What changed between these versions
A substantive restructuring and expansion. v2 renumbers sections, redefines "AI test project" and "financial product, service, or activity," and significantly expands the application requirements and agency review process for AI Innovation Labs. It also adds new provisions for interagency coordination and a notice of intervening agency.
Overview
Extensive changes throughout the bill, including renumbering of sections, modifications to definitions, and significant expansion of the application and review processes. · v2 clarifies and expands the scope of AI test projects, adds more detailed requirements for applications, strengthens interagency coordination, and provides more specific conditions for agency review and enforcement actions.
The bill undergoes a significant restructuring, renumbering sections and expanding key definitions. Most notably, the application process for AI test projects is substantially enhanced with more detailed content requirements, explicit provisions for managing cybersecurity risks, and a new mechanism for an "intervening agency" to require joint approval. Additionally, v2 introduces a dedicated section for interagency coordination and consultation among financial regulatory agencies.
Major additions
This new paragraph introduces a "Notice of intervening agency" process. If a financial regulatory agency receives notice of an application for an AI test project concerning a regulation it issued or enforces, it can issue a notice of intervention within 30 days.
This significantly impacts the approval process for AI test projects, as an intervening agency's notice requires joint approval for the project to take effect, potentially adding another layer of regulatory scrutiny and coordination.
This new subsection mandates interagency coordination and consultation among financial regulatory agencies. They are required to consult, share information, and coordinate, and may enter into a joint memorandum of understanding to facilitate joint approvals, establish best practices for AI Innovation Labs, and avoid duplicative efforts.
This addition aims to streamline the regulatory environment for AI test projects by fostering collaboration among agencies, potentially reducing friction and inconsistencies in oversight, and promoting a more unified approach to AI innovation in financial services.
This new clause clarifies that nothing in the denial, resubmittal, and relief provisions shall be construed to limit a financial regulatory agency's authority to issue an administrative order to cease the activity of an active AI test project if such activity is causing unmitigable or irreparable harm to consumers, investors, or financial stability.
This strengthens the immediate enforcement powers of regulatory agencies, allowing them to halt harmful AI test projects more swiftly through administrative orders, even if an injunction process is ongoing or not yet initiated. This provides an additional layer of consumer and market protection.
Requires regulations to include requirements for regulated entities to report the status and progress of AI test projects at a frequency reasonably necessary for carrying out the Act and the rules promulgated thereunder.
This ensures ongoing oversight and data collection for approved AI test projects, allowing agencies to monitor their development and impact more closely.
Requires regulations to include requirements for regulated entities to make disclosures reasonably appropriate to inform consumers or investors regarding any direct interaction with an AI test project, which shall be tailored to the scale, scope, and risks thereof and describe the nature of the AI test project and its applicable alternative compliance strategy.
This mandates transparency for consumers and investors, ensuring they are informed when interacting with AI test projects operating under alternative compliance strategies, thereby enhancing consumer protection.
Requires regulations to include consideration of the type and capabilities of proposed AI test projects' relevant AI technologies, systems, and applications in the development of applicable guidance and requirements.
This ensures that regulatory guidance and requirements are tailored to the specific nature and risks of the AI technologies being tested, promoting more effective and relevant oversight.
Requires regulations to include procedures for assigning appropriate personnel to serve as liaisons and points of contact for regulated entities with approved AI test projects.
This aims to improve communication and support for regulated entities participating in AI Innovation Labs, facilitating smoother project implementation and regulatory interaction.
Deletions
This section was a general "Rule of Construction" stating that nothing in the section may be construed to limit the authority of a financial regulatory agency to take an enforcement action against a regulated entity with respect to fraud relating to an AI test project.
While the exact text is deleted, the substance of this rule of construction is integrated and expanded upon in v2 Section 4(a)(7)(F), which clarifies that the approval or denial process does not limit agency authority regarding fraud, market manipulation, or unsafe/unsound practices. Therefore, the deletion is more of a relocation and refinement rather than a removal of the underlying principle.
Modifications
The inclusion of "activity" broadens the types of initiatives that can qualify as an AI test project. The new explicit requirement for an application for waiver/modification clarifies that the definition only applies to projects seeking regulatory relief through the Innovation Labs, making the definition more precise and tied to the core purpose of the labs.
Before
Defined an "AI test project" as a financial product or service that falls under agency jurisdiction, uses AI, and is subject to federal regulation or statute.
After
Redefines "AI test project" to include "financial product, service, or activity" (instead of "financial product or service") and adds a new condition: it must be "for which a regulated entity submits an application for the waiver or modification of an applicable regulation subject to an alternative compliance strategy."
This modification means that for security-based swap entities, the SEC is the appropriate financial regulatory agency for all their activities, not just those specifically requiring registration under the Securities Exchange Act of 1934. This could lead to broader SEC oversight for these entities within the AI Innovation Labs framework.
Before
Included security-based swap entities registered with the Commission "with respect to the security-based swap activities of the person that require such person to be registered under such Act."
After
Removes the qualifying phrase "with respect to the security-based swap activities of the person that require such person to be registered under such Act."
The inclusion of "internal activity" significantly broadens the types of AI applications that can be considered for an AI test project, allowing regulated entities to experiment with AI in their back-office operations, risk management, or compliance processes, not just customer-facing products. This could encourage innovation in internal efficiencies.
Before
Defined "financial product or service" by referencing section 1002 of the Consumer Financial Protection Act of 2010, including specific financial activities and the offer/sale of securities, and explicitly excluding the business of insurance.
After
Renames the term to "Financial product, service, or activity." It expands the definition to explicitly include "any internal activity of a regulated entity that is carried out in furtherance of the offering or sale of a product, service, or activity described in subparagraph (A);" and clarifies the exclusion of insurance by referencing section 1002 of the Consumer Financial Protection Act of 2010.
This explicitly includes insured credit unions under the definition, ensuring that they are clearly eligible to participate in the AI Innovation Labs, which was implicitly covered but now explicitly stated.
Before
Defined "regulated entity" as an entity regulated by any financial regulatory agency.
After
Redefines "regulated entity" as "an entity regulated, or insured in the case of a credit union, by any financial regulatory agency."
This modification explicitly encourages the use of AI for regulatory compliance practices within the labs, signaling that agencies should avoid enforcement actions that would hinder such innovation. This could incentivize regulated entities to develop AI solutions for compliance.
Before
Stated each agency shall establish an AI Innovation Lab to enable experimentation "without unnecessary or unduly burdensome regulation or expectation of enforcement actions, pursuant to the approval of an application under paragraph (2)."
After
Retains the core purpose but adds "including enforcement actions that disincentivize the substantial use of artificial intelligence to enhance regulatory compliance practices" to the "without unnecessary or unduly burdensome regulation or expectation of enforcement actions" clause. It also updates the cross-reference to "pursuant to the approval of an application under section 4."
This provides a grace period for agencies to establish their AI Innovation Labs and promulgate necessary regulations before regulated entities can begin submitting applications, ensuring a more prepared regulatory environment.
Before
Stated a regulated entity may submit an application to the appropriate financial regulatory agency.
After
Adds "Beginning one year after the date of enactment of this Act" to specify when applications can start being submitted.
This increases the burden on applicants but provides agencies with much more comprehensive information to assess AI test projects. The focus on cybersecurity, statutory purpose, and specific AI capabilities aims to ensure more robust risk management and a clearer understanding of the project's implications before approval. The explicit mention of deposit/share insurance fund risk adds a layer of protection for federal insurance funds.
Before
Required a description of the project, an alternative compliance strategy (identifying regulations to waive/modify, proposing alternative methods, explaining risk management), an explanation of public interest/innovation benefits, a proposed termination date, limitations, a business plan, and economic impact estimate.
After
Significantly expands the required contents: (A) now requires "the type and capabilities of the relevant AI technologies, systems, and applications; and the purposes and goals of the AI test project." (B) now requires the alternative method to comply with "the Federal statute under which the regulation identified in clause (i) is promulgated and the purpose of such regulation," and explicitly mentions managing "cybersecurity risks." It also adds requirements to describe "applicable plans and policies related to risk assessments, testing, controls, documentation, and monitoring" and "policies for the regulated entity to maintain... records of the activities of the AI test project." (C) adds "a significant risk of loss to the Deposit Insurance Fund or the National Credit Union Share Insurance Fund where the regulated entity is an insured depository institution or insured credit union" to the risks that the project "would not present." (G) now requires "economic, market, operational, and public interest impact."
This provides greater legal precision regarding which agencies must jointly approve an application when multiple regulators are involved, potentially streamlining the process by clearly defining jurisdictional boundaries for joint approvals.
Before
Allowed an application to include an alternative compliance strategy for a regulation issued/enforced by a non-appropriate financial regulatory agency. Required submission to both agencies and joint approval.
After
Clarifies the submission requirement for the "other financial regulatory agency" to be one that "issued the regulation... and has jurisdiction over the regulated entity with respect to such regulation; or enforces the regulation... with respect to the regulated entity." It also clarifies that joint approval is required by "the appropriate financial regulatory agency; and each other financial regulatory agency described in clause (i)(II)."
This narrows the scope of agencies that must receive notice to those with direct regulatory or enforcement authority over the entity or the specific regulation in question, potentially reducing unnecessary notifications.
Before
Required a regulated entity regulated/supervised by more than one agency to provide notice to each such agency within 5 business days of submission.
After
Changes "regulated or supervised by" to "regulated by, or subject to regulations that are enforced by," and removes the "supervised by" language.
These changes provide agencies with more explicit tools and clearer procedures for reviewing and overseeing AI test projects. The ability to request additional information and the explicit administrative cease-and-desist power enhance regulatory control and consumer protection. The refined automatic approval mechanism ensures a timely decision.
Before
Required agency review and determination within 120 days. Approval if "more likely than not" requirements met, specifying terms. Denials required written notice and 30-day enforcement delay. Resubmittals limited to 2. Injunctive relief for immediate danger/risk. Extension by 120 days, with automatic approval if no determination.
After
In general (A): Clarifies "complete application" and adds "assess, to the extent reasonably practicable, the applicant's ability to satisfy the standards described in subparagraphs (B) and (C) of paragraph (2)." Approval (B): Clarifies that limitations/conditions are "subject to limitations or conditions described in subclauses (IV) and (V) of clause (i)." For enforcement by another agency (iii), it adds conditions: "such other financial regulatory agency issued or enforces such regulation" and "the approval of such other financial regulatory agency was required for the AI test project under paragraph (4)(B)(ii)(II) or (6)(B)." It also removes the specific "Rule of construction" from v1 3(b)(2)(B)(IV) and replaces it with a broader one in 4(a)(7)(F). Denial, resubmittal, and relief (C): Adds "Notwithstanding clause (i)(II)" to the injunctive relief provision, clarifying that the 30-day delay for enforcement does not apply to injunctive relief. Extension; failure to make a determination (D): Clarifies the extension period as "one additional 120-day period" (total 240 days) and states that if no determination by the end of the initial 120-day period (or 240-day period), the application "shall be deemed to have approved the application." (v1 said "will automatically be deemed approved and effective"). Additional information (E): New clause explicitly allowing agencies to request additional information during the review period. Rule of construction on fraud and market manipulation authority (F): New clause explicitly stating that nothing in the approval/denial process limits agency authority for fraud, market manipulation, or unsafe/unsound practices.
This ensures that the regulatory framework for AI Innovation Labs is more comprehensive and detailed from the outset, covering aspects like ongoing reporting and consumer disclosures, which were not explicitly mentioned in v1. The change in termination date requirement from "not earlier than 1 year" to "a specified termination date" gives agencies more flexibility in setting project durations.
Before
Required regulations to be promulgated within 180 days, published for 60-day comment, and include procedures for modifying projects, consequences for non-compliance, a minimum 1-year termination date, extension procedures, confidentiality, and coordination.
After
Retains core requirements but adds several new specific requirements for the regulations: Procedures (B)(i): Now explicitly includes "submitting applications for AI test projects." Termination date (B)(iii): Changes "a requirement that an AI test project will terminate not earlier than 1 year after the AI test project is approved" to "a requirement that an AI test project will include a specified termination date." Extension procedures (B)(iv): Now specifies "for a specified time period." Confidentiality (B)(vii): Now "procedures for maintaining, as appropriate and consistent with applicable law, the confidentiality, security, and privacy of information." Also incorporates new requirements (v), (vi), (viii), (ix) as major additions.
The classified annex provision allows for the reporting of sensitive information to Congress without public disclosure, potentially enabling a more complete assessment of AI test projects, especially those with national security implications, while maintaining confidentiality.
Before
Required an annual report to Congress, starting 2 years after enactment and for 7 years thereafter, on AI test project outcomes, including aggregated findings, trends, and lessons learned, but no names or proprietary info.
After
Retains the core reporting requirement (a) but adds a new subsection (b) on "Confidentiality." This new subsection explicitly states the report "may not include the names of participating entities or any proprietary or confidential business information" and "where appropriate, may contain a classified annex."
Scope
Meaningful expansion or narrowing — Changes are scattered throughout the bill, affecting definitions, the establishment of AI Innovation Labs, the detailed application and review processes, interagency coordination, and reporting requirements. — v2 represents a refinement and strengthening of the regulatory framework for AI Innovation Labs. While maintaining the core policy of fostering AI experimentation, it introduces more detailed requirements for applications, enhances interagency oversight, and provides clearer mechanisms for regulatory intervention, particularly concerning risks and consumer protection. — The changes, particularly in definitions and application requirements, interact significantly with the core operative provisions of the bill, making the process more structured and robust. The new interagency coordination provisions also create a framework for how different regulatory bodies will interact regarding these projects.
Impact analysis
Regulated entities seeking to experiment with AI test projects
Procedural change with increased burden, but also increased clarity and support.
Face more comprehensive application requirements, including detailed information on AI technologies, cybersecurity risks, and record-keeping policies. They also benefit from clearer guidelines on interagency coordination and dedicated liaison personnel.
Financial regulatory agencies
Gain increased authority and procedural clarity.
Gain enhanced oversight capabilities, including the ability to request more detailed information, issue administrative cease-and-desist orders for unmitigable harm, and formally intervene in applications affecting their regulations. They are also mandated to coordinate more formally.
Consumers and investors interacting with AI test projects
Gain increased transparency and protection.
Will receive disclosures regarding their direct interaction with AI test projects, detailing the nature of the project and its alternative compliance strategy. They also benefit from strengthened agency powers to address immediate dangers or harms.
Insured depository institutions and insured credit unions
Procedural change, requiring additional risk assessment.
Applications for AI test projects must now explicitly address whether the project would present a significant risk of loss to the Deposit Insurance Fund or the National Credit Union Share Insurance Fund.
Security-based swap execution facilities, data repositories, dealers, or major participants
Procedural change, potentially broadening regulatory oversight.
The SEC's role as the "appropriate financial regulatory agency" for these entities is broadened to cover all their activities, not just those requiring registration under the Securities Exchange Act of 1934.