S. 5576 — Artificial Intelligence Risk Management and Security Act of 2026

This section defines terms used in the Act, including artificial intelligence, artificial intelligence agent, artificial intelligence capabilities or risk assessment, artificial intelligence flaw, artificial intelligence safety incident, artificial intelligence security incident, artificial intelligence security vulnerability, Board, critical infrastructure, developer, frontier artificial intelligence model, Institute, and Secretary.

This section establishes the Artificial Intelligence Safety Board within the Department of Commerce within 30 days of enactment as a permanent advisory committee to address artificial intelligence risks. The Board includes members appointed by the Director of the Institute, the Secretary, the Directors of CISA and NSA, and the Secretary of the Treasury, plus nongovernmental experts in technical fields, AI evaluations, consumer protection, and antitrust; members serve up to 3-year terms with one reappointment and receive Top Secret/SCI security clearances; and the Secretary negotiates international agreements for joint testing, research prizes, guidance, information sharing, and standardized evaluation protocols.

This section requires each developer to develop, publish, and follow a Model Safety Plan for every artificial intelligence system or model that the developer creates, substantially modifies, or uses to train or evaluate other models. Each plan must identify the covered model, include a developer-prepared capabilities or risk assessment, list mitigation measures across the product lifecycle, name the responsible corporate officer, and be submitted to the Secretary.

This section directs the Director of the National Institute of Standards and Technology, in coordination with the Director of the Cybersecurity and Infrastructure Security Agency, to establish voluntary reporting mechanisms for AI security and safety incidents and flaws within 180 days and a publicly accessible database of such incidents and flaws within one year. It requires developers and providers of frontier AI models and operators of critical infrastructure using AI in industrial control systems to report confirmed incidents within 30 days (or 72 hours if an imminent threat to national security, critical infrastructure, or public safety exists), with the database prioritizing cases involving critical infrastructure, high-severity impacts, or widely used systems.

This section directs the Director of the National Institute of Standards and Technology to develop, within 18 months, an Agentic AI Profile as a companion resource to the Artificial Intelligence Risk Management Framework. The profile must define risks novel to or exacerbated by artificial intelligence agents, establish a classification framework for agent autonomy levels, and address cybersecurity risks related to agent identity, authentication, and authorization. It also requires the Director to initiate development of a common template for documenting artificial intelligence agents and their evaluations, covering identity and version, intended use, ownership boundaries, data and system access, evaluations, independent evaluators, and known limitations, for use across sectors and entity sizes.