S3202 Advanced Artificial Intelligence Security Readiness Act of 2025

• Authority: United States Congress
• Parent authority: Federal government
• Jurisdiction: United States
• Collections: U.S. federal laws
• Most recent activity: Proposed
• Most recent activity date: 2025-11-19

Risk subdomain coverage

Good coverage — Comprehensive governance measures or mitigations with clear procedures relating to the risk subdomain are explicitly described.

• AI system security vulnerabilities
• Cyberattacks, weapon development or use
• Competitive dynamics
• AI possessing dangerous capabilities
• Lack of capability or robustness

Minimal coverage — Brief mention but no specific mitigations, recommendations or governance measures relating to the risk subdomain are described.

• Compromise of privacy
• Disinformation, surveillance, and influence at scale
• Governance failure
• AI pursuing its own goals

All other risk subdomains had no coverage in this document.

Risk Coverage Summary

The document has good coverage of approximately 6-8 subdomains, with strong focus on AI system security (2.2), malicious actors (4.1, 4.2), competitive dynamics (6.4), governance failure (6.5), and AI safety failures (7.2, 7.3). Coverage is concentrated in security, threat prevention, and system robustness domains.

Sector coverage

Good coverage — Comprehensive governance measures or mitigations with clear procedures relating to the sector are explicitly described.

• Information
• Scientific Research & Development Services
• National Security

Minimal coverage — Brief mention but no specific mitigations, recommendations or governance measures relating to the sector are described.

• Professional & Technical Services
• Public Administration (excl. National Security)

All other sectors had no coverage in this document.

Sectors Summary

This document primarily governs the National Security sector through mandates on the NSA. It also has significant implications for the Information sector (AI developers), Scientific Research and Development Services (AI researchers and National Laboratories), and Professional and Technical Services (consultants and experts engaged in the process). The guidance developed will ultimately apply to any sector developing or deploying advanced AI with national security implications.

Legislative Status

Hard Law

Legislative Status Summary

This is a binding legislative act from the United States Congress with mandatory obligations on the NSA Director, specified timelines, and reporting requirements to congressional committees.

Actors

Proposer

• Entity Types: AI_Governance_Actor
• Entities: United States Congress; Senate; House of Representatives
• Summary: The document is a Congressional bill proposed by the United States Congress, as indicated by the opening text 'Be it enacted by the Senate and House of Representatives of the United States of America in Congress assembled'.

Target

• Entity Types: AI_Governance_Actor, AI_Developer
• Entities: Director of the National Security Agency; Artificial Intelligence Security Center; prominent artificial intelligence developers and researchers; service providers; private sector
• Summary: The primary target is the NSA Director who must develop guidance. Secondary targets include AI developers and researchers who will be engaged in the process and service providers who will receive security briefings. The guidance is also intended for dissemination to the private sector.

Enforcer

• Entity Types: AI_Governance_Actor
• Entities: Congressional intelligence committees; Select Committee on Intelligence of the Senate; Permanent Select Committee on Intelligence of the House of Representatives
• Summary: The congressional intelligence committees serve as the enforcement mechanism through mandatory reporting requirements and oversight. The NSA Director must submit reports to these committees at specified intervals.

Monitor

• Entity Types: AI_Governance_Actor
• Entities: Congressional intelligence committees; Select Committee on Intelligence of the Senate; Permanent Select Committee on Intelligence of the House of Representatives
• Summary: The congressional intelligence committees monitor implementation through required progress reports at 180 days and final reports at 365 days, including summaries of progress and remaining work.

AI Lifecycle Stages

Lifecycle stages covered by the documents, as defined in the OECD Framework for the Classification of AI Systems

• Plan and Design
• Collect and Process Data
• Build and Use Model
• Verify and Validate
• Deploy
• Operate and Monitor

AI Lifecycle Summary

The document primarily focuses on the Deploy and Operate and Monitor stages, with emphasis on securing AI systems post-development. It addresses security measures throughout the AI supply chain including model weights protection, but does not extensively cover early-stage planning, data collection, or initial model building phases.

Technical Scope

Terms relating to technical scope that are mentioned or implicitly referenced in the document

• AI Models
• AI Systems

Technical Scope Summary

The document explicitly mentions AI systems, AI models, and AI technologies throughout. It focuses on advanced AI with critical capabilities and covers the entire AI supply chain including model weights, training data, and computing environments. It does not explicitly mention frontier AI, general purpose AI, foundation models, generative AI, or specific compute thresholds.