The Commerce Department is set to publish a proposed rule on Wednesday that aims to implement reporting requirements for U.S. companies regarding the development of dual-use foundation artificial intelligence (AI) models.
Set to publish in the Federal Register by Commerce’s Industry and Security Bureau (BIS), the rule is mandated under President Biden’s October 2023 executive order on AI, which requires Commerce to learn more about computing clusters and dual-use foundation AI models in an “ongoing assessment of the AI industry.”
The 2023 EO, Commerce said, directs the agency to “require companies, individuals, or other organizations or entities that acquire, develop, or possess a potential large-scale computing cluster to report any such acquisition, development, or possession, including the existence and location of these clusters and the amount of total computing power available in each cluster.”
The Commerce Department will seek public comment on the proposed rule, with an expected deadline of 30 days after its publication in the Federal Register.
“Today’s proposed rule requires developers of the most powerful AI models and computing clusters to provide detailed reporting to the federal government,” the agency said. “This includes reporting about developmental activities, cybersecurity measures, and outcomes from red-teaming efforts, which involve testing for dangerous capabilities like the ability to assist in cyberattacks or lower the barriers to entry for non-experts to develop chemical, biological, radiological, or nuclear weapons.”
“This proposed reporting requirement would help us understand the capabilities and security of our most advanced AI systems,” Alan Estevez, the under secretary of Commerce for industry and security, said in a statement on the proposed rule. “It would build on BIS’s long history conducting defense industrial base surveys to inform the American government about emerging risks in the most important U.S. industries.”
“As AI is progressing rapidly, it holds both tremendous promise and risk,” said Commerce Secretary Gina Raimondo. “This proposed rule would help us keep pace with new developments in AI technology to bolster our national defense and safeguard our national security.”
“This action demonstrates the U.S. government’s proactive thinking about the dual-use nature of advanced AI,” added Assistant Secretary of Commerce for Export Administration Thea D. Rozman Kendler. “Through this proposed reporting requirement, we are developing a system to identify capabilities emerging at the frontier of AI research.”
The proposed rule would require companies to report information on cybersecurity measures, current development plans, dual system characteristics, the reliability of AI models, and multi-input processing abilities to the Federal government.
The requirements for that reporting are established under the Defense Production Act – which gives the government power to acquire industry information that would support national defense production.
“It is essential to the national defense that the defense industrial base is able to integrate dual-use foundation models,” the proposed rule’s draft reads. “Indeed, because industries and governments across the world are actively working to integrate dual-use foundation models into their defense capabilities, the U.S. defense industrial base will need to integrate dual-use foundation models to remain internationally competitive.”
The proposed rule follows a BIS pilot survey conducted earlier this year that found that the information collected under the new rules would be “vital for ensuring these technologies meet stringent standards.”
The proposed rule states that AI is currently being used to enhance military equipment and protect critical national defense systems. Given this, the rule emphasizes information that proves the safety and reliability of AI systems, with a focus on cybersecurity, noting that dual-use systems can be “disabled or manipulated by hostile actors.”
Companies developing large-scale computer clusters – combining multiple computers to handle complex tasks with shared processing power – will be asked to provide information on whether they own or will acquire clusters in addition to their computing power.
Companies developing dual-use AI systems and computer clusters would be required to report information to BIS quarterly, according to the proposed rule.
