HR9333-119

What This Bill Does

The AI Flaw Reporting and Security Enhancement Act would require the National Institute of Standards and Technology, in consultation with the Cybersecurity and Infrastructure Security Agency, to operate a program supporting voluntary reporting, collection, and tracking of artificial-intelligence flaws. NIST must convene industry, universities, research institutions, nonprofits, standards organizations, civil-society groups, and public agencies to create common definitions and taxonomies for AI vulnerabilities, failure modes, accidents, hazards, misuse, incidents, and other safety or security problems. The program would also develop standards, severity or risk measures, detection methods, reporting practices, documentation formats, and norms for deciding whether and when flaws should be disclosed publicly.

NIST must build the reporting infrastructure itself or use cooperative agreements with one or more eligible universities, research institutions, or consortia. The infrastructure must include a national AI-flaw database or modify an existing national database. NIST must consider machine readability, interoperability with existing systems, future taxonomy and stakeholder updates, and policies for dissemination and public disclosure. Within three years of enactment, NIST must report to Congress on stakeholder findings, the infrastructure and database, and recommendations for standardized voluntary reporting mechanisms.

Who Benefits and How

AI developers, deployers, security teams, researchers, and standards organizations could use common terminology and severity measures to detect, compare, prioritize, and remediate flaws. AI users and members of the public could benefit from earlier identification of safety and security problems and more consistent public-disclosure practices. Universities, research institutions, and their consortia could receive cooperative agreements to develop or maintain the database. NIST, CISA, and other public agencies would gain a shared source of standardized information about emerging AI risks. Congressional committees would receive an implementation assessment and policy recommendations.

Who Bears the Burden and How

NIST staff must convene stakeholders, design definitions and standards, build or contract for reporting infrastructure, manage the national database, coordinate with CISA and other agencies, and prepare the three-year report. Universities or research contractors selected under cooperative agreements must develop, secure, maintain, and update the infrastructure. AI companies, academic researchers, nonprofits, and civil-society organizations that choose to participate may incur reporting, documentation, review, and disclosure costs, but the bill does not require them to submit a flaw. AI providers whose flaws are eventually disclosed could face remediation and reputational pressure, with the disclosure rules left to program norms rather than fixed by the bill.

Key Provisions

• Requires NIST and CISA consultation on a voluntary AI-flaw reporting and tracking program.
• Directs stakeholders to develop common flaw definitions, taxonomies, technical standards, risk measures, detection methods, and disclosure norms.
• Requires a national AI-flaw database that NIST or eligible research entities may develop and maintain.
• Allows cooperative agreements with universities, research institutions, or consortia for the reporting infrastructure.
• Requires NIST to report to Congress within three years on implementation and future standardized voluntary-reporting mechanisms.