Federal Register Doc. No. 2024-28335 (Securing the Information and Communications Technology and Services Supply Chain)

• Authority: Department of Commerce
• Parent authority: Federal government
• Jurisdiction: United States
• Collections: U.S. regulations, executive orders, and agency policies
• Most recent activity: Enacted
• Most recent activity date: 2025-02-04

Risk subdomain coverage

Good coverage — Comprehensive governance measures or mitigations with clear procedures relating to the risk subdomain are explicitly described.

• Compromise of privacy
• AI system security vulnerabilities
• Disinformation, surveillance, and influence at scale
• Cyberattacks, weapon development or use

Minimal coverage — Brief mention but no specific mitigations, recommendations or governance measures relating to the risk subdomain are described.

• Competitive dynamics
• Governance failure
• Lack of transparency or interpretability

All other risk subdomains had no coverage in this document.

Risk Coverage Summary

The document primarily addresses security and malicious actor risks, with strong coverage of AI system security vulnerabilities (2.2), cyberattacks and weapons development (4.2), disinformation and surveillance (4.1), and competitive dynamics (6.4). It also covers governance failure risks (6.5) through its regulatory framework provisions. The document focuses on supply chain security risks from foreign adversaries rather than AI-specific harms.

Sector coverage

Good coverage — Comprehensive governance measures or mitigations with clear procedures relating to the sector are explicitly described.

• Information
• National Security

Minimal coverage — Brief mention but no specific mitigations, recommendations or governance measures relating to the sector are described.

• Agriculture, Mining, Construction & Manufacturing
• Trade, Transportation & Utilities
• Finance & Insurance
• Scientific Research & Development Services
• Health Care & Social Assistance
• Public Administration (excl. National Security)

All other sectors had no coverage in this document.

Sectors Summary

This regulation has broad cross-sectoral application, governing ICTS transactions across virtually all economic sectors. It has particularly strong coverage of Information (telecommunications, data processing), Finance and Insurance, Health Care, Public Administration, and National Security sectors due to explicit mentions of critical infrastructure subsectors and sensitive data handling.

Legislative Status

Hard Law

Legislative Status Summary

This is a binding federal regulation issued by the Department of Commerce under statutory authority (IEEPA and Executive Orders), with mandatory language throughout, explicit enforcement mechanisms including civil and criminal penalties, and formal administrative procedures for compliance.

Actors

Proposer

• Entity Types: AI_Governance_Actor
• Entities: Department of Commerce; Secretary of Commerce; Office of Information and Communications Technology and Services
• Summary: The regulation is issued by the Department of Commerce under the authority of the Secretary of Commerce, implementing Executive Order 13873. The document is signed by the Executive Director of the Office of Information and Communications Technology and Services.

Target

• Entity Types: AI_Developer, AI_Deployer, AI_Infrastructure_Provider
• Entities: United States persons; parties to ICTS Transactions; persons engaged in acquisition, importation, transfer, installation, dealing in, or use of ICTS
• Summary: The regulation applies to any person (including United States persons and entities) who engages in ICTS transactions involving technology from foreign adversaries. This includes designers, developers, providers, buyers, sellers, transferors, licensors, brokers, acquirors, intermediaries, and end users of ICTS.

Enforcer

• Entity Types: AI_Governance_Actor
• Entities: Secretary of Commerce; Department of Commerce; U.S. district court
• Summary: The Secretary of Commerce has primary enforcement authority, including the power to issue determinations, impose penalties, conduct investigations, and take legal action. Civil penalties can be recovered through U.S. district court actions.

Monitor

• Entity Types: AI_Governance_Actor
• Entities: Secretary of Commerce; appropriate agency heads; Secretary of the Treasury; Secretary of State; Secretary of Defense; Attorney General; Secretary of Homeland Security; United States Trade Representative; Director of National Intelligence; Administrator of General Services; Chairman of the Federal Communications Commission
• Summary: The Secretary of Commerce monitors compliance through recordkeeping requirements, information demands, and ongoing review authority. Multiple federal agency heads are consulted and provide oversight through the interagency process for determinations.

AI Lifecycle Stages

Lifecycle stages covered by the documents, as defined in the OECD Framework for the Classification of AI Systems

• Plan and Design
• Collect and Process Data
• Build and Use Model
• Verify and Validate
• Deploy
• Operate and Monitor

AI Lifecycle Summary

The document covers multiple lifecycle stages with primary focus on deployment and operation/monitoring of ICTS. It addresses the acquisition, importation, transfer, installation, dealing in, and use of technology, which spans deployment and operational phases. There is minimal coverage of earlier stages like design or data collection.

Technical Scope

Terms relating to technical scope that are mentioned or implicitly referenced in the document

No technical scope terms identified.

Technical Scope Summary

The document explicitly mentions AI as part of 'critical and emerging technologies' but does not provide detailed definitions or distinctions between AI models, systems, or specific AI types. It focuses on ICTS broadly, including connected software applications and data processing services. No compute thresholds or specific AI model categories (frontier, GPAI, foundation models, etc.) are mentioned.