Artificial Intelligence Risk Management and Security Act of 2026

This bill establishes the Artificial Intelligence Safety Board within the Department of Commerce to address artificial intelligence risks, requires developers of frontier AI models to create and submit safety plans, creates a database for tracking AI security and safety incidents and flaws, and directs the National Institute of Standards and Technology to develop a profile and template for agentic AI systems.

Sec. 2, Definitions: Defines key terms including artificial intelligence, artificial intelligence agent, artificial intelligence capabilities or risk assessment, artificial intelligence flaw, artificial intelligence safety incident, artificial intelligence security incident, artificial intelligence security vulnerability, Board, critical infrastructure, developer, frontier artificial intelligence model, Institute, and Secretary.

Sec. 3, Artificial Intelligence Safety Board: Establishes a permanent board within the Department of Commerce within 30 days of enactment, composed of members selected by the Director of NIST, the Secretary of Commerce, the Director of CISA, the Director of NSA, and the Secretary of the Treasury, plus nongovernmental experts appointed by the Secretary. Members serve up to 3-year terms, may be reappointed once, and must obtain Top Secret security clearance. The Board sets its own bylaws and operating procedures, and the Secretary is directed to negotiate with foreign partners on cooperative activities, regulatory reciprocity, and intellectual property protection.

Sec. 4, Safety Plan Requirement: Each developer of a frontier AI model must create, publish, and follow a Model Safety Plan for each AI system or model they create, substantially modify, or use in training other models. The plan must include the model or system, an AI capabilities or risk assessment, specific mitigation measures, and the identity of the corporate officer responsible. Plans must be submitted to the Secretary.

Sec. 5, Database for Artificial Intelligence Security and Safety Incidents, Flaws, and Risks: Within 180 days, the Director of NIST, with CISA, must establish mechanisms for voluntary sharing of information on AI security or safety incidents and flaws. Within one year, a publicly accessible database of such incidents and flaws must be created. Mandatory reporting is required for developers or providers of frontier AI models and operators of critical infrastructure using AI in industrial control systems, with reports due within 30 days of confirmation, or 72 hours if an imminent threat exists. The Director prioritizes incidents involving critical infrastructure, high-severity impacts, widely used systems, or mandatory submissions. Information shared is exempt from disclosure and anonymized unless affected parties consent.

Sec. 6, Agentic Artificial Intelligence Trust and Verification: Within 18 months, the Director of NIST must develop a cross-sectoral Agentic AI Profile of the AI Risk Management Framework for AI agents, defining novel risks, classifying autonomy levels, and addressing cybersecurity risks. Also within 18 months, the Director must initiate development of a common template for documenting AI agents and their evaluation against standards, covering identity, intended use, ownership, access, evaluations, independent evaluators, and known limitations. The template is designed for use across sectors and organizations of different sizes.