Secure Artificial Intelligence Act of 2024

• Authority: United States Congress
• Parent authority: Federal government
• Jurisdiction: United States
• Collections: U.S. federal laws
• Most recent activity: Defunct
• Most recent activity date: 2025-01-03

Risk subdomain coverage

Good coverage — Comprehensive governance measures or mitigations with clear procedures relating to the risk subdomain are explicitly described.

• AI system security vulnerabilities
• Cyberattacks, weapon development or use
• Governance failure
• Lack of capability or robustness

Minimal coverage — Brief mention but no specific mitigations, recommendations or governance measures relating to the risk subdomain are described.

• Compromise of privacy
• Competitive dynamics
• AI possessing dangerous capabilities
• Lack of transparency or interpretability

All other risk subdomains had no coverage in this document.

Risk Coverage Summary

The document has good coverage of approximately 6-8 subdomains, with strong focus on AI system security vulnerabilities (2.2), malicious actors using AI for cyberattacks (4.2), competitive dynamics (6.4), governance failure (6.5), and AI safety failures (7.2, 7.3). Coverage is concentrated in security, vulnerability management, and system safety domains.

Sector coverage

Good coverage — Comprehensive governance measures or mitigations with clear procedures relating to the sector are explicitly described.

• Information
• Scientific Research & Development Services
• Public Administration (excl. National Security)
• National Security

Minimal coverage — Brief mention but no specific mitigations, recommendations or governance measures relating to the sector are described.

• Trade, Transportation & Utilities
• Professional & Technical Services
• Educational Services

All other sectors had no coverage in this document.

Sectors Summary

The document primarily governs the National Security sector through requirements for NSA, CISA, and national security systems. It also has significant coverage of the Information sector through AI security research and development activities, and the Scientific Research and Development Services sector through academic researcher participation in the AI Security Center test-bed.

Legislative Status

Hard Law

Legislative Status Summary

This is a binding legislative act introduced in the United States Senate with mandatory requirements for federal agencies (CISA, NIST, NSA) to establish databases, update processes, and create an AI Security Center. The document uses mandatory language throughout ('shall') and establishes legally enforceable obligations on government agencies.

Actors

Proposer

• Entity Types: AI_Governance_Actor
• Entities: United States Congress; Senator Warner; Senator Tillis; Committee on Commerce, Science, and Transportation
• Summary: The bill was introduced in the United States Senate by Mr. Warner and Mr. Tillis and referred to the Committee on Commerce, Science, and Transportation, indicating these are the proposing entities.

Target

• Entity Types: AI_Governance_Actor, AI_Developer, AI_Infrastructure_Provider
• Entities: National Institute of Standards and Technology (NIST); Cybersecurity and Infrastructure Security Agency (CISA); National Security Agency (NSA); private sector entities; public sector organizations; civil society groups; academic researchers; Federal agencies; commercial model vendors; managers of national security systems; defense industrial base
• Summary: The Act targets federal agencies (NIST, CISA, NSA) with mandatory obligations to establish processes and databases. It also creates voluntary participation mechanisms for private sector entities, academic researchers, and model vendors to report incidents and participate in research.

Enforcer

• Entity Types: AI_Governance_Actor
• Entities: Director of the National Institute of Standards and Technology; Director of the Cybersecurity and Infrastructure Security Agency; Director of the National Security Agency; Director of the Office of Management and Budget
• Summary: The Directors of NIST, CISA, and NSA are designated as the primary enforcement authorities responsible for implementing the Act's requirements, establishing databases, updating processes, and creating the AI Security Center.

Monitor

• Entity Types: AI_Governance_Actor
• Entities: National Institute of Standards and Technology; Cybersecurity and Infrastructure Security Agency; National Security Agency; Artificial Intelligence Security Center; Artificial Intelligence Safety Institute; relevant congressional committees (Committee on Homeland Security and Governmental Affairs, Committee on Commerce, Science, and Transportation, Select Committee on Intelligence, Committee on the Judiciary, Committee on Oversight and Accountability, Committee on Energy and Commerce, Permanent Select Committee on Intelligence)
• Summary: NIST and CISA are responsible for maintaining databases and tracking incidents. The AI Security Center coordinates research and monitoring. Congressional committees receive reports on implementation and sufficiency of processes.

AI Lifecycle Stages

Lifecycle stages covered by the documents, as defined in the OECD Framework for the Classification of AI Systems

• Plan and Design
• Collect and Process Data
• Build and Use Model
• Verify and Validate
• Deploy
• Operate and Monitor

AI Lifecycle Summary

The document primarily addresses the Deploy and Operate and Monitor lifecycle stages through its focus on vulnerability tracking, incident reporting, and post-deployment security monitoring. It also covers Build and Use Model through supply chain risk considerations and Verify and Validate through the establishment of research test-beds for security testing.

Technical Scope

Terms relating to technical scope that are mentioned or implicitly referenced in the document

• AI Models
• AI Systems
• Open Weight / Open Source

Technical Scope Summary

The document explicitly mentions AI systems and AI models throughout, with particular focus on security vulnerabilities and incidents. It does not specifically mention frontier AI, general purpose AI, foundation models, or compute thresholds. The document addresses both the security aspects of AI systems broadly and specific technical vulnerabilities.