US Department of Commerce Issues Proposal to Require Reporting Development of Advanced AI Models and Computer Clusters

On September 9, 2024, the US Department of Commerce’s (“Commerce”) Bureau of Industry and Security (BIS) released notice of a proposed rule to create a mandatory reporting requirement for artificial intelligence (AI) developers and computing providers concerning the development, training, and testing of powerful AI models. The rule—titled “Establishment of Reporting Requirements for the Development of Advanced Artificial Intelligence Models and Computing Clusters”—stems from the Biden Administration’s Executive Order 14110 (the “AI EO”).

Background

The AI EO directed Commerce to use its authorities under the Defense Production Act to collect certain information from companies that intend to develop “dual-use foundation models”¹ or to acquire or develop a “large-scale computing cluster.”²

In January 2024, the White House publicly stated that, as directed by the AI EO, Commerce had already started using its authorities to require companies to report information about the most powerful AI models and large computing clusters, including AI safety testing results. It now appears that referred to Commerce’s use of an initial, mandatory survey referenced by the proposed rule.

Intention and Possible Future Action

The proposed rule would build on those actions by enabling ongoing, established oversight of dual-use foundation models and the computing infrastructure that enables their training. It follows a number of measures over the past few years by BIS to identify and impose controls with respect to the equipment and technology that is critical to frontier AI model training and development.³ Within that context, the proposed reporting requirements are intended to ensure that BIS, in coordination with other agencies, has enhanced visibility and insights into ongoing developmental, training, testing, and acquisition activity that may warrant imposition of further AI licensing controls.

BIS notes in its discussion of the proposed rule that continuing assessments are necessary for the government to determine whether dual-use foundation models are available to the defense industrial base and to understand the safety and national security risks posed by those models. Therefore, while the proposed rule is limited to reporting obligations, the reports are expected to inform continued regulatory and policy development in this space in a range of possible directions. To this end, BIS refers in the proposed rule to the possibility of action to ensure that the “defense industrial base produces the safest and most reliable products and services in the world” and the “dual-use foundation models produced by U.S. companies are available to the defense industrial base.”

Comments Requested

BIS notes that it is particularly interested in comments on:

The frequency of the proposed notification schedule and any alternative options;
Requirements for collection and storage of data reported by entities; and
The technical thresholds that would trigger the proposed reporting requirements.

Interested parties will have until October 11, 2024, to submit comments.

Additional Details on the Proposed Rule

“Applicable Activities”

According to the proposed rule, a covered US person⁴ will be required to provide quarterly reports to BIS if the US person “engages in, or plans, within six months, to engage in ‘applicable activities.’” “Applicable activities” include:

“Conducting any AI model training run using more than 10^26 computational operations (e.g., integer or floating-point operations);" or
Acquiring, developing, or coming into possession of a computing cluster that has a set of machines transitively connected by data center networking of greater than 300 Gbit/s and having a theoretical maximum greater than 10^20 computational operations (e.g., integer or floating-point operations) per second (OP/s) for AI training, without sparsity.”

Notably, BIS assesses that there are no more than 15 companies that exceed the reporting thresholds for models and computing clusters. It also notes that the “minimum computational threshold that would trigger a reporting requirement established in E.O. 14110 currently exceeds all or virtually all models in use.”

Once a company makes notification of applicable activities, it must provide an affirmation of no applicable activities for the next seven quarters in order to terminate their notification obligation.

Content of Reporting

Upon receiving a notice of “applicable activities,” BIS will issue questions to the reporting entity. The entity is required to answer all questions within 30 calendar days of receiving the request. Topics of those questions could include:

“Any ongoing or planned activities related to training, developing, or producing dual-use foundation models, including the physical and cybersecurity protections taken;"
“The ownership and possession of the model weights of any dual-use foundation models, and the physical and cybersecurity measures taken to protect those model weights;"
“The results of any developed dual-use foundation model’s performance in relevant AI red-team testing;" and
“Other information pertaining to the safety and reliability of dual-use foundation models, or activities or risks that present concerns to U.S. national security”.

The proposed rule also establishes deadlines to correct incomplete answers (14 calendar days) and to respond to clarifying questions from BIS (7 calendar days). Since the proposed rule revises 15 C.F.R. part 702, failure to comply with reporting obligations carries the risk of civil and criminal consequences in 15 C.F.R. § 702.5, including receipt of compulsory process and potentially a fine of not more than $10,000 or imprisonment not more than a year.

¹ The AI EO and the proposed rule provide the same definition for the term. The EO also provides a technical threshold (subject to modification by Commerce) for models that would be subject to the reporting requirements. The proposed rule adopts the same threshold as the EO.

²The AI EO provides a technical threshold (subject to modification by Commerce) for computing clusters that would be subject to the reporting requirements. The proposed rule adopts a higher threshold than the EO (“networking of greater than 300 Gbit/s” rather than “networking of over 100 Gbit/s”).

³Most recently, on September 6, 2024, BIS announced the imposition of new controls in coordination with international partners on a range of quantum computing and advanced semiconductor manufacturing goods, software, and technologies critical for dual-use AI applications. (See our Legal Update.) This follows a series of robust controls imposed over the past two years on advanced computing/supercomputing equipment and related components and technology. (See our December 2023 Legal Update.)

⁴ The proposed rule defines “Covered U.S. person” as “any individual U.S. citizen, lawful permanent resident of the United States as defined by the Immigration and Nationality Act, entity—including organizations, companies, and corporations—organized under the laws of the United States or any jurisdiction within the United States (including foreign branches), or any person (individual) located in the United States.”