Certain large AI providers would need shutdown tools and incident reports

Federal officials would set and update rules deciding which AI providers and systems are covered. Providers must operate the AI system, or a system incorporating it, and offer others access through an interface, hosted service, or similar method. Starting coverage requires at least $500 million in prior-year revenue from the technology, counting affiliated businesses. The AI system must have used development computing power valued above $100 million at prevailing U.S. cloud prices. Providers operating or offering the technology only for personal, academic, or noncommercial use would be exempt. Officials would update the definitions within 90 days after enactment and annually afterward.

Covered AI providers would maintain tools to stop their systems, end user access, and suspend risky accounts or uses. Starting coverage requires offering others access, at least $500 million in prior-year technology revenue including affiliates, and AI development computing power valued above $100 million. Providers operating or offering the technology only for personal, academic, or noncommercial use would be exempt. Officials would issue these requirements within 90 days after enactment and update them annually.

Federal officials could order the provider involved in a specified incident to restrict or shut down its AI system. The order would apply to the covered provider involved in the incident. Officials would need to determine that an incident occurred, and the response must match its nature and urgency. Incidents include obstructing a lawful shutdown, hiding information from monitoring or shutdown tools, or pursuing an unintended goal. Unintended AI behavior causing at least 10 deaths or at least $100 million in economic damage would also qualify. Incidents during structured safety testing would be excluded. Providers could request reconsideration within 48 hours after an order.

Federal officials could fine covered providers for violating the requirements. The higher limit would apply to violations of the emergency-order requirements. A fine would require reasonable notice and an opportunity for a hearing. Officials would consider the violation’s seriousness, the provider’s fault, and its efforts to comply. Minor violations or technical defects corrected within 30 days of discovery would not count as violations. The fine limits would apply for each day a violation occurs.