AI PLAN Act

• Authority: United States Congress
• Parent authority: Federal government
• Jurisdiction: United States
• Collections: U.S. federal laws
• Most recent activity: Proposed
• Most recent activity date: 2025-03-14

Risk subdomain coverage

Good coverage — Comprehensive governance measures or mitigations with clear procedures relating to the risk subdomain are explicitly described.

• Fraud, scams, and targeted manipulation

Minimal coverage — Brief mention but no specific mitigations, recommendations or governance measures relating to the risk subdomain are described.

• AI system security vulnerabilities
• False or misleading information
• Pollution of information ecosystem
• Disinformation, surveillance, and influence at scale
• Cyberattacks, weapon development or use
• Governance failure

All other risk subdomains had no coverage in this document.

Risk Coverage Summary

The document has good coverage of approximately 6-8 subdomains, with strong focus on malicious actors (4.1, 4.2, 4.3), misinformation (3.1, 3.2), AI system security (2.2), and governance (6.5). Coverage is concentrated in security, fraud prevention, and misuse domains related to financial crimes.

Sector coverage

Good coverage — Comprehensive governance measures or mitigations with clear procedures relating to the sector are explicitly described.

• Finance & Insurance
• Public Administration (excl. National Security)
• National Security

Minimal coverage — Brief mention but no specific mitigations, recommendations or governance measures relating to the sector are described.

• Information

All other sectors had no coverage in this document.

Sectors Summary

The document primarily governs the Finance and Insurance sector, with significant coverage of Public Administration. It also addresses National Security concerns and has minimal coverage of Information sector through references to misinformation and digital technologies.

Legislative Status

Hard Law

Legislative Status Summary

This is a binding legislative act from the United States Congress that requires specific federal agencies to submit reports and recommendations, using mandatory language throughout.

Actors

Proposer

• Entity Types: AI_Governance_Actor
• Entities: United States Congress; Senate and House of Representatives of the United States of America
• Summary: The document is a Congressional bill enacted by the Senate and House of Representatives, as indicated in the opening legislative language.

Target

• Entity Types: AI_Governance_Actor, AI_Developer, AI_Deployer
• Entities: Secretary of the Treasury; Secretary of Homeland Security; Secretary of Commerce; United States Trade Representative; Attorney General; Chairman of the Board of Governors of the Federal Reserve System; Director of the National Institute of Standards and Technology; Under Secretary of Commerce for Industry and Security; Chairman of the Securities and Exchange Commission; American businesses; government entities; adversarial actors
• Summary: The Act targets federal agencies who must submit reports and recommendations, and indirectly targets American businesses and government entities who will receive best practices guidance. It also addresses risks from adversarial actors using AI for financial crimes.

Enforcer

• Entity Types: AI_Governance_Actor
• Entities: United States Congress; Secretary of the Treasury; Secretary of Homeland Security; Secretary of Commerce
• Summary: Congress enforces compliance through its oversight authority over the mandated reports. The three Secretaries are responsible for implementing the reporting requirements and developing recommendations.

Monitor

• Entity Types: AI_Governance_Actor
• Entities: United States Congress; Secretary of the Treasury; Secretary of Homeland Security; Secretary of Commerce
• Summary: Congress monitors implementation through annual reporting requirements. The three Secretaries monitor AI-related financial crime risks and report on interagency policies, available resources, and needed capabilities.

AI Lifecycle Stages

Lifecycle stages covered by the documents, as defined in the OECD Framework for the Classification of AI Systems

• Deploy
• Operate and Monitor

AI Lifecycle Summary

The document does not focus on specific AI lifecycle stages but rather on the deployment and operational monitoring of AI systems used in financial crimes. It addresses the use of AI technologies (deepfakes, voice cloning, synthetic identities) and requires monitoring of their misuse, implying coverage of the Deploy and Operate and Monitor stages.

Technical Scope

Terms relating to technical scope that are mentioned or implicitly referenced in the document

• Generative AI
• Task-specific AI

Technical Scope Summary

The document explicitly mentions artificial intelligence and specific AI technologies (deepfakes, voice cloning, synthetic identities) but does not define AI models, AI systems, or distinguish between different types of AI such as frontier AI, general purpose AI, or foundation models. No compute thresholds or open-weight models are mentioned.