AI Flaw Reporting and Security Enhancement Act
- Sponsor
- Rep. Ross, Deborah K. [D-NC-2]
- Committees
- Science, Space, and Technology Committee (primary)
- Last action
- Jun 25, 2026
Bottom line
The bill aims to enhance AI safety and security by creating a standardized, voluntary system for identifying, reporting, and managing AI vulnerabilities and incidents across various sectors.
What it actually does
This bill directs the National Institute of Standards and Technology (NIST), in consultation with the Cybersecurity and Infrastructure Security Agency (CISA), to establish a program for the voluntary reporting, collection, and tracking of artificial intelligence (AI) flaws. The program would involve developing common definitions, technical standards, and methods for detecting and prioritizing AI flaws, and creating a national database for this information.
Proponents argue
Supporters argue that this bill is a crucial, proactive step to address the rapidly evolving risks associated with artificial intelligence. By establishing a voluntary reporting framework and a national database, it fosters a collaborative environment for identifying, understanding, and mitigating AI flaws without imposing burdensome regulations. This approach promotes transparency, shared learning, and the development of best practices across industry, academia, and government, ultimately leading to safer and more secure AI systems.
Opponents contend
Critics might contend that a purely voluntary reporting system may not be sufficient to capture the full scope of critical AI flaws, especially if companies are hesitant to report issues due to reputational concerns or potential legal liabilities. Some may argue that without stronger incentives or mandatory reporting mechanisms, the national database could remain incomplete, potentially creating a false sense of security or hindering a comprehensive understanding of AI risks. Others might express concerns about the breadth of the 'AI flaw' definition and its potential implications for innovation.
The bill is concise and can be read and understood by an informed reader within a short timeframe, allowing for adequate evaluation.
Section 2(a)
Establishment of AI Flaw Reporting and Security Enhancement Program
This provision directs the Director of the National Institute of Standards and Technology (NIST), in consultation with the Director of the Cybersecurity and Infrastructure Security Agency (CISA), to create a program. This program is designed to support the voluntary reporting, collection, and tracking of artificial intelligence flaws, aiming to centralize information on AI vulnerabilities and incidents.
Supporters argue
Supporters argue that establishing a dedicated program is essential for building a shared understanding of AI risks and fostering a culture of safety across the AI ecosystem. The voluntary nature is intended to encourage broad participation by reducing barriers to entry and concerns about punitive measures.
Critics contend
Critics might suggest that relying solely on voluntary reporting could lead to underreporting of critical flaws, especially by entities concerned about reputational damage or legal liability, thereby limiting the program's overall effectiveness.
Tradeoffs
The bill balances the desire for comprehensive data on AI flaws with the need to encourage participation through a voluntary framework, which inherently carries the risk of incomplete information.
Section 2(b)(1)-(3)
Development of Common Definitions, Standards, and Prioritization Methods for AI Flaws
This section mandates NIST to convene various stakeholders, including industry, academia, and civil society, to establish common definitions for terms related to AI flaws (e.g., vulnerabilities, failure modes, accidents, misuse). It also directs the development of taxonomies to classify these flaws (security-related, safety-related), technical standards, guidance, and methods for prioritizing remediation activities based on severity or risk.
Section 2(c)
Creation of a National AI Flaw Database and Infrastructure
This provision directs NIST to develop, or partner with eligible entities to develop, the necessary infrastructure for the voluntary reporting, collection, and tracking of artificial intelligence flaws. A key component of this infrastructure is a national database for AI flaws, or the modification of an existing database. The development must consider machine-readability, interoperability with existing systems, future updates, and policies for disseminating reported flaws and public disclosures.