The US Department of Commerce has unveiled new proposed regulations aimed at increasing oversight of cloud providers and artificial intelligence (AI) developers. The rule mandates that entities engaged in developing powerful AI models and computing clusters submit “detailed reporting” to the federal government. This reporting will encompass various aspects including developmental activities, cybersecurity measures, and outcomes from red-teaming exercises—where simulated cyber attacks test system defenses.
Gina Raimondo, US Secretary of Commerce, emphasized the importance of the proposed rule, stating, “As AI is progressing rapidly, it holds both tremendous promise and risk. This proposed rule would help us keep pace with new developments in AI technology to bolster our national defense and safeguard our national security.”
Alan Estevez, Under Secretary of Commerce for Industry and Security, added, “This proposed reporting requirement would help us understand the capabilities and security of our most advanced AI systems.” He noted that the initiative would build on the Bureau of Industry and Security’s (BIS) longstanding practice of conducting defense industrial base surveys to identify emerging risks in critical US industries.
The proposed regulation follows a BIS pilot survey conducted earlier this year, which highlighted the necessity of detailed information to ensure that AI and computing clusters adhere to rigorous safety and reliability standards. Given the significant role of cloud computing in AI development, the new rule will also extend to major cloud providers managing substantial computing clusters.
This development aligns with prior US government measures concerning AI security. In October 2023, President Joe Biden signed an executive order requiring the developers of AI systems that could pose risks to national security, the economy, or public health to report their findings to the government before publication. The order also mandated the reporting of any acquisition, development, or possession of large-scale computing clusters, including their existence, location, and total computing power.