I 

118TH CONGRESS 

2D SESSION H. R. 9720 

To direct the Director of the National Institute of Standards and Technology 

to update the national vulnerability database to reflect vulnerabilities 

to artificial intelligence systems, study the need for voluntary reporting 

related to artificial intelligence security and safety incidents, and for 

other purposes. 

IN THE HOUSE OF REPRESENTATIVES 

SEPTEMBER 20, 2024 

Ms. ROSS (for herself, Mr. OBERNOLTE, and Mr. BEYER) introduced the following bill; which was referred to the Committee on Science, Space, and 

Technology 

A BILL 

To direct the Director of the National Institute of Standards 

and Technology to update the national vulnerability database to reflect vulnerabilities to artificial intelligence systems, study the need for voluntary reporting related to 

artificial intelligence security and safety incidents, and 

for other purposes. 

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 

3 SECTION 1. SHORT TITLE. 

4 This Act may be cited as the ‘‘AI Incident Reporting 

5 and Security Enhancement Act’’. 


ssavage on LAPJG3WLY3PROD with BILLS
2 

•HR 9720 IH

1 SEC. 2. ACTIVITIES TO SUPPORT VOLUNTARY VULNER2 ABILITY AND INCIDENT TRACKING ASSOCI3 ATED WITH ARTIFICIAL INTELLIGENCE. 

4 (a) UPDATE TO NATIONAL VULNERABILITY DATA5 BASE.—Subject to the availability of appropriations, the 

6 Director of the National Institute of Standards and Tech7 nology, in coordination with industry stakeholders, stand8 ards development organizations, and appropriate Federal 

9 agencies, as appropriate, shall carry out the following: 

10 (1) Establish or identify common definitions 

11 and any characteristics of artificial intelligence secu12 rity vulnerabilities that make utilization of the Na13 tional Vulnerability Database inappropriate for the 

14 management of such vulnerabilities, and develop 

15 processes and procedures for vulnerability manage16 ment of such vulnerabilities. 

17 (2) Support the development of standards and 

18 guidance for technical vulnerability management 

19 processes related to artificial intelligence. 

20 (3) Consistent with paragraphs (1) and (2), as 

21 appropriate, initiate a process to update the Insti22 tute’s processes and procedures associated with the 

23 National Vulnerability Database to ensure such 

24 Database and associated vulnerability management 

25 processes incorporate artificial intelligence security 

26 vulnerabilities to the greatest extent practicable. 


ssavage on LAPJG3WLY3PROD with BILLS
3 

•HR 9720 IH

1 (b) ASSESSING VOLUNTARY TRACKING OF SUBSTAN2 TIAL ARTIFICIAL INTELLIGENCE SECURITY AND SAFETY

3 INCIDENTS.— 

4 (1) IN GENERAL.—Subject to the availability of 

5 appropriations, the Director of the National Insti6 tute of Standards and Technology, in consultation 

7 with the Director of the Cybersecurity and Infra8 structure Security Agency of the Department of 

9 Homeland Security, shall convene a multi-stake10 holder process to consider the development of a 

11 process relating to the voluntary collection, report12 ing, and tracking of substantial artificial intelligence 

13 security incidents and substantial artificial intel14 ligence safety incidents. 

15 (2) ACTIVITIES.—In carrying out paragraph 

16 (1), the Director of the National Institute of Stand17 ards and Technology shall convene appropriate rep18 resentatives of industry, academia, nonprofit organi19 zations, standards development organizations, civil 

20 society groups, Sector Risk Management Agencies, 

21 and appropriate Federal departments and agencies 

22 to carry out the following: 

23 (A) Establish common definitions and 

24 characterizations for relevant aspects of sub25 stantial artificial intelligence security incidents 


ssavage on LAPJG3WLY3PROD with BILLS
4 

•HR 9720 IH

1 and substantial artificial intelligence safety inci2 dents, which may include the following: 

3 (i) Classifications that sufficiently dif4 ferentiate between the following: 

5 (I) Artificial intelligence security 

6 incidents. 

7 (II) Artificial intelligence safety 

8 incidents. 

9 (ii) Taxonomies to classify incidents 

10 referred to in clause (i) based on relevant 

11 characteristics, impacts, or other appro12 priate criteria. 

13 (B) Assess the usefulness and cost-effec14 tiveness of an effort to voluntarily track sub15 stantial artificial intelligence security incidents 

16 and substantial artificial intelligence safety inci17 dents. 

18 (C) Identify and provide guidelines, best 

19 practices, methodologies, procedures, and proc20 esses for tracking and reporting substantial ar21 tificial intelligence security incidents and sub22 stantial artificial intelligence safety incidents 

23 across different sectors and use cases. 

24 (D) Support the development of standard25 ized reporting and documentation mechanisms, 


ssavage on LAPJG3WLY3PROD with BILLS
5 

•HR 9720 IH

1 including automated mechanisms, that would 

2 help provide information, including public infor3 mation, regarding substantial artificial intel4 ligence security incidents and substantial artifi5 cial intelligence safety incidents. 

6 (E) Support the development of norms for 

7 reporting of substantial artificial intelligence se8 curity incidents and substantial artificial intel9 ligence safety incidents, taking into account 

10 when it is appropriate to publicly disclose such 

11 incidents. 

12 (3) REPORT.—Not later than three years after 

13 the date of the enactment of this Act, the Director 

14 of the National Institute of Standards and Tech15 nology shall submit to Congress a report on a proc16 ess relating to the voluntary collection, reporting, 

17 and tracking of substantial artificial intelligence se18 curity incidents and substantial artificial intelligence 

19 safety incidents under paragraph (1). Such report 

20 shall include the following: 

21 (A) Findings from the multi-stakeholder 

22 process referred to in such paragraph. 

23 (B) An assessment of and recommenda24 tions for establishing reporting and collection 

25 mechanisms by which industry, academia, nonVerDate Sep 11 2014 19:02 Oct 03, 2024 Jkt 059200 PO 00000 Frm 00005 Fmt 6652 Sfmt 6201 E:\BILLS\H9720.IH H9720

ssavage on LAPJG3WLY3PROD with BILLS
6 

•HR 9720 IH

1 profit organizations, standards development or2 ganizations, civil society groups, and appro3 priate public sector entities may voluntarily 

4 share standardized information regarding sub5 stantial artificial intelligence security incidents 

6 and substantial artificial intelligence safety inci7 dents; 

8 (c) LIMITATION.—Nothing in this section provides 

9 the Director of the National Institute of Standards and 

10 Technology with any enforcement authority that was not 

11 in effect on the day before the date of the enactment of 

12 this section. 

13 (d) DEFINITIONS.—In this section: 

14 (1) ARTIFICIAL INTELLIGENCE.—The term ‘‘ar15 tificial intelligence’’ has the meaning given such 

16 term in section 5002 of the National Artificial Intel17 ligence Initiative Act of 2020 (15 U.S.C. 9401). 

18 (2) ARTIFICIAL INTELLIGENCE SECURITY VUL19 NERABILITY.—The term ‘‘artificial intelligence secu20 rity vulnerability’’ means a weakness in an artificial 

21 intelligence system, system security procedures, in22 ternal controls, or implementation that could be ex23 ploited or triggered by a threat source. 

24 (3) ARTIFICIAL INTELLIGENCE SYSTEM.—The 

25 term ‘‘artificial intelligence system’’ has the meaning 


ssavage on LAPJG3WLY3PROD with BILLS
7 

•HR 9720 IH

1 given such term in section 7223 of the Advancing 

2 American AI Act (40 U.S.C. 11301 note; as enacted 

3 as part of title LXXII of division G of the James 

4 M. Inhofe National Defense Authorization Act for 

5 Fiscal Year 2023; Public Law 117–263). 

6 (4) SECTOR RISK MANAGEMENT AGENCY.—The 

7 term ‘‘Sector Risk Management Agency’’ has the 

8 meaning given such term in section 2200 of the 

9 Homeland Security Act of 2002 (6 U.S.C. 650). 

10 (5) THREAT SOURCE.—The term ‘‘threat 

11 source’’ means any of the following: 

12 (A) An intent and method targeted at the 

13 intentional exploitation of a vulnerability. 

14 (B) A situation and method that may acci15 dentally trigger a vulnerability. 

Æ 


ssavage on LAPJG3WLY3PROD with BILLS