document addresses risks from foreign adversaries using ICTS (including AI) for surveillance, cyberattacks, and threats to critical infrastructure.

Sector coverage

Good coverage — Comprehensive governance measures or mitigations with clear procedures relating to the sector are explicitly described.

• Information
• Finance & Insurance
• Health Care & Social Assistance
• Public Administration (excl. National Security)
• National Security

Minimal coverage — Brief mention but no specific mitigations, recommendations or governance measures relating to the sector are described.

• Agriculture, Mining, Construction & Manufacturing
• Trade, Transportation & Utilities
• Professional & Technical Services
• Scientific Research & Development Services
• Management, Administrative & Support Services
• Educational Services
• Arts, Entertainment & Recreation
• Accommodation, Food & Other Services

All other sectors had no coverage in this document.

Sectors Summary

The regulation governs ICTS transactions across all critical infrastructure sectors as defined by Presidential Policy Directive 21. It has particularly strong coverage of Information, Finance and Insurance, Health Care, Public Administration, and National Security sectors due to explicit references to telecommunications, data services, sensitive personal data, and national security functions.

Legislative Status

Hard Law

Legislative Status Summary

This is a binding federal regulation (15 CFR part 7) issued by the Department of Commerce under IEEPA authority, with explicit enforcement mechanisms including civil penalties up to $307,922 or twice the transaction value, and criminal penalties up to $1,000,000 fine and 20 years imprisonment.

Actors

Proposer

• Entity Types: AI_Governance_Actor
• Summary: The regulation was promulgated by the Department of Commerce under authority granted by Executive Order 13873 and IEEPA. The Secretary of Commerce has rulemaking authority to establish these procedures.

Target

• Entity Types: AI_Developer, AI_Deployer, AI_Infrastructure_Provider
• Summary: The regulation applies to any person subject to U.S. jurisdiction engaging in ICTS transactions with foreign adversary-linked entities, specifically covering AI developers, deployers, and infrastructure providers dealing with AI/ML, autonomous systems, drones, and data services affecting over 1 million U.S. persons.

Enforcer

• Entity Types: AI_Governance_Actor
• Summary: The Secretary of Commerce has primary enforcement authority to issue determinations, impose penalties, conduct investigations, and bring civil actions. Multiple federal agencies consult on enforcement decisions.

Monitor

• Entity Types: AI_Governance_Actor
• Summary: The Secretary monitors compliance with final determinations and mitigation agreements. Multiple agencies provide ongoing threat assessments and vulnerability reports. The regulation establishes recordkeeping requirements and information-sharing mechanisms.

AI Lifecycle Stages

Lifecycle stages covered by the documents, as defined in the OECD Framework for the Classification of AI Systems

• Deploy
• Operate and Monitor

AI Lifecycle Summary

The document primarily covers the Deploy and Operate and Monitor stages of the AI lifecycle, as it regulates the acquisition, importation, installation, and use of ICTS including AI/ML systems. It does not substantively address earlier stages like planning, data collection, or model development, focusing instead on transaction review and ongoing compliance monitoring.

Technical Scope

Terms relating to technical scope that are mentioned or implicitly referenced in the document

• AI Models
• AI Systems

Technical Scope Summary

The document explicitly mentions AI systems, AI models (through 'artificial intelligence and machine learning'), and various AI applications including autonomous systems, drones, and advanced robotics. It does not distinguish between frontier AI, general purpose AI, or task-specific AI, nor does it mention foundation models, generative AI, predictive AI, or compute thresholds. It does not explicitly address open-weight or open-source models.