S2381 Preventing Recurring Online Abuse of Children Through Intentional Vetting of Artificial Intelligence Data Act of 2025

• Authority: United States Congress
• Parent authority: Federal government
• Jurisdiction: United States
• Collections: U.S. federal laws
• Most recent activity: Proposed
• Most recent activity date: 2025-07-22

Risk subdomain coverage

Good coverage — Comprehensive governance measures or mitigations with clear procedures relating to the risk subdomain are explicitly described.

• Exposure to toxic content
• Cyberattacks, weapon development or use
• Governance failure
• Lack of capability or robustness

Minimal coverage — Brief mention but no specific mitigations, recommendations or governance measures relating to the risk subdomain are described.

• AI system security vulnerabilities
• Fraud, scams, and targeted manipulation
• Lack of transparency or interpretability

All other risk subdomains had no coverage in this document.

Risk Coverage Summary

The document has good coverage of approximately 5-6 subdomains, with strong focus on toxic content exposure (1.2), AI system security vulnerabilities (2.2), cyberattacks and mass harm prevention (4.2), fraud and manipulation (4.3), governance failure (6.5), and lack of robustness (7.3). Coverage is concentrated in security, data integrity, child safety, and governance framework domains.

Sector coverage

Good coverage — Comprehensive governance measures or mitigations with clear procedures relating to the sector are explicitly described.

• Information
• Scientific Research & Development Services

Minimal coverage — Brief mention but no specific mitigations, recommendations or governance measures relating to the sector are described.

• Professional & Technical Services
• Educational Services
• Public Administration (excl. National Security)
• National Security

All other sectors had no coverage in this document.

Sectors Summary

This legislation applies horizontally across all economic sectors where AI systems are developed or where data collection for AI training occurs. It is not sector-specific but rather targets specific actors (AI developers and data collectors) regardless of their industry. The primary sectors governed are Information (where most AI companies operate) and Scientific Research and Development Services (where AI R&D occurs).

Legislative Status

Hard Law

Legislative Status Summary

This is proposed federal legislation (a Congressional bill) that, once enacted, would create binding legal obligations on NIST to develop a framework, establish statutory definitions, and provide liability protections with legal force. The bill uses mandatory language throughout and would have the force of federal law.

Actors

Proposer

• Entity Types: AI_Governance_Actor
• Summary: The document is a Congressional bill proposed by the legislative branch of the U.S. federal government, as indicated by the formal legislative language and structure.

Target

• Entity Types: AI_Developer, AI_Infrastructure_Provider
• Summary: The bill explicitly defines and targets 'artificial intelligence developers' and 'data collectors' for framework compliance, while specifically excluding 'artificial intelligence deployers' and 'artificial intelligence users' from the framework's requirements.

Enforcer

• Entity Types: AI_Governance_Actor
• Summary: The bill assigns framework development responsibilities to NIST, law enforcement reporting requirements to multiple agencies, and research coordination to NSF. Courts would enforce liability provisions.

Monitor

• Entity Types: AI_Governance_Actor
• Summary: The bill establishes monitoring through regular reporting requirements to law enforcement and the National Center for Missing and Exploited Children for detected CSAM in datasets.

AI Lifecycle Stages

Lifecycle stages covered by the documents, as defined in the OECD Framework for the Classification of AI Systems

• Plan and Design
• Collect and Process Data
• Build and Use Model
• Verify and Validate
• Operate and Monitor

AI Lifecycle Summary

The document focuses primarily on the 'Collect and Process Data' stage with detailed requirements for detecting, removing, and reporting CSAM in training datasets. It also covers 'Build and Use Model' (training AI systems) and 'Verify and Validate' (detection methodologies) stages. The framework development and ongoing reporting requirements touch on 'Operate and Monitor' to a lesser extent.

Technical Scope

Terms relating to technical scope that are mentioned or implicitly referenced in the document

• AI Systems

Technical Scope Summary

The document explicitly mentions and defines AI systems and provides separate definitions for AI developers, deployers, and users. It does not specifically mention frontier AI, GPAI, foundation models, generative AI, predictive AI, or compute thresholds. The focus is on AI systems generally, particularly those trained on large datasets collected via automated methods.