Federal agency would develop voluntary AI guidance to fight cyberattacks

NIST would establish a group to develop voluntary standards and recommended practices for using AI to defend against cyberattacks. The group would focus on defensive uses of AI for cybersecurity. NIST would seek representatives from eligible AI businesses and owners and operators of essential infrastructure. NIST would establish the group within 180 days after enactment and publish its standards and recommended practices online within one year after the group is established.

NIST would seek business input to define AI distillation attacks and establish voluntary standards and recommended practices to detect and prevent them. The effort would cover a category called AI distillation attacks, which NIST and participating businesses would work to define. NIST would seek input from businesses that meet the bill’s AI-business eligibility rules. NIST would seek business input within 180 days after enactment. It would publish the standards and recommended practices online within one year after they are established.

NIST would apply eligibility rules when seeking AI-business input under these provisions. Eligible businesses would commercially build, train, use, or supply AI systems, or provide substantial computing, data, or technical support for them. They could qualify before earning revenue. Government bodies and wholly government-owned businesses would be excluded. The foreign-participant exclusion would cover foreign people or businesses headquartered in China, including Hong Kong and Macau, Russia, Iran, North Korea, or Cuba, or whose parent is headquartered there. It would also cover those directed or controlled by organizations with those headquarters ties, and others NIST designates for exclusion. U.S. citizens and lawful permanent residents would be exempt from the foreign-participant exclusion.