Pandemic and All-Hazards Preparedness and Response Act, Sec. 407 ("Assessment of Artificial Intelligence Threats to Health Security")

• Authority: United States Congress
• Parent authority: Federal government
• Jurisdiction: United States
• Collections: U.S. federal laws
• Most recent activity: Defunct
• Most recent activity date: 2025-01-03

Risk subdomain coverage

Good coverage — Comprehensive governance measures or mitigations with clear procedures relating to the risk subdomain are explicitly described.

• Cyberattacks, weapon development or use
• Governance failure
• AI possessing dangerous capabilities

Minimal coverage — Brief mention but no specific mitigations, recommendations or governance measures relating to the risk subdomain are described.

• AI system security vulnerabilities
• Competitive dynamics
• Lack of capability or robustness

All other risk subdomains had no coverage in this document.

Risk Coverage Summary

The document has good coverage of approximately 5-6 subdomains, with strong focus on malicious actors (4.2 - CBRNE threats), AI system safety (7.2 - dangerous capabilities, 7.3 - lack of robustness), and governance (6.5 - governance failure). Coverage is concentrated in security, misuse prevention, and AI safety domains related to health security threats.

Sector coverage

Good coverage — Comprehensive governance measures or mitigations with clear procedures relating to the sector are explicitly described.

• Health Care & Social Assistance
• Public Administration (excl. National Security)
• National Security

Minimal coverage — Brief mention but no specific mitigations, recommendations or governance measures relating to the sector are described.

• Information
• Scientific Research & Development Services

All other sectors had no coverage in this document.

Sectors Summary

The document primarily governs the Health Care and Social Assistance sector through mandated assessment of AI threats to health security. It also has significant coverage of Public Administration (excluding National Security) through requirements for Federal agencies to assess their roles and capabilities. National Security is implicitly covered through assessment of CBRNE threats.

Legislative Status

Hard Law

Legislative Status Summary

This is a binding legislative act passed by the United States Congress with mandatory obligations on the Secretary of Health and Human Services, including specific timelines and reporting requirements to Congressional committees.

Actors

Proposer

• Entity Types: AI_Governance_Actor
• Entities: United States Congress
• Summary: The document is a section of an Act passed by the United States Congress, which is the legislative body that proposed and enacted this governance measure.

Target

• Entity Types: AI_Governance_Actor, AI_Developer
• Entities: Secretary of Health and Human Services; National Academies of Sciences, Engineering, and Medicine; Department of Health and Human Services agencies and offices; other Federal departments and agencies
• Summary: The document mandates actions by the Secretary of HHS and requires assessment of roles and responsibilities of HHS agencies and other Federal departments. It also implicitly targets AI developers through the assessment of AI vulnerabilities, particularly those developing open-source AI models.

Enforcer

• Entity Types: AI_Governance_Actor
• Entities: Committee on Health, Education, Labor, and Pensions of the Senate; Committee on Energy and Commerce of the House of Representatives; United States Congress
• Summary: Congressional committees are designated as the recipients of mandatory reports, providing oversight and enforcement through Congressional authority. The Secretary of HHS is also responsible for implementing actions based on the findings.

Monitor

• Entity Types: AI_Governance_Actor
• Entities: National Academies of Sciences, Engineering, and Medicine; Secretary of Health and Human Services; Committee on Health, Education, Labor, and Pensions of the Senate; Committee on Energy and Commerce of the House of Representatives
• Summary: The National Academies are tasked with conducting the assessment study and monitoring AI vulnerabilities. The Secretary of HHS is required to monitor and report on actions taken to mitigate risks. Congressional committees receive reports for ongoing oversight.

AI Lifecycle Stages

Lifecycle stages covered by the documents, as defined in the OECD Framework for the Classification of AI Systems

• Plan and Design
• Build and Use Model
• Verify and Validate
• Deploy
• Operate and Monitor

AI Lifecycle Summary

The document covers multiple AI lifecycle stages with primary focus on Operate and Monitor (ongoing Federal activities, risk monitoring), and Verify and Validate (assessment of vulnerabilities). It also addresses Plan and Design through recommendations for improving Federal efforts, and implicitly covers Build and Use Model through assessment of open-source AI models and technical advancements.

Technical Scope

Terms relating to technical scope that are mentioned or implicitly referenced in the document

• AI Models
• AI Systems
• Open Weight / Open Source

Technical Scope Summary

The document explicitly mentions AI models (specifically large language models and open-source AI models) and AI systems through references to 'artificial intelligence' and 'technical advancements in artificial intelligence'. It does not explicitly define or mention frontier AI, general purpose AI, task-specific AI, foundation models, generative AI, predictive AI, or compute thresholds.