Federal Information Security Modernization Act of 2023, Sec. 14 ("Automation and Artificial Intelligence")

• Authority: United States Congress
• Parent authority: Federal government
• Jurisdiction: United States
• Collections: U.S. federal laws
• Most recent activity: Defunct
• Most recent activity date: 2025-01-03

Risk subdomain coverage

Good coverage — Comprehensive governance measures or mitigations with clear procedures relating to the risk subdomain are explicitly described.

• AI system security vulnerabilities

Minimal coverage — Brief mention but no specific mitigations, recommendations or governance measures relating to the risk subdomain are described.

• Compromise of privacy
• Cyberattacks, weapon development or use
• Competitive dynamics
• Governance failure

All other risk subdomains had no coverage in this document.

Risk Coverage Summary

The document has minimal to good coverage of approximately 4-5 subdomains, with primary focus on AI system security (2.2), privacy compromise (2.1), governance failure (6.5), and competitive dynamics (6.4). Coverage is concentrated in security, privacy, and governance domains related to federal cybersecurity automation.

Sector coverage

Good coverage — Comprehensive governance measures or mitigations with clear procedures relating to the sector are explicitly described.

• Public Administration (excl. National Security)

All other sectors had no coverage in this document.

Sectors Summary

This document exclusively governs the Public Administration sector, specifically federal agencies' use of AI for cybersecurity purposes. It does not regulate private sector activities or other economic sectors.

Legislative Status

Hard Law

Legislative Status Summary

This is a binding federal statute enacted by the United States Congress with mandatory obligations on federal agencies, enforceable through congressional oversight and administrative mechanisms.

Actors

Proposer

• Entity Types: AI_Governance_Actor
• Entities: United States Congress
• Summary: The document is a section of federal legislation enacted by the United States Congress, as indicated by the statutory format and authority structure.

Target

• Entity Types: AI_Governance_Actor, AI_Deployer
• Entities: Federal agencies; the Director; head of each agency
• Summary: The document explicitly targets federal agencies and their leadership, requiring them to use AI for cybersecurity purposes and consider AI capabilities in automation.

Enforcer

• Entity Types: AI_Governance_Actor
• Entities: United States Congress; appropriate congressional committees; Committees on Homeland Security and Governmental Affairs; Commerce, Science, and Transportation of the Senate; Committees on Oversight and Accountability; Homeland Security; Science, Space, and Technology of the House of Representatives
• Summary: Congressional committees are designated to receive mandatory reports and oversee compliance, with the Comptroller General conducting independent assessments.

Monitor

• Entity Types: AI_Governance_Actor
• Entities: the Director; Comptroller General of the United States; appropriate congressional committees
• Summary: The Director must submit annual reports on AI use in cybersecurity, while the Comptroller General is mandated to conduct studies and report on risks and automation use.

AI Lifecycle Stages

Lifecycle stages covered by the documents, as defined in the OECD Framework for the Classification of AI Systems

• Deploy
• Operate and Monitor

AI Lifecycle Summary

The document primarily addresses the Deploy and Operate and Monitor stages of the AI lifecycle, focusing on the use of AI systems for federal cybersecurity purposes and ongoing reporting requirements. It does not substantially cover earlier stages like planning, data collection, or model building.

Technical Scope

Terms relating to technical scope that are mentioned or implicitly referenced in the document

• AI Systems

Technical Scope Summary

The document explicitly mentions AI systems and artificial intelligence in the context of federal cybersecurity automation. It does not specify particular types of AI (frontier, general purpose, task-specific, foundation models, generative, or predictive) nor does it mention compute thresholds or open-weight models.