Artificial Intelligence Bug Bounty Act of 2023

• Authority: United States Congress
• Parent authority: Federal government
• Jurisdiction: United States
• Collections: U.S. federal laws
• Most recent activity: Defunct
• Most recent activity date: 2025-01-03

Risk subdomain coverage

Minimal coverage — Brief mention but no specific mitigations, recommendations or governance measures relating to the risk subdomain are described.

• AI system security vulnerabilities
• Competitive dynamics
• Lack of capability or robustness

All other risk subdomains had no coverage in this document.

Risk Coverage Summary

The document has minimal coverage of approximately 2-3 subdomains, with focus on AI system security vulnerabilities (2.2) and competitive dynamics (6.4). Coverage is concentrated in security and governance domains, with implicit references to system safety and robustness.

Sector coverage

Good coverage — Comprehensive governance measures or mitigations with clear procedures relating to the sector are explicitly described.

• National Security

Minimal coverage — Brief mention but no specific mitigations, recommendations or governance measures relating to the sector are described.

• Professional & Technical Services
• Scientific Research & Development Services

All other sectors had no coverage in this document.

Sectors Summary

This Act primarily governs AI use within the National Security sector, specifically the Department of Defense's incorporation of foundational AI products. It also has implications for Professional and Technical Services and Scientific Research and Development Services sectors through collaboration with agencies having cybersecurity and AI expertise.

Legislative Status

Hard Law

Legislative Status Summary

This is a binding legislative act from the United States Congress with mandatory requirements, specified timelines, and enforcement through contractual obligations.

Actors

Proposer

• Entity Types: AI_Governance_Actor
• Entities: United States Congress
• Summary: The document is titled 'Artificial Intelligence Bug Bounty Act of 2023' and is presented as legislation from the United States Congress, which is the legislative authority proposing this governance instrument.

Target

• Entity Types: AI_Governance_Actor, AI_Developer
• Entities: Department of Defense; Chief Data and Artificial Intelligence Officer of the Department of Defense; Secretary of Defense; developers/providers of foundational artificial intelligence products
• Summary: The Act primarily targets the Department of Defense and its Chief Data and Artificial Intelligence Officer who must develop and may implement the bug bounty program. It also applies to contractors and AI product developers who engage with the DoD through contracts that must allow participation in the program.

Enforcer

• Entity Types: AI_Governance_Actor
• Entities: Chief Data and Artificial Intelligence Officer of the Department of Defense; Secretary of Defense; congressional defense committees
• Summary: The Chief Data and Artificial Intelligence Officer is responsible for developing and potentially implementing the program. The Secretary of Defense must ensure contractual compliance. Congressional defense committees provide oversight through mandatory briefings.

Monitor

• Entity Types: AI_Governance_Actor
• Entities: congressional defense committees; Chief Data and Artificial Intelligence Officer of the Department of Defense
• Summary: Congressional defense committees monitor implementation through a mandatory briefing on development, implementation, and long-term plans. The Chief monitors the bug bounty programs and reports on their relevance and future plans.

AI Lifecycle Stages

Lifecycle stages covered by the documents, as defined in the OECD Framework for the Classification of AI Systems

• Verify and Validate
• Deploy
• Operate and Monitor

AI Lifecycle Summary

The document primarily addresses the Verify and Validate stage through bug bounty programs designed to identify vulnerabilities in AI products. It also covers the Deploy stage by requiring contractual provisions for bug bounty participation, and the Operate and Monitor stage through ongoing vulnerability discovery and congressional oversight of program implementation.

Technical Scope

Terms relating to technical scope that are mentioned or implicitly referenced in the document

• Foundation Models

Technical Scope Summary

The document explicitly mentions 'foundational artificial intelligence products' being incorporated by the Department of Defense. It does not define specific AI types, compute thresholds, or distinguish between model architectures. The focus is on AI products in general without technical specifications.