Large AI defense contractors would report serious security risks

The Defense Secretary would set mandatory reporting rules for covered contractors. The rules would cover contractors holding or seeking at least $100 million in Defense Department AI contracts that meet a $1 billion, three-year AI research-spending test or use a model from a person meeting that test. Reports would cover security practices, major incidents, model capabilities and misuse risks, concerning behavior, unauthorized access attempts, and other acute national security risks. For an outside model used or proposed for a contract, the Secretary could require the contractor to obtain needed information from the model's developer or controller. The Secretary would issue the rules within 180 days after enactment. Contractors would submit information with a bid or proposal and certify it at least once every 90 days.

Covered contractors would report acute national security risks, and the Defense Secretary would alert relevant officials and lawmakers. The duty would cover information, incidents, or developments presenting an acute national security risk to the United States, including serious model compromises and dangerous model behavior. Contractors would provide known details about the incident, its possible effects, affected systems, and steps taken in response. The reporting rules would protect classified, proprietary, security-sensitive, and vulnerability information and would not require improper public disclosure. Contractors would report within 72 hours after becoming aware of the risk. For a contractor notice, the Secretary would notify the Senate and House Armed Services Committees within seven days after receiving it and provide later updates as important information emerges.

The Defense Secretary would issue voluntary security guidance, assess insider risks, update the guidance, and report on implementation. The guidance would help covered contractors reduce insider threats, espionage, and other personnel-related risks to sensitive AI assets, focusing on highly capable foreign governments. The guidance would suggest stronger safeguards for roles and systems with greater access, sensitivity, or national security risk. Contractors would not be required to adopt any suggested personnel policy, access restriction, or other safeguard. Initial guidance would be due within 180 days after enactment. The risk assessment, updated guidance, and implementation report would be due within one year after enactment.