Comment by Artificial Intelligence Risk Management and Security Act of 2026 (S. 5576)

Not later than 180 days after the date of enactment of this Act, the Director of the Institute shall, in coordination with the Director of the Cybersecurity and Infrastructure Security Agency, establish mechanisms by which private sector entities, public sector organizations, civil society groups, and academic researchers may voluntarily share information with the Institute on confirmed or suspected artificial intelligence security or artificial intelligence safety incidents. [...] The following entities shall report any confirmed artificial intelligence safety incident or artificial intelligence security incident within 30 days of confirmation of such incident and within 72 hours if such incident poses an imminent threat to national security, critical infrastructure, or public safety: (i) Any developer or provider of a frontier artificial intelligence model. (ii) Any operator of critical infrastructure that utilizes an artificial intelligence model in the context of managing industrial control systems or other operational technologies.