Commerce, BIS Proposes Rule To Require Reporting From Companies That Develop, Acquire, or Own Advanced AI Models and Computing Clusters

On September 11, 2024, the Department of Commerce (DOC), Bureau of Industry and Security (BIS) issued a proposed rule that would place an ongoing reporting requirement for entities developing, acquiring, or possessing advanced artificial intelligence (AI) models and computing clusters. BIS proposed this rule pursuant to Section 4.2 of Executive Order 14110, which directed DOC to require periodic reports on companies’ use, ownership, and development of dual-foundation models or large-scale computing clusters. The proposed rule would allow BIS to collect such information regarding advanced AI systems for the purpose of Industrial Base Surveys, as authorized under the Defense Production Act.¹

The proposed rule would add Section 702.7 to 15 C.F.R. Part 702, which governs BIS’ Industrial Base Surveys. If adopted, the proposed rule would require a covered U.S. person to submit quarterly notifications to BIS if the person has engaged in, or plans to engage in, either of the following “applicable activities” pertaining to certain advanced AI systems:

• Development of dual-use foundation AI models: conducting any AI model training run using more than 10^26 computational operations (e.g., integer or floating-point operations)
• Development, acquisition, or possession of large-scale computing clusters: acquiring, developing, or coming into possession of a computing cluster that has a set of machines transitively connected by data center networking of greater than 300Gbit/s and having a theoretical maximum greater than 10^20 computational operations (e.g., integer or floating-point operations) per second (OP/s) for AI training, without sparsity

The quarterly notification dates are April 15, July 15, October 15, and January 15. On each notification date, under the proposed rule, a covered U.S. person must notify BIS of all “applicable activities” that took place during the reporting quarter and “applicable activities” that the entity plans to undertake within the six months following the notification date. Upon receiving a notification, BIS will send questions that address topics including, but not limited to, the following:

• Any ongoing or planned activities related to training, developing, or producing dual-use foundation models, including the physical and cybersecurity protections taken to assure the integrity of that training process against sophisticated threats
• The ownership and possession of the model weights of any dual-use foundation models, and the physical and cybersecurity measures taken to protect those model weights
• The results of any developed dual-use foundation model’s performance in relevant AI red-team testing, including a description of any associated measures the company has taken to meet safety objectives, such as mitigations to improve performance on these red-team tests and strengthen overall model security
• Other information pertaining to the safety and reliability of dual-use foundation models, or activities or risks that present concerns to U.S. national security

The notifying entity must respond to BIS’ questions within 30 calendar days.

If, for the following six months, the covered U.S. person has not engaged in, or does not plan to engage in, “applicable activities” as of a quarterly notification date, then the entity may submit an affirmation of no applicable activities. An entity that submits such an affirmation for seven consecutive quarters need not submit further affirmation until it engages in, or plans to engage in, “applicable activities” again.

The proposed rule defines “covered U.S. persons” as any U.S. citizen or lawful permanent resident, companies organized under the U.S. or a state law, and individuals located within the United States. BIS explained that entities that completed BIS’ January 26, 2024 survey — targeting companies identified as developing or planning to develop potential dual-use foundation models — along with others meeting the criteria of the proposed rule, “would be required to submit information about these activities on a quarterly basis.” Entities that fail to submit a quarterly notification regarding the development, acquisition, or possession of certain advanced AI systems may be compelled to produce relevant information and/or be subject to criminal prosecution.²

Interested parties may submit comments by no later than October 11, 2024. BIS has indicated that it is particularly interested in comments regarding the frequency of the quarterly notification schedule, as well as the adequacy of the technical parameters triggering the reporting requirement. Arnold & Porter will continue to monitor developments in the advanced AI reporting rule.

© Arnold & Porter Kaye Scholer LLP 2024 All Rights Reserved. This Advisory is intended to be a general summary of the law and does not constitute legal advice. You should consult with counsel to determine applicable legal requirements in a specific fact situation.