Advanced AI Security Readiness Act

• Authority: United States Congress
• Parent authority: Federal government
• Jurisdiction: United States
• Collections: U.S. federal laws
• Most recent activity: Proposed
• Most recent activity date: 2025-06-11

Risk subdomain coverage

Good coverage — Comprehensive governance measures or mitigations with clear procedures relating to the risk subdomain are explicitly described.

• AI system security vulnerabilities
• Cyberattacks, weapon development or use
• AI possessing dangerous capabilities

Minimal coverage — Brief mention but no specific mitigations, recommendations or governance measures relating to the risk subdomain are described.

• Disinformation, surveillance, and influence at scale
• Competitive dynamics
• Governance failure
• AI pursuing its own goals
• Lack of capability or robustness

All other risk subdomains had no coverage in this document.

Risk Coverage Summary

The document has good coverage of approximately 6-8 subdomains, with strong focus on AI system security vulnerabilities (2.2), malicious actors including cyberattacks and weapons development (4.1, 4.2), competitive dynamics (6.4), governance structures (6.5), dangerous capabilities (7.2), and lack of robustness (7.3). Coverage is concentrated in security, national security threats, and AI safety domains.

Sector coverage

Good coverage — Comprehensive governance measures or mitigations with clear procedures relating to the sector are explicitly described.

• National Security

Minimal coverage — Brief mention but no specific mitigations, recommendations or governance measures relating to the sector are described.

• Information
• Scientific Research & Development Services

All other sectors had no coverage in this document.

Sectors Summary

This document primarily governs the National Security sector through mandating NSA action to develop AI security strategies. It also has implications for the Information sector (AI developers and data centers) and Scientific Research and Development Services (AI researchers) through engagement requirements and dissemination of security guidelines.

Legislative Status

Hard Law

Legislative Status Summary

This is a binding legislative act from the United States Congress that creates mandatory obligations for the NSA Director with specific timelines, reporting requirements to congressional committees, and formal legislative authority.

Actors

Proposer

• Entity Types: AI_Governance_Actor
• Summary: The document is a bill enacted by the United States Congress, as stated in the opening: 'Be it enacted by the Senate and House of Representatives of the United States of America in Congress assembled'

Target

• Entity Types: AI_Governance_Actor, AI_Developer
• Summary: The primary target is the NSA Director who must develop the AI Security Playbook. Secondary targets include advanced AI developers and researchers who will be engaged in the process and may receive the unclassified guidelines. The document also references 'advanced AI data centers and among advanced AI developers capable of producing covered AI technologies'

Enforcer

• Entity Types: AI_Governance_Actor
• Summary: The congressional intelligence committees serve as the enforcement mechanism through their oversight role, receiving mandatory progress reports at 90 days and final reports at 270 days. These committees have the authority to oversee compliance with the Act's requirements.

Monitor

• Entity Types: AI_Governance_Actor
• Summary: The same congressional intelligence committees that enforce also monitor implementation through the required progress reports. They receive an initial report at 90 days summarizing progress and a final report at 270 days on the completed Playbook.

AI Lifecycle Stages

Lifecycle stages covered by the documents, as defined in the OECD Framework for the Classification of AI Systems

• Plan and Design
• Build and Use Model
• Verify and Validate
• Deploy
• Operate and Monitor

AI Lifecycle Summary

The document primarily focuses on the Build and Use Model stage (addressing model security, model weights, and core algorithmic insights) and the Operate and Monitor stage (addressing ongoing security threats, detection, and response strategies). It also covers aspects of Plan and Design through its focus on security frameworks and preparedness strategies.

Technical Scope

Terms relating to technical scope that are mentioned or implicitly referenced in the document

• AI Models
• AI Systems

Technical Scope Summary

The document explicitly mentions AI systems, AI models, and advanced AI technologies. It focuses on 'covered AI technologies' defined as advanced AI with critical capabilities that pose grave national security threats. The document references specific dangerous capabilities including CBRN, cyber offense, model autonomy, persuasion, R&D, and self-improvement. No compute thresholds or distinctions between general-purpose, task-specific, foundation, generative, or predictive AI are mentioned.