H.R. 3447 Chip Security Act

• Authority: Federal government
• Jurisdiction: United States
• Collections: U.S. federal laws
• Most recent activity: Proposed
• Most recent activity date: 2025-05-15

Risk subdomain coverage

Good coverage — Comprehensive governance measures or mitigations with clear procedures relating to the risk subdomain are explicitly described.

• AI system security vulnerabilities
• Competitive dynamics
• Governance failure

Minimal coverage — Brief mention but no specific mitigations, recommendations or governance measures relating to the risk subdomain are described.

• Compromise of privacy
• Disinformation, surveillance, and influence at scale
• Cyberattacks, weapon development or use
• Fraud, scams, and targeted manipulation
• Lack of capability or robustness

All other risk subdomains had no coverage in this document.

Risk Coverage Summary

The document has good coverage of approximately 5-6 subdomains, with strong focus on malicious actors (4.1, 4.2), AI system security (2.2), competitive dynamics (6.4), and governance failure (6.5). Coverage is concentrated in security, export control compliance, and preventing unauthorized access to advanced computing hardware.

Sector coverage

Good coverage — Comprehensive governance measures or mitigations with clear procedures relating to the sector are explicitly described.

• Agriculture, Mining, Construction & Manufacturing
• Information
• National Security

Minimal coverage — Brief mention but no specific mitigations, recommendations or governance measures relating to the sector are described.

• Professional & Technical Services
• Scientific Research & Development Services

All other sectors had no coverage in this document.

Sectors Summary

The document primarily governs the Information sector (specifically data processing and telecommunications infrastructure) and the Manufacturing sector (integrated circuit production). It also has significant implications for Professional and Technical Services (IT consultants and technical services) and Scientific Research and Development Services that rely on advanced computing hardware.

Legislative Status

Hard Law

Legislative Status Summary

This is a federal legislative bill (H.R. 3447) that, if enacted, would create binding legal obligations with mandatory requirements, enforcement mechanisms, and reporting obligations. The document uses mandatory language throughout ('shall require', 'shall submit') and establishes clear enforcement authority for the Secretary of Commerce.

Actors

Proposer

• Entity Types: AI_Governance_Actor
• Summary: The document is a federal bill introduced in Congress, as indicated by the opening text 'Be it enacted by the Senate and House of Representatives of the United States of America in Congress assembled'.

Target

• Entity Types: AI_Developer, AI_Infrastructure_Provider
• Summary: The document targets entities that export covered integrated circuit products (advanced chips and computing hardware), requiring them to outfit products with security mechanisms and report on diversion or tampering. These entities are manufacturers and exporters of AI hardware infrastructure.

Enforcer

• Entity Types: AI_Governance_Actor
• Summary: The Secretary of Commerce is explicitly designated as the primary enforcement authority with powers to require security mechanisms, verify compliance, maintain records, and require reporting. The Under Secretary of Industry and Security receives reports of violations.

Monitor

• Entity Types: AI_Governance_Actor
• Summary: The Secretary of Commerce is responsible for conducting assessments, maintaining records, and verifying locations of covered products. Congressional committees receive annual reports on implementation and new security mechanisms, providing legislative oversight.

AI Lifecycle Stages

Lifecycle stages covered by the documents, as defined in the OECD Framework for the Classification of AI Systems

• Build and Use Model
• Verify and Validate
• Deploy
• Operate and Monitor

AI Lifecycle Summary

The document primarily focuses on the Deploy and Operate and Monitor stages of the AI lifecycle, with some coverage of Build and Use Model. It addresses security mechanisms for integrated circuits used in AI systems, emphasizing export controls, location verification, and post-deployment monitoring of hardware.

Technical Scope

Terms relating to technical scope that are mentioned or implicitly referenced in the document

No technical scope terms identified.

Technical Scope Summary

The document focuses on integrated circuit products and computing hardware that enable AI systems, particularly advanced chips used for AI computation. It does not explicitly define AI models, systems, or specific AI categories, but addresses the hardware infrastructure layer that supports AI development and deployment.