H.R. 9477: AI Incident Reporting Act

This bill would create a federal reporting system for certain high-risk artificial intelligence models and the companies that develop them.

What the bill would require

The Secretary of Commerce would have to set rules, within 180 days, to decide which AI models and developers are covered by the law. The rules would focus on models that could pose significant risks to national security or public safety.

If a covered AI developer learns, or reasonably believes, that a specified kind of serious incident or risky capability has occurred, it would have to report it to the Department of Commerce within 7 days. In urgent cases involving imminent or ongoing serious harm, the bill would allow faster reporting.

What kinds of incidents would have to be reported

The bill lists several types of reportable activity, including:

• AI behavior suggesting it is trying to evade human oversight, deceive evaluators, resist shutdown, bypass safeguards, or gain unauthorized access.
• The theft, attempted theft, or unauthorized access to model weights, or signs that model weights have been compromised or are being exfiltrated.
• Capabilities that could significantly help offensive cyberattacks against software, digital infrastructure, industrial systems, or critical infrastructure.
• Evidence that a model can meaningfully speed up the development or improvement of advanced AI systems in ways that could create serious risk.
• Capabilities that could materially help develop or use chemical, biological, radiological, nuclear, or explosive weapons.
• Situations where one of these harms was likely, but was avoided only because of outside factors rather than the developer’s safeguards.
• Other similar risks that the Secretary of Commerce later adds by rule.

What the reports would have to include

Reports would need to describe the incident or capability, when it was discovered, any known or suspected cause or threat actor, and any likely impact on national security or public safety. The Department of Commerce could also require additional information.

Developers would also have to file follow-up reports as more information becomes available, including details on steps being taken to reduce the risk.

Government notification and use of the reports

If a report shows an imminent or ongoing serious harm risk, the Secretary of Commerce would have to notify specified congressional leaders within 48 hours. For other reports, notification would be due within 30 days.

The bill says the information in these reports would be protected from public disclosure, would not waive trade secret or attorney-client protections, and generally could not be used in civil lawsuits or as the basis for regulation or enforcement against the reporting developer. At the same time, the information could still be used by the government to respond to, reduce, or prevent national security or public safety risks, and to check compliance with the reporting law itself.

Enforcement

The Secretary of Commerce would have authority to issue rules and guidance, demand records and other information, conduct investigations, use subpoenas, require corrective action, and refer cases to the Attorney General. Violations could lead to civil penalties of up to $2 million, with each day of a continuing violation counted separately.

Who would count as covered

The law would apply to developers of AI models that the Secretary designates as covered models. It would also apply to entities that substantially modify a covered model in a way that brings it within the coverage thresholds.

Relevant Companies

• None found