SEC. 2. ACTIVITIES TO SUPPORT VOLUNTARY VULNER-
ABILITY AND INCIDENT TRACKING ASSOCI-
ATED WITH ARTIFICIAL INTELLIGENCE. 
(a) UPDATE TO NATIONAL VULNERABILITY DATA-
BASE.—Subject to the availability of appropriations, the 
Director of the National Institute of Standards and Tech-
nology, in coordination with industry stakeholders, stand-
ards development organizations, and appropriate Federal 
agencies, as appropriate, shall carry out the following: 
(1) Establish or identify common definitions 
and any characteristics of artificial intelligence secu-
rity vulnerabilities that make utilization of the Na-
tional Vulnerability Database inappropriate for the 
management of such vulnerabilities, and develop 
processes and procedures for vulnerability manage-
ment of such vulnerabilities. 
(2) Support the development of standards and 
guidance for technical vulnerability management 
processes related to artificial intelligence. 
(3) Consistent with paragraphs (1) and (2), as 
appropriate, initiate a process to update the Insti-
tute’s processes and procedures associated with the 
National Vulnerability Database to ensure such 
Database and associated vulnerability management 
processes incorporate artificial intelligence security 
vulnerabilities to the greatest extent practicable. 
VerDate Sep 11 2014 
19:02 Oct 03, 2024
Jkt 059200
PO 00000
Frm 00002
Fmt 6652
Sfmt 6201
E:\BILLS\H9720.IH
H9720
ssavage on LAPJG3WLY3PROD with BILLS
(b) ASSESSING VOLUNTARY TRACKING OF SUBSTAN-
TIAL ARTIFICIAL INTELLIGENCE SECURITY AND SAFETY 
INCIDENTS.— 
(1) IN GENERAL.—Subject to the availability of 
appropriations, the Director of the National Insti-
tute of Standards and Technology, in consultation 
with the Director of the Cybersecurity and Infra-
structure Security Agency of the Department of 
Homeland Security, shall convene a multi-stake-
holder process to consider the development of a 
process relating to the voluntary collection, report-
ing, and tracking of substantial artificial intelligence 
security incidents and substantial artificial intel-
ligence safety incidents. 
(2) ACTIVITIES.—In carrying out paragraph 
(1), the Director of the National Institute of Stand-
ards and Technology shall convene appropriate rep-
resentatives of industry, academia, nonprofit organi-
zations, standards development organizations, civil 
society groups, Sector Risk Management Agencies, 
and appropriate Federal departments and agencies 
to carry out the following: 
(A) Establish common definitions and 
characterizations for relevant aspects of sub-
stantial artificial intelligence security incidents 
VerDate Sep 11 2014 
19:02 Oct 03, 2024
Jkt 059200
PO 00000
Frm 00003
Fmt 6652
Sfmt 6201
E:\BILLS\H9720.IH
H9720
ssavage on LAPJG3WLY3PROD with BILLS
and substantial artificial intelligence safety inci-
dents, which may include the following: 
(i) Classifications that sufficiently dif-
ferentiate between the following: 
(I) Artificial intelligence security 
incidents. 
(II) Artificial intelligence safety 
incidents. 
(ii) Taxonomies to classify incidents 
referred to in clause (i) based on relevant 
characteristics, impacts, or other appro-
priate criteria. 
(B) Assess the usefulness and cost-effec-
tiveness of an effort to voluntarily track sub-
stantial artificial intelligence security incidents 
and substantial artificial intelligence safety inci-
dents. 
(C) Identify and provide guidelines, best 
practices, methodologies, procedures, and proc-
esses for tracking and reporting substantial ar-
tificial intelligence security incidents and sub-
stantial artificial intelligence safety incidents 
across different sectors and use cases. 
(D) Support the development of standard-
ized reporting and documentation mechanisms, 
VerDate Sep 11 2014 
19:02 Oct 03, 2024
Jkt 059200
PO 00000
Frm 00004
Fmt 6652
Sfmt 6201
E:\BILLS\H9720.IH
H9720
ssavage on LAPJG3WLY3PROD with BILLS
including automated mechanisms, that would 
help provide information, including public infor-
mation, regarding substantial artificial intel-
ligence security incidents and substantial artifi-
cial intelligence safety incidents. 
(E) Support the development of norms for 
reporting of substantial artificial intelligence se-
curity incidents and substantial artificial intel-
ligence safety incidents, taking into account 
when it is appropriate to publicly disclose such 
incidents. 
(3) REPORT.—Not later than three years after 
the date of the enactment of this Act, the Director 
of the National Institute of Standards and Tech-
nology shall submit to Congress a report on a proc-
ess relating to the voluntary collection, reporting, 
and tracking of substantial artificial intelligence se-
curity incidents and substantial artificial intelligence 
safety incidents under paragraph (1). Such report 
shall include the following: 
(A) Findings from the multi-stakeholder 
process referred to in such paragraph. 
(B) An assessment of and recommenda-
tions for establishing reporting and collection 
mechanisms by which industry, academia, non-
VerDate Sep 11 2014 
19:02 Oct 03, 2024
Jkt 059200
PO 00000
Frm 00005
Fmt 6652
Sfmt 6201
E:\BILLS\H9720.IH
H9720
ssavage on LAPJG3WLY3PROD with BILLS
profit organizations, standards development or-
ganizations, civil society groups, and appro-
priate public sector entities may voluntarily 
share standardized information regarding sub-
stantial artificial intelligence security incidents 
and substantial artificial intelligence safety inci-
dents; 
(c) LIMITATION.—Nothing in this section provides 
the Director of the National Institute of Standards and 
Technology with any enforcement authority that was not 
in effect on the day before the date of the enactment of 
this section. 
(d) DEFINITIONS.—In this section: 
(1) ARTIFICIAL INTELLIGENCE.—The term ‘‘ar-
tificial intelligence’’ has the meaning given such 
term in section 5002 of the National Artificial Intel-
ligence Initiative Act of 2020 (15 U.S.C. 9401). 
(2) ARTIFICIAL INTELLIGENCE SECURITY VUL-
NERABILITY.—The term ‘‘artificial intelligence secu-
rity vulnerability’’ means a weakness in an artificial 
intelligence system, system security procedures, in-
ternal controls, or implementation that could be ex-
ploited or triggered by a threat source. 
(3) ARTIFICIAL INTELLIGENCE SYSTEM.—The 
term ‘‘artificial intelligence system’’ has the meaning 
VerDate Sep 11 2014 
19:02 Oct 03, 2024
Jkt 059200
PO 00000
Frm 00006
Fmt 6652
Sfmt 6201
E:\BILLS\H9720.IH
H9720
ssavage on LAPJG3WLY3PROD with BILLS
given such term in section 7223 of the Advancing 
American AI Act (40 U.S.C. 11301 note; as enacted 
as part of title LXXII of division G of the James 
M. Inhofe National Defense Authorization Act for 
Fiscal Year 2023; Public Law 117–263). 
(4) SECTOR RISK MANAGEMENT AGENCY.—The 
term ‘‘Sector Risk Management Agency’’ has the 
meaning given such term in section 2200 of the 
Homeland Security Act of 2002 (6 U.S.C. 650). 
(5) 
THREAT
SOURCE.—The 
term 
‘‘threat 
source’’ means any of the following: 
(A) An intent and method targeted at the 
intentional exploitation of a vulnerability. 
(B) A situation and method that may acci-
dentally trigger a vulnerability. 
Æ 
VerDate Sep 11 2014 
19:02 Oct 03, 2024
Jkt 059200
PO 00000
Frm 00007
Fmt 6652
Sfmt 6301
E:\BILLS\H9720.IH
H9720
ssavage on LAPJG3WLY3PROD with BILLS