(ii) in reporting incidents to any 
Member of Congress or any committee of 
Congress; or 
(iii) in initiating, testifying in, or as-
sisting in any investigation or judicial or 
administrative action based upon or related 
to the incidents described in clause (i) or 
(ii). 
In addition, no employer may require their em-
ployees or contractors to obtain prior consent 
from such employer to report incidents using 
the reporting mechanism established in this sec-
tion or to any Member of Congress or any com-
mittee of Congress, or to obtain prior consent 
to participate in investigations, judicial, or ad-
ministrative actions based upon or related to 
such incidents. 
(B) ENFORCEMENT.—Any individual who 
alleges discharge or other discrimination, or is 
otherwise aggrieved by an employer or former 
employer, in violation of subparagraph (A), may 
seek relief by— 
(i) filing a complaint with the Sec-
retary of Labor in accordance with the re-
quirements of this subsection; or 
VerDate Sep 11 2014 
01:00 Oct 04, 2024
Jkt 059200
PO 00000
Frm 00008
Fmt 6652
Sfmt 6201
E:\BILLS\H9737.IH
H9737
kjohnson on DSK7ZCZBW3PROD with $$_JOB
(ii) if the Secretary of Labor has not 
issued a final decision within 180 days of 
the filing of a complaint under clause (i), 
and there is no showing that such a delay 
is due to the bad faith of the claimant, 
bringing an action against the employer at 
law or in equity in the appropriate district 
court of the United States, which shall 
have jurisdiction over such an action with-
out regard to the amount in controversy. 
(C) 
CONFIDENTIALITY.—The 
Director, 
and any officer or employee of the National In-
stitute of Standards and Technology or the Cy-
bersecurity and Infrastructure Security Agency, 
shall not disclose any information, including in-
formation provided by a whistleblower to either 
such official, which could reasonably be ex-
pected to reveal the identity of a whistleblower, 
except in accordance with the provisions of sec-
tion 552a of title 5, United States Code, unless 
and until required to be disclosed to a defend-
ant or respondent in connection with a public 
proceeding instituted by the appropriate such 
official. 
VerDate Sep 11 2014 
01:00 Oct 04, 2024
Jkt 059200
PO 00000
Frm 00009
Fmt 6652
Sfmt 6201
E:\BILLS\H9737.IH
H9737
kjohnson on DSK7ZCZBW3PROD with $$_JOB
(D) RIGHTS RETAINED.—Nothing in this 
section shall be deemed to diminish the rights, 
privileges, or remedies of any whistleblower 
under any Federal or State law or under any 
collective bargaining agreement. 
SEC. 4. UPDATING PROCESSES AND PROCEDURES RELAT-
ING TO COMMON VULNERABILITIES AND EX-
POSURES PROGRAM AND EVALUATION OF 
CONSENSUS STANDARDS RELATING TO ARTI-
FICIAL INTELLIGENCE SECURITY VULNER-
ABILITY REPORTING. 
(a) DEFINITIONS.—In this section: 
(1) COMMON
VULNERABILITIES
AND
EXPO-
SURES
PROGRAM.—The 
term 
‘‘Common 
Vulnerabilities and Exposures Program’’ means the 
reference guide and classification system for publicly 
known information security vulnerabilities sponsored 
by the Cybersecurity and Infrastructure Security 
Agency. 
(2) 
RELEVANT
CONGRESSIONAL
COMMIT-
TEES.—The term ‘‘relevant congressional commit-
tees’’ means— 
(A) the Committee on Homeland Security 
and Governmental Affairs, the Committee on 
Commerce, Science, and Transportation, the 
VerDate Sep 11 2014 
01:00 Oct 04, 2024
Jkt 059200
PO 00000
Frm 00010
Fmt 6652
Sfmt 6201
E:\BILLS\H9737.IH
H9737
kjohnson on DSK7ZCZBW3PROD with $$_JOB
Select Committee on Intelligence, and the Com-
mittee on the Judiciary of the Senate; and 
(B) the Committee on Oversight and Ac-
countability, the Committee on Energy and 
Commerce, the Permanent Select Committee on 
Intelligence, and the Committee on the Judici-
ary of the House of Representatives. 
(b) IN GENERAL.—Not later than 180 days after the 
date of enactment of this Act, the Director of the Cyberse-
curity and Infrastructure Security Agency shall— 
(1) initiate a process to update processes and 
procedures 
associated 
with 
the 
Common 
Vulnerabilities and Exposures Program to ensure 
that the program and associated processes identify 
and 
enumerate 
artificial 
intelligence 
security 
vulnerabilities to the greatest extent practicable; and 
(2) identify any characteristic of artificial intel-
ligence security vulnerabilities that make utilization 
of the Common Vulnerabilities and Exposures Pro-
gram inappropriate for their management and de-
velop processes and procedures for vulnerability 
identification and enumeration for those artificial in-
telligence security vulnerabilities. 
(c) EVALUATION OF CONSENSUS STANDARDS.— 
VerDate Sep 11 2014 
01:00 Oct 04, 2024
Jkt 059200
PO 00000
Frm 00011
Fmt 6652
Sfmt 6201
E:\BILLS\H9737.IH
H9737
kjohnson on DSK7ZCZBW3PROD with $$_JOB
(1) IN GENERAL.—Not later than 30 days after 
the date of enactment of this Act, the Director of 
the National Institute of Standards and Technology 
shall initiate a multi-stakeholder process to evaluate 
whether existing voluntary consensus standards for 
vulnerability reporting effectively accommodate arti-
ficial intelligence security vulnerabilities. 
(2) REPORT.— 
(A) SUBMISSION.—Not later than 180 
days after the date on which the evaluation 
under paragraph (1) is carried out, the Director 
shall submit a report to the relevant congres-
sional committees on the sufficiency of existing 
vulnerability reporting processes and standards 
to accommodate artificial intelligence security 
vulnerabilities. 
(B) POST-REPORT ACTION.—If the Direc-
tor concludes in the report submitted under 
subparagraph (A) that existing processes do not 
sufficiently accommodate reporting of artificial 
intelligence security vulnerabilities, the Director 
shall initiate a process, in consultation with the 
Director of the National Institute of Standards 
and Technology and the Director of the Office 
of Management and Budget, to update relevant 
VerDate Sep 11 2014 
01:00 Oct 04, 2024
Jkt 059200
PO 00000
Frm 00012
Fmt 6652
Sfmt 6201
E:\BILLS\H9737.IH
H9737
kjohnson on DSK7ZCZBW3PROD with $$_JOB
vulnerability reporting processes, including the 
Department of Homeland Security Binding 
Operational Directive 20–01, or any subsequent 
directive. 
(d) BEST PRACTICES.—Not later than 90 days after 
the date of enactment of this Act, the Director of the Cy-
bersecurity and Infrastructure Security Agency shall, in 
collaboration with the Director of the National Security 
Agency and the Director of the National Institute of 
Standards and Technology and by leveraging efforts of the 
Information Communications Technology Supply Chain 
Risk Management Task Force to the greatest extent prac-
ticable, convene a multi-stakeholder process to encourage 
the development and adoption of best practices relating 
to addressing supply chain risks associated with training 
and maintaining artificial intelligence models, which shall 
ensure consideration of supply chain risks associated 
with— 
(1) data collection, cleaning, and labeling, par-
ticularly the supply chain risks of reliance on remote 
workforce and foreign labor for such tasks; 
(2) inadequate documentation of training data 
and test data storage, as well as limited provenance 
of training data; 
VerDate Sep 11 2014 
01:00 Oct 04, 2024
Jkt 059200
PO 00000
Frm 00013
Fmt 6652
Sfmt 6201
E:\BILLS\H9737.IH
H9737
kjohnson on DSK7ZCZBW3PROD with $$_JOB
(3) human feedback systems used to refine arti-
ficial intelligence systems, particularly the supply 
chain risks of reliance on remote workforce and for-
eign labor for such tasks; 
(4) the use of large-scale, open-source datasets, 
particularly the supply chain risks to repositories 
that host such datasets for use by public and private 
sector developers in the United States; and 
(5) the use of proprietary datasets containing 
sensitive or personally identifiable information. 
(e) RULE OF CONSTRUCTION.—To the extent prac-
ticable, the Director shall examine the reporting require-
ments pursuant to division Y of the Cyber Incident Re-
porting for Critical Infrastructure Act of 2022 (Public 
Law 117–103) and the amendments made by that division 
and ensure that the requirements under this section are 
not duplicative of requirements set forth in that division 
and the amendments made by that division. 
SEC. 5. ESTABLISHMENT OF ARTIFICIAL INTELLIGENCE SE-
CURITY CENTER. 
(a) ESTABLISHMENT.—Not later than 90 days after 
the date of the enactment of this Act, the Director of the 
National Security Agency shall establish an Artificial In-
telligence Security Center within the Cybersecurity Col-
laboration Center of the National Security Agency. 
VerDate Sep 11 2014 
01:00 Oct 04, 2024
Jkt 059200
PO 00000
Frm 00014
Fmt 6652
Sfmt 6201
E:\BILLS\H9737.IH
H9737
kjohnson on DSK7ZCZBW3PROD with $$_JOB
(b) FUNCTIONS.—The functions of the Artificial In-
telligence Security Center shall be as follows: 
(1) Making available a research test-bed to pri-
vate sector and academic researchers, on a sub-
sidized basis, to engage in artificial intelligence secu-
rity research, including through the secure provision 
of access in a secure environment to proprietary 
third-party models with the consent of the vendors 
of the models. 
(2) Developing guidance to prevent or mitigate 
counter-artificial intelligence techniques. 
(3) Promoting secure artificial intelligence 
adoption practices for managers of national security 
systems (as defined in section 3552 of title 44, 
United States Code) and elements of the defense in-
dustrial base. 
(4) Coordinating with the Artificial Intelligence 
Safety Institute within the National Institute of 
Standards and Technology. 
(5) Such other functions as the Director con-
siders appropriate. 
(c) TEST-BED REQUIREMENTS.— 
(1) ACCESS AND TERMS OF USAGE.— 
(A) RESEARCHER ACCESS.—The Director 
shall establish terms of usage governing re-
VerDate Sep 11 2014 
01:00 Oct 04, 2024
Jkt 059200
PO 00000
Frm 00015
Fmt 6652
Sfmt 6201
E:\BILLS\H9737.IH
H9737
kjohnson on DSK7ZCZBW3PROD with $$_JOB
searcher access to the test-bed made available 
under subsection (b)(1), with limitations on re-
searcher publication only to the extent nec-
essary to protect classified information or pro-
prietary information concerning third-party 
models provided through the consent of model 
vendors. 
(B) AVAILABILITY
TO
FEDERAL
AGEN-
CIES.—The Director shall ensure that the test- 
bed made available under subsection (b)(1) is 
also made available to other Federal agencies 
on a cost-recovery basis. 
(2) USE
OF
CERTAIN
INFRASTRUCTURE
AND 
OTHER
RESOURCES.—In carrying out subsection 
(b)(1), the Director shall leverage, to the greatest 
extent practicable, infrastructure and other re-
sources provided under section 5.2 of the Executive 
order dated October 30, 2023 (relating to safe, se-
cure, and trustworthy development and use of artifi-
cial intelligence). 
(d) ACCESS TO PROPRIETARY MODELS.—In carrying 
out this section, The Director shall establish such mecha-
nisms as the Director considers appropriate, including po-
tential contractual incentives, to ensure the provision of 
access to proprietary models by qualified independent, 
VerDate Sep 11 2014 
01:00 Oct 04, 2024
Jkt 059200
PO 00000
Frm 00016
Fmt 6652
Sfmt 6201
E:\BILLS\H9737.IH
H9737
kjohnson on DSK7ZCZBW3PROD with $$_JOB
third-party researchers, provided that commercial model 
vendors have voluntarily provided models and associated 
resources for such testing. 
Æ 
VerDate Sep 11 2014 
01:00 Oct 04, 2024
Jkt 059200
PO 00000
Frm 00017
Fmt 6652
Sfmt 6301
E:\BILLS\H9737.IH
H9737
kjohnson on DSK7ZCZBW3PROD with $$_JOB