S. 5061 — Secure A.I. Development Act of 2026

This section establishes definitions for the Act, including adversarial artificial intelligence as techniques to extract information about or manipulate an artificial intelligence system to subvert its confidentiality, integrity, or availability; artificial intelligence safety incident as an event that materially increases risks to human life, health, property, or the environment; artificial intelligence security incident as an event that materially increases risks of unauthorized extraction or manipulation; and artificial intelligence security vulnerability as a weakness that could be exploited through data poisoning, evasion attacks, privacy-based attacks, model theft, or adversarial machine learning.

This section establishes the Artificial Intelligence Risk Board within the National Institute of Standards and Technology not later than 90 days after enactment to address risks from frontier artificial intelligence models, defined as models exhibiting or modifiable to exhibit high performance at tasks posing serious risks to national security, economic security, or public health or safety. The Board consists of members selected by the Directors of NIST, CISA, and NSA, the Secretaries of Commerce and the Treasury, plus nongovernmental technical experts in evaluations and AI systems; members serve terms of up to 3 years, require Top Secret/SCI clearances, and follow bylaws for quorum, voting, and conflict-of-interest rules.

This section directs the Director of the National Institute of Standards and Technology, in coordination with the Director of the Cybersecurity and Infrastructure Security Agency, to establish within 1 year of enactment a voluntary mechanism for private sector, public sector, civil society, and academic entities to share information on confirmed or suspected artificial intelligence security or safety incidents while preserving confidentiality, and to create a publicly accessible database of such incidents. It requires review of submissions, identification of causal factors including the system, its deployment, and operational practices, and prioritization of incidents involving critical infrastructure, high-severity impacts, or widely used systems. It mandates anonymity protections, exemptions from disclosure, consultation with system developers before publication, and issuance of nonbinding guidance within 180 days on criteria for events that materially increase risk.

This section directs the Director of the National Institute of Standards and Technology, within 180 days, to evaluate and reform the National Vulnerability Database to address the increased volume of vulnerabilities identified by artificial intelligence systems, incorporate AI for vulnerability characterization, update the Secure Software Development Framework with AI code-generation guidance, and assess whether existing consensus standards for vulnerability reporting accommodate AI-related vulnerabilities. It also directs the Director of the Cybersecurity and Infrastructure Security Agency, within 180 days, to update the Common Vulnerabilities and Exposures Program to identify and enumerate AI security vulnerabilities and to develop alternative processes where the program is unsuitable. The Directors must submit a strategic plan to Congress on addressing AI security risks and, if needed, update relevant vulnerability reporting processes including Department of Homeland Security Binding Operational Directive 20–01.

This section directs federal departments and agencies participating in the Vulnerabilities Equities Process to evaluate within 90 days of enactment whether the process sufficiently accommodates artificial intelligence security vulnerabilities and to report to the appropriate congressional committees on applicability, including whether submission would generate an unduly large volume of vendor notifications. If the process is insufficient and public interest merits review, they must establish a submission and review process within 30 days. The Director of National Intelligence must report to the congressional intelligence committees on the volume of information system vulnerabilities identified by artificial intelligence systems and the impact on disclosure equities.

This section directs the Director of the Cybersecurity and Infrastructure Security Agency, in collaboration with the Directors of the National Security Agency and the National Institute of Standards and Technology, to convene a multi-stakeholder process within 90 days of enactment to develop and adopt best practices addressing supply chain risks to artificial intelligence models and critical infrastructure from foreign entities of concern. The process must consider risks of illicit technology transfer, sabotage of training data and computing environments, and related threat information.